Hotejka's Help TDS had a bit of kernel panic thrashing today. Posting new C2 domains to their Telegram channel every minute instead of normal 5 minute cadence. After months of living off Pages, they seem to have given up and gone back to my.id domains. yes, hosted on cloudflare CDN still but not on Cloudflare Pages.
Very long story short..these guys run a tech support scam operation, cloaked with Keitaro and driving victims to call centers where they are led to download remote access software (ultraviewer).
They run an affiliate program which has some of most prolific actors... #balada #dollyway #detourdog and more...
here's some domains to block as we're quite sure they'll be forced to stay on my.id until they figure something else out.
satesailiki[.]my[.]id
sateiliki[.]my[.]id
jendareok[.]my[.]id
tytmemiliki[.]my[.]id
jenggfdlirrcok[.]my[.]id
feemiliki[.]my[.]id
je5neelirrcok[.]my[.]id
jenggfdetemiliki[.]my[.]id
effectsden[.]my[.]id
dadarethk[.]my[.]id
effdeectsden[.]my[.]id
library1library[.]my[.]id
pkgm620[.]my[.]id
jeneelif3rrcok[.]my[.]id
beiksk[.]my[.]id
jenggfdetearrcok[.]my[.]id
jeneelirrcok[.]my[.]id
hteermemiliki[.]my[.]id
jenggecok[.]my[.]id
satesfaailiki[.]my[.]id
my22library[.]my[.]id
hafcocok[.]my[.]id
jeniscouuutok[.]my[.]id
mydomlibrary[.]my[.]id
jenggfdetecok[.]my[.]id
lawyetteiki[.]my[.]id
reeelirrcok[.]my[.]id
jenggetecok[.]my[.]id
belirryercok[.]my[.]id
fedmy22library[.]my[.]id
link to our latest research on these losers.
#malware #phishing #scam #techsupportScam #wordpress #malware