2 results for “infobloxthreatintel”
Oh... turns out we never posted our research released last week. That work unmasked the affiliate program behind Help TDS and how it works.
Perhaps more interesting was how one of our data scientists was able to detect the C2 domains an average of a week in advance. These ran on Cloudflare Pages and the actor used about a dozen domain generation algorithms... a combination that creates a formidable problem.
#malware #phishing #scam #techsupportScam #wordpress #malware #dga
Hotejka's Help TDS had a bit of kernel panic thrashing today. Posting new C2 domains to their Telegram channel every minute instead of normal 5 minute cadence. After months of living off Pages, they seem to have given up and gone back to my.id domains. yes, hosted on cloudflare CDN still but not on Cloudflare Pages.
Very long story short..these guys run a tech support scam operation, cloaked with Keitaro and driving victims to call centers where they are led to download remote access software (ultraviewer).
They run an affiliate program which has some of most prolific actors... #balada #dollyway #detourdog and more...
here's some domains to block as we're quite sure they'll be forced to stay on my.id until they figure something else out.
satesailiki[.]my[.]id
sateiliki[.]my[.]id
jendareok[.]my[.]id
tytmemiliki[.]my[.]id
jenggfdlirrcok[.]my[.]id
feemiliki[.]my[.]id
je5neelirrcok[.]my[.]id
jenggfdetemiliki[.]my[.]id
effectsden[.]my[.]id
dadarethk[.]my[.]id
effdeectsden[.]my[.]id
library1library[.]my[.]id
pkgm620[.]my[.]id
jeneelif3rrcok[.]my[.]id
beiksk[.]my[.]id
jenggfdetearrcok[.]my[.]id
jeneelirrcok[.]my[.]id
hteermemiliki[.]my[.]id
jenggecok[.]my[.]id
satesfaailiki[.]my[.]id
my22library[.]my[.]id
hafcocok[.]my[.]id
jeniscouuutok[.]my[.]id
mydomlibrary[.]my[.]id
jenggfdetecok[.]my[.]id
lawyetteiki[.]my[.]id
reeelirrcok[.]my[.]id
jenggetecok[.]my[.]id
belirryercok[.]my[.]id
fedmy22library[.]my[.]id
link to our latest research on these losers.
#malware #phishing #scam #techsupportScam #wordpress #malware