{ "campaign_count": 47, "campaigns": [ { "activity": { "2026-09-24": 190 }, "anchors": { "registered_domains": [ "aleverifocation.beer", "anlytic-js-cloud.beer", "awesomeisojs.beer", "bbdsnssserver.beer", "bhfgtrns-js.beer", "bilfojsclod.beer", "biyaconserver.beer", "bkscndclou.beer", "bnnsbdsdn-js.beer", "bnsclod.beer", "bootstrap-maxcdn.beer", "bootstrup-cdnmaper.beer", "capcha-cdn-js.beer", "cdn-2faclov.sbs", "cdn-plugin-js.beer", "chekbrow.beer", "clainasns.beer", "claudesave.beer", "claudjaframework.beer", "claufancdn.beer", "clhfgcomacdn.beer", "cloud-save-image.sbs", "cloudcdnginx.beer", "cloude-js-server.beer", "darndcs-js.beer", "dhnsdns.beer", "dncloteam.beer", "eng-electrum.org", "entry-code-cdn.codes", "ethercdnns.beer", "exdanteam.beer", "fijscdn.beer", "fingerprint-veri.info", "fingerprint-verification.info", "fontawesome-js-cdn.beer", "framework-jsoncdn.beer", "frameworkjsbns.beer", "gdnssljs.beer", "ghdnsserverns.beer", "gppcdnns.beer", "hasmeverdcdn.beer", "hftplcnsns.beer", "hpscdn.beer", "kawaiimechasoul.cfd", "las-js-claud.beer", "lcates-vs.beer", "lckcdnjs.beer", "lcstdnsns.beer", "ldnscreatejs.beer", "lnfcdnclad.beer" ], "tags": [ "#ClearFake", "#ClickFix" ], "url_path_patterns": [] }, "confidence": "high", "context": "Large ClickFix/ClearFake wave on newly registered .beer and .sbs domains with script and CDN-themed names such as bootstrap-maxcdn.beer and capcha-cdn-js.beer. Enrichment cites 80+ domains used for fake CAPTCHA and browser verification lures. One reporter (TheM3gatr0n) flagged 190 IOCs on 2026-09-24.", "enriched_count": 190, "families": {}, "first_seen": "2026-09-24", "history": { "by_pattern": [], "domains_365d": 94, "first_seen_365d": "2026-08-08", "iocs_365d": 198, "iocs_before_window": 10, "last_seen_365d": "2026-09-24", "window_days": 365 }, "id": "tfc-3e959d6b64d2", "ioc_count": 190, "ioc_count_1d": 0, "ioc_count_30d": 190, "ioc_count_7d": 0, "iocs": [ { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://darndcs-js.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://cloude-js-server.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://cloudcdnginx.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://cloud-save-image.sbs" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://clhfgcomacdn.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://claufancdn.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://claudjaframework.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://claudesave.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://clainasns.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://chekbrow.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://cdn-plugin-js.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://cdn-2faclov.sbs" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://capcha-cdn-js.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://bootstrup-cdnmaper.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://bootstrap-maxcdn.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://bnsclod.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://bnnsbdsdn-js.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://bkscndclou.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://biyaconserver.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://bilfojsclod.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://bhfgtrns-js.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://bbdsnssserver.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://awesomeisojs.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://anlytic-js-cloud.beer" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 12:12:59", "tags": [ "#ClearFake", "#ClickFix" ], "tweet": "https://x.com/TheM3gatr0n/status/2103095348113924175", "type": "url", "user": "TheM3gatr0n", "value": "http://aleverifocation.beer" } ], "last_seen": "2026-09-24", "member_cluster_ids": [ "tfc-3e959d6b64d2" ], "name": "ClearFake/ClickFix fake CAPTCHA lures on .beer and .sbs domains", "reporters": [ "TheM3gatr0n" ], "tags": [ "#ClearFake", "#ClickFix" ], "targeted_brand": null, "targeted_country": null, "targeted_sector": null, "threat_types": { "malware": 190 }, "ttps": [ "T1204.004", "T1583.001" ], "types": { "domain": 94, "sha256": 2, "url": 94 } }, { "activity": { "2026-10-16": 6, "2026-10-20": 50 }, "anchors": { "registered_domains": [ "cloudapi-whatsapp.com", "cloudauth-whatsapp.com", "cloudcdn-whatsapp.com", "cloudcore-whatsapp.com", "clouddns-whatsapp.com", "cloudeliverenterprise.com", "cloudeliverrs.com", "cloudenterpriseve.com", "cloudlink-whatsapp.com", "cloudnode-whatsapp.com", "cloudsec-whatsapp.com", "cookieapi-whatsapp.com", "cookiecdn-whatsapp.com", "cookienode-whatsapp.com", "sessionapi-whatsapp.com", "sessioncdn-whatsapp.com", "sessionnode-whatsapp.com", "tokenapi-whatsapp.com", "tokencdn-whatsapp.com", "tokennode-whatsapp.com", "webarc-whatsapp.com", "webarm-whatsapp.com", "webart-whatsapp.com", "webbad-whatsapp.com", "webbag-whatsapp.com", "webban-whatsapp.com", "webbar-whatsapp.com", "webbat-whatsapp.com" ], "tags": [], "url_path_patterns": [] }, "confidence": "medium", "context": "Domains following a -whatsapp.com pattern (cloud*, token*, session*, web*, cookie*) were reported as phishing infrastructure. Enrichment says a large set of WhatsApp-themed domains (473 cited) registered in October 2026 shares one IP and redirects to search engines, so staging is possible but unconfirmed. Also included are cloudeliver*/cloudenterprise* domains from the same candidate.", "enriched_count": 56, "families": {}, "first_seen": "2026-10-16", "history": { "by_pattern": [], "domains_365d": 28, "first_seen_365d": "2026-10-16", "iocs_365d": 56, "iocs_before_window": 0, "last_seen_365d": "2026-10-20", "window_days": 365 }, "id": "tfc-c5793b987513", "ioc_count": 56, "ioc_count_1d": 50, "ioc_count_30d": 56, "ioc_count_7d": 56, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 16:34:59", "tags": [ "#phishing" ], "tweet": "https://x.com/skocherhan/status/2112583368479318236", "type": "url", "user": "skocherhan", "value": "http://cloudnode-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 16:34:59", "tags": [ "#phishing" ], "tweet": "https://x.com/skocherhan/status/2112583368479318236", "type": "url", "user": "skocherhan", "value": "http://cloudlink-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 16:34:59", "tags": [ "#phishing" ], "tweet": "https://x.com/skocherhan/status/2112583368479318236", "type": "url", "user": "skocherhan", "value": "http://cloudcore-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 16:34:59", "tags": [ "#phishing" ], "tweet": "https://x.com/skocherhan/status/2112583368479318236", "type": "url", "user": "skocherhan", "value": "http://cloudauth-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "domain", "user": "Malwarehunterr", "value": "webbar-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "domain", "user": "Malwarehunterr", "value": "webban-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "domain", "user": "Malwarehunterr", "value": "webbag-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "domain", "user": "Malwarehunterr", "value": "webbad-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "domain", "user": "Malwarehunterr", "value": "webart-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "domain", "user": "Malwarehunterr", "value": "webarm-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "domain", "user": "Malwarehunterr", "value": "webarc-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "domain", "user": "Malwarehunterr", "value": "tokennode-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "domain", "user": "Malwarehunterr", "value": "tokencdn-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "domain", "user": "Malwarehunterr", "value": "tokenapi-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "domain", "user": "Malwarehunterr", "value": "sessionnode-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "domain", "user": "Malwarehunterr", "value": "sessioncdn-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "domain", "user": "Malwarehunterr", "value": "sessionapi-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "url", "user": "Malwarehunterr", "value": "http://cookiecdn-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "url", "user": "Malwarehunterr", "value": "http://cookieapi-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "url", "user": "Malwarehunterr", "value": "http://clouddns-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "url", "user": "Malwarehunterr", "value": "http://cloudcdn-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "url", "user": "Malwarehunterr", "value": "http://cloudapi-whatsapp.com" }, { "ai": { "threat_type": "other" }, "date": "2026-10-16 08:51:21", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2111017138790056108", "type": "url", "user": "malwrhunterteam", "value": "http://cloudenterpriseve.com" }, { "ai": { "threat_type": "other" }, "date": "2026-10-16 08:51:21", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2111017138790056108", "type": "url", "user": "malwrhunterteam", "value": "http://cloudeliverrs.com" }, { "ai": { "threat_type": "other" }, "date": "2026-10-16 08:51:21", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2111017138790056108", "type": "url", "user": "malwrhunterteam", "value": "http://cloudeliverenterprise.com" } ], "last_seen": "2026-10-20", "member_cluster_ids": [ "tfc-c5793b987513", "tfc-6a3f19739b2d", "tfc-109dfc32995c", "tfc-5005594a1639", "tfc-673d02971792", "tfc-6b3127d558af" ], "name": "WhatsApp lookalike domains on -whatsapp.com pattern", "related": { "checked_at": "2026-10-21T06:28:10Z", "match_count": 22, "matches": [ { "asn": "AS138415", "company": "whatsapp", "domain": "cloudauth-whatsapp.com", "match": "exact" }, { "asn": "AS138415", "company": "whatsapp", "domain": "cloudcdn-whatsapp.com", "match": "exact" }, { "asn": "AS138415", "company": "whatsapp", "domain": "cloudcore-whatsapp.com", "match": "exact" }, { "asn": "AS138415", "company": "whatsapp", "domain": "cloudlink-whatsapp.com", "match": "exact" }, { "asn": "AS138415", "company": "whatsapp", "domain": "cloudnode-whatsapp.com", "match": "exact" }, { "asn": "AS138415", "company": "whatsapp", "domain": "cookieapi-whatsapp.com", "match": "exact" }, { "asn": "AS138415", "company": "whatsapp", "domain": "cookiecdn-whatsapp.com", "match": "exact" }, { "asn": "AS138415", "company": "whatsapp", "domain": "cookienode-whatsapp.com", "match": "exact" }, { "asn": "AS138415", "company": "whatsapp", "domain": "sessionapi-whatsapp.com", "match": "exact" }, { "asn": "AS138415", "company": "whatsapp", "domain": "sessioncdn-whatsapp.com", "match": "exact" } ], "source": "phishunt.io" }, "reporters": [ "Malwarehunterr", "malwrhunterteam", "skocherhan" ], "tags": [ "#phishing" ], "targeted_brand": "WhatsApp", "targeted_country": null, "targeted_sector": "communications", "threat_types": { "other": 6, "phishing": 50 }, "ttps": [ "T1583.001", "T1566.002" ], "types": { "domain": 28, "url": 28 } }, { "activity": { "2026-09-26": 46, "2026-10-20": 6 }, "anchors": { "registered_domains": [ "analytics-secure.com", "assets-bundle.com", "assetsbundle.com", "captchatimestamp.com", "doubleclickcache.com", "doubleclickpro.com", "explorerbrowser.com", "feedback-bundle.com", "feedback-hotjar.com", "feedbackbundle.com", "gtmtimestamp.com", "jquery-bootstrap.com", "lurkershield.com", "review-cdn.com", "safepayguard.com", "safeprocessmaster.com", "safeprocessor.com", "solutionjquery.com", "specterguardian.com", "static-secure.com", "webcache-cache.com", "webcachecache.com", "webcap-whatsapp.com", "webcar-whatsapp.com", "webcat-whatsapp.com", "websitewebcache.com" ], "tags": [ "#Magecart" ], "url_path_patterns": [] }, "confidence": "medium", "context": "Magecart web-skimming infrastructure uses domains that imitate analytics, CDN and security services, such as doubleclickpro.com, feedback-hotjar.com and captchatimestamp.com. Enrichment describes them as skimmer domains impersonating analytics and security services. Three reporters flagged 52 IOCs from 2026-09-26 to 2026-10-20.", "enriched_count": 52, "families": {}, "first_seen": "2026-09-26", "history": { "by_pattern": [], "domains_365d": 26, "first_seen_365d": "2026-09-26", "iocs_365d": 52, "iocs_before_window": 0, "last_seen_365d": "2026-10-20", "window_days": 365 }, "id": "tfc-f5958442ebd2", "ioc_count": 52, "ioc_count_1d": 6, "ioc_count_30d": 52, "ioc_count_7d": 6, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "domain", "user": "Malwarehunterr", "value": "webcat-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "domain", "user": "Malwarehunterr", "value": "webcar-whatsapp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 13:55:55", "tags": [ "#phishing" ], "tweet": "https://x.com/Malwarehunterr/status/2112543337832227119", "type": "domain", "user": "Malwarehunterr", "value": "webcap-whatsapp.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/500mk500/status/2103934538254557327", "type": "domain", "user": "500mk500", "value": "webcachecache.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/500mk500/status/2103934538254557327", "type": "domain", "user": "500mk500", "value": "webcache-cache.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/500mk500/status/2103934538254557327", "type": "domain", "user": "500mk500", "value": "static-secure.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/reporturi/status/2103392201384329646", "type": "domain", "user": "reporturi", "value": "specterguardian.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/reporturi/status/2103392201384329646", "type": "domain", "user": "reporturi", "value": "solutionjquery.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/reporturi/status/2103392201384329646", "type": "domain", "user": "reporturi", "value": "safeprocessor.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/reporturi/status/2103392201384329646", "type": "domain", "user": "reporturi", "value": "safeprocessmaster.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/500mk500/status/2103934538254557327", "type": "domain", "user": "500mk500", "value": "safepayguard.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/reporturi/status/2103392201384329646", "type": "domain", "user": "reporturi", "value": "review-cdn.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/500mk500/status/2103934538254557327", "type": "domain", "user": "500mk500", "value": "lurkershield.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/500mk500/status/2103934538254557327", "type": "domain", "user": "500mk500", "value": "jquery-bootstrap.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/reporturi/status/2103392201384329646", "type": "url", "user": "reporturi", "value": "http://gtmtimestamp.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/500mk500/status/2103934538254557327", "type": "url", "user": "500mk500", "value": "http://feedbackbundle.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/500mk500/status/2103934538254557327", "type": "url", "user": "500mk500", "value": "http://feedback-hotjar.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/500mk500/status/2103934538254557327", "type": "url", "user": "500mk500", "value": "http://feedback-bundle.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/reporturi/status/2103392201384329646", "type": "url", "user": "reporturi", "value": "http://explorerbrowser.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/500mk500/status/2103934538254557327", "type": "url", "user": "500mk500", "value": "http://doubleclickpro.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/reporturi/status/2103392201384329646", "type": "url", "user": "reporturi", "value": "http://doubleclickcache.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/500mk500/status/2103934538254557327", "type": "url", "user": "500mk500", "value": "http://captchatimestamp.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/reporturi/status/2103392201384329646", "type": "url", "user": "reporturi", "value": "http://assetsbundle.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/500mk500/status/2103934538254557327", "type": "url", "user": "500mk500", "value": "http://assets-bundle.com" }, { "ai": { "threat_type": "other" }, "date": "2026-09-26 19:47:37", "tags": [ "#Magecart" ], "tweet": "https://x.com/500mk500/status/2103934538254557327", "type": "url", "user": "500mk500", "value": "http://analytics-secure.com" } ], "last_seen": "2026-10-20", "member_cluster_ids": [ "tfc-f5958442ebd2" ], "name": "Magecart skimmer infrastructure on fake analytics/CDN domains", "related": { "checked_at": "2026-10-21T06:28:10Z", "match_count": 3, "matches": [ { "asn": "AS138415", "company": "whatsapp", "domain": "webcap-whatsapp.com", "match": "exact" }, { "asn": "AS138415", "company": "whatsapp", "domain": "webcar-whatsapp.com", "match": "exact" }, { "asn": "AS138415", "company": "whatsapp", "domain": "webcat-whatsapp.com", "match": "exact" } ], "source": "phishunt.io" }, "reporters": [ "500mk500", "Malwarehunterr", "reporturi" ], "tags": [ "#Magecart", "#phishing" ], "targeted_brand": null, "targeted_country": null, "targeted_sector": null, "threat_types": { "other": 46, "phishing": 6 }, "ttps": [ "T1684.001", "T1583.001" ], "types": { "domain": 26, "url": 26 } }, { "activity": { "2026-09-22": 5, "2026-09-25": 2, "2026-09-28": 6, "2026-09-29": 2, "2026-09-30": 2, "2026-10-01": 8, "2026-10-02": 5, "2026-10-06": 3, "2026-10-10": 2, "2026-10-14": 1, "2026-10-15": 4, "2026-10-16": 3 }, "anchors": { "registered_domains": [ "cornebrdjubf.top", "keepgreentb.com", "leiber.top", "onixone.com.co", "screenconnect.com", "swervimgbackj.top" ], "tags": [], "url_path_patterns": [ "/Bin/ScreenConnect.ClientSetup.exe", "/Bin/ScreenConnect.ClientSetup.msi", "/UPDATE/ScreenConnect.ClientSetup.exe", "/UPDATE/download.html", "/doc/ScreenConnect.ClientSetup.exe" ] }, "confidence": "medium", "context": "Adobe-themed phishing pages lead victims to ScreenConnect client installers, many on screenconnect.com tenant subdomains such as hl-ltd and manuelitellc, plus .top domains such as leiber.top and swervimgbackj.top. Lure pages on keepgreentb.com (/doc/) and onixone.com.co (/UPDATE/) deliver the same ScreenConnect.ClientSetup.exe. Shared paths are /Bin/ScreenConnect.ClientSetup.exe and .msi. Reporters patialavii and smica83 flagged IOCs from 2026-09-22 to 2026-10-16.", "enriched_count": 43, "families": { "ScreenConnect": 7 }, "first_seen": "2026-09-22", "history": { "by_pattern": [], "domains_365d": 6, "first_seen_365d": "2026-04-18", "iocs_365d": 116, "iocs_before_window": 76, "last_seen_365d": "2026-10-16", "window_days": 365 }, "id": "tfc-fe15df7d4526", "ioc_count": 43, "ioc_count_1d": 0, "ioc_count_30d": 43, "ioc_count_7d": 7, "iocs": [ { "ai": { "family": "ScreenConnect", "threat_type": "malware" }, "date": "2026-10-16 22:09:34", "tags": [], "tweet": "https://x.com/smica83/status/2111218017547817401", "type": "url", "user": "smica83", "value": "http://107.174.19.11:443/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest" }, { "ai": { "family": "ScreenConnect", "threat_type": "phishing" }, "date": "2026-10-16 05:14:57", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2110962680358175038", "type": "domain", "user": "patialavii", "value": "theocbuildinggroup.screenconnect.com" }, { "ai": { "family": "ScreenConnect", "threat_type": "phishing" }, "date": "2026-10-16 05:14:57", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2110962680358175038", "type": "url", "user": "patialavii", "value": "https://theocbuildinggroup.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-15 03:51:06", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2110579189250433531", "type": "domain", "user": "patialavii", "value": "manuelitellc.screenconnect.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-15 03:51:06", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2110579189250433531", "type": "url", "user": "patialavii", "value": "https://manuelitellc.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-15 03:34:31", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2110575016995897595", "type": "domain", "user": "patialavii", "value": "secure.cornebrdjubf.top" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-14 03:26:19", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2110210566614888793", "type": "url", "user": "patialavii", "value": "http://2.27.21.82/Bin/ScreenConnect.ClientSetup.msi" }, { "ai": { "family": "ScreenConnect", "threat_type": "malware" }, "date": "2026-10-10 11:51:06", "tags": [], "tweet": "https://x.com/smica83/status/2108888048242958751", "type": "domain", "user": "smica83", "value": "swervimgbackj.top" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-06 04:45:05", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2107331284834074952", "type": "domain", "user": "patialavii", "value": "manuelitellc.screenconnect.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-06 04:45:05", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2107331284834074952", "type": "url", "user": "patialavii", "value": "https://manuelitellc.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-02 04:08:56", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2105872637608255523", "type": "domain", "user": "patialavii", "value": "onixone.com.co" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-02 04:08:56", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2105872637608255523", "type": "url", "user": "patialavii", "value": "https://onixone.com.co/UPDATE/download.html" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-02 04:06:15", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2105871963109703880", "type": "url", "user": "patialavii", "value": "https://hl-ltd.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-02 04:06:15", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2105871963109703880", "type": "domain", "user": "patialavii", "value": "hl-ltd.screenconnect.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-01 03:25:11", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2105499238566355071", "type": "url", "user": "patialavii", "value": "https://gpcom1.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-01 03:25:11", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2105499238566355071", "type": "domain", "user": "patialavii", "value": "gpcom1.screenconnect.com" }, { "ai": { "family": "ScreenConnect", "threat_type": "phishing" }, "date": "2026-10-01 03:18:08", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2105497466040926462", "type": "domain", "user": "patialavii", "value": "strafordhomes.screenconnect.com" }, { "ai": { "family": "ScreenConnect", "threat_type": "phishing" }, "date": "2026-10-01 03:18:08", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2105497466040926462", "type": "url", "user": "patialavii", "value": "https://strafordhomes.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-01 03:12:36", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2105496072785453421", "type": "domain", "user": "patialavii", "value": "logiccorporation.screenconnect.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-01 03:12:36", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2105496072785453421", "type": "url", "user": "patialavii", "value": "https://logiccorporation.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-01 03:06:03", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2105494422804996111", "type": "domain", "user": "patialavii", "value": "valeriediedrich13.screenconnect.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-01 03:06:03", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2105494422804996111", "type": "url", "user": "patialavii", "value": "https://valeriediedrich13.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-28 04:19:47", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2104425815954108574", "type": "domain", "user": "patialavii", "value": "leiber.top" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-22 04:02:35", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2102247161299914762", "type": "domain", "user": "patialavii", "value": "keepgreentb.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-22 04:02:35", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2102247161299914762", "type": "url", "user": "patialavii", "value": "https://keepgreentb.com/doc/ScreenConnect.ClientSetup.exe" } ], "last_seen": "2026-10-16", "member_cluster_ids": [ "tfc-fe15df7d4526", "tfc-32ea56449ca2", "tfc-ae63984a2bec" ], "name": "Adobe-themed phishing delivering ScreenConnect RMM installer", "reporters": [ "patialavii", "smica83" ], "tags": [ "#phishing" ], "targeted_brand": "Adobe", "targeted_country": null, "targeted_sector": "technology", "threat_types": { "malware": 5, "phishing": 38 }, "ttps": [ "T1036.005", "T1608.001", "T1588.002", "T1566.002" ], "types": { "domain": 19, "url": 24 } }, { "activity": { "2026-09-29": 2, "2026-10-05": 2, "2026-10-13": 5, "2026-10-16": 3, "2026-10-19": 8, "2026-10-20": 4, "2026-10-21": 13 }, "anchors": { "registered_domains": [ "cxxsmxt.com", "rkm-20260709-1514.zip", "scnk3.club" ], "tags": [ "#ValleyRAT" ], "url_path_patterns": [] }, "confidence": "medium", "context": "Domains, IP addresses, URLs and file hashes are tagged ValleyRAT and C2. Enrichment describes C2 domains such as m.cxxsmxt.com, a disk image attachment delivering a fake tax checklist executable, and a VHDX sample. Six reporters flagged 37 IOCs from 2026-09-29 to 2026-10-21.", "enriched_count": 24, "families": { "ValleyRAT": 24 }, "first_seen": "2026-09-29", "history": { "by_pattern": [], "domains_365d": 3, "first_seen_365d": "2026-08-04", "iocs_365d": 10, "iocs_before_window": 2, "last_seen_365d": "2026-10-21", "window_days": 365 }, "id": "tfc-724bffa012b8", "infra": [ { "country": "HK", "ip_count": 2, "org": "AS152194 CTG Server Limited" }, { "country": "HK", "ip_count": 2, "org": "AS45102 Alibaba (US) Technology Co., Ltd." }, { "country": "CN", "ip_count": 1, "org": "AS37963 Hangzhou Alibaba Advertising Co.,Ltd." }, { "country": "HK", "ip_count": 1, "org": "AS401701 cognetcloud INC" }, { "country": "CN", "ip_count": 1, "org": "AS55990 Huawei Cloud Service data center" }, { "country": "HK", "ip_count": 1, "org": "AS976 CoreNET Inc." } ], "ioc_count": 37, "ioc_count_1d": 15, "ioc_count_30d": 37, "ioc_count_7d": 28, "iocs": [ { "date": "2026-10-21 03:54:00", "tags": [ "#ValleyRAT" ], "tweet": "https://x.com/bomccss/status/2112754246542406060", "type": "sha256", "user": "bomccss", "value": "99e781b4662daf6d65d66416bdf304b11cb10ecb6bf3a69c27fdf26d726b529c" }, { "date": "2026-10-21 02:49:33", "tags": [ "#ValleyRAT" ], "tweet": "https://x.com/tdatwja/status/2112738029064589398", "type": "md5", "user": "tdatwja", "value": "e6240ab3c91c4059a84c0415db1d68d0" }, { "date": "2026-10-21 02:49:33", "tags": [ "#ValleyRAT" ], "tweet": "https://x.com/tdatwja/status/2112738026938069150", "type": "md5", "user": "tdatwja", "value": "bd6ff51ec573b5d1cced6b5faa0d78ab" }, { "date": "2026-10-21 02:49:33", "tags": [ "#ValleyRAT" ], "tweet": "https://x.com/tdatwja/status/2112738029064589398", "type": "md5", "user": "tdatwja", "value": "9356a73aa05b45a2e87dd1207820f26d" }, { "date": "2026-10-21 02:49:33", "tags": [ "#ValleyRAT" ], "tweet": "https://x.com/tdatwja/status/2112738026938069150", "type": "md5", "user": "tdatwja", "value": "75084b45b724a406d3c9e17d679b617e" }, { "date": "2026-10-21 02:49:33", "tags": [ "#ValleyRAT" ], "tweet": "https://x.com/tdatwja/status/2112738029064589398", "type": "md5", "user": "tdatwja", "value": "408f36738f10d2ac47fed558f2820682" }, { "date": "2026-10-21 02:49:33", "tags": [ "#ValleyRAT" ], "tweet": "https://x.com/tdatwja/status/2112738026938069150", "type": "md5", "user": "tdatwja", "value": "1d617f5fda401b5bed0a63550f9de05d" }, { "date": "2026-10-21 02:49:32", "tags": [ "#ValleyRAT" ], "tweet": "https://x.com/tdatwja/status/2112738024262181174", "type": "url", "user": "tdatwja", "value": "http://47.243.109.132:5252" }, { "date": "2026-10-21 02:49:32", "tags": [ "#ValleyRAT" ], "tweet": "https://x.com/tdatwja/status/2112738024262181174", "type": "sha256", "user": "tdatwja", "value": "de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4" }, { "date": "2026-10-21 02:49:32", "tags": [ "#ValleyRAT" ], "tweet": "https://x.com/tdatwja/status/2112738024262181174", "type": "ip", "user": "tdatwja", "value": "47.243.109.132" }, { "date": "2026-10-21 02:49:31", "tags": [ "#ValleyRAT" ], "tweet": "https://x.com/tdatwja/status/2112738020046823432", "type": "domain", "user": "tdatwja", "value": "rkm-20260709-1514.zip" }, { "ai": { "family": "ValleyRAT", "threat_type": "c2" }, "date": "2026-10-20 13:12:06", "tags": [ "#ValleyRAT" ], "tweet": "https://x.com/James_inthe_box/status/2112532310742691861", "type": "url", "user": "James_inthe_box", "value": "http://202.146.222.95:443" }, { "ai": { "family": "ValleyRAT", "threat_type": "c2" }, "date": "2026-10-20 13:12:06", "net": { "country": "HK", "org": "AS152194 CTG Server Limited" }, "tags": [ "#ValleyRAT" ], "tweet": "https://x.com/James_inthe_box/status/2112532310742691861", "type": "ip", "user": "James_inthe_box", "value": "202.146.222.95" }, { "ai": { "family": "ValleyRat", "threat_type": "c2" }, "date": "2026-10-20 05:36:30", "tags": [ "#ValleyRAT" ], "tweet": "https://x.com/skocherhan/status/2112417657156932000", "type": "domain", "user": "skocherhan", "value": "scnk3.club" }, { "ai": { "family": "ValleyRAT", "threat_type": "c2" }, "date": "2026-10-19 09:01:13", "tags": [ "#C2", "#ValleyRAT" ], "tweet": "https://x.com/fr0s7_/status/2112106786064896324", "type": "domain", "user": "fr0s7_", "value": "m.cxxsmxt.com" }, { "ai": { "family": "ValleyRAT", "threat_type": "c2" }, "date": "2026-10-19 09:01:13", "tags": [ "#C2", "#ValleyRAT" ], "tweet": "https://x.com/fr0s7_/status/2112106786064896324", "type": "url", "user": "fr0s7_", "value": "http://m.cxxsmxt.com" }, { "ai": { "family": "ValleyRAT", "threat_type": "c2" }, "date": "2026-10-19 09:01:13", "tags": [ "#C2", "#ValleyRAT" ], "tweet": "https://x.com/fr0s7_/status/2112106786064896324", "type": "url", "user": "fr0s7_", "value": "http://am.cxxsmxt.com" }, { "ai": { "family": "ValleyRAT", "threat_type": "c2" }, "date": "2026-10-19 09:01:13", "tags": [ "#C2", "#ValleyRAT" ], "tweet": "https://x.com/fr0s7_/status/2112106786064896324", "type": "url", "user": "fr0s7_", "value": "http://47.114.2.196" }, { "ai": { "family": "ValleyRAT", "threat_type": "c2" }, "date": "2026-10-19 09:01:13", "tags": [ "#C2", "#ValleyRAT" ], "tweet": "https://x.com/fr0s7_/status/2112106786064896324", "type": "url", "user": "fr0s7_", "value": "http://154.222.28.41" }, { "ai": { "family": "ValleyRAT", "threat_type": "c2" }, "date": "2026-10-19 09:01:13", "net": { "country": "CN", "org": "AS37963 Hangzhou Alibaba Advertising Co.,Ltd." }, "tags": [ "#C2", "#ValleyRAT" ], "tweet": "https://x.com/fr0s7_/status/2112106786064896324", "type": "ip", "user": "fr0s7_", "value": "47.114.2.196" }, { "ai": { "family": "ValleyRAT", "threat_type": "c2" }, "date": "2026-10-19 09:01:13", "net": { "country": "HK", "org": "AS401701 cognetcloud INC" }, "tags": [ "#C2", "#ValleyRAT" ], "tweet": "https://x.com/fr0s7_/status/2112106786064896324", "type": "ip", "user": "fr0s7_", "value": "154.222.28.41" }, { "ai": { "family": "ValleyRAT", "threat_type": "malware" }, "date": "2026-10-16 09:13:05", "tags": [ "#ValleyRAT" ], "tweet": "https://x.com/smica83/status/2111022610280550553", "type": "url", "user": "smica83", "value": "http://143.92.38.167:8383" }, { "ai": { "family": "ValleyRAT", "threat_type": "malware" }, "date": "2026-10-16 09:13:05", "tags": [ "#ValleyRAT" ], "tweet": "https://x.com/smica83/status/2111022610280550553", "type": "sha256", "user": "smica83", "value": "b5e640b7676e3ef1741d902dfb183e6129aa997d4b99a9626af9bb7c022e796f" }, { "ai": { "family": "ValleyRAT", "threat_type": "malware" }, "date": "2026-10-16 09:13:05", "net": { "country": "HK", "org": "AS152194 CTG Server Limited" }, "tags": [ "#ValleyRAT" ], "tweet": "https://x.com/smica83/status/2111022610280550553", "type": "ip", "user": "smica83", "value": "143.92.38.167" }, { "ai": { "family": "ValleyRAT", "threat_type": "malware" }, "date": "2026-10-13 05:18:49", "net": { "country": "HK", "org": "AS976 CoreNET Inc." }, "tags": [ "#ValleyRAT" ], "tweet": "https://x.com/tdatwja/status/2109876492050293230", "type": "ip", "user": "tdatwja", "value": "103.118.42.120" } ], "last_seen": "2026-10-21", "member_cluster_ids": [ "tfc-724bffa012b8" ], "name": "ValleyRAT C2 infrastructure linked to Silver Fox", "reporters": [ "James_inthe_box", "bomccss", "fr0s7_", "skocherhan", "smica83", "tdatwja" ], "tags": [ "#C2", "#ValleyRAT" ], "targeted_brand": null, "targeted_country": null, "targeted_sector": null, "threat_types": { "c2": 16, "malware": 8 }, "ttps": [ "T1588.001", "T1071.001" ], "types": { "domain": 4, "ip": 9, "md5": 8, "sha256": 5, "url": 11 } }, { "activity": { "2026-09-23": 2, "2026-09-24": 4, "2026-09-27": 4, "2026-09-30": 5, "2026-10-01": 2, "2026-10-05": 4, "2026-10-06": 8 }, "anchors": { "registered_domains": [ "130826.ngrok.app", "interactions-according-reports-syndication.trycloudflare.com", "periods-genetic-stones-government.trycloudflare.com", "sc88qt.com", "ygz.bet" ], "tags": [ "#AsyncRAT", "#Xworm" ], "url_path_patterns": [ "/MicrosoftUpdateServices.exe", "/fps.exe" ] }, "confidence": "medium", "context": "An ngrok.app host serves MicrosoftUpdateServices.exe as a next stage after a malicious JS sample resembling XWorm. Tags name XWorm, AsyncRAT and #opendir; enrichment also cites fps.exe from ygz.bet, trycloudflare.com hosts and a VBS booking lure with steganographic JPGs. Six reporters flagged 29 IOCs from 2026-09-23 to 2026-10-06.", "enriched_count": 29, "families": { "AsyncRAT": 15, "XWorm": 12 }, "first_seen": "2026-09-23", "history": { "by_pattern": [], "domains_365d": 5, "first_seen_365d": "2026-09-16", "iocs_365d": 14, "iocs_before_window": 4, "last_seen_365d": "2026-10-06", "window_days": 365 }, "id": "tfc-7fca162f136a", "infra": [ { "country": "US", "ip_count": 2, "org": "AS36352 HostPapa" }, { "country": "US", "ip_count": 2, "org": "AS399486 12651980 CANADA INC." }, { "country": "TH", "ip_count": 1, "org": "AS142299 CLOUDFOREST CO., LTD." }, { "country": "US", "ip_count": 1, "org": "AS35986 Vyve Broadband" }, { "country": "US", "ip_count": 1, "org": "AS44382 Fiba Cloud Operation Company, LLC" }, { "country": "NL", "ip_count": 1, "org": "AS8075 Microsoft Corporation" } ], "ioc_count": 29, "ioc_count_1d": 0, "ioc_count_30d": 29, "ioc_count_7d": 0, "iocs": [ { "ai": { "family": "XWorm", "threat_type": "c2" }, "date": "2026-10-06 15:21:19", "tags": [ "#Xworm", "#opendir" ], "tweet": "https://x.com/James_inthe_box/status/2107491399730073763", "type": "url", "user": "James_inthe_box", "value": "http://151.241.154.23:7007" }, { "ai": { "family": "XWorm", "threat_type": "c2" }, "date": "2026-10-06 15:21:19", "tags": [ "#Xworm", "#opendir" ], "tweet": "https://x.com/James_inthe_box/status/2107491399730073763", "type": "url", "user": "James_inthe_box", "value": "http://107.173.143.44/60" }, { "ai": { "family": "XWorm", "threat_type": "c2" }, "date": "2026-10-06 15:21:19", "net": { "country": "FR", "org": "AS399486 12651980 CANADA INC." }, "tags": [ "#Xworm", "#opendir" ], "tweet": "https://x.com/James_inthe_box/status/2107491399730073763", "type": "ip", "user": "James_inthe_box", "value": "151.241.154.23" }, { "ai": { "family": "XWorm", "threat_type": "c2" }, "date": "2026-10-06 15:21:19", "net": { "country": "US", "org": "AS36352 HostPapa" }, "tags": [ "#Xworm", "#opendir" ], "tweet": "https://x.com/James_inthe_box/status/2107491399730073763", "type": "ip", "user": "James_inthe_box", "value": "107.173.143.44" }, { "ai": { "family": "XWorm", "threat_type": "malware" }, "date": "2026-10-06 11:45:32", "tags": [ "#Xworm" ], "tweet": "https://x.com/smica83/status/2107437096495419722", "type": "domain", "user": "smica83", "value": "ygz.bet" }, { "ai": { "family": "XWorm", "threat_type": "malware" }, "date": "2026-10-06 11:45:32", "tags": [ "#Xworm" ], "tweet": "https://x.com/smica83/status/2107437096495419722", "type": "url", "user": "smica83", "value": "http://ygz.bet/fps.exe" }, { "ai": { "family": "XWorm", "threat_type": "malware" }, "date": "2026-10-06 11:45:32", "net": { "country": "TH", "org": "AS142299 CLOUDFOREST CO., LTD." }, "tags": [ "#Xworm" ], "tweet": "https://x.com/smica83/status/2107437096495419722", "type": "ip", "user": "smica83", "value": "45.141.26.63" }, { "ai": { "family": "XWorm", "threat_type": "malware" }, "date": "2026-10-06 11:45:32", "tags": [ "#Xworm" ], "tweet": "https://x.com/smica83/status/2107437096495419722", "type": "sha256", "user": "smica83", "value": "38fc7910c4e49d6be701b7850ad3f00093735590d051bbeb1399ce149fc65b94" }, { "ai": { "family": "XWorm", "threat_type": "malware" }, "date": "2026-10-05 16:00:14", "tags": [ "#Xworm" ], "tweet": "https://x.com/smica83/status/2107138805270487052", "type": "url", "user": "smica83", "value": "https://130826.ngrok.app/MicrosoftUpdateServices.exe" }, { "ai": { "family": "XWorm", "threat_type": "malware" }, "date": "2026-10-05 16:00:14", "tags": [ "#Xworm" ], "tweet": "https://x.com/smica83/status/2107138805270487052", "type": "sha256", "user": "smica83", "value": "2ede40f7d7f02014533a250bd68ee2da8f48cd222d14d4a66c50206646ede127" }, { "ai": { "family": "XWorm", "threat_type": "malware" }, "date": "2026-10-05 16:00:14", "tags": [ "#Xworm" ], "tweet": "https://x.com/smica83/status/2107138805270487052", "type": "sha256", "user": "smica83", "value": "22d80c337a78b9a5ffe4fd41492fe2f1a65ce5b9bf9f63ecf58608437184f178" }, { "ai": { "family": "XWorm", "threat_type": "malware" }, "date": "2026-10-05 16:00:14", "tags": [ "#Xworm" ], "tweet": "https://x.com/smica83/status/2107138805270487052", "type": "domain", "user": "smica83", "value": "130826.ngrok.app" }, { "ai": { "threat_type": "malware" }, "date": "2026-10-01 09:03:04", "tags": [ "#AsyncRAT", "#Xworm" ], "tweet": "https://x.com/_AkatsukiLegion/status/2105584268680507901", "type": "url", "user": "_AkatsukiLegion", "value": "http://51.144.45.141" }, { "ai": { "threat_type": "malware" }, "date": "2026-10-01 09:03:04", "net": { "country": "NL", "org": "AS8075 Microsoft Corporation" }, "tags": [ "#AsyncRAT", "#Xworm" ], "tweet": "https://x.com/_AkatsukiLegion/status/2105584268680507901", "type": "ip", "user": "_AkatsukiLegion", "value": "51.144.45.141" }, { "ai": { "family": "AsyncRAT", "threat_type": "malware" }, "date": "2026-09-30 06:11:22", "tags": [], "tweet": "https://x.com/JAMESWT_WT/status/2105178672420323406", "type": "md5", "user": "JAMESWT_WT", "value": "82fa22bc4ac39d06a41cef104b9255c4" }, { "ai": { "family": "AsyncRAT", "threat_type": "malware" }, "date": "2026-09-30 06:11:22", "net": { "country": "US", "org": "AS399486 12651980 CANADA INC." }, "tags": [], "tweet": "https://x.com/JAMESWT_WT/status/2105178672420323406", "type": "ip", "user": "JAMESWT_WT", "value": "64.224.17.115" }, { "ai": { "family": "AsyncRAT", "threat_type": "malware" }, "date": "2026-09-30 06:11:22", "net": { "country": "US", "org": "AS44382 Fiba Cloud Operation Company, LLC" }, "tags": [], "tweet": "https://x.com/JAMESWT_WT/status/2105178672420323406", "type": "ip", "user": "JAMESWT_WT", "value": "216.9.224.48" }, { "ai": { "family": "AsyncRAT", "threat_type": "malware" }, "date": "2026-09-30 06:11:22", "tags": [], "tweet": "https://x.com/JAMESWT_WT/status/2105178672420323406", "type": "md5", "user": "JAMESWT_WT", "value": "1a2eb4add748ffbe552d2bbc9d289bab" }, { "ai": { "family": "AsyncRAT", "threat_type": "malware" }, "date": "2026-09-30 06:11:22", "net": { "country": "US", "org": "AS36352 HostPapa" }, "tags": [], "tweet": "https://x.com/JAMESWT_WT/status/2105178672420323406", "type": "ip", "user": "JAMESWT_WT", "value": "107.175.148.115" }, { "ai": { "family": "asyncrat", "threat_type": "malware" }, "date": "2026-09-27 17:01:36", "tags": [ "#AsyncRAT" ], "tweet": "https://x.com/skocherhan/status/2104255144384692734", "type": "md5", "user": "skocherhan", "value": "78bf1882183a3be3df1ed9186dbe660b" }, { "ai": { "family": "asyncrat", "threat_type": "c2" }, "date": "2026-09-27 16:59:54", "tags": [ "#AsyncRAT" ], "tweet": "https://x.com/skocherhan/status/2104254718465790200", "type": "domain", "user": "skocherhan", "value": "sc88qt.com" }, { "ai": { "family": "asyncrat", "threat_type": "c2" }, "date": "2026-09-27 16:59:54", "tags": [ "#AsyncRAT" ], "tweet": "https://x.com/skocherhan/status/2104254718465790200", "type": "url", "user": "skocherhan", "value": "http://sc88qt.com" }, { "ai": { "family": "AsyncRAT", "threat_type": "malware" }, "date": "2026-09-24 16:07:54", "tags": [ "#AsyncRAT", "#opendir" ], "tweet": "https://x.com/James_inthe_box/status/2103154466770010137", "type": "domain", "user": "James_inthe_box", "value": "periods-genetic-stones-government.trycloudflare.com" }, { "ai": { "family": "AsyncRAT", "threat_type": "malware" }, "date": "2026-09-24 16:07:54", "tags": [ "#AsyncRAT", "#opendir" ], "tweet": "https://x.com/James_inthe_box/status/2103154466770010137", "type": "domain", "user": "James_inthe_box", "value": "interactions-according-reports-syndication.trycloudflare.com" }, { "ai": { "family": "AsyncRAT", "threat_type": "malware" }, "date": "2026-09-24 16:07:54", "tags": [ "#AsyncRAT", "#opendir" ], "tweet": "https://x.com/James_inthe_box/status/2103154466770010137", "type": "url", "user": "James_inthe_box", "value": "https://periods-genetic-stones-government.trycloudflare.com" } ], "last_seen": "2026-10-06", "member_cluster_ids": [ "tfc-7fca162f136a" ], "name": "XWorm/AsyncRAT staging via ngrok and open directories", "reporters": [ "JAMESWT_WT", "James_inthe_box", "_AkatsukiLegion", "curious_drac0", "skocherhan", "smica83" ], "tags": [ "#AsyncRAT", "#C2", "#Xworm", "#opendir" ], "targeted_brand": null, "targeted_country": null, "targeted_sector": null, "threat_types": { "c2": 9, "malware": 20 }, "ttps": [ "T1588.001", "T1608.001", "T1583.006", "T1036.005" ], "types": { "domain": 5, "ip": 8, "md5": 4, "sha256": 3, "url": 9 } }, { "activity": { "2026-10-19": 22, "2026-10-20": 6 }, "anchors": { "registered_domains": [ "l4-l4.site", "meet-google.cam", "meet-google.cyou", "meet-google.live", "qooglo.com" ], "tags": [], "url_path_patterns": [] }, "confidence": "medium", "context": "Domains such as meet-google.live, meet-google.cam, meet-google.cyou, live-join-meet.l4-l4.site and qooglo.com, with meet and mail subdomains, are tied by enrichment to one fake Google Meet phishing campaign (meet-google and qooglo variants). Reporters 500mk500, scanmalware and DEVOTOMSOLUTION flagged IOCs on 2026-10-19 and 2026-10-20. No payload is described.", "enriched_count": 28, "families": {}, "first_seen": "2026-10-19", "history": { "by_pattern": [], "domains_365d": 5, "first_seen_365d": "2026-10-19", "iocs_365d": 28, "iocs_before_window": 0, "last_seen_365d": "2026-10-20", "window_days": 365 }, "id": "tfc-47cc7e1dd73f", "ioc_count": 28, "ioc_count_1d": 6, "ioc_count_30d": 28, "ioc_count_7d": 28, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 11:08:59", "tags": [ "#phishing" ], "tweet": "https://x.com/DEVOTOMSOLUTION/status/2112501328018628870", "type": "domain", "user": "DEVOTOMSOLUTION", "value": "qooglo.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 11:08:59", "tags": [ "#phishing" ], "tweet": "https://x.com/DEVOTOMSOLUTION/status/2112501328018628870", "type": "domain", "user": "DEVOTOMSOLUTION", "value": "meet-google.cyou" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 11:08:59", "tags": [ "#phishing" ], "tweet": "https://x.com/DEVOTOMSOLUTION/status/2112501328018628870", "type": "url", "user": "DEVOTOMSOLUTION", "value": "http://qooglo.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 11:08:59", "tags": [ "#phishing" ], "tweet": "https://x.com/DEVOTOMSOLUTION/status/2112501328018628870", "type": "url", "user": "DEVOTOMSOLUTION", "value": "http://meet-google.cyou" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 09:35:56", "tags": [], "tweet": "https://x.com/scanmalware/status/2112477910976135359", "type": "domain", "user": "scanmalware", "value": "meet-google.live" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 09:35:56", "tags": [], "tweet": "https://x.com/scanmalware/status/2112477910976135359", "type": "url", "user": "scanmalware", "value": "http://meet-google.live" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 20:50:17", "tags": [], "tweet": "https://x.com/500mk500/status/2112285228337344897", "type": "domain", "user": "500mk500", "value": "qooglo.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 20:50:17", "tags": [], "tweet": "https://x.com/500mk500/status/2112285228337344897", "type": "domain", "user": "500mk500", "value": "meet.qooglo.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 20:50:17", "tags": [], "tweet": "https://x.com/500mk500/status/2112285228337344897", "type": "domain", "user": "500mk500", "value": "meet-google.meet-google.cam" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 20:50:17", "tags": [], "tweet": "https://x.com/500mk500/status/2112285228337344897", "type": "domain", "user": "500mk500", "value": "meet-google.live" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 20:50:17", "tags": [], "tweet": "https://x.com/500mk500/status/2112285228337344897", "type": "domain", "user": "500mk500", "value": "meet-google.cyou" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 20:50:17", "tags": [], "tweet": "https://x.com/500mk500/status/2112285228337344897", "type": "domain", "user": "500mk500", "value": "meet-google.cam" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 20:50:17", "tags": [], "tweet": "https://x.com/500mk500/status/2112285228337344897", "type": "domain", "user": "500mk500", "value": "mail.qooglo.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 20:50:17", "tags": [], "tweet": "https://x.com/500mk500/status/2112285228337344897", "type": "domain", "user": "500mk500", "value": "mail.meet-google.live" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 20:50:17", "tags": [], "tweet": "https://x.com/500mk500/status/2112285228337344897", "type": "domain", "user": "500mk500", "value": "live-join-meet.l4-l4.site" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 20:50:17", "tags": [], "tweet": "https://x.com/500mk500/status/2112285228337344897", "type": "domain", "user": "500mk500", "value": "l4-l4.site" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 20:50:17", "tags": [], "tweet": "https://x.com/500mk500/status/2112285228337344897", "type": "domain", "user": "500mk500", "value": "ipv6.meet-google.live" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 20:50:17", "tags": [], "tweet": "https://x.com/500mk500/status/2112285228337344897", "type": "url", "user": "500mk500", "value": "http://qooglo.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 20:50:17", "tags": [], "tweet": "https://x.com/500mk500/status/2112285228337344897", "type": "url", "user": "500mk500", "value": "http://meet.qooglo.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 20:50:17", "tags": [], "tweet": "https://x.com/500mk500/status/2112285228337344897", "type": "url", "user": "500mk500", "value": "http://meet-google.meet-google.cam" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 20:50:17", "tags": [], "tweet": "https://x.com/500mk500/status/2112285228337344897", "type": "url", "user": "500mk500", "value": "http://meet-google.live" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 20:50:17", "tags": [], "tweet": "https://x.com/500mk500/status/2112285228337344897", "type": "url", "user": "500mk500", "value": "http://meet-google.cyou" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 20:50:17", "tags": [], "tweet": "https://x.com/500mk500/status/2112285228337344897", "type": "url", "user": "500mk500", "value": "http://meet-google.cam" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 20:50:17", "tags": [], "tweet": "https://x.com/500mk500/status/2112285228337344897", "type": "url", "user": "500mk500", "value": "http://mail.meet-google.live" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 20:50:17", "tags": [], "tweet": "https://x.com/500mk500/status/2112285228337344897", "type": "url", "user": "500mk500", "value": "http://live-join-meet.l4-l4.site" } ], "last_seen": "2026-10-20", "member_cluster_ids": [ "tfc-47cc7e1dd73f", "tfc-da0091ab1369", "tfc-0b5828ffa2c3", "tfc-96b3a875fd4f", "tfc-9ca1287a08c7" ], "name": "Fake Google Meet phishing on meet-google and qooglo domains", "reporters": [ "500mk500", "DEVOTOMSOLUTION", "scanmalware" ], "tags": [ "#phishing" ], "targeted_brand": "Google Meet", "targeted_country": null, "targeted_sector": "technology", "threat_types": { "phishing": 28 }, "ttps": [ "T1583.001", "T1566.002", "T1684.001" ], "types": { "domain": 14, "url": 14 } }, { "activity": { "2026-09-21": 2, "2026-09-26": 1, "2026-09-28": 1, "2026-09-29": 1, "2026-09-30": 4, "2026-10-01": 1, "2026-10-06": 2, "2026-10-07": 4, "2026-10-09": 1, "2026-10-10": 4, "2026-10-15": 2, "2026-10-20": 2 }, "anchors": { "registered_domains": [ "cquup.com", "expirience.click", "hnxledu.com", "https--www--roblox.com", "https-roblox.com", "htttps-www-roblox.co", "mcjzy.com", "mikoblico.xyz", "roblox.fo" ], "tags": [], "url_path_patterns": [ "/login" ] }, "confidence": "low", "context": "Phishing pages share a /login path across two lures: Roblox lookalikes such as https-roblox.com and htttps-www-roblox.co, and iCloud clones such as account-icloud.hnxledu.com and account-icloud.cquup.com, the latter aimed at Japanese users. The shared path is weak evidence of one operator. Four reporters flagged 25 IOCs from 2026-09-21 to 2026-10-20.", "enriched_count": 25, "families": { "NEXUS": 1 }, "first_seen": "2026-09-21", "history": { "by_pattern": [], "domains_365d": 9, "first_seen_365d": "2026-09-21", "iocs_365d": 18, "iocs_before_window": 0, "last_seen_365d": "2026-10-20", "window_days": 365 }, "id": "tfc-66e666c2695d", "ioc_count": 25, "ioc_count_1d": 2, "ioc_count_30d": 25, "ioc_count_7d": 4, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 12:01:32", "tags": [ "#phishing" ], "tweet": "https://x.com/phishunt_io/status/2112514550939501023", "type": "domain", "user": "phishunt_io", "value": "roblox.fo" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 12:01:32", "tags": [ "#phishing" ], "tweet": "https://x.com/phishunt_io/status/2112514550939501023", "type": "url", "user": "phishunt_io", "value": "http://roblox.fo/login?returnUrl=250803160" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-15 17:01:27", "tags": [ "#phishing" ], "tweet": "https://x.com/phishunt_io/status/2110778091257696295", "type": "domain", "user": "phishunt_io", "value": "https--www--roblox.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-15 17:01:27", "tags": [ "#phishing" ], "tweet": "https://x.com/phishunt_io/status/2110778091257696295", "type": "url", "user": "phishunt_io", "value": "http://https--www--roblox.com/login?returnUrl=1717572407" }, { "ai": { "threat_type": "other" }, "date": "2026-10-10 19:50:55", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2109008798786716087", "type": "url", "user": "malwrhunterteam", "value": "https://expirience.click/login" }, { "ai": { "threat_type": "other" }, "date": "2026-10-10 19:50:55", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2109008798786716087", "type": "domain", "user": "malwrhunterteam", "value": "expirience.click" }, { "ai": { "threat_type": "c2" }, "date": "2026-10-10 17:44:58", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2108977101168578939", "type": "url", "user": "malwrhunterteam", "value": "http://194.9.6.5:1115/login" }, { "ai": { "threat_type": "c2" }, "date": "2026-10-10 17:41:26", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2108976213209600497", "type": "url", "user": "malwrhunterteam", "value": "http://194.9.6.117:8090/login?next=/" }, { "ai": { "family": "NEXUS", "threat_type": "c2" }, "date": "2026-10-09 19:42:46", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2108644359390298618", "type": "url", "user": "malwrhunterteam", "value": "http://194.9.6.5:4313/login" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-07 09:47:54", "tags": [ "#phishing" ], "tweet": "https://x.com/Metemcyber/status/2107769879021707522", "type": "url", "user": "Metemcyber", "value": "https://account-icloud.cquup.com/login/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-07 09:47:54", "tags": [ "#phishing" ], "tweet": "https://x.com/Metemcyber/status/2107769879021707522", "type": "domain", "user": "Metemcyber", "value": "account-icloud.cquup.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-07 05:37:30", "tags": [ "#phishing" ], "tweet": "https://x.com/romonlyht/status/2107706866210054644", "type": "url", "user": "romonlyht", "value": "https://account-icloud.mcjzy.com/login/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-07 05:37:30", "tags": [ "#phishing" ], "tweet": "https://x.com/romonlyht/status/2107706866210054644", "type": "domain", "user": "romonlyht", "value": "account-icloud.mcjzy.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-06 03:52:14", "tags": [ "#phishing" ], "tweet": "https://x.com/Metemcyber/status/2107317984834503033", "type": "url", "user": "Metemcyber", "value": "https://account-icloud.hnxledu.com/login/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-06 03:52:14", "tags": [ "#phishing" ], "tweet": "https://x.com/Metemcyber/status/2107317984834503033", "type": "domain", "user": "Metemcyber", "value": "account-icloud.hnxledu.com" }, { "ai": { "threat_type": "c2" }, "date": "2026-10-01 08:34:26", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2105577064761852336", "type": "url", "user": "malwrhunterteam", "value": "http://23.94.145.224/login" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-30 12:01:21", "tags": [ "#phishing" ], "tweet": "https://x.com/phishunt_io/status/2105266748341530927", "type": "domain", "user": "phishunt_io", "value": "https-roblox.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-30 12:01:21", "tags": [ "#phishing" ], "tweet": "https://x.com/phishunt_io/status/2105266748341530927", "type": "url", "user": "phishunt_io", "value": "http://https-roblox.com/login?returnUrl=1961065750" }, { "ai": { "threat_type": "other" }, "date": "2026-09-30 07:05:39", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2105192333234831688", "type": "domain", "user": "malwrhunterteam", "value": "mikoblico.xyz" }, { "ai": { "threat_type": "other" }, "date": "2026-09-30 07:05:39", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2105192333234831688", "type": "url", "user": "malwrhunterteam", "value": "https://mikoblico.xyz/login" }, { "ai": { "threat_type": "c2" }, "date": "2026-09-29 17:46:40", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2104991264106000850", "type": "url", "user": "malwrhunterteam", "value": "http://51.68.34.78:20109/login" }, { "ai": { "threat_type": "other" }, "date": "2026-09-28 08:45:50", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2104492768827732396", "type": "url", "user": "malwrhunterteam", "value": "http://109.238.87.111/login" }, { "ai": { "threat_type": "c2" }, "date": "2026-09-26 13:43:21", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2103842866573484177", "type": "url", "user": "malwrhunterteam", "value": "http://20.102.117.176:8080/login" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-21 07:01:25", "tags": [ "#phishing" ], "tweet": "https://x.com/phishunt_io/status/2101929776264991057", "type": "domain", "user": "phishunt_io", "value": "htttps-www-roblox.co" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-21 07:01:25", "tags": [ "#phishing" ], "tweet": "https://x.com/phishunt_io/status/2101929776264991057", "type": "url", "user": "phishunt_io", "value": "http://htttps-www-roblox.co/login?returnUrl=1789978322" } ], "last_seen": "2026-10-20", "member_cluster_ids": [ "tfc-66e666c2695d" ], "name": "Roblox and iCloud lookalike phishing sharing a /login path", "reporters": [ "Metemcyber", "malwrhunterteam", "phishunt_io", "romonlyht" ], "tags": [ "#phishing" ], "targeted_brand": "Roblox", "targeted_country": null, "targeted_sector": "entertainment", "threat_types": { "c2": 6, "other": 5, "phishing": 14 }, "ttps": [ "T1566.002", "T1684.001", "T1583.001" ], "types": { "domain": 9, "url": 16 } }, { "activity": { "2026-10-08": 7, "2026-10-13": 8, "2026-10-14": 6, "2026-10-18": 2 }, "anchors": { "registered_domains": [ "5tr.org", "iakmialor.web.id" ], "tags": [ "#Vidar" ], "url_path_patterns": [] }, "confidence": "medium", "context": "Subdomains of 5tr.org (vpn, dev and others), iakmialor.web.id and several IP addresses are tagged Vidar. Enrichment describes C2 IPs plus fake CAPTCHA, verification and CDN lure domains on abuse TLDs, some also linked to SmartLoader. Two reporters flagged 23 IOCs from 2026-10-08 to 2026-10-18.", "enriched_count": 23, "families": { "Vidar": 23 }, "first_seen": "2026-10-08", "history": { "by_pattern": [], "domains_365d": 2, "first_seen_365d": "2026-10-13", "iocs_365d": 16, "iocs_before_window": 0, "last_seen_365d": "2026-10-18", "window_days": 365 }, "id": "tfc-775d0df5b044", "infra": [ { "country": "NL", "ip_count": 4, "org": "AS209373 SWISSNET LLC" }, { "country": "DE", "ip_count": 2, "org": "AS24940 Hetzner Online GmbH" }, { "country": "NL", "ip_count": 1, "org": "AS202412 Omegatech LTD" } ], "ioc_count": 23, "ioc_count_1d": 0, "ioc_count_30d": 23, "ioc_count_7d": 8, "iocs": [ { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-18 09:54:05", "tags": [ "#Vidar", "#infostealer", "#malware" ], "tweet": "https://x.com/orlof_v/status/2111757703110676824", "type": "url", "user": "orlof_v", "value": "http://7k.iakmialor.web.id" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-18 09:54:05", "tags": [ "#Vidar", "#infostealer", "#malware" ], "tweet": "https://x.com/orlof_v/status/2111757703110676824", "type": "domain", "user": "orlof_v", "value": "7k.iakmialor.web.id" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-14 09:55:30", "tags": [ "#Vidar", "#infostealer", "#malware" ], "tweet": "https://x.com/orlof_v/status/2110308506255417764", "type": "domain", "user": "orlof_v", "value": "vpn.5tr.org" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-14 09:55:30", "tags": [ "#Vidar", "#infostealer", "#malware" ], "tweet": "https://x.com/orlof_v/status/2110308506255417764", "type": "domain", "user": "orlof_v", "value": "lryjfreporting.5tr.org" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-14 09:55:30", "tags": [ "#Vidar", "#infostealer", "#malware" ], "tweet": "https://x.com/orlof_v/status/2110308506255417764", "type": "url", "user": "orlof_v", "value": "http://vpn.5tr.org" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-14 09:55:30", "tags": [ "#Vidar", "#infostealer", "#malware" ], "tweet": "https://x.com/orlof_v/status/2110308506255417764", "type": "url", "user": "orlof_v", "value": "http://lryjfreporting.5tr.org" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-14 09:55:30", "tags": [ "#Vidar", "#infostealer", "#malware" ], "tweet": "https://x.com/orlof_v/status/2110308506255417764", "type": "url", "user": "orlof_v", "value": "http://dev.5tr.org" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-14 09:55:30", "tags": [ "#Vidar", "#infostealer", "#malware" ], "tweet": "https://x.com/orlof_v/status/2110308506255417764", "type": "domain", "user": "orlof_v", "value": "dev.5tr.org" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-13 15:43:35", "tags": [ "#Vidar", "#infostealer", "#malware" ], "tweet": "https://x.com/orlof_v/status/2110033718345863417", "type": "domain", "user": "orlof_v", "value": "webconnect.5tr.org" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-13 15:43:35", "tags": [ "#Vidar", "#infostealer", "#malware" ], "tweet": "https://x.com/orlof_v/status/2110033718345863417", "type": "domain", "user": "orlof_v", "value": "remote.5tr.org" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-13 15:43:35", "tags": [ "#Vidar", "#infostealer", "#malware" ], "tweet": "https://x.com/orlof_v/status/2110033718345863417", "type": "url", "user": "orlof_v", "value": "http://webconnect.5tr.org" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-13 15:43:35", "tags": [ "#Vidar", "#infostealer", "#malware" ], "tweet": "https://x.com/orlof_v/status/2110033718345863417", "type": "url", "user": "orlof_v", "value": "http://remote.5tr.org" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-13 15:43:35", "tags": [ "#Vidar", "#infostealer", "#malware" ], "tweet": "https://x.com/orlof_v/status/2110033718345863417", "type": "url", "user": "orlof_v", "value": "http://data.5tr.org" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-13 15:43:35", "tags": [ "#Vidar", "#infostealer", "#malware" ], "tweet": "https://x.com/orlof_v/status/2110033718345863417", "type": "url", "user": "orlof_v", "value": "http://app.5tr.org" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-13 15:43:35", "tags": [ "#Vidar", "#infostealer", "#malware" ], "tweet": "https://x.com/orlof_v/status/2110033718345863417", "type": "domain", "user": "orlof_v", "value": "data.5tr.org" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-13 15:43:35", "tags": [ "#Vidar", "#infostealer", "#malware" ], "tweet": "https://x.com/orlof_v/status/2110033718345863417", "type": "domain", "user": "orlof_v", "value": "app.5tr.org" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-08 14:48:18", "net": { "country": "DE", "org": "AS24940 Hetzner Online GmbH" }, "tags": [], "tweet": "https://x.com/teamcymru_S2/status/2108207867446648928", "type": "ip", "user": "teamcymru_S2", "value": "91.98.96.199" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-08 14:48:18", "net": { "country": "NL", "org": "AS202412 Omegatech LTD" }, "tags": [], "tweet": "https://x.com/teamcymru_S2/status/2108207867446648928", "type": "ip", "user": "teamcymru_S2", "value": "91.92.243.218" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-08 14:48:18", "net": { "country": "NL", "org": "AS209373 SWISSNET LLC" }, "tags": [], "tweet": "https://x.com/teamcymru_S2/status/2108207867446648928", "type": "ip", "user": "teamcymru_S2", "value": "217.60.103.200" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-08 14:48:18", "net": { "country": "NL", "org": "AS209373 SWISSNET LLC" }, "tags": [], "tweet": "https://x.com/teamcymru_S2/status/2108207867446648928", "type": "ip", "user": "teamcymru_S2", "value": "217.60.103.158" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-08 14:48:18", "net": { "country": "NL", "org": "AS209373 SWISSNET LLC" }, "tags": [], "tweet": "https://x.com/teamcymru_S2/status/2108207867446648928", "type": "ip", "user": "teamcymru_S2", "value": "217.60.102.236" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-08 14:48:18", "net": { "country": "NL", "org": "AS209373 SWISSNET LLC" }, "tags": [], "tweet": "https://x.com/teamcymru_S2/status/2108207867446648928", "type": "ip", "user": "teamcymru_S2", "value": "217.60.102.185" }, { "ai": { "family": "Vidar", "threat_type": "malware" }, "date": "2026-10-08 14:48:18", "net": { "country": "DE", "org": "AS24940 Hetzner Online GmbH" }, "tags": [], "tweet": "https://x.com/teamcymru_S2/status/2108207867446648928", "type": "ip", "user": "teamcymru_S2", "value": "138.199.248.47" } ], "last_seen": "2026-10-18", "member_cluster_ids": [ "tfc-775d0df5b044" ], "name": "Vidar infostealer infrastructure on 5tr.org and abuse-TLD lures", "reporters": [ "orlof_v", "teamcymru_S2" ], "tags": [ "#Vidar", "#infostealer", "#malware" ], "targeted_brand": null, "targeted_country": null, "targeted_sector": null, "threat_types": { "malware": 23 }, "ttps": [ "T1588.001", "T1583.001" ], "types": { "domain": 8, "ip": 7, "url": 8 } }, { "activity": { "2026-09-24": 2, "2026-09-26": 2, "2026-09-28": 2, "2026-09-30": 10, "2026-10-01": 6 }, "anchors": { "registered_domains": [ "cgongseq.com", "jwscaiwu.com", "lysxcyy.com", "oiuwaksdiw.com", "poiwaksuwa.com", "uwaiskdas.com", "wauskjdas.com", "wudaksldas.com" ], "tags": [], "url_path_patterns": [ "/cash/downloadopwad", "/point/download" ] }, "confidence": "medium", "context": "Scrambled-letter .com domains such as oiuwaksdiw.com, jwscaiwu.com and cgongseq.com share /point/download and /cash/downloadopwad kit paths. Enrichment describes Rakuten points and special cash benefit lures aimed at Japanese users. Reporter masaomi346 flagged 22 IOCs from 2026-09-24 to 2026-10-01.", "enriched_count": 22, "families": {}, "first_seen": "2026-09-24", "history": { "by_pattern": [], "domains_365d": 8, "first_seen_365d": "2026-09-19", "iocs_365d": 26, "iocs_before_window": 4, "last_seen_365d": "2026-10-01", "window_days": 365 }, "id": "tfc-de6cf2368a2b", "ioc_count": 22, "ioc_count_1d": 0, "ioc_count_30d": 22, "ioc_count_7d": 0, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-01 12:20:25", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2105633933203578986", "type": "domain", "user": "masaomi346", "value": "wudaksldas.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-01 12:20:25", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2105633933203578986", "type": "domain", "user": "masaomi346", "value": "wauskjdas.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-01 12:20:25", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2105633933203578986", "type": "url", "user": "masaomi346", "value": "https://wudaksldas.com/point/download/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-01 12:20:25", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2105633933203578986", "type": "url", "user": "masaomi346", "value": "https://wudaksldas.com/cash/downloadopwad" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-01 12:20:25", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2105633933203578986", "type": "url", "user": "masaomi346", "value": "https://wauskjdas.com/point/download/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-01 12:20:25", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2105633933203578986", "type": "url", "user": "masaomi346", "value": "https://wauskjdas.com/cash/downloadopwad" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-30 12:52:28", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2105279613614330291", "type": "domain", "user": "masaomi346", "value": "poiwaksuwa.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-30 12:52:28", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2105279613614330291", "type": "domain", "user": "masaomi346", "value": "oiuwaksdiw.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-30 12:52:28", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2105279613614330291", "type": "domain", "user": "masaomi346", "value": "lysxcyy.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-30 12:52:28", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2105279613614330291", "type": "domain", "user": "masaomi346", "value": "jwscaiwu.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-30 12:52:28", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2105279613614330291", "type": "url", "user": "masaomi346", "value": "https://poiwaksuwa.com/point/download/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-30 12:52:28", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2105279613614330291", "type": "url", "user": "masaomi346", "value": "https://oiuwaksdiw.com/point/download/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-30 12:52:28", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2105279613614330291", "type": "url", "user": "masaomi346", "value": "https://lysxcyy.com/point/download/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-30 12:52:28", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2105279613614330291", "type": "url", "user": "masaomi346", "value": "https://jwscaiwu.com/point/download/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-30 12:52:28", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2105279613614330291", "type": "url", "user": "masaomi346", "value": "https://cgongseq.com/point/download/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-30 12:52:28", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2105279613614330291", "type": "domain", "user": "masaomi346", "value": "cgongseq.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-28 07:27:58", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2104473171688820902", "type": "domain", "user": "masaomi346", "value": "jwscaiwu.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-28 07:27:58", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2104473171688820902", "type": "url", "user": "masaomi346", "value": "https://jwscaiwu.com/cash/downloadopwad" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-26 07:48:37", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2103753595737014458", "type": "domain", "user": "masaomi346", "value": "uwaiskdas.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-26 07:48:37", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2103753595737014458", "type": "url", "user": "masaomi346", "value": "https://uwaiskdas.com/cash/downloadopwad" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-24 06:38:03", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2103011060597031287", "type": "domain", "user": "masaomi346", "value": "oiuwaksdiw.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-24 06:38:03", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2103011060597031287", "type": "url", "user": "masaomi346", "value": "https://oiuwaksdiw.com/cash/downloadopwad" } ], "last_seen": "2026-10-01", "member_cluster_ids": [ "tfc-de6cf2368a2b" ], "name": "Rakuten phishing on scrambled-letter .com domains", "reporters": [ "masaomi346" ], "tags": [ "#phishing" ], "targeted_brand": "Rakuten", "targeted_country": "JP", "targeted_sector": "retail", "threat_types": { "phishing": 22 }, "ttps": [ "T1566.002", "T1583.001" ], "types": { "domain": 10, "url": 12 } }, { "activity": { "2026-10-15": 4, "2026-10-16": 10, "2026-10-18": 4, "2026-10-19": 2 }, "anchors": { "registered_domains": [ "myssologin.com" ], "tags": [], "url_path_patterns": [] }, "confidence": "low", "context": "Subdomains of myssologin.com are named after law firms such as stinson, dechert and bhfs. Enrichment attributes them to UNC6671 and describes Microsoft OAuth login impersonation aimed at the legal sector. Reporter PadelLifeUK flagged 20 IOCs from 2026-10-15 to 2026-10-19.", "enriched_count": 20, "families": {}, "first_seen": "2026-10-15", "history": { "by_pattern": [], "domains_365d": 1, "first_seen_365d": "2026-10-15", "iocs_365d": 20, "iocs_before_window": 0, "last_seen_365d": "2026-10-19", "window_days": 365 }, "id": "tfc-8ccf313da96f", "ioc_count": 20, "ioc_count_1d": 0, "ioc_count_30d": 20, "ioc_count_7d": 20, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 07:32:24", "tags": [], "tweet": "https://x.com/PadelLifeUK/status/2112084435629990046", "type": "domain", "user": "PadelLifeUK", "value": "myssologin.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 07:32:24", "tags": [], "tweet": "https://x.com/PadelLifeUK/status/2112084435629990046", "type": "url", "user": "PadelLifeUK", "value": "http://myssologin.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-18 08:09:10", "tags": [], "tweet": "https://x.com/PadelLifeUK/status/2111731298897465601", "type": "domain", "user": "PadelLifeUK", "value": "myssologin.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-18 08:09:10", "tags": [], "tweet": "https://x.com/PadelLifeUK/status/2111731298897465601", "type": "url", "user": "PadelLifeUK", "value": "http://myssologin.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-18 08:09:10", "tags": [], "tweet": "https://x.com/PadelLifeUK/status/2111731298897465601", "type": "url", "user": "PadelLifeUK", "value": "http://bhfs.myssologin.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-18 08:09:10", "tags": [], "tweet": "https://x.com/PadelLifeUK/status/2111731298897465601", "type": "domain", "user": "PadelLifeUK", "value": "bhfs.myssologin.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-16 20:01:26", "tags": [], "tweet": "https://x.com/PadelLifeUK/status/2111185771000406305", "type": "domain", "user": "PadelLifeUK", "value": "stinson.myssologin.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-16 20:01:26", "tags": [], "tweet": "https://x.com/PadelLifeUK/status/2111185771000406305", "type": "url", "user": "PadelLifeUK", "value": "http://stinson.myssologin.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-16 20:01:26", "tags": [], "tweet": "https://x.com/PadelLifeUK/status/2111185771000406305", "type": "url", "user": "PadelLifeUK", "value": "http://dechert.myssologin.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-16 20:01:26", "tags": [], "tweet": "https://x.com/PadelLifeUK/status/2111185771000406305", "type": "domain", "user": "PadelLifeUK", "value": "dechert.myssologin.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-16 07:53:32", "tags": [], "tweet": "https://x.com/PadelLifeUK/status/2111002588996931660", "type": "domain", "user": "PadelLifeUK", "value": "willkie.myssologin.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-16 07:53:32", "tags": [], "tweet": "https://x.com/PadelLifeUK/status/2111002588996931660", "type": "domain", "user": "PadelLifeUK", "value": "myssologin.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-16 07:53:32", "tags": [], "tweet": "https://x.com/PadelLifeUK/status/2111002588996931660", "type": "domain", "user": "PadelLifeUK", "value": "kelleydrye.myssologin.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-16 07:53:32", "tags": [], "tweet": "https://x.com/PadelLifeUK/status/2111002588996931660", "type": "url", "user": "PadelLifeUK", "value": "http://willkie.myssologin.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-16 07:53:32", "tags": [], "tweet": "https://x.com/PadelLifeUK/status/2111002588996931660", "type": "url", "user": "PadelLifeUK", "value": "http://myssologin.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-16 07:53:32", "tags": [], "tweet": "https://x.com/PadelLifeUK/status/2111002588996931660", "type": "url", "user": "PadelLifeUK", "value": "http://kelleydrye.myssologin.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-15 20:43:38", "tags": [], "tweet": "https://x.com/PadelLifeUK/status/2110834004647641338", "type": "domain", "user": "PadelLifeUK", "value": "paulweiss.myssologin.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-15 20:43:38", "tags": [], "tweet": "https://x.com/PadelLifeUK/status/2110834004647641338", "type": "url", "user": "PadelLifeUK", "value": "http://paulweiss.myssologin.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-15 20:43:38", "tags": [], "tweet": "https://x.com/PadelLifeUK/status/2110834004647641338", "type": "url", "user": "PadelLifeUK", "value": "http://cooley.myssologin.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-15 20:43:38", "tags": [], "tweet": "https://x.com/PadelLifeUK/status/2110834004647641338", "type": "domain", "user": "PadelLifeUK", "value": "cooley.myssologin.com" } ], "last_seen": "2026-10-19", "member_cluster_ids": [ "tfc-8ccf313da96f" ], "name": "UNC6671 Microsoft OAuth lookalikes on myssologin.com", "reporters": [ "PadelLifeUK" ], "tags": [], "targeted_brand": "Microsoft", "targeted_country": null, "targeted_sector": "technology", "threat_types": { "phishing": 20 }, "ttps": [ "T1684.001", "T1583.001" ], "types": { "domain": 10, "url": 10 } }, { "activity": { "2026-10-05": 1, "2026-10-15": 4, "2026-10-16": 4, "2026-10-17": 4, "2026-10-18": 2, "2026-10-20": 4 }, "anchors": { "families": [ "sliver" ], "registered_domains": [], "tags": [], "url_path_patterns": [] }, "confidence": "medium", "context": "A bucket of 19 IP addresses attributed to the Sliver C2 framework. The grouping comes from enrichment, which cites Shodan results. No domains or lure content are present. Two reporters flagged these IOCs from 2026-10-05 to 2026-10-20.", "enriched_count": 19, "families": { "Sliver": 19 }, "first_seen": "2026-10-05", "id": "tfc-037f20476929", "infra": [ { "country": "NL", "ip_count": 3, "org": "AS14061 DigitalOcean, LLC" }, { "country": "KR", "ip_count": 2, "org": "AS132203 Tencent Building, Kejizhongyi Avenue" }, { "country": "TR", "ip_count": 1, "org": "AS154177 LIGHT NODE LIMITED" }, { "country": "FR", "ip_count": 1, "org": "AS16276 OVH SAS" }, { "country": "IE", "ip_count": 1, "org": "AS16509 Amazon.com, Inc." }, { "country": "FR", "ip_count": 1, "org": "AS215311 Regxa Company for Information Technology Ltd" }, { "country": "DE", "ip_count": 1, "org": "AS24940 Hetzner Online GmbH" }, { "country": "MX", "ip_count": 1, "org": "AS31898 Oracle Corporation" }, { "country": "JP", "ip_count": 1, "org": "AS3258 xTom Japan Corporation" }, { "country": "CN", "ip_count": 1, "org": "AS38365 Beijing Baidu Netcom Science and Technology Co., Ltd." }, { "country": "HK", "ip_count": 1, "org": "AS401696 cognetcloud INC" }, { "country": "CN", "ip_count": 1, "org": "AS45090 Shenzhen Tencent Computer Systems Company Limited" }, { "country": "FR", "ip_count": 1, "org": "AS51167 Contabo GmbH" }, { "country": "TR", "ip_count": 1, "org": "AS57043 HOSTKEY B.V." }, { "country": "DE", "ip_count": 1, "org": "AS58087 Florian Kolb" }, { "country": "US", "ip_count": 1, "org": "AS63949 Akamai Connected Cloud" } ], "ioc_count": 19, "ioc_count_1d": 4, "ioc_count_30d": 19, "ioc_count_7d": 18, "iocs": [ { "ai": { "family": "Sliver", "threat_type": "c2" }, "date": "2026-10-20 13:52:33", "net": { "country": "SG", "org": "AS132203 Tencent Building, Kejizhongyi Avenue" }, "tags": [ "#malware" ], "tweet": "https://x.com/orlof_v/status/2112542490683183523", "type": "ip", "user": "orlof_v", "value": "43.160.211.117" }, { "ai": { "family": "Sliver", "threat_type": "c2" }, "date": "2026-10-20 13:52:33", "net": { "country": "DE", "org": "AS58087 Florian Kolb" }, "tags": [ "#malware" ], "tweet": "https://x.com/orlof_v/status/2112542490683183523", "type": "ip", "user": "orlof_v", "value": "38.87.116.68" }, { "ai": { "family": "Sliver", "threat_type": "c2" }, "date": "2026-10-20 13:52:33", "net": { "country": "FR", "org": "AS16276 OVH SAS" }, "tags": [ "#malware" ], "tweet": "https://x.com/orlof_v/status/2112542490683183523", "type": "ip", "user": "orlof_v", "value": "193.70.100.109" }, { "ai": { "family": "Sliver", "threat_type": "c2" }, "date": "2026-10-20 13:52:33", "net": { "country": "CN", "org": "AS38365 Beijing Baidu Netcom Science and Technology Co., Ltd." }, "tags": [ "#malware" ], "tweet": "https://x.com/orlof_v/status/2112542490683183523", "type": "ip", "user": "orlof_v", "value": "106.12.190.248" }, { "ai": { "family": "Sliver", "threat_type": "c2" }, "date": "2026-10-18 13:51:24", "net": { "country": "US", "org": "AS14061 DigitalOcean, LLC" }, "tags": [ "#malware" ], "tweet": "https://x.com/orlof_v/status/2111817425150964152", "type": "ip", "user": "orlof_v", "value": "167.99.227.197" }, { "ai": { "family": "Sliver", "threat_type": "c2" }, "date": "2026-10-18 13:51:24", "net": { "country": "TR", "org": "AS154177 LIGHT NODE LIMITED" }, "tags": [ "#malware" ], "tweet": "https://x.com/orlof_v/status/2111817425150964152", "type": "ip", "user": "orlof_v", "value": "130.94.1.88" }, { "ai": { "family": "Sliver", "threat_type": "c2" }, "date": "2026-10-17 09:58:33", "net": { "country": "KR", "org": "AS132203 Tencent Building, Kejizhongyi Avenue" }, "tags": [ "#malware" ], "tweet": "https://x.com/orlof_v/status/2111396440815947970", "type": "ip", "user": "orlof_v", "value": "43.155.215.231" }, { "ai": { "family": "Sliver", "threat_type": "c2" }, "date": "2026-10-17 09:58:33", "net": { "country": "FR", "org": "AS215311 Regxa Company for Information Technology Ltd" }, "tags": [ "#malware" ], "tweet": "https://x.com/orlof_v/status/2111396440815947970", "type": "ip", "user": "orlof_v", "value": "145.223.68.204" }, { "ai": { "family": "Sliver", "threat_type": "c2" }, "date": "2026-10-17 09:58:33", "net": { "country": "CN", "org": "AS45090 Shenzhen Tencent Computer Systems Company Limited" }, "tags": [ "#malware" ], "tweet": "https://x.com/orlof_v/status/2111396440815947970", "type": "ip", "user": "orlof_v", "value": "106.55.34.199" }, { "ai": { "family": "Sliver", "threat_type": "c2" }, "date": "2026-10-17 09:58:33", "net": { "country": "US", "org": "AS63949 Akamai Connected Cloud" }, "tags": [ "#malware" ], "tweet": "https://x.com/orlof_v/status/2111396440815947970", "type": "ip", "user": "orlof_v", "value": "104.237.154.191" }, { "ai": { "family": "Sliver", "threat_type": "c2" }, "date": "2026-10-16 14:03:21", "net": { "country": "US", "org": "AS14061 DigitalOcean, LLC" }, "tags": [ "#malware" ], "tweet": "https://x.com/orlof_v/status/2111095657465516235", "type": "ip", "user": "orlof_v", "value": "167.71.16.171" }, { "ai": { "family": "Sliver", "threat_type": "c2" }, "date": "2026-10-16 14:03:21", "net": { "country": "NL", "org": "AS14061 DigitalOcean, LLC" }, "tags": [ "#malware" ], "tweet": "https://x.com/orlof_v/status/2111095657465516235", "type": "ip", "user": "orlof_v", "value": "159.223.238.117" }, { "ai": { "family": "Sliver", "threat_type": "c2" }, "date": "2026-10-16 14:03:21", "net": { "country": "MX", "org": "AS31898 Oracle Corporation" }, "tags": [ "#malware" ], "tweet": "https://x.com/orlof_v/status/2111095657465516235", "type": "ip", "user": "orlof_v", "value": "129.121.62.230" }, { "ai": { "family": "Sliver", "threat_type": "c2" }, "date": "2026-10-16 14:03:21", "net": { "country": "HK", "org": "AS401696 cognetcloud INC" }, "tags": [ "#malware" ], "tweet": "https://x.com/orlof_v/status/2111095657465516235", "type": "ip", "user": "orlof_v", "value": "103.185.249.13" }, { "ai": { "family": "Sliver", "threat_type": "c2" }, "date": "2026-10-15 19:41:00", "net": { "country": "FR", "org": "AS51167 Contabo GmbH" }, "tags": [ "#malware" ], "tweet": "https://x.com/orlof_v/status/2110818240863891857", "type": "ip", "user": "orlof_v", "value": "62.171.131.66" }, { "ai": { "family": "Sliver", "threat_type": "c2" }, "date": "2026-10-15 19:41:00", "net": { "country": "DE", "org": "AS24940 Hetzner Online GmbH" }, "tags": [ "#malware" ], "tweet": "https://x.com/orlof_v/status/2110818240863891857", "type": "ip", "user": "orlof_v", "value": "46.225.55.187" }, { "ai": { "family": "Sliver", "threat_type": "c2" }, "date": "2026-10-15 19:41:00", "net": { "country": "JP", "org": "AS3258 xTom Japan Corporation" }, "tags": [ "#malware" ], "tweet": "https://x.com/orlof_v/status/2110818240863891857", "type": "ip", "user": "orlof_v", "value": "45.129.8.190" }, { "ai": { "family": "Sliver", "threat_type": "c2" }, "date": "2026-10-15 19:41:00", "net": { "country": "TR", "org": "AS57043 HOSTKEY B.V." }, "tags": [ "#malware" ], "tweet": "https://x.com/orlof_v/status/2110818240863891857", "type": "ip", "user": "orlof_v", "value": "195.162.69.212" }, { "ai": { "family": "Sliver", "threat_type": "c2" }, "date": "2026-10-05 09:45:23", "net": { "country": "IE", "org": "AS16509 Amazon.com, Inc." }, "tags": [ "#C2", "#malware" ], "tweet": "https://x.com/etugenio/status/2107044472198693028", "type": "ip", "user": "etugenio", "value": "34.254.202.253" } ], "last_seen": "2026-10-20", "member_cluster_ids": [ "tfc-037f20476929" ], "name": "Sliver C2 server IPs", "reporters": [ "etugenio", "orlof_v" ], "tags": [ "#C2", "#malware" ], "targeted_brand": null, "targeted_country": null, "targeted_sector": null, "threat_types": { "c2": 19 }, "ttps": [ "T1588.002", "T1071.001" ], "types": { "ip": 19 } }, { "activity": { "2026-10-17": 16 }, "anchors": { "registered_domains": [ "anqbsss.cn", "bixsgrb.cn", "dzwwftf.cn", "fmcoyko.cn", "gbjeifr.cn", "hfpzuia.cn", "iasteun.cn", "iugbkbg.cn" ], "tags": [], "url_path_patterns": [ "/Login" ] }, "confidence": "medium", "context": "Eight seven-letter .cn domains such as anqbsss.cn, bixsgrb.cn and hfpzuia.cn serve the same /Login/ path and are tagged #phishing. Enrichment describes Apple-impersonating login pages. One reporter (masaomi346) flagged 16 IOCs on 2026-10-17.", "enriched_count": 16, "families": {}, "first_seen": "2026-10-17", "history": { "by_pattern": [], "domains_365d": 8, "first_seen_365d": "2026-10-17", "iocs_365d": 16, "iocs_before_window": 0, "last_seen_365d": "2026-10-17", "window_days": 365 }, "id": "tfc-9775614460a8", "ioc_count": 16, "ioc_count_1d": 0, "ioc_count_30d": 16, "ioc_count_7d": 16, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-17 00:09:09", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2111248110081224749", "type": "domain", "user": "masaomi346", "value": "iugbkbg.cn" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-17 00:09:09", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2111248110081224749", "type": "domain", "user": "masaomi346", "value": "iasteun.cn" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-17 00:09:09", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2111248110081224749", "type": "url", "user": "masaomi346", "value": "https://iugbkbg.cn/Login/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-17 00:09:09", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2111248110081224749", "type": "url", "user": "masaomi346", "value": "https://iasteun.cn/Login/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-17 00:09:09", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2111248110081224749", "type": "url", "user": "masaomi346", "value": "https://hfpzuia.cn/Login/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-17 00:09:09", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2111248110081224749", "type": "url", "user": "masaomi346", "value": "https://gbjeifr.cn/Login/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-17 00:09:09", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2111248110081224749", "type": "url", "user": "masaomi346", "value": "https://fmcoyko.cn/Login/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-17 00:09:09", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2111248110081224749", "type": "url", "user": "masaomi346", "value": "https://dzwwftf.cn/Login/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-17 00:09:09", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2111248110081224749", "type": "url", "user": "masaomi346", "value": "https://bixsgrb.cn/Login/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-17 00:09:09", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2111248110081224749", "type": "url", "user": "masaomi346", "value": "https://anqbsss.cn/Login/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-17 00:09:09", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2111248110081224749", "type": "domain", "user": "masaomi346", "value": "hfpzuia.cn" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-17 00:09:09", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2111248110081224749", "type": "domain", "user": "masaomi346", "value": "gbjeifr.cn" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-17 00:09:09", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2111248110081224749", "type": "domain", "user": "masaomi346", "value": "fmcoyko.cn" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-17 00:09:09", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2111248110081224749", "type": "domain", "user": "masaomi346", "value": "dzwwftf.cn" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-17 00:09:09", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2111248110081224749", "type": "domain", "user": "masaomi346", "value": "bixsgrb.cn" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-17 00:09:09", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2111248110081224749", "type": "domain", "user": "masaomi346", "value": "anqbsss.cn" } ], "last_seen": "2026-10-17", "member_cluster_ids": [ "tfc-9775614460a8" ], "name": "Random-label .cn phishing domains with /Login path", "reporters": [ "masaomi346" ], "tags": [ "#phishing" ], "targeted_brand": "Apple", "targeted_country": null, "targeted_sector": "technology", "threat_types": { "phishing": 16 }, "ttps": [ "T1566.002", "T1583.001" ], "types": { "domain": 8, "url": 8 } }, { "activity": { "2026-09-29": 2, "2026-10-18": 8, "2026-10-19": 2, "2026-10-20": 2 }, "anchors": { "registered_domains": [ "dothome.co.kr" ], "tags": [ "#Kimsuky" ], "url_path_patterns": [] }, "confidence": "medium", "context": "Subdomains of the dothome.co.kr free hosting domain, such as outlook365livee, portalmsn365 and instagram, are tagged Kimsuky, C2 and phishing. Enrichment describes Microsoft 365 and Outlook credential phishing, an Instagram phishing page and a C2 host. Three reporters flagged 14 IOCs from 2026-09-29 to 2026-10-20.", "enriched_count": 14, "families": {}, "first_seen": "2026-09-29", "history": { "by_pattern": [], "domains_365d": 1, "first_seen_365d": "2026-04-14", "iocs_365d": 24, "iocs_before_window": 10, "last_seen_365d": "2026-10-20", "window_days": 365 }, "id": "tfc-ae23c8f867dc", "ioc_count": 14, "ioc_count_1d": 2, "ioc_count_30d": 14, "ioc_count_7d": 12, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 07:01:37", "tags": [ "#phishing" ], "tweet": "https://x.com/phishunt_io/status/2112439076120928419", "type": "domain", "user": "phishunt_io", "value": "instagram.dothome.co.kr" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 07:01:37", "tags": [ "#phishing" ], "tweet": "https://x.com/phishunt_io/status/2112439076120928419", "type": "url", "user": "phishunt_io", "value": "http://instagram.dothome.co.kr" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 17:01:20", "tags": [ "#phishing" ], "tweet": "https://x.com/phishunt_io/status/2112227610121969834", "type": "domain", "user": "phishunt_io", "value": "outlook365livee.dothome.co.kr" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 17:01:20", "tags": [ "#phishing" ], "tweet": "https://x.com/phishunt_io/status/2112227610121969834", "type": "url", "user": "phishunt_io", "value": "http://outlook365livee.dothome.co.kr" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-18 16:54:27", "tags": [ "#Kimsuky" ], "tweet": "https://x.com/curious_drac0/status/2111863490621354029", "type": "domain", "user": "curious_drac0", "value": "renovar365.dothome.co.kr" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-18 16:54:27", "tags": [ "#Kimsuky" ], "tweet": "https://x.com/curious_drac0/status/2111863490621354029", "type": "domain", "user": "curious_drac0", "value": "portalmsn365.dothome.co.kr" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-18 16:54:27", "tags": [ "#Kimsuky" ], "tweet": "https://x.com/curious_drac0/status/2111863490621354029", "type": "domain", "user": "curious_drac0", "value": "outlook365livee.dothome.co.kr" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-18 16:54:27", "tags": [ "#Kimsuky" ], "tweet": "https://x.com/curious_drac0/status/2111863490621354029", "type": "domain", "user": "curious_drac0", "value": "liveeee365.dothome.co.kr" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-18 16:54:27", "tags": [ "#Kimsuky" ], "tweet": "https://x.com/curious_drac0/status/2111863490621354029", "type": "url", "user": "curious_drac0", "value": "http://renovar365.dothome.co.kr" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-18 16:54:27", "tags": [ "#Kimsuky" ], "tweet": "https://x.com/curious_drac0/status/2111863490621354029", "type": "url", "user": "curious_drac0", "value": "http://portalmsn365.dothome.co.kr" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-18 16:54:27", "tags": [ "#Kimsuky" ], "tweet": "https://x.com/curious_drac0/status/2111863490621354029", "type": "url", "user": "curious_drac0", "value": "http://outlook365livee.dothome.co.kr" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-18 16:54:27", "tags": [ "#Kimsuky" ], "tweet": "https://x.com/curious_drac0/status/2111863490621354029", "type": "url", "user": "curious_drac0", "value": "http://liveeee365.dothome.co.kr" }, { "ai": { "threat_type": "c2" }, "date": "2026-09-29 00:07:13", "tags": [ "#C2", "#Kimsuky" ], "tweet": "https://x.com/cyberwar_15/status/2104724643420754209", "type": "domain", "user": "cyberwar_15", "value": "oppsite.dothome.co.kr" }, { "ai": { "threat_type": "c2" }, "date": "2026-09-29 00:07:13", "tags": [ "#C2", "#Kimsuky" ], "tweet": "https://x.com/cyberwar_15/status/2104724643420754209", "type": "url", "user": "cyberwar_15", "value": "https://oppsite.dothome.co.kr" } ], "last_seen": "2026-10-20", "member_cluster_ids": [ "tfc-ae23c8f867dc" ], "name": "Kimsuky Microsoft 365 phishing on dothome.co.kr subdomains", "related": { "checked_at": "2026-10-21T06:28:10Z", "match_count": 1, "matches": [ { "asn": "AS4766", "company": "santander", "domain": "santander2026.dothome.co.kr", "match": "exact" } ], "source": "phishunt.io" }, "reporters": [ "curious_drac0", "cyberwar_15", "phishunt_io" ], "tags": [ "#C2", "#Kimsuky", "#phishing" ], "targeted_brand": "Microsoft", "targeted_country": null, "targeted_sector": "technology", "threat_types": { "c2": 2, "phishing": 12 }, "ttps": [ "T1684.001", "T1071.001" ], "types": { "domain": 7, "url": 7 } }, { "activity": { "2026-10-20": 14 }, "anchors": { "registered_domains": [ "iojdao.com", "nlpbxc.com", "power-lk.com", "regvz88i.com", "rioecommerce.com", "smt7mlj.pro", "syzing.com" ], "tags": [], "url_path_patterns": [ "/bplbfldb" ] }, "confidence": "medium", "context": "Seven domains such as iojdao.com, power-lk.com and smt7mlj.pro serve the same /bplbfldb/ path with mysmbc, mitsuiapp and api.mitsui subdomains. Enrichment describes SMBC and Mitsui Sumitomo card phishing on a shared IP. One reporter (KesaGataMe0) flagged 14 IOCs on 2026-10-20.", "enriched_count": 14, "families": {}, "first_seen": "2026-10-20", "history": { "by_pattern": [], "domains_365d": 7, "first_seen_365d": "2026-10-20", "iocs_365d": 14, "iocs_before_window": 0, "last_seen_365d": "2026-10-20", "window_days": 365 }, "id": "tfc-d934c8f96d02", "ioc_count": 14, "ioc_count_1d": 0, "ioc_count_30d": 14, "ioc_count_7d": 14, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:59:23", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112423415563039186", "type": "domain", "user": "KesaGataMe0", "value": "mysmbc.iojdao.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:59:23", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112423415563039186", "type": "domain", "user": "KesaGataMe0", "value": "mitsuiapp.rioecommerce.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:59:23", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112423415563039186", "type": "domain", "user": "KesaGataMe0", "value": "mitsuiapp.regvz88i.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:59:23", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112423415563039186", "type": "domain", "user": "KesaGataMe0", "value": "mitsuiapp.power-lk.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:59:23", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112423415563039186", "type": "domain", "user": "KesaGataMe0", "value": "mitsuiapp.nlpbxc.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:59:23", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112423415563039186", "type": "url", "user": "KesaGataMe0", "value": "https://mysmbc.iojdao.com/bplbfldb/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:59:23", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112423415563039186", "type": "url", "user": "KesaGataMe0", "value": "https://mitsuiapp.rioecommerce.com/bplbfldb/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:59:23", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112423415563039186", "type": "url", "user": "KesaGataMe0", "value": "https://mitsuiapp.regvz88i.com/bplbfldb/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:59:23", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112423415563039186", "type": "url", "user": "KesaGataMe0", "value": "https://mitsuiapp.power-lk.com/bplbfldb/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:59:23", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112423415563039186", "type": "url", "user": "KesaGataMe0", "value": "https://mitsuiapp.nlpbxc.com/bplbfldb/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:59:23", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112423415563039186", "type": "url", "user": "KesaGataMe0", "value": "https://api.mitsui.syzing.com/bplbfldb/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:59:23", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112423415563039186", "type": "url", "user": "KesaGataMe0", "value": "https://api.mitsui.smt7mlj.pro/bplbfldb/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:59:23", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112423415563039186", "type": "domain", "user": "KesaGataMe0", "value": "api.mitsui.syzing.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:59:23", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112423415563039186", "type": "domain", "user": "KesaGataMe0", "value": "api.mitsui.smt7mlj.pro" } ], "last_seen": "2026-10-20", "member_cluster_ids": [ "tfc-d934c8f96d02" ], "name": "SMBC and Mitsui card phishing on random domains with /bplbfldb path", "reporters": [ "KesaGataMe0" ], "tags": [], "targeted_brand": "Mitsui Sumitomo Card", "targeted_country": "JP", "targeted_sector": "financial-services", "threat_types": { "phishing": 14 }, "ttps": [ "T1583.001", "T1684.001", "T1566.002" ], "types": { "domain": 7, "url": 7 } }, { "activity": { "2026-10-19": 12 }, "anchors": { "registered_domains": [ "btrf36.cc", "cslt168.com", "ypnfeo.cc" ], "tags": [], "url_path_patterns": [] }, "confidence": "medium", "context": "Two .cc domains serve the same /hx path and are tagged with the darksword family by enrichment, alongside subdomains of cslt168.com named after shop brands (walkingpad, ooni, earthbuddypet). Enrichment describes a DarkSword-related iOS exploit kit injected into PrestaShop and WordPress shops through a hidden iframe, beaconing to these domains, with 40+ domains serving identical kit files. Reporter 0xDanielLopez flagged IOCs on 2026-10-19.", "enriched_count": 12, "families": { "DarkSword": 12 }, "first_seen": "2026-10-19", "history": { "by_pattern": [], "domains_365d": 3, "first_seen_365d": "2026-10-19", "iocs_365d": 12, "iocs_before_window": 0, "last_seen_365d": "2026-10-19", "window_days": 365 }, "id": "tfc-2bfc74aad3a6", "ioc_count": 12, "ioc_count_1d": 0, "ioc_count_30d": 12, "ioc_count_7d": 12, "iocs": [ { "ai": { "family": "DarkSword", "threat_type": "malware" }, "date": "2026-10-19 21:28:27", "tags": [], "tweet": "https://x.com/0xDanielLopez/status/2112294833557577834", "type": "domain", "user": "0xDanielLopez", "value": "walkingpad.cslt168.com" }, { "ai": { "family": "DarkSword", "threat_type": "malware" }, "date": "2026-10-19 21:28:27", "tags": [], "tweet": "https://x.com/0xDanielLopez/status/2112294833557577834", "type": "domain", "user": "0xDanielLopez", "value": "ooni.cslt168.com" }, { "ai": { "family": "DarkSword", "threat_type": "vulnerability" }, "date": "2026-10-19 21:28:27", "tags": [], "tweet": "https://x.com/0xDanielLopez/status/2112294833557577834", "type": "url", "user": "0xDanielLopez", "value": "https://ypnfeo.cc/hx" }, { "ai": { "family": "DarkSword", "threat_type": "vulnerability" }, "date": "2026-10-19 21:28:27", "tags": [], "tweet": "https://x.com/0xDanielLopez/status/2112294833557577834", "type": "url", "user": "0xDanielLopez", "value": "https://btrf36.cc/hx" }, { "ai": { "family": "DarkSword", "threat_type": "malware" }, "date": "2026-10-19 21:28:27", "tags": [], "tweet": "https://x.com/0xDanielLopez/status/2112294833557577834", "type": "url", "user": "0xDanielLopez", "value": "http://walkingpad.cslt168.com" }, { "ai": { "family": "DarkSword", "threat_type": "malware" }, "date": "2026-10-19 21:28:27", "tags": [], "tweet": "https://x.com/0xDanielLopez/status/2112294833557577834", "type": "url", "user": "0xDanielLopez", "value": "http://ooni.cslt168.com" }, { "ai": { "family": "DarkSword", "threat_type": "malware" }, "date": "2026-10-19 21:28:27", "tags": [], "tweet": "https://x.com/0xDanielLopez/status/2112294833557577834", "type": "url", "user": "0xDanielLopez", "value": "http://earthbuddypet.cslt168.com" }, { "ai": { "family": "DarkSword", "threat_type": "malware" }, "date": "2026-10-19 21:28:27", "tags": [], "tweet": "https://x.com/0xDanielLopez/status/2112294833557577834", "type": "domain", "user": "0xDanielLopez", "value": "earthbuddypet.cslt168.com" }, { "ai": { "family": "DarkSword", "threat_type": "vulnerability" }, "date": "2026-10-19 21:10:41", "tags": [], "tweet": "https://x.com/0xDanielLopez/status/2112290363540938907", "type": "domain", "user": "0xDanielLopez", "value": "ypnfeo.cc" }, { "ai": { "family": "DarkSword", "threat_type": "vulnerability" }, "date": "2026-10-19 21:10:41", "tags": [], "tweet": "https://x.com/0xDanielLopez/status/2112290363540938907", "type": "url", "user": "0xDanielLopez", "value": "http://ypnfeo.cc/hx" }, { "ai": { "family": "DarkSword", "threat_type": "vulnerability" }, "date": "2026-10-19 21:10:41", "tags": [], "tweet": "https://x.com/0xDanielLopez/status/2112290363540938907", "type": "url", "user": "0xDanielLopez", "value": "http://btrf36.cc/hx" }, { "ai": { "family": "DarkSword", "threat_type": "vulnerability" }, "date": "2026-10-19 21:10:41", "tags": [], "tweet": "https://x.com/0xDanielLopez/status/2112290363540938907", "type": "domain", "user": "0xDanielLopez", "value": "btrf36.cc" } ], "last_seen": "2026-10-19", "member_cluster_ids": [ "tfc-2bfc74aad3a6", "tfc-5a9b71453a0a", "tfc-0674151a8258" ], "name": "DarkSword iOS exploit kit beacons on btrf36.cc, ypnfeo.cc and cslt168.com", "reporters": [ "0xDanielLopez" ], "tags": [], "targeted_brand": null, "targeted_country": null, "targeted_sector": null, "threat_types": { "malware": 6, "vulnerability": 6 }, "ttps": [ "T1583.001" ], "types": { "domain": 5, "url": 7 } }, { "activity": { "2026-09-26": 4, "2026-09-27": 4, "2026-10-16": 4 }, "anchors": { "registered_domains": [ "canabit.ai", "canabit.ca" ], "tags": [ "#cryptoscam" ], "url_path_patterns": [] }, "confidence": "medium", "context": "Canabit.ai and canabit.ca are tagged #cryptoscam and #scam. Enrichment cites an investment warning urging verification before committing funds. Two reporters flagged these IOCs from 2026-09-26 to 2026-10-16.", "enriched_count": 12, "families": {}, "first_seen": "2026-09-26", "history": { "by_pattern": [], "domains_365d": 2, "first_seen_365d": "2026-09-26", "iocs_365d": 12, "iocs_before_window": 0, "last_seen_365d": "2026-10-16", "window_days": 365 }, "id": "tfc-5ad9774c96fb", "ioc_count": 12, "ioc_count_1d": 0, "ioc_count_30d": 12, "ioc_count_7d": 4, "iocs": [ { "ai": { "threat_type": "cryptoscam" }, "date": "2026-10-16 00:12:03", "tags": [ "#scam" ], "tweet": "https://x.com/Wilmichels/status/2110886454897283150", "type": "url", "user": "Wilmichels", "value": "http://Canabit.ca" }, { "ai": { "threat_type": "cryptoscam" }, "date": "2026-10-16 00:12:03", "tags": [ "#scam" ], "tweet": "https://x.com/Wilmichels/status/2110886454897283150", "type": "url", "user": "Wilmichels", "value": "http://Canabit.ai" }, { "ai": { "threat_type": "cryptoscam" }, "date": "2026-10-16 00:12:03", "tags": [ "#scam" ], "tweet": "https://x.com/Wilmichels/status/2110886454897283150", "type": "domain", "user": "Wilmichels", "value": "canabit.ca" }, { "ai": { "threat_type": "cryptoscam" }, "date": "2026-10-16 00:12:03", "tags": [ "#scam" ], "tweet": "https://x.com/Wilmichels/status/2110886454897283150", "type": "domain", "user": "Wilmichels", "value": "canabit.ai" }, { "ai": { "threat_type": "cryptoscam" }, "date": "2026-09-27 02:28:04", "tags": [ "#cryptoscam", "#scam" ], "tweet": "https://x.com/joshuaiancooper/status/2104035314755096726", "type": "url", "user": "joshuaiancooper", "value": "http://Canabit.ca" }, { "ai": { "threat_type": "cryptoscam" }, "date": "2026-09-27 02:28:04", "tags": [ "#cryptoscam", "#scam" ], "tweet": "https://x.com/joshuaiancooper/status/2104035314755096726", "type": "url", "user": "joshuaiancooper", "value": "http://Canabit.ai" }, { "ai": { "threat_type": "cryptoscam" }, "date": "2026-09-27 02:28:04", "tags": [ "#cryptoscam", "#scam" ], "tweet": "https://x.com/joshuaiancooper/status/2104035314755096726", "type": "domain", "user": "joshuaiancooper", "value": "canabit.ca" }, { "ai": { "threat_type": "cryptoscam" }, "date": "2026-09-27 02:28:04", "tags": [ "#cryptoscam", "#scam" ], "tweet": "https://x.com/joshuaiancooper/status/2104035314755096726", "type": "domain", "user": "joshuaiancooper", "value": "canabit.ai" }, { "ai": { "threat_type": "cryptoscam" }, "date": "2026-09-26 09:14:42", "tags": [ "#cryptoscam", "#scam" ], "tweet": "https://x.com/Wilmichels/status/2103775259568599393", "type": "url", "user": "Wilmichels", "value": "http://Canabit.ca" }, { "ai": { "threat_type": "cryptoscam" }, "date": "2026-09-26 09:14:42", "tags": [ "#cryptoscam", "#scam" ], "tweet": "https://x.com/Wilmichels/status/2103775259568599393", "type": "url", "user": "Wilmichels", "value": "http://Canabit.ai" }, { "ai": { "threat_type": "cryptoscam" }, "date": "2026-09-26 09:14:42", "tags": [ "#cryptoscam", "#scam" ], "tweet": "https://x.com/Wilmichels/status/2103775259568599393", "type": "domain", "user": "Wilmichels", "value": "canabit.ca" }, { "ai": { "threat_type": "cryptoscam" }, "date": "2026-09-26 09:14:42", "tags": [ "#cryptoscam", "#scam" ], "tweet": "https://x.com/Wilmichels/status/2103775259568599393", "type": "domain", "user": "Wilmichels", "value": "canabit.ai" } ], "last_seen": "2026-10-16", "member_cluster_ids": [ "tfc-5ad9774c96fb", "tfc-cedf787a27b5" ], "name": "Canabit crypto investment scam on .ai and .ca domains", "reporters": [ "Wilmichels", "joshuaiancooper" ], "tags": [ "#cryptoscam", "#scam" ], "targeted_brand": null, "targeted_country": null, "targeted_sector": null, "threat_types": { "cryptoscam": 12 }, "ttps": [ "T1657" ], "types": { "domain": 6, "url": 6 } }, { "activity": { "2026-09-27": 2, "2026-10-07": 4, "2026-10-08": 2, "2026-10-09": 2, "2026-10-20": 2 }, "anchors": { "registered_domains": [ "abcasdb.study", "brejksa.study", "i0tjgjgm.xyz", "qweaxfgtc.study", "sdueioy.study", "ualf53oo.xyz" ], "tags": [], "url_path_patterns": [ "/KnaeByNf" ] }, "confidence": "medium", "context": "Four .study domains and two .xyz domains serve pages at the same /KnaeByNf/ path. Enrichment describes Docomo d Account impersonation aimed at Japanese users. Three reporters flagged 12 IOCs from 2026-09-27 to 2026-10-20.", "enriched_count": 12, "families": {}, "first_seen": "2026-09-27", "history": { "by_pattern": [], "domains_365d": 6, "first_seen_365d": "2026-09-27", "iocs_365d": 12, "iocs_before_window": 0, "last_seen_365d": "2026-10-20", "window_days": 365 }, "id": "tfc-f2bea031d06f", "ioc_count": 12, "ioc_count_1d": 0, "ioc_count_30d": 12, "ioc_count_7d": 2, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 03:50:08", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2112390886885843380", "type": "domain", "user": "masaomi346", "value": "ualf53oo.xyz" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 03:50:08", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2112390886885843380", "type": "url", "user": "masaomi346", "value": "https://ualf53oo.xyz/KnaeByNf/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-09 04:39:16", "tags": [ "#phishing" ], "tweet": "https://x.com/Metemcyber/status/2108416986963415061", "type": "domain", "user": "Metemcyber", "value": "qweaxfgtc.study" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-09 04:39:16", "tags": [ "#phishing" ], "tweet": "https://x.com/Metemcyber/status/2108416986963415061", "type": "url", "user": "Metemcyber", "value": "https://qweaxfgtc.study/KnaeByNf/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-08 04:12:59", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2108047982860091756", "type": "url", "user": "masaomi346", "value": "https://brejksa.study/KnaeByNf/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-08 04:12:59", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2108047982860091756", "type": "domain", "user": "masaomi346", "value": "brejksa.study" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-07 04:24:09", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2107688407032062290", "type": "domain", "user": "masaomi346", "value": "sdueioy.study" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-07 04:24:09", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2107688407032062290", "type": "url", "user": "masaomi346", "value": "https://sdueioy.study/KnaeByNf/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-07 01:22:56", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2107642801601294739", "type": "url", "user": "masaomi346", "value": "https://abcasdb.study/KnaeByNf/" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-07 01:22:56", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2107642801601294739", "type": "domain", "user": "masaomi346", "value": "abcasdb.study" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-27 19:39:39", "tags": [ "#phishing" ], "tweet": "https://x.com/PhishStats/status/2104294921066934411", "type": "domain", "user": "PhishStats", "value": "i0tjgjgm.xyz" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-27 19:39:39", "tags": [ "#phishing" ], "tweet": "https://x.com/PhishStats/status/2104294921066934411", "type": "url", "user": "PhishStats", "value": "https://i0tjgjgm.xyz/KnaeByNf/" } ], "last_seen": "2026-10-20", "member_cluster_ids": [ "tfc-f2bea031d06f" ], "name": "Docomo phishing on random .study/.xyz domains with /KnaeByNf path", "reporters": [ "Metemcyber", "PhishStats", "masaomi346" ], "tags": [ "#phishing" ], "targeted_brand": "NTT Docomo", "targeted_country": "JP", "targeted_sector": "telecommunications", "threat_types": { "phishing": 12 }, "ttps": [ "T1583.001", "T1566.002" ], "types": { "domain": 6, "url": 6 } }, { "activity": { "2026-10-13": 3, "2026-10-17": 8 }, "anchors": { "registered_domains": [ "salator.es", "websalat.top", "wruser.org" ], "tags": [ "#SalatStealer" ], "url_path_patterns": [] }, "confidence": "medium", "context": "Domains wruser.org, salator.es and websalat.top, plus IP 176.12.71.122 and a sample hash, are tagged SalatStealer. Enrichment says TLS certificates link the IP to the rotating C2 domains. Two reporters flagged 11 IOCs from 2026-10-13 to 2026-10-17.", "enriched_count": 11, "families": { "SalatStealer": 11 }, "first_seen": "2026-10-13", "history": { "by_pattern": [], "domains_365d": 3, "first_seen_365d": "2026-10-17", "iocs_365d": 6, "iocs_before_window": 0, "last_seen_365d": "2026-10-17", "window_days": 365 }, "id": "tfc-5ce40d906d89", "infra": [ { "country": "RU", "ip_count": 1, "org": "AS29182 JSC IOT" } ], "ioc_count": 11, "ioc_count_1d": 0, "ioc_count_30d": 11, "ioc_count_7d": 8, "iocs": [ { "ai": { "family": "SalatStealer", "threat_type": "c2" }, "date": "2026-10-17 12:12:18", "tags": [ "#SalatStealer", "#infostealer" ], "tweet": "https://x.com/Huntbackio/status/2111430099538948116", "type": "domain", "user": "Huntbackio", "value": "wruser.org" }, { "ai": { "family": "SalatStealer", "threat_type": "c2" }, "date": "2026-10-17 12:12:18", "tags": [ "#SalatStealer", "#infostealer" ], "tweet": "https://x.com/Huntbackio/status/2111430099538948116", "type": "domain", "user": "Huntbackio", "value": "websalat.top" }, { "ai": { "family": "SalatStealer", "threat_type": "c2" }, "date": "2026-10-17 12:12:18", "tags": [ "#SalatStealer", "#infostealer" ], "tweet": "https://x.com/Huntbackio/status/2111430099538948116", "type": "domain", "user": "Huntbackio", "value": "salator.es" }, { "ai": { "family": "SalatStealer", "threat_type": "c2" }, "date": "2026-10-17 12:12:18", "tags": [ "#SalatStealer", "#infostealer" ], "tweet": "https://x.com/Huntbackio/status/2111430099538948116", "type": "url", "user": "Huntbackio", "value": "http://wruser.org" }, { "ai": { "family": "SalatStealer", "threat_type": "c2" }, "date": "2026-10-17 12:12:18", "tags": [ "#SalatStealer", "#infostealer" ], "tweet": "https://x.com/Huntbackio/status/2111430099538948116", "type": "url", "user": "Huntbackio", "value": "http://websalat.top" }, { "ai": { "family": "SalatStealer", "threat_type": "c2" }, "date": "2026-10-17 12:12:18", "tags": [ "#SalatStealer", "#infostealer" ], "tweet": "https://x.com/Huntbackio/status/2111430099538948116", "type": "url", "user": "Huntbackio", "value": "http://salator.es" }, { "ai": { "family": "SalatStealer", "threat_type": "malware" }, "date": "2026-10-17 12:12:18", "tags": [ "#SalatStealer", "#infostealer" ], "tweet": "https://x.com/Huntbackio/status/2111430099538948116", "type": "url", "user": "Huntbackio", "value": "http://176.12.71.122" }, { "ai": { "family": "SalatStealer", "threat_type": "malware" }, "date": "2026-10-17 12:12:18", "net": { "country": "RU", "org": "AS29182 JSC IOT" }, "tags": [ "#SalatStealer", "#infostealer" ], "tweet": "https://x.com/Huntbackio/status/2111430099538948116", "type": "ip", "user": "Huntbackio", "value": "176.12.71.122" }, { "ai": { "family": "SalatStealer", "threat_type": "malware" }, "date": "2026-10-13 10:16:57", "tags": [ "#SalatStealer" ], "tweet": "https://x.com/smica83/status/2109951516878549366", "type": "url", "user": "smica83", "value": "http://176.12.71.122" }, { "ai": { "family": "SalatStealer", "threat_type": "malware" }, "date": "2026-10-13 10:16:57", "tags": [ "#SalatStealer" ], "tweet": "https://x.com/smica83/status/2109951516878549366", "type": "sha256", "user": "smica83", "value": "f07ebd2b3b30f1325026af3ff8bd523f0a6833796ef11e3380f2090864e9c1b2" }, { "ai": { "family": "SalatStealer", "threat_type": "malware" }, "date": "2026-10-13 10:16:57", "net": { "country": "RU", "org": "AS29182 JSC IOT" }, "tags": [ "#SalatStealer" ], "tweet": "https://x.com/smica83/status/2109951516878549366", "type": "ip", "user": "smica83", "value": "176.12.71.122" } ], "last_seen": "2026-10-17", "member_cluster_ids": [ "tfc-5ce40d906d89" ], "name": "SalatStealer C2 domains and IP on rotating infrastructure", "reporters": [ "Huntbackio", "smica83" ], "tags": [ "#SalatStealer", "#infostealer" ], "targeted_brand": null, "targeted_country": null, "targeted_sector": null, "threat_types": { "c2": 6, "malware": 5 }, "ttps": [ "T1588.001", "T1583.001" ], "types": { "domain": 3, "ip": 2, "sha256": 1, "url": 5 } }, { "activity": { "2026-09-23": 2, "2026-09-28": 2, "2026-09-30": 2, "2026-10-16": 3, "2026-10-17": 2 }, "anchors": { "registered_domains": [ "mygamesonline.org", "scienceontheweb.net" ], "tags": [ "#Kimsuky" ], "url_path_patterns": [ "/setting.php" ] }, "confidence": "low", "context": "Subdomains on mygamesonline.org and scienceontheweb.net are tagged Kimsuky and serve /setting.php with host and user name parameters. Enrichment links them to a Korean-named health checkup LNK lure. Three reporters flagged 11 IOCs from 2026-09-23 to 2026-10-17.", "enriched_count": 11, "families": {}, "first_seen": "2026-09-23", "history": { "by_pattern": [], "domains_365d": 2, "first_seen_365d": "2026-08-17", "iocs_365d": 15, "iocs_before_window": 4, "last_seen_365d": "2026-10-17", "window_days": 365 }, "id": "tfc-f0106d21d108", "ioc_count": 11, "ioc_count_1d": 0, "ioc_count_30d": 11, "ioc_count_7d": 5, "iocs": [ { "ai": { "threat_type": "malware" }, "date": "2026-10-17 12:10:49", "tags": [ "#APT" ], "tweet": "https://x.com/byrne_emmy12099/status/2111429723574386756", "type": "url", "user": "byrne_emmy12099", "value": "http://asdkjcn30r9.mygamesonline.org/setting.php" }, { "ai": { "threat_type": "malware" }, "date": "2026-10-17 12:10:49", "tags": [ "#APT" ], "tweet": "https://x.com/byrne_emmy12099/status/2111429723574386756", "type": "domain", "user": "byrne_emmy12099", "value": "asdkjcn30r9.mygamesonline.org" }, { "ai": { "threat_type": "malware" }, "date": "2026-10-16 22:04:23", "tags": [], "tweet": "https://x.com/smica83/status/2111216711831810173", "type": "url", "user": "smica83", "value": "http://asdkjcn30r9.mygamesonline.org/setting.php?aaaaaa=DESKTOP-ET51AJO&bbbbbb=Bruno&cccccc=alpha" }, { "ai": { "threat_type": "malware" }, "date": "2026-10-16 05:49:40", "tags": [ "#Kimsuky" ], "tweet": "https://x.com/copy_and_paster/status/2110971416963326442", "type": "url", "user": "copy_and_paster", "value": "http://asdkjcn30r9.mygamesonline.org" }, { "ai": { "threat_type": "malware" }, "date": "2026-10-16 05:49:40", "tags": [ "#Kimsuky" ], "tweet": "https://x.com/copy_and_paster/status/2110971416963326442", "type": "domain", "user": "copy_and_paster", "value": "asdkjcn30r9.mygamesonline.org" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-30 13:11:29", "tags": [], "tweet": "https://x.com/smica83/status/2105284398446731348", "type": "domain", "user": "smica83", "value": "xv57j3d.scienceontheweb.net" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-30 13:11:29", "tags": [], "tweet": "https://x.com/smica83/status/2105284398446731348", "type": "url", "user": "smica83", "value": "http://xv57j3d.scienceontheweb.net/setting.php?aaaaaa=DESKTOP-ET51AJO&bbbbbb=Bruno&cccccc=alpha" }, { "ai": { "threat_type": "other" }, "date": "2026-09-28 00:30:38", "tags": [ "#Kimsuky" ], "tweet": "https://x.com/copy_and_paster/status/2104368146878693602", "type": "domain", "user": "copy_and_paster", "value": "nyqxa4.scienceontheweb.net" }, { "ai": { "threat_type": "other" }, "date": "2026-09-28 00:30:38", "tags": [ "#Kimsuky" ], "tweet": "https://x.com/copy_and_paster/status/2104368146878693602", "type": "url", "user": "copy_and_paster", "value": "http://nyqxa4.scienceontheweb.net" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-23 04:18:25", "tags": [ "#Kimsuky" ], "tweet": "https://x.com/copy_and_paster/status/2102613534228300007", "type": "domain", "user": "copy_and_paster", "value": "xv57j3d.scienceontheweb.net" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-23 04:18:25", "tags": [ "#Kimsuky" ], "tweet": "https://x.com/copy_and_paster/status/2102613534228300007", "type": "url", "user": "copy_and_paster", "value": "http://xv57j3d.scienceontheweb.net" } ], "last_seen": "2026-10-17", "member_cluster_ids": [ "tfc-f0106d21d108" ], "name": "Kimsuky setting.php beacons on free-hosting subdomains", "reporters": [ "byrne_emmy12099", "copy_and_paster", "smica83" ], "tags": [ "#APT", "#Kimsuky" ], "targeted_brand": null, "targeted_country": null, "targeted_sector": null, "threat_types": { "malware": 9, "other": 2 }, "ttps": [ "T1583.006" ], "types": { "domain": 5, "url": 6 } }, { "activity": { "2026-09-22": 2, "2026-09-29": 2, "2026-10-03": 2, "2026-10-14": 2, "2026-10-16": 2 }, "anchors": { "registered_domains": [ "harborstonegroup.shop" ], "tags": [], "url_path_patterns": [] }, "confidence": "low", "context": "Enrichment describes a loan-verification phishing lure sent from mortgageclearbrook.info that points to harborstonegroup.shop. One reporter (TKemmerling) flagged 10 IOCs from 2026-09-22 to 2026-10-16, all tagged #phishing.", "enriched_count": 10, "families": {}, "first_seen": "2026-09-22", "history": { "by_pattern": [], "domains_365d": 1, "first_seen_365d": "2026-09-09", "iocs_365d": 14, "iocs_before_window": 4, "last_seen_365d": "2026-10-16", "window_days": 365 }, "id": "tfc-3b8b639332da", "ioc_count": 10, "ioc_count_1d": 0, "ioc_count_30d": 10, "ioc_count_7d": 2, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-16 21:58:08", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2111215138552574004", "type": "url", "user": "TKemmerling", "value": "http://harborstonegroup.shop" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-16 21:58:08", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2111215138552574004", "type": "domain", "user": "TKemmerling", "value": "harborstonegroup.shop" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-14 01:58:47", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2110188536234447094", "type": "url", "user": "TKemmerling", "value": "http://harborstonegroup.shop" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-14 01:58:47", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2110188536234447094", "type": "domain", "user": "TKemmerling", "value": "harborstonegroup.shop" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-03 01:53:17", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2106200887240859805", "type": "url", "user": "TKemmerling", "value": "http://harborstonegroup.shop" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-03 01:53:17", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2106200887240859805", "type": "domain", "user": "TKemmerling", "value": "harborstonegroup.shop" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-29 15:46:47", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2104961092757987331", "type": "url", "user": "TKemmerling", "value": "http://harborstonegroup.shop" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-29 15:46:47", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2104961092757987331", "type": "domain", "user": "TKemmerling", "value": "harborstonegroup.shop" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-22 11:50:26", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2102364899058057621", "type": "url", "user": "TKemmerling", "value": "http://harborstonegroup.shop" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-22 11:50:26", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2102364899058057621", "type": "domain", "user": "TKemmerling", "value": "harborstonegroup.shop" } ], "last_seen": "2026-10-16", "member_cluster_ids": [ "tfc-3b8b639332da" ], "name": "Loan-verification phishing via harborstonegroup.shop", "reporters": [ "TKemmerling" ], "tags": [ "#phishing" ], "targeted_brand": null, "targeted_country": null, "targeted_sector": null, "threat_types": { "phishing": 10 }, "ttps": [ "T1583.001" ], "types": { "domain": 5, "url": 5 } }, { "activity": { "2026-09-22": 2, "2026-10-13": 2, "2026-10-15": 2, "2026-10-17": 2, "2026-10-18": 2 }, "anchors": { "registered_domains": [ "truenorthworks.fun" ], "tags": [], "url_path_patterns": [] }, "confidence": "low", "context": "Enrichment describes an Americor debt-relief lure sent from portfoliomoneyline.com that links to truenorthworks.fun, flagged by threat intelligence providers. Reporter TKemmerling flagged 10 IOCs from 2026-09-22 to 2026-10-18, all tagged #phishing.", "enriched_count": 10, "families": {}, "first_seen": "2026-09-22", "history": { "by_pattern": [], "domains_365d": 1, "first_seen_365d": "2026-09-09", "iocs_365d": 16, "iocs_before_window": 6, "last_seen_365d": "2026-10-18", "window_days": 365 }, "id": "tfc-4545fa78ef03", "ioc_count": 10, "ioc_count_1d": 0, "ioc_count_30d": 10, "ioc_count_7d": 6, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-18 22:05:11", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2111941688327557325", "type": "domain", "user": "TKemmerling", "value": "truenorthworks.fun" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-18 22:05:11", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2111941688327557325", "type": "url", "user": "TKemmerling", "value": "http://truenorthworks.fun" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-17 21:59:52", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2111577962156007931", "type": "domain", "user": "TKemmerling", "value": "truenorthworks.fun" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-17 21:59:52", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2111577962156007931", "type": "url", "user": "TKemmerling", "value": "http://truenorthworks.fun" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-15 00:56:41", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2110535297499037806", "type": "domain", "user": "TKemmerling", "value": "truenorthworks.fun" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-15 00:56:41", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2110535297499037806", "type": "url", "user": "TKemmerling", "value": "http://truenorthworks.fun" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-13 23:04:57", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2110144791313010852", "type": "domain", "user": "TKemmerling", "value": "truenorthworks.fun" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-13 23:04:57", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2110144791313010852", "type": "url", "user": "TKemmerling", "value": "http://truenorthworks.fun" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-22 12:22:59", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2102373091750093175", "type": "domain", "user": "TKemmerling", "value": "truenorthworks.fun" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-22 12:22:59", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2102373091750093175", "type": "url", "user": "TKemmerling", "value": "http://truenorthworks.fun" } ], "last_seen": "2026-10-18", "member_cluster_ids": [ "tfc-4545fa78ef03" ], "name": "Bad credit lending phishing via truenorthworks.fun", "reporters": [ "TKemmerling" ], "tags": [ "#phishing" ], "targeted_brand": "Americor", "targeted_country": null, "targeted_sector": "financial-services", "threat_types": { "phishing": 10 }, "ttps": [ "T1583.001" ], "types": { "domain": 5, "url": 5 } }, { "activity": { "2026-10-07": 1, "2026-10-08": 2, "2026-10-16": 6, "2026-10-19": 1 }, "anchors": { "registered_domains": [ "share.google" ], "tags": [], "url_path_patterns": [ "/NONdaNJLwxYGNGiMN", "/NONdaNJLwxYGNGiMN&source=gmail&ust=N&usg=AOvVawNmqhUsfdNGkKtNQQarOdO", "/NSOcLGpLBcyNaacIu", "/QHaVAHYezQEEkXXab", "/VVTNByPZBsKoTFyLV", "/VVTNByPZBsKoTFyLV&source=gmail&ust=N&usg=AOvVawNICXKBy-NwnasCHkxpRzJh", "/XpDwUYNwrNgBIJQ", "/xNylDnCpTrclOeMNI" ] }, "confidence": "low", "context": "Malware emails, including Japanese-language ones, use share.google short URLs that lead to downloads. Enrichment tags chains as PureLogs and PureRAT and names content.wordwalkers.co.nz as a download host. Three reporters flagged 10 IOCs from 2026-10-07 to 2026-10-19.", "enriched_count": 10, "families": { "PureLogs": 4, "PureRAT": 2 }, "first_seen": "2026-10-07", "history": { "by_pattern": [], "domains_365d": 1, "first_seen_365d": "2026-02-23", "iocs_365d": 22, "iocs_before_window": 12, "last_seen_365d": "2026-10-19", "window_days": 365 }, "id": "tfc-a9e8e25613bb", "ioc_count": 10, "ioc_count_1d": 0, "ioc_count_30d": 10, "ioc_count_7d": 7, "iocs": [ { "ai": { "threat_type": "malware" }, "date": "2026-10-19 11:25:07", "tags": [], "tweet": "https://x.com/bomccss/status/2112143000361218342", "type": "url", "user": "bomccss", "value": "https://share.google/XpDwUY4wr618gBIJQ" }, { "ai": { "family": "PureRAT", "threat_type": "malware" }, "date": "2026-10-16 11:05:03", "tags": [], "tweet": "https://x.com/bomccss/status/2111050786839175513", "type": "url", "user": "bomccss", "value": "https://share.google/QHaVAHYezQEEkXXab" }, { "ai": { "family": "PureRAT", "threat_type": "malware" }, "date": "2026-10-16 07:40:26", "tags": [], "tweet": "https://x.com/tdatwja/status/2110999292425216435", "type": "url", "user": "tdatwja", "value": "http://share.google/QHaVAHYezQEEkXXab" }, { "ai": { "family": "PureLogs", "threat_type": "malware" }, "date": "2026-10-16 06:46:40", "tags": [], "tweet": "https://x.com/tdatwja/status/2110985762032501167", "type": "url", "user": "tdatwja", "value": "http://share.google/5O0da0JLwxYG9GiM0&source=gmail&ust=1792020229421000&usg=AOvVaw2mqhUsfd75GkKt8QQarOdO" }, { "ai": { "family": "PureLogs", "threat_type": "malware" }, "date": "2026-10-16 06:46:40", "tags": [], "tweet": "https://x.com/tdatwja/status/2110985762032501167", "type": "url", "user": "tdatwja", "value": "http://share.google/5O0da0JLwxYG9GiM0" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-16 06:05:21", "tags": [], "tweet": "https://x.com/tdatwja/status/2110975364407439829", "type": "url", "user": "tdatwja", "value": "http://share.google/VVT7ByPZBsKoTFyLV&source=gmail&ust=1792020319700000&usg=AOvVaw3ICXKBy-9wnasCHkxpRzJh" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-16 06:05:21", "tags": [], "tweet": "https://x.com/tdatwja/status/2110975364407439829", "type": "url", "user": "tdatwja", "value": "http://share.google/VVT7ByPZBsKoTFyLV" }, { "ai": { "family": "PureLogs", "threat_type": "malware" }, "date": "2026-10-08 05:58:55", "tags": [], "tweet": "https://x.com/bomccss/status/2108074644045754866", "type": "url", "user": "bomccss", "value": "https://share.google/6SOcLGpLBcy9aacIu" }, { "ai": { "family": "PureLogs", "threat_type": "malware" }, "date": "2026-10-08 04:19:58", "tags": [], "tweet": "https://x.com/tdatwja/status/2108049742458691661", "type": "url", "user": "tdatwja", "value": "http://share.google/6SOcLGpLBcy9aacIu" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-07 06:15:16", "tags": [ "#phishing" ], "tweet": "https://x.com/romonlyht/status/2107716369232130512", "type": "url", "user": "romonlyht", "value": "https://share.google/x9ylDnCpTrclOeM7I" } ], "last_seen": "2026-10-19", "member_cluster_ids": [ "tfc-a9e8e25613bb" ], "name": "Malspam with share.google links to downloads", "reporters": [ "bomccss", "romonlyht", "tdatwja" ], "tags": [ "#phishing" ], "targeted_brand": null, "targeted_country": null, "targeted_sector": null, "threat_types": { "malware": 7, "phishing": 3 }, "ttps": [], "types": { "url": 10 } }, { "activity": { "2026-10-01": 3, "2026-10-14": 3, "2026-10-15": 2 }, "anchors": { "registered_domains": [ "rajug.eu", "xo.je" ], "tags": [ "#DPRK" ], "url_path_patterns": [ "/YENBwNzBNtNUNi.php" ] }, "confidence": "medium", "context": "Random-label subdomains of xo.je serve a PHP endpoint tagged C2, APT and DPRK, plus rajug.eu. Enrichment identifies it as a KONNI C2 URL on a free hosting domain and links a Korean-named defense-technology LNK lure. Three reporters flagged 8 IOCs from 2026-10-01 to 2026-10-15.", "enriched_count": 8, "families": { "KONNI": 3 }, "first_seen": "2026-10-01", "history": { "by_pattern": [], "domains_365d": 2, "first_seen_365d": "2025-12-09", "iocs_365d": 21, "iocs_before_window": 14, "last_seen_365d": "2026-10-15", "window_days": 365 }, "id": "tfc-19336502fa27", "ioc_count": 8, "ioc_count_1d": 0, "ioc_count_30d": 8, "ioc_count_7d": 5, "iocs": [ { "ai": { "threat_type": "malware" }, "date": "2026-10-15 22:16:36", "tags": [ "#APT" ], "tweet": "https://x.com/byrne_emmy12099/status/2110857397929714119", "type": "domain", "user": "byrne_emmy12099", "value": "wi20a-1kkan-llam2.xo.je" }, { "ai": { "threat_type": "malware" }, "date": "2026-10-15 22:16:36", "tags": [ "#APT" ], "tweet": "https://x.com/byrne_emmy12099/status/2110857397929714119", "type": "url", "user": "byrne_emmy12099", "value": "https://wi20a-1kkan-llam2.xo.je" }, { "ai": { "family": "KONNI", "threat_type": "c2" }, "date": "2026-10-14 21:50:38", "tags": [ "#APT" ], "tweet": "https://x.com/byrne_emmy12099/status/2110488476777156875", "type": "url", "user": "byrne_emmy12099", "value": "https://iwnw-1knwni-21siw.xo.je" }, { "ai": { "family": "KONNI", "threat_type": "c2" }, "date": "2026-10-14 14:35:57", "tags": [ "#C2", "#DPRK" ], "tweet": "https://x.com/fr0s7_/status/2110379084371067079", "type": "domain", "user": "fr0s7_", "value": "iwnw-1knwni-21siw.xo.je" }, { "ai": { "family": "KONNI", "threat_type": "c2" }, "date": "2026-10-14 14:35:57", "tags": [ "#C2", "#DPRK" ], "tweet": "https://x.com/fr0s7_/status/2110379084371067079", "type": "url", "user": "fr0s7_", "value": "https://iwnw-1knwni-21siw.xo.je/YE97Bw999zB87t1U8i.php" }, { "ai": { "threat_type": "malware" }, "date": "2026-10-01 10:22:29", "tags": [ "#DPRK" ], "tweet": "https://x.com/smica83/status/2105604256757694867", "type": "domain", "user": "smica83", "value": "rajug.eu" }, { "ai": { "threat_type": "malware" }, "date": "2026-10-01 10:22:29", "tags": [ "#DPRK" ], "tweet": "https://x.com/smica83/status/2105604256757694867", "type": "url", "user": "smica83", "value": "http://rajug.eu" }, { "ai": { "threat_type": "malware" }, "date": "2026-10-01 10:22:29", "tags": [ "#DPRK" ], "tweet": "https://x.com/smica83/status/2105604256757694867", "type": "sha256", "user": "smica83", "value": "4f954c7c6228ca4eb0e6b7c3d5f2d025467996866c2d9ae4dd1f005cb6cb1f19" } ], "last_seen": "2026-10-15", "member_cluster_ids": [ "tfc-19336502fa27" ], "name": "KONNI C2 on xo.je free hosting subdomain", "reporters": [ "byrne_emmy12099", "fr0s7_", "smica83" ], "tags": [ "#APT", "#C2", "#DPRK" ], "targeted_brand": null, "targeted_country": null, "targeted_sector": null, "threat_types": { "c2": 3, "malware": 5 }, "ttps": [ "T1071.001" ], "types": { "domain": 3, "sha256": 1, "url": 4 } }, { "activity": { "2026-10-20": 8 }, "anchors": { "registered_domains": [ "japanpostae0.club", "japanpostfup.club", "japanpostmhk.club", "japanpostr7l.club" ], "tags": [], "url_path_patterns": [] }, "confidence": "medium", "context": "Four .club domains named japanpost plus a three-character suffix (japanpostr7l.club, japanpostmhk.club and others) were flagged. Enrichment describes Japan Post phishing hosted on Alibaba infrastructure at one IP. Reporter KesaGataMe0 flagged 8 IOCs on 2026-10-20.", "enriched_count": 8, "families": {}, "first_seen": "2026-10-20", "history": { "by_pattern": [], "domains_365d": 4, "first_seen_365d": "2026-10-20", "iocs_365d": 8, "iocs_before_window": 0, "last_seen_365d": "2026-10-20", "window_days": 365 }, "id": "tfc-5c6c4ccfc23e", "ioc_count": 8, "ioc_count_1d": 0, "ioc_count_30d": 8, "ioc_count_7d": 8, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:22:04", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112414023237185714", "type": "domain", "user": "KesaGataMe0", "value": "japanpostr7l.club" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:22:04", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112414023237185714", "type": "domain", "user": "KesaGataMe0", "value": "japanpostmhk.club" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:22:04", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112414023237185714", "type": "domain", "user": "KesaGataMe0", "value": "japanpostfup.club" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:22:04", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112414023237185714", "type": "domain", "user": "KesaGataMe0", "value": "japanpostae0.club" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:22:04", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112414023237185714", "type": "url", "user": "KesaGataMe0", "value": "https://japanpostr7l.club" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:22:04", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112414023237185714", "type": "url", "user": "KesaGataMe0", "value": "https://japanpostmhk.club" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:22:04", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112414023237185714", "type": "url", "user": "KesaGataMe0", "value": "https://japanpostfup.club" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:22:04", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112414023237185714", "type": "url", "user": "KesaGataMe0", "value": "https://japanpostae0.club" } ], "last_seen": "2026-10-20", "member_cluster_ids": [ "tfc-5c6c4ccfc23e" ], "name": "Japan Post phishing on japanpost*.club domains", "reporters": [ "KesaGataMe0" ], "tags": [], "targeted_brand": "Japan Post", "targeted_country": "JP", "targeted_sector": "transportation", "threat_types": { "phishing": 8 }, "ttps": [ "T1583.001", "T1684.001" ], "types": { "domain": 4, "url": 4 } }, { "activity": { "2026-10-20": 6 }, "anchors": { "registered_domains": [ "cdn-staticfiles.com", "wiredrum.llc" ], "tags": [ "#Mythic" ], "url_path_patterns": [] }, "confidence": "medium", "context": "Domains wiredrum.llc and cdn-staticfiles.com and IP 2.27.63.244 are tagged Mythic and C2. Enrichment describes a Mythic C2 server with callback domains and payload files such as agent_165.exe and OfficeSupport.exe in an open directory. Reporter etugenio flagged 6 IOCs on 2026-10-20.", "enriched_count": 6, "families": { "Mythic": 6 }, "first_seen": "2026-10-20", "history": { "by_pattern": [], "domains_365d": 2, "first_seen_365d": "2026-10-20", "iocs_365d": 4, "iocs_before_window": 0, "last_seen_365d": "2026-10-20", "window_days": 365 }, "id": "tfc-089bcfbec86c", "infra": [ { "country": "DE", "ip_count": 1, "org": "AS210457 Kyonix Networks Limited" } ], "ioc_count": 6, "ioc_count_1d": 6, "ioc_count_30d": 6, "ioc_count_7d": 6, "iocs": [ { "ai": { "family": "Mythic", "threat_type": "c2" }, "date": "2026-10-20 19:35:18", "tags": [ "#C2", "#Mythic", "#malware" ], "tweet": "https://x.com/etugenio/status/2112628745077133499", "type": "domain", "user": "etugenio", "value": "wiredrum.llc" }, { "ai": { "family": "Mythic", "threat_type": "c2" }, "date": "2026-10-20 19:35:18", "tags": [ "#C2", "#Mythic", "#malware" ], "tweet": "https://x.com/etugenio/status/2112628745077133499", "type": "url", "user": "etugenio", "value": "http://wiredrum.llc" }, { "ai": { "family": "Mythic", "threat_type": "c2" }, "date": "2026-10-20 19:35:18", "tags": [ "#C2", "#Mythic", "#malware" ], "tweet": "https://x.com/etugenio/status/2112628745077133499", "type": "url", "user": "etugenio", "value": "http://cdn-staticfiles.com" }, { "ai": { "family": "Mythic", "threat_type": "c2" }, "date": "2026-10-20 19:35:18", "tags": [ "#C2", "#Mythic", "#malware" ], "tweet": "https://x.com/etugenio/status/2112628745077133499", "type": "url", "user": "etugenio", "value": "http://2.27.63.244" }, { "ai": { "family": "Mythic", "threat_type": "c2" }, "date": "2026-10-20 19:35:18", "tags": [ "#C2", "#Mythic", "#malware" ], "tweet": "https://x.com/etugenio/status/2112628745077133499", "type": "domain", "user": "etugenio", "value": "cdn-staticfiles.com" }, { "ai": { "family": "Mythic", "threat_type": "c2" }, "date": "2026-10-20 19:35:18", "net": { "country": "DE", "org": "AS210457 Kyonix Networks Limited" }, "tags": [ "#C2", "#Mythic", "#malware" ], "tweet": "https://x.com/etugenio/status/2112628745077133499", "type": "ip", "user": "etugenio", "value": "2.27.63.244" } ], "last_seen": "2026-10-20", "member_cluster_ids": [ "tfc-089bcfbec86c" ], "name": "Mythic C2 with open-directory payload builders", "reporters": [ "etugenio" ], "tags": [ "#C2", "#Mythic", "#malware" ], "targeted_brand": null, "targeted_country": null, "targeted_sector": null, "threat_types": { "c2": 6 }, "ttps": [ "T1588.002", "T1608.001", "T1071.001" ], "types": { "domain": 2, "ip": 1, "url": 3 } }, { "activity": { "2026-10-16": 6 }, "anchors": { "registered_domains": [ "scloudeliverrs.com", "scloudsenterprise.com", "scloudsenterprisever.com" ], "tags": [], "url_path_patterns": [] }, "confidence": "low", "context": "Three recently registered domains share a cloud/deliver/enterprise naming pattern, such as scloudeliverrs.com and scloudsenterprise.com. Enrichment says they resolve to the same IP and may be shared malicious infrastructure. No lure or payload is described. Reporter malwrhunterteam flagged 6 IOCs on 2026-10-16.", "enriched_count": 6, "families": {}, "first_seen": "2026-10-16", "history": { "by_pattern": [], "domains_365d": 3, "first_seen_365d": "2026-10-16", "iocs_365d": 6, "iocs_before_window": 0, "last_seen_365d": "2026-10-16", "window_days": 365 }, "id": "tfc-1832e62ccfa0", "ioc_count": 6, "ioc_count_1d": 0, "ioc_count_30d": 6, "ioc_count_7d": 6, "iocs": [ { "ai": { "threat_type": "other" }, "date": "2026-10-16 08:51:21", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2111017138790056108", "type": "domain", "user": "malwrhunterteam", "value": "scloudsenterprisever.com" }, { "ai": { "threat_type": "other" }, "date": "2026-10-16 08:51:21", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2111017138790056108", "type": "domain", "user": "malwrhunterteam", "value": "scloudsenterprise.com" }, { "ai": { "threat_type": "other" }, "date": "2026-10-16 08:51:21", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2111017138790056108", "type": "domain", "user": "malwrhunterteam", "value": "scloudeliverrs.com" }, { "ai": { "threat_type": "other" }, "date": "2026-10-16 08:51:21", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2111017138790056108", "type": "url", "user": "malwrhunterteam", "value": "http://scloudsenterprisever.com" }, { "ai": { "threat_type": "other" }, "date": "2026-10-16 08:51:21", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2111017138790056108", "type": "url", "user": "malwrhunterteam", "value": "http://scloudsenterprise.com" }, { "ai": { "threat_type": "other" }, "date": "2026-10-16 08:51:21", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2111017138790056108", "type": "url", "user": "malwrhunterteam", "value": "http://scloudeliverrs.com" } ], "last_seen": "2026-10-16", "member_cluster_ids": [ "tfc-1832e62ccfa0" ], "name": "cloud*deliver*enterprise lookalike domains on one IP", "reporters": [ "malwrhunterteam" ], "tags": [], "targeted_brand": null, "targeted_country": null, "targeted_sector": null, "threat_types": { "other": 6 }, "ttps": [ "T1583.001" ], "types": { "domain": 3, "url": 3 } }, { "activity": { "2026-09-29": 3, "2026-10-09": 3 }, "anchors": { "registered_domains": [ "inviteteamsmeeting.fit", "teams-meeting-invite.icu" ], "tags": [], "url_path_patterns": [ "/Teamsetup.msi" ] }, "confidence": "medium", "context": "The domains inviteteamsmeeting.fit and teams-meeting-invite.icu host the same /Teamsetup.msi installer under a Microsoft Teams meeting invite lure. Enrichment identifies the installer as an Atera RMM package. The hostnames embed the Teams brand and the filename mimics a legitimate Teams setup package. Reporter patialavii flagged 6 IOCs from 2026-09-29 to 2026-10-09.", "enriched_count": 6, "families": {}, "first_seen": "2026-09-29", "history": { "by_pattern": [], "domains_365d": 2, "first_seen_365d": "2026-09-29", "iocs_365d": 6, "iocs_before_window": 0, "last_seen_365d": "2026-10-09", "window_days": 365 }, "id": "tfc-4859a3b1a8c6", "ioc_count": 6, "ioc_count_1d": 0, "ioc_count_30d": 6, "ioc_count_7d": 0, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-09 03:33:11", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2108400354538946709", "type": "domain", "user": "patialavii", "value": "teams-meeting-invite.icu" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-09 03:33:11", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2108400354538946709", "type": "url", "user": "patialavii", "value": "https://teams-meeting-invite.icu/Teamsetup.msi" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-09 03:33:11", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2108400354538946709", "type": "url", "user": "patialavii", "value": "http://teams-meeting-invite.icu" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-29 05:14:34", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2104801988894732660", "type": "domain", "user": "patialavii", "value": "inviteteamsmeeting.fit" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-29 05:14:34", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2104801988894732660", "type": "url", "user": "patialavii", "value": "https://inviteteamsmeeting.fit/Teamsetup.msi" }, { "ai": { "threat_type": "phishing" }, "date": "2026-09-29 05:14:34", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2104801988894732660", "type": "url", "user": "patialavii", "value": "https://inviteteamsmeeting.fit" } ], "last_seen": "2026-10-09", "member_cluster_ids": [ "tfc-4859a3b1a8c6", "tfc-8a2b0702917c" ], "name": "Fake Teams meeting invite delivering Teamsetup.msi", "reporters": [ "patialavii" ], "tags": [ "#phishing" ], "targeted_brand": "Microsoft Teams", "targeted_country": null, "targeted_sector": "technology", "threat_types": { "phishing": 6 }, "ttps": [ "T1608.001", "T1684.001", "T1036.005" ], "types": { "domain": 2, "url": 4 } }, { "activity": { "2026-09-22": 2, "2026-10-13": 2, "2026-10-19": 2 }, "anchors": { "registered_domains": [ "pagina-clientes-havan.com", "site-google-havan.com" ], "tags": [], "url_path_patterns": [ "/produto/N" ] }, "confidence": "medium", "context": "Domains containing 'havan' (pagina-clientes-havan.com, site-google-havan.com) serve fake product pages under /produto/. Enrichment describes a Brazilian clone of the Havan retailer used for phishing and fraud. One reporter (Coolcarlos17) flagged 6 IOCs from 2026-09-22 to 2026-10-19.", "enriched_count": 6, "families": {}, "first_seen": "2026-09-22", "history": { "by_pattern": [], "domains_365d": 2, "first_seen_365d": "2026-09-22", "iocs_365d": 6, "iocs_before_window": 0, "last_seen_365d": "2026-10-19", "window_days": 365 }, "id": "tfc-d2fe209f2218", "ioc_count": 6, "ioc_count_1d": 0, "ioc_count_30d": 6, "ioc_count_7d": 2, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 14:14:03", "tags": [ "#phishing", "#scam" ], "tweet": "https://x.com/Coolcarlos17/status/2112185513381703717", "type": "domain", "user": "Coolcarlos17", "value": "pagina-clientes-havan.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 14:14:03", "tags": [ "#phishing", "#scam" ], "tweet": "https://x.com/Coolcarlos17/status/2112185513381703717", "type": "url", "user": "Coolcarlos17", "value": "https://pagina-clientes-havan.com/produto/33051" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-13 14:33:42", "tags": [ "#phishing", "#scam" ], "tweet": "https://x.com/Coolcarlos17/status/2110016132048363843", "type": "domain", "user": "Coolcarlos17", "value": "pagina-clientes-havan.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-13 14:33:42", "tags": [ "#phishing", "#scam" ], "tweet": "https://x.com/Coolcarlos17/status/2110016132048363843", "type": "url", "user": "Coolcarlos17", "value": "https://pagina-clientes-havan.com/produto/32812" }, { "ai": { "threat_type": "scam" }, "date": "2026-09-22 19:03:30", "tags": [ "#phishing", "#scam" ], "tweet": "https://x.com/Coolcarlos17/status/2102473881315643843", "type": "domain", "user": "Coolcarlos17", "value": "site-google-havan.com" }, { "ai": { "threat_type": "scam" }, "date": "2026-09-22 19:03:30", "tags": [ "#phishing", "#scam" ], "tweet": "https://x.com/Coolcarlos17/status/2102473881315643843", "type": "url", "user": "Coolcarlos17", "value": "https://site-google-havan.com/produto/32812" } ], "last_seen": "2026-10-19", "member_cluster_ids": [ "tfc-d2fe209f2218" ], "name": "Havan retailer clone shops on havan-named domains", "reporters": [ "Coolcarlos17" ], "tags": [ "#phishing", "#scam" ], "targeted_brand": "Havan", "targeted_country": "BR", "targeted_sector": "retail", "threat_types": { "phishing": 4, "scam": 2 }, "ttps": [ "T1684.001", "T1583.001", "T1566.002" ], "types": { "domain": 3, "url": 3 } }, { "activity": { "2026-10-12": 2, "2026-10-13": 2, "2026-10-15": 2 }, "anchors": { "registered_domains": [ "wickerlookoutdoorfurniture.com" ], "tags": [], "url_path_patterns": [] }, "confidence": "low", "context": "Enrichment describes phishing lures posing as cloud payment or renewal warnings that link to afromantic.com and wickerlookoutdoorfurniture.com instead of an official service. No specific brand is named. Reporter TKemmerling flagged 6 IOCs from 2026-10-12 to 2026-10-15, all tagged #phishing.", "enriched_count": 6, "families": {}, "first_seen": "2026-10-12", "history": { "by_pattern": [], "domains_365d": 1, "first_seen_365d": "2026-10-12", "iocs_365d": 6, "iocs_before_window": 0, "last_seen_365d": "2026-10-15", "window_days": 365 }, "id": "tfc-deaa5772e731", "ioc_count": 6, "ioc_count_1d": 0, "ioc_count_30d": 6, "ioc_count_7d": 2, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-15 00:00:45", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2110521220877942805", "type": "domain", "user": "TKemmerling", "value": "wickerlookoutdoorfurniture.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-15 00:00:45", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2110521220877942805", "type": "url", "user": "TKemmerling", "value": "http://wickerlookoutdoorfurniture.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-13 00:58:29", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2109810976212345008", "type": "domain", "user": "TKemmerling", "value": "wickerlookoutdoorfurniture.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-13 00:58:29", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2109810976212345008", "type": "url", "user": "TKemmerling", "value": "http://wickerlookoutdoorfurniture.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-12 23:04:38", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2109782324149952795", "type": "domain", "user": "TKemmerling", "value": "wickerlookoutdoorfurniture.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-12 23:04:38", "tags": [ "#phishing" ], "tweet": "https://x.com/TKemmerling/status/2109782324149952795", "type": "url", "user": "TKemmerling", "value": "http://wickerlookoutdoorfurniture.com" } ], "last_seen": "2026-10-15", "member_cluster_ids": [ "tfc-deaa5772e731" ], "name": "Cloud payment renewal phishing via wickerlook and afromantic", "reporters": [ "TKemmerling" ], "tags": [ "#phishing" ], "targeted_brand": null, "targeted_country": null, "targeted_sector": null, "threat_types": { "phishing": 6 }, "ttps": [ "T1583.001" ], "types": { "domain": 3, "url": 3 } }, { "activity": { "2026-10-01": 2, "2026-10-02": 2, "2026-10-16": 2 }, "anchors": { "registered_domains": [ "docsewallet.com", "luxfab.luxe", "strutsupportsystems.com" ], "tags": [], "url_path_patterns": [ "/Adobe_Installer.html" ] }, "confidence": "medium", "context": "Three domains, docsewallet.com, luxfab.luxe and strutsupportsystems.com, serve the same /Adobe_Installer.html path. Enrichment describes Adobe-themed pages delivering a ScreenConnect installer and, in one case, an OpsBridge RMM MSI. Reporter patialavii flagged 6 IOCs from 2026-10-01 to 2026-10-16.", "enriched_count": 6, "families": { "ScreenConnect": 2 }, "first_seen": "2026-10-01", "history": { "by_pattern": [], "domains_365d": 3, "first_seen_365d": "2026-10-01", "iocs_365d": 6, "iocs_before_window": 0, "last_seen_365d": "2026-10-16", "window_days": 365 }, "id": "tfc-e65d5eb33d1a", "ioc_count": 6, "ioc_count_1d": 0, "ioc_count_30d": 6, "ioc_count_7d": 2, "iocs": [ { "ai": { "family": "ScreenConnect", "threat_type": "phishing" }, "date": "2026-10-16 05:14:57", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2110962680358175038", "type": "url", "user": "patialavii", "value": "https://docsewallet.com/Adobe_Installer.html" }, { "ai": { "family": "ScreenConnect", "threat_type": "phishing" }, "date": "2026-10-16 05:14:57", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2110962680358175038", "type": "domain", "user": "patialavii", "value": "docsewallet.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-02 04:20:19", "tags": [], "tweet": "https://x.com/patialavii/status/2105875500057165923", "type": "domain", "user": "patialavii", "value": "luxfab.luxe" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-02 04:20:19", "tags": [], "tweet": "https://x.com/patialavii/status/2105875500057165923", "type": "url", "user": "patialavii", "value": "https://luxfab.luxe/Adobe_Installer.html" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-01 03:12:36", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2105496072785453421", "type": "domain", "user": "patialavii", "value": "strutsupportsystems.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-01 03:12:36", "tags": [ "#phishing" ], "tweet": "https://x.com/patialavii/status/2105496072785453421", "type": "url", "user": "patialavii", "value": "https://strutsupportsystems.com/Adobe_Installer.html" } ], "last_seen": "2026-10-16", "member_cluster_ids": [ "tfc-e65d5eb33d1a" ], "name": "Fake Adobe_Installer.html pages pushing RMM installers", "reporters": [ "patialavii" ], "tags": [ "#phishing" ], "targeted_brand": "Adobe", "targeted_country": null, "targeted_sector": "technology", "threat_types": { "phishing": 6 }, "ttps": [ "T1036.005", "T1588.002", "T1566.002" ], "types": { "domain": 3, "url": 3 } }, { "activity": { "2026-10-05": 2, "2026-10-19": 2 }, "anchors": { "registered_domains": [ "penwfe.asia", "u0fnd.info" ], "tags": [], "url_path_patterns": [ "/HNAoO" ] }, "confidence": "medium", "context": "Two domains, penwfe.asia and u0fnd.info, serve pages at the same random path and are tagged #phishing. Enrichment describes impersonation of UC Card aimed at Japanese users. Reporters Metemcyber and romonlyht flagged 4 IOCs from 2026-10-05 to 2026-10-19.", "enriched_count": 4, "families": {}, "first_seen": "2026-10-05", "history": { "by_pattern": [], "domains_365d": 2, "first_seen_365d": "2026-08-17", "iocs_365d": 6, "iocs_before_window": 2, "last_seen_365d": "2026-10-19", "window_days": 365 }, "id": "tfc-1c970c85d4b2", "ioc_count": 4, "ioc_count_1d": 0, "ioc_count_30d": 4, "ioc_count_7d": 2, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 02:45:19", "tags": [ "#phishing" ], "tweet": "https://x.com/romonlyht/status/2112012188101840997", "type": "domain", "user": "romonlyht", "value": "saissodbn202607oint.u0fnd.info" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 02:45:19", "tags": [ "#phishing" ], "tweet": "https://x.com/romonlyht/status/2112012188101840997", "type": "url", "user": "romonlyht", "value": "https://saissodbn202607oint.u0fnd.info/H80AoO" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-05 12:33:50", "tags": [ "#phishing" ], "tweet": "https://x.com/Metemcyber/status/2107086863836279280", "type": "domain", "user": "Metemcyber", "value": "kaifitness.penwfe.asia" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-05 12:33:50", "tags": [ "#phishing" ], "tweet": "https://x.com/Metemcyber/status/2107086863836279280", "type": "url", "user": "Metemcyber", "value": "https://kaifitness.penwfe.asia/H80AoO" } ], "last_seen": "2026-10-19", "member_cluster_ids": [ "tfc-1c970c85d4b2" ], "name": "UC Card phishing on penwfe.asia and u0fnd.info", "reporters": [ "Metemcyber", "romonlyht" ], "tags": [ "#phishing" ], "targeted_brand": "UC Card", "targeted_country": "JP", "targeted_sector": "financial-services", "threat_types": { "phishing": 4 }, "ttps": [ "T1583.001", "T1566.002" ], "types": { "domain": 2, "url": 2 } }, { "activity": { "2026-10-14": 2, "2026-10-15": 2 }, "anchors": { "registered_domains": [ "borshynel.cfd", "branthoven.cfd" ], "tags": [], "url_path_patterns": [ "/identifier" ] }, "confidence": "medium", "context": "Two .cfd domains, borshynel.cfd and branthoven.cfd, serve pages at the same /identifier/ path. Enrichment describes impersonation of Mitsubishi UFJ eSmart Securities to steal login credentials. Reporters masaomi346 and oroshi0064 flagged 4 IOCs from 2026-10-14 to 2026-10-15.", "enriched_count": 4, "families": {}, "first_seen": "2026-10-14", "history": { "by_pattern": [], "domains_365d": 2, "first_seen_365d": "2026-10-14", "iocs_365d": 4, "iocs_before_window": 0, "last_seen_365d": "2026-10-15", "window_days": 365 }, "id": "tfc-3575dbb089de", "ioc_count": 4, "ioc_count_1d": 0, "ioc_count_30d": 4, "ioc_count_7d": 4, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-15 00:35:33", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2110529977871638930", "type": "url", "user": "masaomi346", "value": "https://branthoven.cfd/identifier/#/index" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-15 00:35:33", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2110529977871638930", "type": "domain", "user": "masaomi346", "value": "branthoven.cfd" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-14 23:37:26", "tags": [ "#phishing" ], "tweet": "https://x.com/oroshi0064/status/2110515355068314085", "type": "url", "user": "oroshi0064", "value": "https://borshynel.cfd/identifier/#/index" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-14 23:37:26", "tags": [ "#phishing" ], "tweet": "https://x.com/oroshi0064/status/2110515355068314085", "type": "domain", "user": "oroshi0064", "value": "borshynel.cfd" } ], "last_seen": "2026-10-15", "member_cluster_ids": [ "tfc-3575dbb089de" ], "name": "Mitsubishi UFJ eSmart Securities phishing on .cfd domains", "reporters": [ "masaomi346", "oroshi0064" ], "tags": [ "#phishing" ], "targeted_brand": "Mitsubishi UFJ eSmart Securities", "targeted_country": "JP", "targeted_sector": "financial-services", "threat_types": { "phishing": 4 }, "ttps": [ "T1583.001", "T1566.002" ], "types": { "domain": 2, "url": 2 } }, { "activity": { "2026-10-19": 2, "2026-10-21": 2 }, "anchors": { "registered_domains": [ "bestpartneha-jp.com" ], "tags": [], "url_path_patterns": [] }, "confidence": "medium", "context": "A single domain, bestpartneha-jp.com, is tagged #phishing and #malware. Enrichment describes a phishing URL impersonating the Japanese National Tax Agency, reported through a Japanese alert. Reporters masaomi346 and romonlyht flagged 4 IOCs from 2026-10-19 to 2026-10-21.", "enriched_count": 4, "families": {}, "first_seen": "2026-10-19", "history": { "by_pattern": [], "domains_365d": 1, "first_seen_365d": "2026-10-19", "iocs_365d": 4, "iocs_before_window": 0, "last_seen_365d": "2026-10-21", "window_days": 365 }, "id": "tfc-3da69a3f8b32", "ioc_count": 4, "ioc_count_1d": 2, "ioc_count_30d": 4, "ioc_count_7d": 4, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-21 05:06:37", "tags": [ "#malware", "#phishing" ], "tweet": "https://x.com/masaomi346/status/2112772524828483798", "type": "url", "user": "masaomi346", "value": "https://bestpartneha-jp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-21 05:06:37", "tags": [ "#malware", "#phishing" ], "tweet": "https://x.com/masaomi346/status/2112772524828483798", "type": "domain", "user": "masaomi346", "value": "bestpartneha-jp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 03:28:58", "tags": [ "#phishing" ], "tweet": "https://x.com/romonlyht/status/2112023172040347658", "type": "url", "user": "romonlyht", "value": "https://bestpartneha-jp.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 03:28:58", "tags": [ "#phishing" ], "tweet": "https://x.com/romonlyht/status/2112023172040347658", "type": "domain", "user": "romonlyht", "value": "bestpartneha-jp.com" } ], "last_seen": "2026-10-21", "member_cluster_ids": [ "tfc-3da69a3f8b32" ], "name": "National Tax Agency phishing on bestpartneha-jp.com", "reporters": [ "masaomi346", "romonlyht" ], "tags": [ "#malware", "#phishing" ], "targeted_brand": "National Tax Agency", "targeted_country": "JP", "targeted_sector": "government-national", "threat_types": { "phishing": 4 }, "ttps": [ "T1583.001", "T1566.002" ], "types": { "domain": 2, "url": 2 } }, { "activity": { "2026-10-11": 2, "2026-10-20": 2 }, "anchors": { "registered_domains": [ "mail-mof-gov-np.netlify.app" ], "tags": [], "url_path_patterns": [] }, "confidence": "medium", "context": "The Netlify-hosted host mail-mof-gov-np.netlify.app mimics a Nepal Ministry of Finance mail portal and is tagged #phishing. Enrichment says an online scanner flagged it as a confirmed scam. Reporters TIE__SUN and scanmalware flagged 4 IOCs from 2026-10-11 to 2026-10-20.", "enriched_count": 4, "families": {}, "first_seen": "2026-10-11", "history": { "by_pattern": [], "domains_365d": 1, "first_seen_365d": "2026-10-11", "iocs_365d": 4, "iocs_before_window": 0, "last_seen_365d": "2026-10-20", "window_days": 365 }, "id": "tfc-72dc1c589f75", "ioc_count": 4, "ioc_count_1d": 2, "ioc_count_30d": 4, "ioc_count_7d": 2, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 23:41:56", "tags": [ "#phishing" ], "tweet": "https://x.com/TIE__SUN/status/2112690811683168671", "type": "domain", "user": "TIE__SUN", "value": "mail-mof-gov-np.netlify.app" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 23:41:56", "tags": [ "#phishing" ], "tweet": "https://x.com/TIE__SUN/status/2112690811683168671", "type": "url", "user": "TIE__SUN", "value": "http://mail-mof-gov-np.netlify.app" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-11 07:41:10", "tags": [ "#ransomware" ], "tweet": "https://x.com/scanmalware/status/2109187538392936840", "type": "domain", "user": "scanmalware", "value": "mail-mof-gov-np.netlify.app" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-11 07:41:10", "tags": [ "#ransomware" ], "tweet": "https://x.com/scanmalware/status/2109187538392936840", "type": "url", "user": "scanmalware", "value": "http://mail-mof-gov-np.netlify.app" } ], "last_seen": "2026-10-20", "member_cluster_ids": [ "tfc-72dc1c589f75" ], "name": "Nepal finance ministry mail portal lookalike on Netlify", "reporters": [ "TIE__SUN", "scanmalware" ], "tags": [ "#phishing", "#ransomware" ], "targeted_brand": "Ministry of Finance (Nepal)", "targeted_country": "NP", "targeted_sector": "government-national", "threat_types": { "phishing": 4 }, "ttps": [ "T1583.006", "T1684.001", "T1566.002" ], "types": { "domain": 2, "url": 2 } }, { "activity": { "2026-10-20": 4 }, "anchors": { "registered_domains": [ "dnuise.top", "zgynkj.top" ], "tags": [], "url_path_patterns": [ "/lkXSz" ] }, "confidence": "medium", "context": "Two .top domains, dnuise.top and zgynkj.top, serve the same /lkXSz path on SonderCloud hosting. Enrichment says dnuise.top impersonates Iwate Bank and zgynkj.top impersonates Yamanashi Chuo Bank. One reporter (KesaGataMe0) flagged 4 IOCs on 2026-10-20.", "enriched_count": 4, "families": {}, "first_seen": "2026-10-20", "history": { "by_pattern": [], "domains_365d": 2, "first_seen_365d": "2026-10-20", "iocs_365d": 4, "iocs_before_window": 0, "last_seen_365d": "2026-10-20", "window_days": 365 }, "id": "tfc-bd4d580d9244", "ioc_count": 4, "ioc_count_1d": 0, "ioc_count_30d": 4, "ioc_count_7d": 4, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:31:35", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112416417941516696", "type": "domain", "user": "KesaGataMe0", "value": "zgynkj.top" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:31:35", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112416417941516696", "type": "url", "user": "KesaGataMe0", "value": "https://zgynkj.top/lkXSz" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:30:42", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112416195827904825", "type": "url", "user": "KesaGataMe0", "value": "https://dnuise.top/lkXSz" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:30:42", "tags": [], "tweet": "https://x.com/KesaGataMe0/status/2112416195827904825", "type": "domain", "user": "KesaGataMe0", "value": "dnuise.top" } ], "last_seen": "2026-10-20", "member_cluster_ids": [ "tfc-bd4d580d9244" ], "name": "Japanese regional bank phishing on .top domains with /lkXSz path", "reporters": [ "KesaGataMe0" ], "tags": [], "targeted_brand": "Iwate Bank", "targeted_country": "JP", "targeted_sector": "financial-services", "threat_types": { "phishing": 4 }, "ttps": [ "T1583.001", "T1566.002" ], "types": { "domain": 2, "url": 2 } }, { "activity": { "2026-10-17": 2, "2026-10-18": 2 }, "anchors": { "registered_domains": [ "rabbitshiha-jp.com" ], "tags": [], "url_path_patterns": [] }, "confidence": "medium", "context": "Enrichment describes Android malware impersonating Visa, distributed through a phishing site at rabbitshiha-jp.com hosted on Google Cloud. Tags are #malware and #phishing. Reporters masaomi346 and oroshi0064 flagged 4 IOCs from 2026-10-17 to 2026-10-18.", "enriched_count": 4, "families": {}, "first_seen": "2026-10-17", "history": { "by_pattern": [], "domains_365d": 1, "first_seen_365d": "2026-10-17", "iocs_365d": 4, "iocs_before_window": 0, "last_seen_365d": "2026-10-18", "window_days": 365 }, "id": "tfc-c3b7799a3ddf", "ioc_count": 4, "ioc_count_1d": 0, "ioc_count_30d": 4, "ioc_count_7d": 4, "iocs": [ { "ai": { "threat_type": "malware" }, "date": "2026-10-18 01:24:36", "tags": [ "#malware", "#phishing" ], "tweet": "https://x.com/masaomi346/status/2111629488304136633", "type": "domain", "user": "masaomi346", "value": "rabbitshiha-jp.com" }, { "ai": { "threat_type": "malware" }, "date": "2026-10-18 01:24:36", "tags": [ "#malware", "#phishing" ], "tweet": "https://x.com/masaomi346/status/2111629488304136633", "type": "url", "user": "masaomi346", "value": "https://rabbitshiha-jp.com" }, { "ai": { "threat_type": "malware" }, "date": "2026-10-17 22:42:06", "tags": [ "#malware", "#phishing" ], "tweet": "https://x.com/oroshi0064/status/2111588591759679546", "type": "domain", "user": "oroshi0064", "value": "rabbitshiha-jp.com" }, { "ai": { "threat_type": "malware" }, "date": "2026-10-17 22:42:06", "tags": [ "#malware", "#phishing" ], "tweet": "https://x.com/oroshi0064/status/2111588591759679546", "type": "url", "user": "oroshi0064", "value": "https://rabbitshiha-jp.com" } ], "last_seen": "2026-10-18", "member_cluster_ids": [ "tfc-c3b7799a3ddf" ], "name": "Visa-themed Android malware phishing on rabbitshiha-jp.com", "reporters": [ "masaomi346", "oroshi0064" ], "tags": [ "#malware", "#phishing" ], "targeted_brand": "Visa", "targeted_country": null, "targeted_sector": "financial-services", "threat_types": { "malware": 4 }, "ttps": [ "T1566.002", "T1583.001" ], "types": { "domain": 2, "url": 2 } }, { "activity": { "2026-10-19": 2, "2026-10-20": 2 }, "anchors": { "registered_domains": [ "bankcheckdata-card.jp" ], "tags": [], "url_path_patterns": [] }, "confidence": "medium", "context": "A single .jp domain, bankcheckdata-card.jp, is tagged #phishing. Enrichment describes impersonation of Sumitomo Mitsui Card to steal card and banking credentials. Reporters PhishStats and masaomi346 flagged 4 IOCs from 2026-10-19 to 2026-10-20.", "enriched_count": 4, "families": {}, "first_seen": "2026-10-19", "history": { "by_pattern": [], "domains_365d": 1, "first_seen_365d": "2026-10-19", "iocs_365d": 4, "iocs_before_window": 0, "last_seen_365d": "2026-10-20", "window_days": 365 }, "id": "tfc-e19c8a393566", "ioc_count": 4, "ioc_count_1d": 0, "ioc_count_30d": 4, "ioc_count_7d": 4, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:32:02", "tags": [ "#phishing" ], "tweet": "https://x.com/PhishStats/status/2112416533263843835", "type": "url", "user": "PhishStats", "value": "https://bankcheckdata-card.jp" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-20 05:32:02", "tags": [ "#phishing" ], "tweet": "https://x.com/PhishStats/status/2112416533263843835", "type": "domain", "user": "PhishStats", "value": "bankcheckdata-card.jp" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 23:05:34", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2112319273876254826", "type": "url", "user": "masaomi346", "value": "https://bankcheckdata-card.jp" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 23:05:34", "tags": [ "#phishing" ], "tweet": "https://x.com/masaomi346/status/2112319273876254826", "type": "domain", "user": "masaomi346", "value": "bankcheckdata-card.jp" } ], "last_seen": "2026-10-20", "member_cluster_ids": [ "tfc-e19c8a393566" ], "name": "Sumitomo Mitsui Card phishing on bankcheckdata-card.jp", "reporters": [ "PhishStats", "masaomi346" ], "tags": [ "#phishing" ], "targeted_brand": "Sumitomo Mitsui Card", "targeted_country": "JP", "targeted_sector": "financial-services", "threat_types": { "phishing": 4 }, "ttps": [ "T1583.001", "T1566.002" ], "types": { "domain": 2, "url": 2 } }, { "activity": { "2026-10-19": 4 }, "anchors": { "registered_domains": [ "fase-x.com" ], "tags": [], "url_path_patterns": [ "/NaNeNdN", "/NfdfNbea" ] }, "confidence": "medium", "context": "Hex-labelled subdomains of fase-x.com serve short hash paths and are tagged #phishing. Enrichment describes Japanese-language Amazon impersonation that redirects to vn-open888.com. One reporter (romonlyht) flagged 4 IOCs on 2026-10-19.", "enriched_count": 4, "families": {}, "first_seen": "2026-10-19", "history": { "by_pattern": [], "domains_365d": 1, "first_seen_365d": "2026-10-19", "iocs_365d": 4, "iocs_before_window": 0, "last_seen_365d": "2026-10-19", "window_days": 365 }, "id": "tfc-ff391bff430f", "ioc_count": 4, "ioc_count_1d": 0, "ioc_count_30d": 4, "ioc_count_7d": 4, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 03:55:24", "tags": [ "#phishing" ], "tweet": "https://x.com/romonlyht/status/2112029826542714916", "type": "url", "user": "romonlyht", "value": "https://a0be120b.fase-x.com/1fdf1bea" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 03:55:24", "tags": [ "#phishing" ], "tweet": "https://x.com/romonlyht/status/2112029826542714916", "type": "domain", "user": "romonlyht", "value": "a0be120b.fase-x.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 03:54:01", "tags": [ "#phishing" ], "tweet": "https://x.com/romonlyht/status/2112029478574780667", "type": "url", "user": "romonlyht", "value": "https://3cdffc93.fase-x.com/7a7e36d3" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-19 03:54:01", "tags": [ "#phishing" ], "tweet": "https://x.com/romonlyht/status/2112029478574780667", "type": "domain", "user": "romonlyht", "value": "3cdffc93.fase-x.com" } ], "last_seen": "2026-10-19", "member_cluster_ids": [ "tfc-ff391bff430f" ], "name": "Amazon Japan phishing on hashed subdomains of fase-x.com", "reporters": [ "romonlyht" ], "tags": [ "#phishing" ], "targeted_brand": "Amazon", "targeted_country": "JP", "targeted_sector": "retail", "threat_types": { "phishing": 4 }, "ttps": [ "T1583.001", "T1566.002" ], "types": { "domain": 2, "url": 2 } }, { "activity": { "2026-09-28": 3 }, "anchors": { "registered_domains": [ "delphiaonline.top" ], "tags": [ "#Remcos" ], "url_path_patterns": [] }, "confidence": "medium", "context": "An open directory at delphiaonline.top hosts a PowerShell payload for Remcos RAT, with a sample SHA256 linked. Enrichment notes the script is broken and that C2 runs on a duckdns domain on port 14642. Reporter James_inthe_box flagged 3 IOCs on 2026-09-28.", "enriched_count": 3, "families": { "Remcos": 3 }, "first_seen": "2026-09-28", "history": { "by_pattern": [], "domains_365d": 1, "first_seen_365d": "2026-09-28", "iocs_365d": 2, "iocs_before_window": 0, "last_seen_365d": "2026-09-28", "window_days": 365 }, "id": "tfc-0387361f10bb", "ioc_count": 3, "ioc_count_1d": 0, "ioc_count_30d": 3, "ioc_count_7d": 0, "iocs": [ { "ai": { "family": "Remcos", "threat_type": "malware" }, "date": "2026-09-28 13:56:17", "tags": [ "#Remcos", "#opendir" ], "tweet": "https://x.com/James_inthe_box/status/2104570898124812499", "type": "url", "user": "James_inthe_box", "value": "https://delphiaonline.top" }, { "ai": { "family": "Remcos", "threat_type": "malware" }, "date": "2026-09-28 13:56:17", "tags": [ "#Remcos", "#opendir" ], "tweet": "https://x.com/James_inthe_box/status/2104570898124812499", "type": "domain", "user": "James_inthe_box", "value": "delphiaonline.top" }, { "ai": { "family": "Remcos", "threat_type": "malware" }, "date": "2026-09-28 13:56:17", "tags": [ "#Remcos", "#opendir" ], "tweet": "https://x.com/James_inthe_box/status/2104570898124812499", "type": "sha256", "user": "James_inthe_box", "value": "9d9f149a0052999587be2078375bb4530b351f3cda1b343c7f81a5d13b02ac45" } ], "last_seen": "2026-09-28", "member_cluster_ids": [ "tfc-0387361f10bb" ], "name": "Remcos payload open directory on delphiaonline.top", "reporters": [ "James_inthe_box" ], "tags": [ "#Remcos", "#opendir" ], "targeted_brand": null, "targeted_country": null, "targeted_sector": null, "threat_types": { "malware": 3 }, "ttps": [ "T1588.001", "T1608.001", "T1583.001" ], "types": { "domain": 1, "sha256": 1, "url": 1 } }, { "activity": { "2026-10-16": 3 }, "anchors": { "registered_domains": [ "wuaze.com" ], "tags": [ "#Kimsuky" ], "url_path_patterns": [ "/xacN/xacN" ] }, "confidence": "medium", "context": "A random-label subdomain of wuaze.com is tagged Kimsuky and serves a PDF under an /xac/ path. Enrichment links it to a Korean-named health checkup ZIP lure whose payload contacts a remote PHP endpoint. Two reporters flagged 3 IOCs on 2026-10-16.", "enriched_count": 1, "families": {}, "first_seen": "2026-10-16", "history": { "by_pattern": [], "domains_365d": 1, "first_seen_365d": "2025-10-27", "iocs_365d": 19, "iocs_before_window": 16, "last_seen_365d": "2026-10-16", "window_days": 365 }, "id": "tfc-3977157f8c1b", "ioc_count": 3, "ioc_count_1d": 0, "ioc_count_30d": 3, "ioc_count_7d": 3, "iocs": [ { "ai": { "threat_type": "malware" }, "date": "2026-10-16 22:04:23", "tags": [], "tweet": "https://x.com/smica83/status/2111216711831810173", "type": "url", "user": "smica83", "value": "https://xncdvoghw.wuaze.com//xac74/xac15/xac80/xc9c4.pdf" }, { "date": "2026-10-16 05:49:40", "tags": [ "#Kimsuky" ], "tweet": "https://x.com/copy_and_paster/status/2110971416963326442", "type": "domain", "user": "copy_and_paster", "value": "xncdvoghw.wuaze.com" }, { "date": "2026-10-16 05:49:40", "tags": [ "#Kimsuky" ], "tweet": "https://x.com/copy_and_paster/status/2110971416963326442", "type": "url", "user": "copy_and_paster", "value": "http://xncdvoghw.wuaze.com" } ], "last_seen": "2026-10-16", "member_cluster_ids": [ "tfc-3977157f8c1b" ], "name": "Kimsuky health checkup lure on wuaze.com subdomain", "reporters": [ "copy_and_paster", "smica83" ], "tags": [ "#Kimsuky" ], "targeted_brand": null, "targeted_country": null, "targeted_sector": null, "threat_types": { "malware": 1 }, "ttps": [ "T1583.006" ], "types": { "domain": 1, "url": 2 } }, { "activity": { "2026-10-13": 3 }, "anchors": { "registered_domains": [ "easydriverhub.com" ], "tags": [], "url_path_patterns": [ "/downloads/intel-multi-drv.fix" ] }, "confidence": "low", "context": "easydriverhub.com serves /downloads/intel-multi-drv.fix. Enrichment describes a Python info stealer posing as an NVIDIA driver update that collects browser data, uploads to 198.37.111.206 and keeps a TCP 8008 channel. One reporter (TheM3gatr0n) flagged 3 IOCs on 2026-10-13.", "enriched_count": 3, "families": {}, "first_seen": "2026-10-13", "history": { "by_pattern": [], "domains_365d": 1, "first_seen_365d": "2026-10-13", "iocs_365d": 3, "iocs_before_window": 0, "last_seen_365d": "2026-10-13", "window_days": 365 }, "id": "tfc-3e1cf6d02e96", "ioc_count": 3, "ioc_count_1d": 0, "ioc_count_30d": 3, "ioc_count_7d": 0, "iocs": [ { "ai": { "threat_type": "malware" }, "date": "2026-10-13 11:22:36", "tags": [], "tweet": "https://x.com/TheM3gatr0n/status/2109968038900466012", "type": "url", "user": "TheM3gatr0n", "value": "https://easydriverhub.com/downloads/intel-multi-drv.fix" }, { "ai": { "threat_type": "malware" }, "date": "2026-10-13 11:22:36", "tags": [], "tweet": "https://x.com/TheM3gatr0n/status/2109968038900466012", "type": "url", "user": "TheM3gatr0n", "value": "http://easydriverhub.com" }, { "ai": { "threat_type": "malware" }, "date": "2026-10-13 11:22:36", "tags": [], "tweet": "https://x.com/TheM3gatr0n/status/2109968038900466012", "type": "domain", "user": "TheM3gatr0n", "value": "easydriverhub.com" } ], "last_seen": "2026-10-13", "member_cluster_ids": [ "tfc-3e1cf6d02e96" ], "name": "Fake NVIDIA driver update stealer on easydriverhub.com", "reporters": [ "TheM3gatr0n" ], "tags": [], "targeted_brand": "NVIDIA", "targeted_country": null, "targeted_sector": "technology", "threat_types": { "malware": 3 }, "ttps": [ "T1583.001", "T1036.005" ], "types": { "domain": 1, "url": 2 } }, { "activity": { "2026-09-24": 3 }, "anchors": { "registered_domains": [ "puwaiosd.com" ], "tags": [], "url_path_patterns": [ "/nenkin/download" ] }, "confidence": "medium", "context": "puwaiosd.com serves /nenkin/download and /ana pages tagged #malware and #phishing. Enrichment describes Android malware impersonating the Japan Pension Service (Nenkin) and ANA airline. Reporter masaomi346 flagged 3 IOCs on 2026-09-24.", "enriched_count": 3, "families": {}, "first_seen": "2026-09-24", "history": { "by_pattern": [], "domains_365d": 1, "first_seen_365d": "2026-09-24", "iocs_365d": 3, "iocs_before_window": 0, "last_seen_365d": "2026-09-24", "window_days": 365 }, "id": "tfc-9102d9ad80b9", "ioc_count": 3, "ioc_count_1d": 0, "ioc_count_30d": 3, "ioc_count_7d": 0, "iocs": [ { "ai": { "threat_type": "malware" }, "date": "2026-09-24 06:49:50", "tags": [ "#malware", "#phishing" ], "tweet": "https://x.com/masaomi346/status/2103014027630895339", "type": "domain", "user": "masaomi346", "value": "puwaiosd.com" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 06:49:50", "tags": [ "#malware", "#phishing" ], "tweet": "https://x.com/masaomi346/status/2103014027630895339", "type": "url", "user": "masaomi346", "value": "https://puwaiosd.com/nenkin/download" }, { "ai": { "threat_type": "malware" }, "date": "2026-09-24 06:49:50", "tags": [ "#malware", "#phishing" ], "tweet": "https://x.com/masaomi346/status/2103014027630895339", "type": "url", "user": "masaomi346", "value": "https://puwaiosd.com/ana" } ], "last_seen": "2026-09-24", "member_cluster_ids": [ "tfc-9102d9ad80b9" ], "name": "Japan Pension Service and ANA Android malware on puwaiosd.com", "reporters": [ "masaomi346" ], "tags": [ "#malware", "#phishing" ], "targeted_brand": "Japan Pension Service", "targeted_country": "JP", "targeted_sector": "government-national", "threat_types": { "malware": 3 }, "ttps": [ "T1566.002", "T1583.001", "T1036.005" ], "types": { "domain": 1, "url": 2 } }, { "activity": { "2026-10-18": 3 }, "anchors": { "registered_domains": [ "nenkin.shop" ], "tags": [], "url_path_patterns": [ "/nenkingojp" ] }, "confidence": "medium", "context": "nenkin.shop and its www host serve a /nenkingojp/ page. Enrichment describes a phishing site impersonating the Japan Pension Service that distributes Android malware. Tags are #malware and #phishing. Reporters masaomi346 and oroshi0064 flagged 3 IOCs on 2026-10-18.", "enriched_count": 3, "families": {}, "first_seen": "2026-10-18", "history": { "by_pattern": [], "domains_365d": 1, "first_seen_365d": "2026-10-18", "iocs_365d": 3, "iocs_before_window": 0, "last_seen_365d": "2026-10-18", "window_days": 365 }, "id": "tfc-9181a4a92940", "ioc_count": 3, "ioc_count_1d": 0, "ioc_count_30d": 3, "ioc_count_7d": 3, "iocs": [ { "ai": { "threat_type": "malware" }, "date": "2026-10-18 12:48:57", "tags": [ "#malware", "#phishing" ], "tweet": "https://x.com/masaomi346/status/2111801710863851952", "type": "url", "user": "masaomi346", "value": "https://nenkin.shop/nenkingojp/" }, { "ai": { "threat_type": "malware" }, "date": "2026-10-18 11:42:34", "tags": [ "#malware", "#phishing" ], "tweet": "https://x.com/oroshi0064/status/2111785001813778792", "type": "domain", "user": "oroshi0064", "value": "nenkin.shop" }, { "ai": { "threat_type": "malware" }, "date": "2026-10-18 11:42:34", "tags": [ "#malware", "#phishing" ], "tweet": "https://x.com/oroshi0064/status/2111785001813778792", "type": "url", "user": "oroshi0064", "value": "https://www.nenkin.shop/nenkingojp/" } ], "last_seen": "2026-10-18", "member_cluster_ids": [ "tfc-9181a4a92940" ], "name": "Japan Pension Service phishing delivering Android malware on nenkin.shop", "reporters": [ "masaomi346", "oroshi0064" ], "tags": [ "#malware", "#phishing" ], "targeted_brand": "Japan Pension Service", "targeted_country": "JP", "targeted_sector": "government-national", "threat_types": { "malware": 3 }, "ttps": [ "T1566.002", "T1583.001" ], "types": { "domain": 1, "url": 2 } }, { "activity": { "2026-10-12": 3 }, "anchors": { "registered_domains": [ "exodusathleticclub.com" ], "tags": [], "url_path_patterns": [ "/wp-content/themes" ] }, "confidence": "medium", "context": "A Wells Fargo-themed phishing page posing as an OTP file download is hosted under /wp-content/themes on exodusathleticclub.com, which enrichment describes as a compromised WordPress site behind Fastly. Two reporters (PhishStats, phishunt_io) flagged 3 IOCs on 2026-10-12.", "enriched_count": 3, "families": {}, "first_seen": "2026-10-12", "history": { "by_pattern": [], "domains_365d": 1, "first_seen_365d": "2026-10-12", "iocs_365d": 3, "iocs_before_window": 0, "last_seen_365d": "2026-10-12", "window_days": 365 }, "id": "tfc-a31832bec6a4", "ioc_count": 3, "ioc_count_1d": 0, "ioc_count_30d": 3, "ioc_count_7d": 0, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-12 12:03:24", "tags": [ "#phishing" ], "tweet": "https://x.com/PhishStats/status/2109615918150045954", "type": "url", "user": "PhishStats", "value": "https://www.exodusathleticclub.com/wp-content/themes/wordpress/wordpress/WELLSFARGO%20OTP/Download%20File.html" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-12 07:01:33", "tags": [ "#phishing" ], "tweet": "https://x.com/phishunt_io/status/2109539956251107793", "type": "url", "user": "phishunt_io", "value": "http://exodusathleticclub.com/wp-content/themes/wordpress/wordpress/WELLSFARGO%20OTP/Download%20File.html" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-12 07:01:33", "tags": [ "#phishing" ], "tweet": "https://x.com/phishunt_io/status/2109539956251107793", "type": "domain", "user": "phishunt_io", "value": "exodusathleticclub.com" } ], "last_seen": "2026-10-12", "member_cluster_ids": [ "tfc-a31832bec6a4" ], "name": "Wells Fargo OTP phishing on compromised WordPress site", "reporters": [ "PhishStats", "phishunt_io" ], "tags": [ "#phishing" ], "targeted_brand": "Wells Fargo", "targeted_country": null, "targeted_sector": "financial-services", "threat_types": { "phishing": 3 }, "ttps": [ "T1566.002" ], "types": { "domain": 1, "url": 2 } }, { "activity": { "2026-10-14": 3 }, "anchors": { "registered_domains": [ "ollama-for-macos.github.io" ], "tags": [], "url_path_patterns": [ "/Ollama_N.N.N.dmg" ] }, "confidence": "medium", "context": "ollama-for-macos.github.io offers a fake Ollama_0.23.1.dmg download. Enrichment describes it as a GitHub Pages site distributing a suspicious DMG likely to be malware. The hostname and filename use the Ollama name. Reporter malwrhunterteam flagged 3 IOCs on 2026-10-14.", "enriched_count": 3, "families": {}, "first_seen": "2026-10-14", "history": { "by_pattern": [], "domains_365d": 1, "first_seen_365d": "2026-10-14", "iocs_365d": 3, "iocs_before_window": 0, "last_seen_365d": "2026-10-14", "window_days": 365 }, "id": "tfc-c25d4ed7f213", "ioc_count": 3, "ioc_count_1d": 0, "ioc_count_30d": 3, "ioc_count_7d": 3, "iocs": [ { "ai": { "threat_type": "malware" }, "date": "2026-10-14 11:13:17", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2110328081516998964", "type": "domain", "user": "malwrhunterteam", "value": "ollama-for-macos.github.io" }, { "ai": { "threat_type": "malware" }, "date": "2026-10-14 11:13:17", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2110328081516998964", "type": "url", "user": "malwrhunterteam", "value": "https://ollama-for-macos.github.io/Ollama_0.23.1.dmg" }, { "ai": { "threat_type": "malware" }, "date": "2026-10-14 11:13:17", "tags": [], "tweet": "https://x.com/malwrhunterteam/status/2110328081516998964", "type": "url", "user": "malwrhunterteam", "value": "https://ollama-for-macos.github.io" } ], "last_seen": "2026-10-14", "member_cluster_ids": [ "tfc-c25d4ed7f213" ], "name": "Fake Ollama for macOS GitHub Pages DMG download", "reporters": [ "malwrhunterteam" ], "tags": [], "targeted_brand": "Ollama", "targeted_country": null, "targeted_sector": "technology", "threat_types": { "malware": 3 }, "ttps": [ "T1684.001", "T1583.006", "T1036.005" ], "types": { "domain": 1, "url": 2 } }, { "activity": { "2026-10-07": 3 }, "anchors": { "registered_domains": [ "aowwo.com" ], "tags": [], "url_path_patterns": [ "/iTtqNvNIfh.gifu.jp", "/tNIcOuIHBu.machida.jp" ] }, "confidence": "low", "context": "aowwo.com serves Apple-themed phishing behind a CAPTCHA gate, with URL paths ending in Japanese-style suffixes such as .machida.jp and .gifu.jp. Enrichment links it to a fake iCloud login on another domain and a related IP. One reporter (romonlyht) flagged 3 IOCs on 2026-10-07.", "enriched_count": 3, "families": {}, "first_seen": "2026-10-07", "history": { "by_pattern": [], "domains_365d": 1, "first_seen_365d": "2026-10-07", "iocs_365d": 3, "iocs_before_window": 0, "last_seen_365d": "2026-10-07", "window_days": 365 }, "id": "tfc-f3a23b9ba438", "ioc_count": 3, "ioc_count_1d": 0, "ioc_count_30d": 3, "ioc_count_7d": 0, "iocs": [ { "ai": { "threat_type": "phishing" }, "date": "2026-10-07 05:38:37", "tags": [ "#phishing" ], "tweet": "https://x.com/romonlyht/status/2107707144711860404", "type": "url", "user": "romonlyht", "value": "https://aowwo.com/t9IcOuIHBu.machida.jp" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-07 05:38:37", "tags": [ "#phishing" ], "tweet": "https://x.com/romonlyht/status/2107707144711860404", "type": "domain", "user": "romonlyht", "value": "aowwo.com" }, { "ai": { "threat_type": "phishing" }, "date": "2026-10-07 05:37:30", "tags": [ "#phishing" ], "tweet": "https://x.com/romonlyht/status/2107706866210054644", "type": "url", "user": "romonlyht", "value": "https://aowwo.com/iTtq3v2Ifh.gifu.jp" } ], "last_seen": "2026-10-07", "member_cluster_ids": [ "tfc-f3a23b9ba438" ], "name": "Apple/iCloud phishing behind CAPTCHA on aowwo.com", "reporters": [ "romonlyht" ], "tags": [ "#phishing" ], "targeted_brand": "Apple", "targeted_country": null, "targeted_sector": "technology", "threat_types": { "phishing": 3 }, "ttps": [ "T1583.001" ], "types": { "domain": 1, "url": 2 } } ], "generated_at": "2026-10-21T06:28:10Z", "stale": false, "stale_since": null, "version": 1, "window": "month" }