Detailing Daily Domain Hunting
Tags
| country: | South Korea Russia |
| maec-delivery-vectors: | Watering Hole |
| attack-pattern: | Data Confluence - T1213.001 Domains - T1583.001 Domains - T1584.001 Ip Addresses - T1590.005 Phishing - T1660 Phishing - T1566 Server - T1583.004 Server - T1584.004 |
Common Information
| Type | Value |
|---|---|
| UUID | fb2ad95b-3d62-476c-ae23-4c9343f3d0f3 |
| Fingerprint | a700a6db6b828ef0 |
| Analysis status | DONE |
| Considered CTI value | 1 |
| Text language | |
| Published | Nov. 23, 2022, 3:58 p.m. |
| Added to db | Aug. 31, 2024, 3:45 a.m. |
| Last updated | Nov. 17, 2024, 6:54 p.m. |
| Headline | Detailing Daily Domain Hunting |
| Title | Detailing Daily Domain Hunting |
| Detected Hints/Tags/Attributes | 48/3/81 |
Source URLs
| Redirection | Url | |
|---|---|---|
| Details | Source | https://pylos.co/2022/11/23/detailing-daily-domain-hunting/ |
URL Provider
RSS Feed
| Details | Id | Enabled | Feed title | Url | Added to db |
|---|---|---|---|---|---|
| Details | 199 | ✔ | Stranded on Pylos | https://pylos.co/feed/ | 2024-08-30 22:08 |
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 1 | msn-imap.com |
|
| Details | Domain | 1 | onkrdot.info |
|
| Details | Domain | 154 | urlscan.io |
|
| Details | Domain | 1 | accountskk.certuser.info |
|
| Details | Domain | 4 | cloudns.net |
|
| Details | Domain | 24 | publicdomainregistry.com |
|
| Details | Domain | 1 | authuser.info |
|
| Details | Domain | 1 | certuser.info |
|
| Details | Domain | 1 | daum-policy.com |
|
| Details | Domain | 2 | daum-privacy.com |
|
| Details | Domain | 1 | daum-security.com |
|
| Details | Domain | 1 | googlernails.com |
|
| Details | Domain | 2 | googlmeil.com |
|
| Details | Domain | 2 | goooglesecurity.com |
|
| Details | Domain | 2 | guser.eu |
|
| Details | Domain | 2 | kakaocop.com |
|
| Details | Domain | 1 | komale.eu |
|
| Details | Domain | 1 | koreailmin.com |
|
| Details | Domain | 1 | main.in.net |
|
| Details | Domain | 1 | openprovider.nl |
|
| Details | Domain | 1 | navemail.space |
|
| Details | Domain | 1 | navercorp.center |
|
| Details | Domain | 1 | navernail.eu |
|
| Details | Domain | 1 | oncloudvip.info |
|
| Details | Domain | 1 | servicemember.info |
|
| Details | Domain | 1 | serviceprotect.eu |
|
| Details | Domain | 1 | usersec.info |
|
| Details | Domain | 1 | loginslive.certuser.info |
|
| Details | Domain | 1 | accountsmt.certuser.info |
|
| Details | Domain | 1 | loginsmcmf.certuser.info |
|
| Details | Domain | 1 | loginsioup.certuser.info |
|
| Details | Domain | 1 | t1dm.certuser.info |
|
| Details | Domain | 1 | mysql06.certuser.info |
|
| Details | Domain | 1 | accountsms.certuser.info |
|
| Details | Domain | 1 | account.authuser.info |
|
| Details | Domain | 1 | staticnidlog.navernail.eu |
|
| Details | Domain | 1 | remote.navernail.eu |
|
| Details | Domain | 1 | vpn.navernail.eu |
|
| Details | Domain | 1 | accountsig.servicemember.info |
|
| Details | Domain | 1 | loginsig.servicemember.info |
|
| Details | Domain | 1 | contentnts.slogin.eu |
|
| Details | Domain | 1 | accounts.oksite.eu |
|
| Details | Domain | 1 | cmember.eu |
|
| Details | Domain | 1 | accountslog.puser.eu |
|
| Details | Domain | 1 | accounts.slogin.edu |
|
| Details | Domain | 1 | natescorp.com |
|
| Details | Domain | 1 | accounts.auser.eu |
|
| Details | Domain | 1 | account.koreailmin.com |
|
| Details | Domain | 1 | mailuser.info |
|
| Details | Domain | 1 | accounts.guser.eu |
|
| Details | Domain | 1 | accounts.goooglesecurity.com |
|
| Details | Domain | 1 | mobile.navernnail.com |
|
| Details | Domain | 1 | nidm.navernnail.com |
|
| Details | Domain | 1 | nidlogin.navernnail.com |
|
| Details | File | 1 | accountskk.cer |
|
| Details | File | 1 | loginslive.cer |
|
| Details | File | 1 | accountsmt.cer |
|
| Details | File | 1 | loginsmcmf.cer |
|
| Details | File | 1 | loginsioup.cer |
|
| Details | File | 1 | t1dm.cer |
|
| Details | File | 1 | mysql06.cer |
|
| Details | File | 1 | accountsms.cer |
|
| Details | sha256 | 1 | 9b43f670273b6a12b2b6894a9e29157c1859717594e98ccc5fb3eea05e71f4ed |
|
| Details | IPv4 | 2 | 92.38.135.213 |
|
| Details | IPv4 | 2 | 118.128.149.119 |
|
| Details | IPv4 | 1 | 210.92.18.161 |
|
| Details | IPv4 | 2 | 210.92.18.164 |
|
| Details | IPv4 | 1 | 23.106.122.16 |
|
| Details | IPv4 | 1 | 61.82.110.46 |
|
| Details | IPv4 | 1 | 61.82.110.60 |
|
| Details | IPv4 | 2 | 92.38.160.140 |
|
| Details | IPv4 | 1 | 92.38.160.134 |
|
| Details | IPv4 | 1 | 92.38.160.213 |
|
| Details | IPv4 | 12 | 209.99.40.222 |
|
| Details | IPv4 | 1 | 27.102.66.162 |
|
| Details | IPv4 | 3 | 74.119.239.234 |
|
| Details | IPv4 | 1 | 210.92.18.180 |
|
| Details | IPv4 | 2 | 92.38.135.166 |
|
| Details | IPv4 | 1 | 185.105.35.11 |
|
| Details | IPv4 | 1 | 118.39.76.109 |
|
| Details | Threat Actor Identifier - APT | 783 | APT28 |