Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.
Slow Pisces gained renown for stealing billions of dollars from the cryptocurrency sector in various countries since 2023. It is up to no good again as it recently trailed its sights on cryptocurrency developers, engaging with them on LinkedIn in their 2025 campaign.1
Palo Alto Unit 42 reported on the attack and identified 54 indicators of compromise (IoCs) in the process. WhoisXML API expanded the current list of IoCs and uncovered other potentially connected artifacts comprising:
- 12 alleged victim IP records obtained from the Internet Abuse Signal Collective (IASC) tied to five Autonomous System numbers (ASNs)
- 551 email-connected domains
- One additional IP address that turned out to be malicious
- 179 IP-connected domains
- 389 string-connected domains, three of which turned out to be malicious
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/