Behind the Genesis Market Infrastructure: An In-Depth DNS Analysis
The Federal Bureau of Investigation (FBI) and other law enforcement agencies shut down Genesis Market, a darknet market for cybercriminal attack tools, in April 2023.1 Apart from seizing the operators’ infrastructure, more than a hundred people were nabbed for taking part in the malicious operation. Does that spell the end for the black market?
The WhoisXML API research team sought to find out using 12 email addresses Dancho Danchev collated as indicators of compromise (IoCs). To determine if any Genesis Market web properties remain online, we performed an IoC list expansion analysis that led to the discovery of:
- 28 email-connected domains
- Five IP addresses
- Two IP-connected domains
- 2,417 string-connected domains, three of which turned out to be malicious based on a bulk malware check
Download a sample of the threat research materials now or contact us to access the complete set of research materials.
—
[1] https://techcrunch.com/2023/04/05/fbi-genesis-market-seized-stolen-logins/
Latest Reports
Integrity Technology Group-Backed Actors Combine Automated and Manual Tools in Global Attack
WhoisXML API uncovered 7,100+ additional artifacts linked to the Integrity Tech-enabled global data theft attack. Download the threat research materials now.
Earth Sirrush Espionage Tool Evolution: DNS Facts Unveiled
WhoisXML API uncovered 400+ additional artifacts linked to Earth Sirrush. Download the threat research materials now.
Four hours before PHP2Shell’s Disclosure
A server scouted our honeypots 4 hours before PHP2Shell’s disclosure, then returned with exploit attempts. The report covers its traffic history and IoCs.