A U.S. Tax Scammer's Web Infrastructure through the DNS Lens
WhoisXML API found several artifacts that could be connected to an ongoing U.S. tax scam. Download the threat research materials now.
Continue reading Download reportCareful, the Next Premium SMS Offer You Subscribe to May Be Malicious
Avast recently reported that SMSFactory Android Trojan has affected around 165,000 users worldwide.1 But so far, only a few digital properties have been publicized as indicators of compromise (IoCs).2
If you don’t want to lose as much as US$336 a year to cybercriminals, our detailed threat research materials may be able to help.
Our deep dive into the threat revealed that:
- The threat actors behind SMSFactory Android Trojan typically used newly registered domains (NRDs).
- The domain IoCs resolved to three unique seemingly dedicated IP addresses.
- Close to 200 domains shared the IoCs’ IP addresses, three of which have been dubbed “malicious.”
- Almost half of the possibly connected domains hosted the same content as the three malicious web properties identified.
- Nearly 1,200 domains shared common strings with the IoCs, four of which are already considered malicious.
Download a sample of the threat research materials now or contact us to access the complete set of research materials.
---
- [1] https://blog.avast.com/smsfactory-android-trojan
- [2] https://otx.alienvault.com/pulse/629c7c22660f94c3764f9e6a