Thumbing through the DNS Traces of TamperedChef | WhoisXML API
WhoisXML API found 1,000+ artifacts that could be tied to TamperedChef. Download the threat research materials now.
Continue reading Download reportChasing After RacoonO365 IoCs Using DNS and Domain Intelligence
In September 2025, Cloudflare and Microsoft jointly disrupted RaccoonO365, a Phishing-as-a-Service (PhaaS) operation that had enabled cybercriminals to steal over 5,000 user credentials worldwide. Despite the takedown, traces of the infrastructure remain scattered across the internet.
In its threat brief, Cloudflare1 listed numerous indicators of compromise (IoCs), including three cryptocurrency addresses, 21 subdomains, and 77 domain names.
Our research team analyzed the domains tagged as IoCs, leading to the discovery of:
- 121 email-connected domains
- 163 additional IP addresses, 159 were malicious
- 311 IP-connected domains, one was malicious
- 49 string- and registrar-connected domains, two were malicious
- All domain IoCs containing the string “o365” were predicted to be malicious an average of 61 days before their publication date.
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://www.cloudflare.com/threat-intelligence/research/report/cloudflare-participates-in-global-operation-to-disrupt-raccoono365/#coordinating-our-racoono365-disruption