A U.S. Tax Scammer's Web Infrastructure through the DNS Lens
WhoisXML API found several artifacts that could be connected to an ongoing U.S. tax scam. Download the threat research materials now.
Continue reading Download reportDNS Investigation: Is xDedic Truly Done for After Its Takedown?
At the height of xDedic’s popularity in 2016, it was said to have provided cybercriminals access to 85,000 hacked web servers.1 In early 2019, however, law enforcement agents from all over the world teamed up and took the cybercrime-as-a-service (CaaS) marketplace down. Are all of its traces gone from the DNS?
WhoisXML API sought to find out by expanding a list of 19 xDedic indicators of compromise (IoCs). Our in-depth analysis led to the discovery of:
- 15 email-connected domains, one of which turned out to be malicious
- 126 IP-connected domains, one of which turned out to be malicious
- Nine string-connected domains
Download a sample of the threat research materials now or contact us to access the complete set of research materials.
—
- [1] https://www.zdnet.com/article/authorities-shut-down-xdedic-marketplace-for-buying-hacked-servers/