A DNS Deep Dive into FUNNULL’s Triad Nexus
WhoisXML API found 11,900+ artifacts that could be connected to Triad Nexus. Download the threat research materials now.
Continue reading Download reportExamining a U.S. Tax Scammer's Web Infrastructure through the DNS Lens
As 15 April 2024, the deadline for filing taxes in the U.S., draws near, it is not surprising that scammers have come out of their hiding holes once again. One particular U.S. tax scammer, in fact, has been reportedly going after small businesses and self-employed individuals.1
Three domains have been identified as indicators of compromise (IoCs) for the threat. We expanded that list to identify other web properties that could be part of the threat actor’s attack infrastructure and uncovered:
- Nine email-connected domains
- One IP address that turned out to be malicious
- Nine domains that contained a string found among the IoCs
Fellow security researchers also noted the growing popularity of scams featuring fake tax preparers,2 among other tax-related fraud, which we also looked into.
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response.
—
- [1] https://www.malwarebytes.com/blog/uncategorized/2024/03/tax-scammer-goes-after-small-business-owners-and-self-employed-people
- [2] https://www.washingtonpost.com/business/2024/03/06/irs-tax-preparer-fraud/