An Iran-based hacker forum that was shut down in 2018 became active again last year.¹ While our initial investigation at that time uncovered 100+ digital properties related to the group, our most recent exploration exposes thousands more. 

WhoisXML API threat researcher Dancho Danchev performed an open source intelligence (OSINT) analysis of the Ashiyane Digital Security Team’s Internet-connected infrastructure, uncovering the following key findings:

• 11,000+ malicious and fraudulent domain names operated and managed by the Ashiyane Digital Security Team.

• About 35% of these properties actively resolving to IP addresses, with several hosting gambling, adult, news, and possible phishing content targeting Apple, Intuit, PayPal, and Walmart.
• More than half of the domains were registered with Media Elite Holdings Limited and used the privacy protection company called “Fundacion Privacy Services Ltd.”
• Only about 1% of the properties have been flagged as malicious by malware engines despite their association with the threat group.

Download a sample of the threat research materials now or contact us to access the complete set of research materials.

—

• [1] https://main.whoisxmlapi.com/threat-reports/exposing-100-domains-possibly-belonging-to-the-ashiyane-digital-security-team