Rogue Bulletproof Hosts Still Alive and Kicking as DNS Intel Shows
WhoisXML API found 6,400+ artifacts that could have ties to rogue bulletproof hosting services. Download the threat research materials now.
Continue reading Download reportShedding Light on the Darkode Forum
The Darkode Forum, which started operating in 2007, was taken down through a global effort in 2015.1 But the community came back online in 2019.2
WhoisXML API threat researcher Dancho Danchev sought to find out if the DNS still has traces of Darkode. His deep dive, which began with five domains identified as indicators of compromise (IoCs), into the threat revealed:
- 40+ IP address resolutions of the domains identified as IoCs obtained from DNS lookups
- 30+ unredacted email addresses used to register the domains identified as IoCs from historical WHOIS records
- 3600+ more domains that shared the IoCs’ registrant email addresses or IP addresses from reverse WHOIS and IP lookups
Download a sample of the threat research materials now or contact us to access the complete set of research materials.
—
- [1] https://www.europol.europa.eu/media-press/newsroom/news/cybercriminal-darkode-forum-taken-down-through-global-action
- [2] https://www.forbes.com/sites/kateoflahertyuk/2019/04/10/notorious-hacking-forum-darkode-is-back-online/?sh=1c23ed1252e8