Peering into Midnight Blizzard’s DNS Footprint
WhoisXML API found 160 artifacts that could be connected to Midnight Blizzard. Download the threat research materials now.
Continue reading Download reportShedding Light on the Darkode Forum
The Darkode Forum, which started operating in 2007, was taken down through a global effort in 2015.1 But the community came back online in 2019.2
WhoisXML API threat researcher Dancho Danchev sought to find out if the DNS still has traces of Darkode. His deep dive, which began with five domains identified as indicators of compromise (IoCs), into the threat revealed:
- 40+ IP address resolutions of the domains identified as IoCs obtained from DNS lookups
- 30+ unredacted email addresses used to register the domains identified as IoCs from historical WHOIS records
- 3600+ more domains that shared the IoCs’ registrant email addresses or IP addresses from reverse WHOIS and IP lookups
Download a sample of the threat research materials now or contact us to access the complete set of research materials.
—
- [1] https://www.europol.europa.eu/media-press/newsroom/news/cybercriminal-darkode-forum-taken-down-through-global-action
- [2] https://www.forbes.com/sites/kateoflahertyuk/2019/04/10/notorious-hacking-forum-darkode-is-back-online/?sh=1c23ed1252e8