A DNS Investigation of the GootLoader Campaign
WhoisXML API found 1,000+ artifacts that could be connected to the GootLoader campaign. Download the threat research materials now.
Continue reading Download reportThe Inner Workings of the Russian Business Network
VeriSign dubbed the Russian Business Network (RBN) as “the baddest of the bad”1 in a report. And the fact that it played host to sites owned by the most notorious spammers, malware operators, phishers, distributed denial-of-service (DDoS) attackers, and other cybercriminals proved that.2
Has RBN ceased operating or does it remain active? WhoisXML API threat researcher Dancho Danchev sought to find out. His investigation uncovered:
- 20+ unredacted email addresses used to register the domains identified as indicators of compromise (IoCs)
- Close to 50 IP addresses to which the domains resolved
- Nearly 400 possibly connected domains as they shared the IoCs’ registrant email addresses or IP hosts, four of which have been dubbed “malicious” by various malware engines
Download a sample of the threat research materials now or contact us to access the complete set of research materials.
—
- [1] http://economist.com/displaystory.cfm?story_id=9723768
- [2] https://www.itprotoday.com/windows-78/what-russian-business-network