A U.S. Tax Scammer's Web Infrastructure through the DNS Lens
WhoisXML API found several artifacts that could be connected to an ongoing U.S. tax scam. Download the threat research materials now.
Continue reading Download reportTracing Connections to Rogue Software Spread through Google Search Ads
Bleeping Computer’s analysis of a recent malicious campaign targeting users looking for open-source software download sites publicized 68 domains as indicators of compromise (IoCs).1
WhoisXML API researchers expanded that list aided by WHOIS and DNS intelligence and uncovered 800+ more artifacts, including 36 malicious web properties. These are:
- Two unredacted registrant email addresses from the IoCs’ current WHOIS records that led to 18 email-connected domains
- Two IP addresses to which the IoCs’ resolved, both of which were found malicious
- 329 IP-connected domains, five of which turned out to be malicious
- 84 string-connected domains, two of which were malicious
- 387 domains that contained the 11 software brands the attackers targeted, 27 of which were confirmed malware hosts
Download a sample of the threat research materials now or contact us to access the complete set of research materials.
—
- [1] https://www.bleepingcomputer.com/news/security/hackers-push-malware-via-google-search-ads-for-vlc-7-zip-ccleaner/