A U.S. Tax Scammer's Web Infrastructure through the DNS Lens
WhoisXML API found several artifacts that could be connected to an ongoing U.S. tax scam. Download the threat research materials now.
Continue reading Download reportWhy Domain Seizure May Not Stop Money Mule Recruitment Campaigns
U.S. law enforcement agencies recently seized 18 domains believed to be part of money mule recruitment campaigns in a bid to put a stop to ongoing malware attacks. Bleeping Computer researchers published the indicators of compromise (IoCs) on their blog.1
Did the domain seizure thwart the ongoing malicious campaigns entirely? We sought to find out through an IoC expansion exercise that uncovered:
- A single IP address to which all the seized domains resolved to
- 60+ additional domains that resolved to the same IP address as the domain IoCs did
- 400+ more domains that shared unique strings or string combinations found among the IoCs
- Nine unredacted personal registrant email addresses from the artifacts’ historical WHOIS records
- 100+ additional domains that shared some of the artifacts’ registrant email addresses, two of which were malicious
Download a sample of the threat research materials now or contact us to access the complete set of research materials.
—
- [1] https://www.bleepingcomputer.com/news/security/us-seized-18-web-domains-used-for-recruiting-money-mules/#.Y2_4y1-mshQ.linkedin