Research Center

We’ve recently decided to take an in-depth and personal look inside the modern money mule recruitment ecosystem by using WhoisXML API’s powerful and versatile real-time and historical WHOIS records database, which is one of the security industry’s and the Web’s leading databases for real-time and historical OSINT records. WhoisXML API’s data is a highly recommended tool in the arsenal of OSINT researchers and analysts, which also includes cybercrime researchers and threat intelligence analysts for relevant enrichment and research and analysis.

We’ve recently came across to a third-party research indicating a pretty interesting and important Iran-based foreign influence and disinformation campaign. So, we’ve decided to take a deeper look by using Maltego and WhoisXML API so as to offer additional insights into the disinformation campaign in terms of its online infrastructure.

In this analysis, we’ll use public campaign sources for the sample data and will offer an in-depth peek inside its online infrastructure by using Maltego and WhoisXML API’s vast real-time and historical WHOIS database as well as specifying additional IoCs (Indicators of Compromise) for the purpose of assisting researchers and vendors on their way to stay on top of this campaign.

We decided to take an in-depth look into the infamous hxxp://omerta.cc cybercrime-friendly forum community, which is currently sharing the same infrastructure as the original E-Shop for stolen credit cards information which we’ve already profiled and elaborated on in two separate white papers and case studies. There I decided to continue monitoring and investigating the original E-Shop for stolen credit cards information which we profiled in our original white paper – hxxp://thefreshstuffs.at and came up with some pretty interesting results. Those results also include an additional set of E-shops for stolen credit card information that are actively sharing the same infrastructure of the original E-Shop for stolen credit card information, which we profiled in our original research.

We’ve recently become aware of a malicious targeted spear-phishing client-side exploits dropping campaign that targets legitimate security researchers by approaching them personally or using social media in an attempt to entice them into verifying the validity of a supposedly newly discovered and recently launched Zero Day flaw, which in reality once executed drops malicious software on the hosts of the affected researchers. So, we decided to research even further and offer practical and relevant including actionable intelligence on the campaign’s infrastructure for the purpose of assisting fellow researchers and the industry on its way to track down and monitor the campaign.