Infected Device - Accounts for "vs.rs" were observed for sale on the Russian Market, On Oct 10, 2023
Code:
{
"country": "RS",
"date": "2023.10.10",
"files": "archive.zip",
"id": "12611458",
"isp": "Serbia Broadband",
"links": [
"mail.mod.gov.rs",
"mail.mod.gov.rs",
"app.pravnisistem.rs",
"mail.mod.gov.rs",
"mail.vs.rs",
"propisionline.com"
],
"outlook": "-",
"price": "10.00",
"province": "Belgrade",
"size": "0.21Mb",
"stealer": "Redline ",
"vendor": "Th####ow gold"
}Infected Device - Accounts for "vs.rs" were observed for sale on the Russian Market, On Aug 06, 2023
Code:
{
"country": "RS",
"date": "2023.08.02",
"files": "archive.zip",
"id": "11709982",
"isp": "TELEKOM-SRBIJA",
"links": [
"m.facebook.com",
"mediaclient.netflix.com",
"humblebundle.com",
"my.account.sony.com",
"id.sonyentertainmentnetwork.com",
"manpowergroup.rs",
"store.steampowered.com",
"app.android.twitch.tv",
"accounts.google.com",
"skillshare.com",
"rtsplaneta.rs",
"nalog.infostud.com",
"career5.successfactors.eu",
"katana.facebook.com",
"epicgames.com",
"leoni.taleo.net",
"eon.tv",
"prijava.eid.gov.rs",
"login.live.com",
"gateway.hbogo.eu",
"signin.ea.com",
"discordapp.com",
"accounts.google.com",
"gigatron.rs",
"deezer.com",
"newgrounds.com",
"servisi.euprava.gov.rs",
"coinlist.co",
"secure.square-enix.com",
"ecas.ec.europa.eu",
"myanimelist.net",
"prijava.eid.gov.rs",
"ecas.ec.europa.eu",
"paypal.com",
"facebook.com",
"gateway.hbogo.rs",
"nagradenasat.rs",
"ecas.ec.europa.eu",
"id.sonyentertainmentnetwork.com",
"linkedin.com",
"nba2011.gametime.nbaimd.com",
"jobs.siemens.com",
"netflix.com",
"app.android.deezer",
"crunchyroll.com",
"steamcommunity.com",
"humblebundle.com",
"playdauntless.com",
"leoni.taleo.net",
"poslovi.infostud.com",
"accounts.epicgames.com",
"accounts.google.com",
"nba2011.gametime.nbaimd.com",
"acs.firstdata.lv",
"blackdesertonline.com",
"rtsplaneta.rs",
"studenti.mas.bg.ac.rs",
"eu.battle.net",
"anaconda.cloud",
"career2.successfactors.eu",
"login.oracle.com",
"login.live.com",
"account.formula1.com",
"jobs.brose.com",
"kupujemprodajem.com",
"accounts.autodesk.com",
"servisi.euprava.gov.rs",
"smartr.me",
"play.hbomax.com",
"frontpage.reddit.com",
"udemy.com",
"mapgenie.io",
"hbomax.com",
"act.hoyolab.com",
"lstore.rs",
"euprava.gov.rs",
"login.live.com",
"kupindo.com",
"fzs.dev",
"asmp.vipmobile.rs",
"myaccount.nytimes.com",
"idmsa.apple.com",
"accounts.firefox.com",
"secure.limundo.com",
"kupindo.com",
"profreg.medscape.com",
"github.com",
"lilplay.com",
"signup.playster.com",
"rottentomatoes.com",
"cineplexx.rs",
"arkona.kupindo.com",
"xboxachievements.com",
"kupujemprodajem.com",
"us.battle.net",
"login.live.com",
"paypal.com",
"zavvi.com",
"vipmobile.rs",
"signin.ebay.com",
"southpark.cc.com",
"accounts.unity3d.com",
"workhere.co.nz",
"mojsbb.rs",
"hb.posted.co.rs",
"hattrick.org",
"login.ubuntu.com",
"mssql.mywindowshosting.com",
"workingin-newzealand.com",
"zend.com",
"secure.kupindo.com",
"accounts.google.com",
"uplayconnect.ubi.com",
"account2.lego.com",
"codeproject.com",
"marcaria.com",
"accounts.google.com",
"accounts.unrealengine.com",
"cineplexx.rs",
"my.easyname.com",
"localhost",
"poslovi.infostud.com",
"localhost",
"linkedin.com",
"secure.metacritic.com",
"localhost",
"immigration.govt.nz",
"dropbox.com",
"flightaware.com",
"dvig.rs",
"member2.mywindowshosting.com",
"api.twitter.com",
"passport.dx.com",
"mojnalog.telekom.rs",
"mywindowshosting.com",
"oglasindo.rs",
"hb.posted.co.rs",
"reddit.com",
"signin.ea.com",
"immigration.govt.nz",
"secure.pegazhosting.com",
"konsoleh.your-server.de",
"wizzair.com",
"accounts.google.com",
"localhost",
"facebook.com",
"wizzair.com",
"dvig.rs",
"webhostingaustria.at",
"mail.vs.rs",
"thehut.com",
"my.world4you.com",
"twitter.com",
"amazon.com",
"flughafentaxibond.at",
"online.bancaintesabeograd.com",
"member2.mywindowshosting.com",
"secure.twitch.tv",
"netflix.com",
"newkiwis.co.nz",
"fzs.dev",
"sportmagazin.rs",
"limundo.com",
"gigatronshop.com",
"howlongtobeat.com",
"fzs.dev",
"89.216.45.50",
"fzs.dev",
"10.10.30.130",
"jobs.gaijinpot.com",
"nocopyrightsounds.co.uk",
"kms.dev",
"connect.ubi.com",
"vipmobile.rs",
"wizzair.com",
"helloworld.rs",
"id.getharvest.com",
"192.168.0.1",
"metacritic.com",
"admin.comparis.ch",
"polovniautomobili.com",
"admin.comparis.ch",
"accounts.nintendo.com",
"2bike.rs",
"cdkeys.com",
"app.datadoghq.com",
"browserstack.com",
"online.idea.rs",
"euprava.gov.rs",
"mytime.enjoying.rs",
"secure.booking.com",
"upwork.com",
"codeschool.com",
"app.pluralsight.com",
"comparis.ch",
"eon.tv",
"eon.tv",
"asmp.vipmobile.rs",
"winwin.rs",
"passport.aliexpress.com",
"planetasport.rs",
"planetasport.rs",
"qwertee.com",
"signin.gatehub.net",
"wallet.advcash.com",
"bitsane.com",
"iqoption.com",
"cex.io",
"reid.apr.gov.rs",
"linkedin.com",
"paypal.com",
"iaeste.ac.rs",
"sogehomebank.com",
"moj.pausal.rs",
"moj.pausal.rs",
"looksee.co.nz",
"gigatron.rs",
"tickets.formula1.com",
"join.thetimes.co.uk",
"id.sonyentertainmentnetwork.com",
"comparis.bamboohr.co.uk",
"owa.enjoying.rs",
"exchange.comparis.ch",
"id.g2a.com",
"id.sonyentertainmentnetwork.com",
"linkedin.com",
"secure.motogp.com",
"eparking-dev.enjoying.rs",
"udemy.com",
"eparking-dev.enjoying.rs",
"tickets.motogp.com",
"clegc-gckey.gc.ca",
"getpocket.com",
"netflix.com",
"eon.tv",
"account.formula1.com",
"comparis.slack.com",
"trabajos.com",
"login.gog.com",
"servisi.euprava.gov.rs",
"beobuild.rs",
"beobuild.rs",
"intranet.enjoying.rs",
"es.jooble.org",
"otpsrbija.rs",
"zoom.us",
"forum.bjbikers.com",
"srbija.triviador.net",
"watch.nba.com",
"cabanking.creditagricole.rs",
"tickets.funcode.hu",
"deezer.com",
"account.samsung.com",
"timemanager-oauth.enjoying.rs",
"sbb.rs",
"help.steampowered.com",
"store.steampowered.com",
"rtsplaneta.rs",
"ticketmaster.cz",
"livenation.cz",
"192.168.0.1",
"192.168.1.1",
"192.168.0.1",
"warranty.makita.eu",
"zios.mpn.gov.rs",
"fotocasa.es",
"myaccount.nytimes.com",
"account.activedirectory.windowsazure.com",
"clockify.me",
"forums.flightsimulator.com",
"app.pinetool.ai",
"bear.rs",
"video.geekle.us",
"miro.com",
"games.rs",
"sts.enjoying.rs",
"my.account.sony.com",
"id.sonyentertainmentnetwork.com",
"accounts.google.com",
"id.sonyentertainmentnetwork.com",
"tecnoempleo.com",
"udemy.com",
"login.newrelic.com",
"mojsbb.rs",
"strava.com",
"app.bodyfx.com",
"bloomberg.com",
"rs.accounts.ikea.com",
"korisnickapodrska.com",
"sso.dorna.com",
"korisnickapodrska.com",
"servicedesk.comparis.ch",
"sale.benqi.fi",
"secure.newegg.com",
"accounts.hetzner.com",
"coinlist.co",
"ebank.otpbanka.rs",
"my.account.sony.com",
"asmp.a1.rs",
"buzzsneakers.com",
"192.168.0.1",
"miro.com",
"ematrica.nemzetiutdij.hu",
"exchange.comparis.ch",
"download.hetzner.de",
"sale.ardana.org",
"carvertical.com",
"ecas.ec.europa.eu",
"nebula.app",
"app.pluralsight.com",
"eparking.rs",
"curiositystream.com",
"prijava.eid.gov.rs",
"github.com",
"nebula.tv",
"paypal.com",
"misterd.rs",
"login.yahoo.com",
"id.aeon.co",
"appleid.apple.com",
"play.hbomax.com",
"ecas.ec.europa.eu",
"securitas-dokumenti.com",
"gamers-outlet.net",
"app.clockify.me",
"admin.comparis.ch",
"kredium.rs",
"eon.tv",
"servisi.pio.rs",
"biglietti.monzanet.it",
"accounts.google.com",
"lstore.rs",
"my.anydesk.com",
"m.facebook.com",
"mediaclient.netflix.com",
"humblebundle.com",
"my.account.sony.com",
"id.sonyentertainmentnetwork.com",
"manpowergroup.rs",
"store.steampowered.com",
"app.android.twitch.tv",
"accounts.google.com",
"skillshare.com",
"rtsplaneta.rs",
"nalog.infostud.com",
"career5.successfactors.eu",
"katana.facebook.com",
"epicgames.com",
"leoni.taleo.net",
"eon.tv",
"prijava.eid.gov.rs",
"login.live.com",
"gateway.hbogo.eu",
"signin.ea.com",
"discordapp.com",
"accounts.google.com",
"gigatron.rs",
"deezer.com",
"newgrounds.com",
"servisi.euprava.gov.rs",
"coinlist.co",
"secure.square-enix.com",
"ecas.ec.europa.eu",
"myanimelist.net",
"prijava.eid.gov.rs",
"ecas.ec.europa.eu",
"paypal.com",
"facebook.com",
"gateway.hbogo.rs",
"nagradenasat.rs",
"ecas.ec.europa.eu",
"id.sonyentertainmentnetwork.com",
"linkedin.com",
"nba2011.gametime.nbaimd.com",
"jobs.siemens.com",
"netflix.com",
"app.android.deezer",
"crunchyroll.com",
"steamcommunity.com",
"humblebundle.com",
"playdauntless.com",
"leoni.taleo.net",
"poslovi.infostud.com",
"accounts.epicgames.com",
"accounts.google.com",
"nba2011.gametime.nbaimd.com",
"acs.firstdata.lv",
"blackdesertonline.com",
"rtsplaneta.rs",
"studenti.mas.bg.ac.rs",
"eu.battle.net",
"anaconda.cloud",
"career2.successfactors.eu",
"login.oracle.com",
"login.live.com",
"account.formula1.com",
"jobs.brose.com",
"kupujemprodajem.com",
"accounts.autodesk.com",
"servisi.euprava.gov.rs",
"smartr.me",
"play.hbomax.com",
"frontpage.reddit.com",
"udemy.com",
"mapgenie.io",
"hbomax.com",
"act.hoyolab.com",
"lstore.rs",
"euprava.gov.rs",
"login.live.com",
"kupindo.com",
"fzs.dev",
"asmp.vipmobile.rs",
"myaccount.nytimes.com",
"idmsa.apple.com",
"accounts.firefox.com",
"secure.limundo.com",
"kupindo.com",
"profreg.medscape.com",
"github.com",
"lilplay.com",
"signup.playster.com",
"rottentomatoes.com",
"cineplexx.rs",
"arkona.kupindo.com",
"xboxachievements.com",
"kupujemprodajem.com",
"us.battle.net",
"login.live.com",
"paypal.com",
"zavvi.com",
"vipmobile.rs",
"signin.ebay.com",
"southpark.cc.com",
"accounts.unity3d.com",
"workhere.co.nz",
"mojsbb.rs",
"hb.posted.co.rs",
"hattrick.org",
"login.ubuntu.com",
"mssql.mywindowshosting.com",
"workingin-newzealand.com",
"zend.com",
"secure.kupindo.com",
"accounts.google.com",
"uplayconnect.ubi.com",
"account2.lego.com",
"codeproject.com",
"marcaria.com",
"accounts.google.com",
"accounts.unrealengine.com",
"cineplexx.rs",
"my.easyname.com",
"localhost",
"poslovi.infostud.com",
"localhost",
"linkedin.com",
"secure.metacritic.com",
"localhost",
"immigration.govt.nz",
"dropbox.com",
"flightaware.com",
"dvig.rs",
"member2.mywindowshosting.com",
"api.twitter.com",
"passport.dx.com",
"mojnalog.telekom.rs",
"mywindowshosting.com",
"oglasindo.rs",
"hb.posted.co.rs",
"reddit.com",
"signin.ea.com",
"immigration.govt.nz",
"secure.pegazhosting.com",
"konsoleh.your-server.de",
"wizzair.com",
"accounts.google.com",
"localhost",
"facebook.com",
"wizzair.com",
"dvig.rs",
"webhostingaustria.at",
"mail.vs.rs",
"thehut.com",
"my.world4you.com",
"twitter.com",
"amazon.com",
"flughafentaxibond.at",
"online.bancaintesabeograd.com",
"member2.mywindowshosting.com",
"secure.twitch.tv",
"netflix.com",
"newkiwis.co.nz",
"fzs.dev",
"sportmagazin.rs",
"limundo.com",
"gigatronshop.com",
"howlongtobeat.com",
"fzs.dev",
"89.216.45.50",
"fzs.dev",
"10.10.30.130",
"jobs.gaijinpot.com",
"nocopyrightsounds.co.uk",
"kms.dev",
"connect.ubi.com",
"vipmobile.rs",
"wizzair.com",
"helloworld.rs",
"id.getharvest.com",
"192.168.0.1",
"metacritic.com",
"admin.comparis.ch",
"polovniautomobili.com",
"admin.comparis.ch",
"accounts.nintendo.com",
"2bike.rs",
"cdkeys.com",
"app.datadoghq.com",
"browserstack.com",
"online.idea.rs",
"euprava.gov.rs",
"mytime.enjoying.rs",
"secure.booking.com",
"upwork.com",
"codeschool.com",
"app.pluralsight.com",
"comparis.ch",
"eon.tv",
"eon.tv",
"asmp.vipmobile.rs",
"winwin.rs",
"passport.aliexpress.com",
"planetasport.rs",
"planetasport.rs",
"qwertee.com",
"signin.gatehub.net",
"wallet.advcash.com",
"bitsane.com",
"iqoption.com",
"cex.io",
"reid.apr.gov.rs",
"linkedin.com",
"paypal.com",
"iaeste.ac.rs",
"sogehomebank.com",
"moj.pausal.rs",
"moj.pausal.rs",
"looksee.co.nz",
"gigatron.rs",
"tickets.formula1.com",
"join.thetimes.co.uk",
"id.sonyentertainmentnetwork.com",
"comparis.bamboohr.co.uk",
"owa.enjoying.rs",
"exchange.comparis.ch",
"id.g2a.com",
"id.sonyentertainmentnetwork.com",
"linkedin.com",
"secure.motogp.com",
"eparking-dev.enjoying.rs",
"udemy.com",
"eparking-dev.enjoying.rs",
"tickets.motogp.com",
"clegc-gckey.gc.ca",
"getpocket.com",
"netflix.com",
"eon.tv",
"account.formula1.com",
"comparis.slack.com",
"trabajos.com",
"login.gog.com",
"servisi.euprava.gov.rs",
"beobuild.rs",
"beobuild.rs",
"intranet.enjoying.rs",
"es.jooble.org",
"otpsrbija.rs",
"zoom.us",
"forum.bjbikers.com",
"srbija.triviador.net",
"watch.nba.com",
"cabanking.creditagricole.rs",
"tickets.funcode.hu",
"deezer.com",
"account.samsung.com",
"timemanager-oauth.enjoying.rs",
"sbb.rs",
"help.steampowered.com",
"store.steampowered.com",
"rtsplaneta.rs",
"ticketmaster.cz",
"livenation.cz",
"192.168.0.1",
"192.168.1.1",
"192.168.0.1",
"warranty.makita.eu",
"zios.mpn.gov.rs",
"fotocasa.es",
"myaccount.nytimes.com",
"account.activedirectory.windowsazure.com",
"clockify.me",
"forums.flightsimulator.com",
"app.pinetool.ai",
"bear.rs",
"video.geekle.us",
"miro.com",
"games.rs",
"sts.enjoying.rs",
"my.account.sony.com",
"id.sonyentertainmentnetwork.com",
"accounts.google.com",
"id.sonyentertainmentnetwork.com",
"tecnoempleo.com",
"udemy.com",
"login.newrelic.com",
"mojsbb.rs",
"strava.com",
"app.bodyfx.com",
"bloomberg.com",
"rs.accounts.ikea.com",
"korisnickapodrska.com",
"sso.dorna.com",
"korisnickapodrska.com",
"servicedesk.comparis.ch",
"sale.benqi.fi",
"secure.newegg.com",
"accounts.hetzner.com",
"coinlist.co",
"ebank.otpbanka.rs",
"my.account.sony.com",
"asmp.a1.rs",
"buzzsneakers.com",
"192.168.0.1",
"miro.com",
"ematrica.nemzetiutdij.hu",
"exchange.comparis.ch",
"download.hetzner.de",
"sale.ardana.org",
"carvertical.com",
"ecas.ec.europa.eu",
"nebula.app",
"app.pluralsight.com",
"eparking.rs",
"curiositystream.com",
"prijava.eid.gov.rs",
"github.com",
"nebula.tv",
"paypal.com",
"misterd.rs",
"login.yahoo.com",
"id.aeon.co",
"appleid.apple.com",
"play.hbomax.com",
"ecas.ec.europa.eu",
"securitas-dokumenti.com",
"gamers-outlet.net",
"app.clockify.me",
"admin.comparis.ch",
"kredium.rs",
"eon.tv",
"servisi.pio.rs",
"biglietti.monzanet.it",
"accounts.google.com",
"lstore.rs",
"my.anydesk.com"
],
"outlook": "-",
"price": "10.00",
"province": "Central Serbia",
"size": "0.81Mb",
"stealer": "lumma ",
"vendor": "Mo####yf [Diamond]"
}Infected Device - Accounts for "vs.rs" were observed for sale on the Russian Market, On Jul 18, 2023
Code:
{
"country": "RS",
"date": "2023.07.17",
"files": "archive.zip",
"id": "11557418",
"isp": "TELEKOM-SRBIJA",
"links": [
"mail.vs.rs",
"in.pinterest.com"
],
"outlook": "-",
"price": "10.00",
"province": "Central Serbia",
"size": "0.15Mb",
"stealer": "Racoon ",
"vendor": "Mo####yf [Diamond]"
}
U poslednje vreme kruži phishing kampanja gde se napadač lažno predstavlja kao advokat i nudi vam ogromnu sumu novcu koju ste "nasledili".
Link: https://twitter.com/Studentbgd/status/17...6995516576
Posted by: Jana
12-11-2023, 03:34 PM
Forum: Seminari, predavanja, radionice, konferencije
- No Replies
12-11-2023, 03:34 PM
Forum: Seminari, predavanja, radionice, konferencije
- No Replies
Od ponedeljka 11.12. u Novom Sadu Tilda Centar počinje ponovo sa radom gde su svakog ponedeljka dobrodošli open-source entuzijasti, hakeri i stručnjaci iz raznih oblasti.
Lokacija: Šekspirova 4
Link: https://www.linkedin.com/posts/tilda-cen...er_desktop
Zdravo, krenula je nova phishing kampanja vezana za NLB banku.
Napadaci pokusavanju da navedu primaoce da kliknu na link.
IP adresa sa koje salje:
Authentication-Results
spf=softfail (sender IP is 148.163.129.49) smtp.mailfrom=botteselle.cl; dkim=pass (signature was verified) header.d=botteselle.cl;dmarc=bestguesspass action=none header.from=botteselle.cl;compauth=pass reason=109
Adresa jeste prijavljena vise puta kao Phishing i SPAM: https://www.abuseipdb.com/check/148.163.129.49
From adresa: [email protected]
Return Path: [email protected]
Subject: Ажурирање налога: Потребне су нам информације
adres na koju vodi vise nije vazeca: http://www.mta2nziwmdcw.com/
Napadaci nemaju azurne informacije i salju na mejlove koji su stariji od godinu dana.
Navodno Pošta radi i ovo: https://twitter.com/sevichius/status/173...3727465891
https://www.bleepingcomputer.com/news/se...re-attack/
hse.si CloudFlare: 104.22.9.52 104.22.8.52 172.67.12.100
Na sajtu shodan.io pronadjeno je ukupno 5377 kamera koje su online dostupne u BiH.
Link: https://twitter.com/vladimircicovic/stat...0019953996
Možda je outdate, ali su ipak imali pristup control panel-u sajta dualsoft.net (dualsoft.rs) sistem za sportsko klađenje. Imali su pristup ftp-a, server logs fajlovi, najverovatnije i baza podataka.