Microsoft SharePoint - Šifrovani dokumenti spam

[milos_rs]

Evo još jedan phish koji je deo iste kampanje:

   

Link je pub-0e3ea9ee1ab440899b11595aa49093fe.r2 .dev/index.html#mejl@ovde a sajt izgleda ovako:

   

Code:

pub-0e3ea9ee1ab440899b11595aa49093fe.r2.dev has address 104.18.3.35
pub-0e3ea9ee1ab440899b11595aa49093fe.r2.dev has address 104.18.2.35

Ovaj r2.dev je od cloudflare-a i koristi se sve više u phishingu: https://www.trustwave.com/en-us/resource...c-buckets/

   

Kada se unese šifra šalje je na mnemonicparsingbackup .xyz/billions.php što je isti domen kao i prethodni phish. Registracija domena i hosting ovoga je na Namecheap-u.

Code:

mnemonicparsingbackup.xyz has address 68.65.122.110
mnemonicparsingbackup.xyz mail is handled by 20 mx3-hosting.jellyfish.systems.
mnemonicparsingbackup.xyz mail is handled by 10 mx2-hosting.jellyfish.systems.
mnemonicparsingbackup.xyz mail is handled by 5 mx1-hosting.jellyfish.systems.