DomainHighVerifiedSignal 58/100
asm-air.com
Location
NetherlandsFirst Seen
Feb 18, 2024
Last Seen
Aug 13, 2025
Found in 4 reports. Confidence: high. · Confidence scores are heuristic. Verify before acting on results.
Domain Name
Malicious domain used for C2, phishing, or malware distribution.
MISP Category
Network Activity
Confidence
58%
Signal Score
58 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Feed Intelligence Summary
4 reports58% confidence
4
Source reports
58%
Confidence score
Category tags
4m mviendbaaaaaaaa nxdomainabuseabuse contactacademic institutionsacceptaccess controlaccount compromiseaccount securityacintactive relatedactive threatad tevdagadded activeaddressadloadadwareadwindafricaafrinicagentagent teslaaigalbertaalberta metaalertsalexaalexa topall octoseekall scoreblueall searchamadeyamerica asnanalysis dateanalyzeanalyzer pasteapacheapi blogapnicappleapple iosapple phoneapplication developmentapplied researcharinartemisartroas16876 icannascii textasiaasia pacificasnoneasnone unitedasyncratattackattacksautoav detectionsavailable fromawfulaws ec2azorultb3viles0 febbackbackdoorbangladeshbank securitybankerbankerxbankingbbygxbehavbeijing baidubitcoinbitrepblacklist httpblacklist httpsblacknet ratblinkblockchainbluenoroffbodybody doctypebody lengthbotnetbrianbrian sabeybrontokbrute force attackbundledc2 channelc2 commandscachecallscamscanada unknowncapturecar bomb threatscellebrite ufedcfqirgdhj5 httpcfqirgdhj5 urlcheckin m1china domainchina flagchina unknownchromecisco umbrellacitycivil servicescivil societyck idck matrixclasscleanerclick-based attackcloud hostcloud servicescloud storagecnamecnusco sheriffcobalt strikecobaltstrikecode executioncode injectioncoinminercollegecommandcommand and controlcommand executioncommodity contracts intermediationcommunication protocolcommunication technologiescommunity managementcompany limitedcompanyname gmcomspecconduitconfigcontactcontacted urlscontent generatingcontent sharingcookiecopy md5corecorporate espionagecount blacklistcountrycovid19creation datecredential accesscredential harvestingcredential stuffingcredential theftcredit card servicescritical riskcrypcrypto exchangecrypto miningcrypto walletcryptocurrencycryptocurrency threatscryptojackingcsc corporatecve typecvescyber harassmentcyber stalkingcyber threatsdamagedangerdark powerdark webdata accessdata cdata copyingdata encryptiondata exfiltrationdata leakdata misusedata transferdata uploaddbatloaderddos attacksde indicatorsdecentralized financedecoy systemdeepscandeletedelphidetected m1detected m2detection listdetections filedetections typedevelopment labsdevelopment methodologiesdevopsdgadhsdhdigital currencydigital platformsdigital profilediscorddistributed attacksdiv divdjindnspionagednssecdockdocs pricingdomestic cyber terrorismdonedouglas countydownldrdownload csvdownloaderdraiedrivedroppeddropperdynadot llcdynamicdynamic dnsdynamicloaderecacc saa83ddeducational resourceseducational serviceseducational technologyelectronic health recordself collectionelf executableelf wgetboatemailsemotetencdocencryptenter soudcetdienterprise securityentriesentries founderroret cinsetpro trojaneuropeeurope/asiaevadereventsexcludeexclude suggesexodusexodus malwareexpirationexpiration dateexplexploitextortionextr dataextraction dataextri dataextri includefactoryfailedfakedout threatfalconfalcon sandboxfalse informationfamilyfareitfederal creditfeedsfeeds iocfilefilesfiles domainfiles hostnamefiles locationfiles relatedfinal urlfinancefinancial crimesfinancial institutionfinancial servicesfinancial technologyfindfind sfireeyefireholfirstflagfor privacyformatpng febfoundfound pefoundryframingfrancefueryfusioncoregandi sasgeneral fullgenericgeneric malwaregermanyget h2ghost ratgithub pagesglobalnpfgmbh versiongmogmo internetgo.sabeygooglegoogle llcgoogle safegophergovernment technologygp practicegraph communitygtmkr32guardhackershackinghall renderhashesheadersheaders dateheaders nelhealth care and social assistancehealth information technologyhealthcare information systemsheurhighhigher educationhighly targetedhistoricalhistorical otxhistorical sslhospital managementhostinghostname addhostname enumerationhstrhtmlhtml infohttp attackhttp responsehttp scannerhttpshwp supporthybridianaiana idiana reficedidicmp trafficiconidat bidatxidentity theftids detectionsiframeinclude reviewindicatorinfection sourceinformation gatheringinformation technologyinfostealerinfrastructure acquisitionreconnaissanceingress tool transferinjectioninnovation managementinput threatinput validation bypassintelinternet of thingsiociocsiosios unlockeriot botnetiot/ics attackipv4ipv4 addipv4 addressisrael unknownit infrastructureit's backjapan unknownjeffrey scottjson datajson urljunk datak-12 educationkey algorithmkey identifierkeygenkeyloggerkeyloggerskgs0killavkimsukykld1063kls0kryptiklacniclazaruslazarus grouplearnlevel analysislicenselifelimitedlinuxllwnlocallocuologicloginlogin0lokibotlokibot requestlolkeklos angeleslow risklucky guylumma stealermail spammermainmakopmalicious activitymalicious adwaremalicious downloadmalicious hostmalicious linksmalicious malwaremalicious sitemalicious softwaremalicious urlsmalvertisingmalvertizingmalwaremalware distributionmalware foundmalware genericmalware httpmalware sitemarkmark brian sabeymark sabeymarkmonitormatches rulemaxads0media centermedical servicesmediummedium highmemscanmessagemeta tagsmetadata analysismetastealermeterpretermetromexicomicrosoft waymillionmillion alexaminiminimal lowmirai botnetmitre attmkdirmobilemobile carriersmobile devicemobile device exploitationmobile networksmobile securitymodelmodule loadmonitoringmonths agomorphexmovedmozillamsiemtismulti scanmusicmusic industrymyappnamename servername serversname tacticsname verdictnancorenanocore ratneshtaneshta virusnetcom sciencenetherlandsnetskynetworknetwork scanningnewsnextnext associatednimdanircmdnjratno datano entriesno expirationnoname057north americanovno jannumbero tiresobject modelobserved emailobz4usfn0 httpobz4usfn0 urloccamyofficeoffice openonline sasopenopen pasteopen portsoperating system securityoracleorgabusephoneorgidotx octoseekotx scoreblueotx telemetryoutlookoverview ippagepalantir foundrypassive dnspasswordpassword attackspassword stealerpastepatchpatch managementpatcherpath pattern matchpath traversalpatientpatient carepattern matchpayloadspayment processingpayment securitypayment system attackpaypalpcappdf cellebritepdf reportpe resourcepe sectionpeexe cpegasuspegasus attackspegasus spywarepersonal dataphiphishingphishing attackphishing sitepingplatform interferenceplay ransomwarepornpornhubportpostpragmapresent augpresent junpresent sepprivacy incprivate sectorprivilege httpsprobeprocess injectionprocess32nextwproduct developmentprotectprotocol h2proxypryntpsexecpublic administrationpublic infrastructurepublic policypulse httppulse pulsespulse submitpulse usepulsespulses nonepulses otxpulses urlpurduepushputtyqakbotqbotqbot qakbotqbot typeqmountquackbotquality assurancequasarquasar ratquothr&d strategyraccoonrandom domainsrandom hostsransomransomexxransomwareratratelravenreadread creconnaissancerecord valuered teamredacted forredirectorredline stealerredlinestealerregistrarsaferegistry domainregszregulatory agenciesreimer dptrejected samplerelated nidsrelated pulsesrelated tagsrelicremoteremote accessremote servicesreport spamreportsreputation damagereputation ipreputation manipulationrequest idresearch & developmentresearch methodologyresearchedresource hijackingrevenge ratreverse dnsreviewrims httpsripe nccrobotorole titleromania unknownrootsrostpayroundupruntime processrussiasa victimsabeysafe sitesahilsamplessarsrxscan endpointsscientific researchscreen capturescriptscript domainsscript urlssea altsea xsearchsearch livesecrisksecure serversecurity policysecurity risksecurity tlsseraphserver responseserversserviceserving ipsetupsfqh4dt74w0 urlsherrifshop tiresshowshow techniqueshowingsiblings parentsimda httpsitesite safesite topsize68b typeskynetslcc2smear campaignsmokeloadersocial analyticssocial engineeringsocial mediasocial media abusesocial media marketingsocial media securitysocial networkingsoftware architecturesoftware developmentsoftware engineeringsoftware exploitationsoftware testingsoftware vulnerabilitiessong culturesoranosouth carolinaspainspammerspanspan h2span spanspoofedsportspyingssl certssl certificatessl vulnerabilitystalking tacticsstatic enginestatusstatus codestealerstixstopstop xstopransomwarestorystringsstusstyle1subject keysuggessummarysummary iocssuperwebbysearchsurveillance campaignsuspsuspicswisynswrortsystem disruptionsysvt1003t1005t1012t1021t1027t1030t1036t1041t1055t1056t1056.001t1057t1059t1059.001t1059.007t1064t1071t1071.001t1078t1082t1083t1105t1106t1110t1110.001t1110.002t1110.003t1110.004t1114t1129t1132t1133t1140t1190t1203t1204.001t1204.002t1486t1490t1496t1499.001t1499.002t1499.003t1534t1546t1555t1565t1566t1566.001t1566.002t1566.003t1566.004t1569.002t1573t1583t1584t1587.001t1588t1589t1589.001t1590.001t1592t1595t1598tablettag counttag managertagstargettargets sateamteam internetteam proxyteamsteams apitechnology researchtelecom servicestelecommunicationstelefonica detemptextthreatthreat actorthreat actor groupthreat analyzerthreat intelligencethreat networkthreat preventionthreat reportthreat rounduptiggretimetirestires languagetitletitle addedtitle shoptld counttlsv1tlsv1 aprtofseetoolstrackers googletrojan malwaretrojandroppertrojanspytrojanxtsara brashearstulachtwittertwitter runningtypetype indicatortype nametypeid1tzw variantsuac bypassufed iphoneufed releaseunicode textunionuniqueunitedunited kingdomunited statesunknown nsunruyunsafeunsafeevaluny inuuueupgradeurlrefurlsurls httpurls httpsurls showursnifusa windowsusageuser engagementuser executionutcutc submissionsv3 serialvaluevaryverdict vpnvidarview detailsvirgin islandsvirtoolvirus networkvt graphwacatacwealth managementweb application exploitationweb exploitationweb generatorweb securityweb trafficwebico companywheels onlinewhitewhois lookupwhois lookupswhois recordwhois sslwhois whoiswin32 dllwin32 exewin32 malwarewindirwindows malwarewindows ntwiperwormwritewrite cwunderx308bx509v3 extendedx509v3 keyxamzexpires300xml documentxportxratxserverxtratyara detectionsyara rulezbotzpevdo
Activity Timeline
Aug 13Aug 13
Threat Activity Heatmap
· Peak: 2025-08-13LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
0
Dormant
Intelligence SummaryAI Generated
The domain **asm-air.com**, originating from the Netherlands, has been identified as a significant indicator of compromise (IOC) associated with multiple cyber threats. First observed on February
Threat ScoreMedium Risk
58
SIGNAL
Signal Score
58%
Confidence
4
Reports
First seenFeb 18, 2024
Last seenAug 13, 2025
Verified IOC
VirusTotal
Not checked
WHOIS
- registrar
- GoDaddy.com, LLC
- description
- FT Adviser | Foundry - platform.twitter.com + Apple + T-Mobile | ImFurther investigation of familiar IoC’s in Tethering T-mobile to iOS research. Palantir is the the Cyber Defense Firm that provides the weapons, man force, military, false arrest records ,reputation damage, the man who drove her off the road, constant stalking and the marketing of her music in other media. Realize this hot stock you’re investing is a domestic and international terrorist organization. There are several People here being 24/7/365 monitored. They have fulfillment centers from Amazon and can provide food to medicine, they have the entire military, all government contracts and their own physicians. #malware #foundry #rip #palantir # twitter #paypalmafia #quasi #government # workerscompensation #law_enforcement # #jeffreyreimer #sabey #tsarabrashearslivesinourhearts
- domain rank
- -1
- raw
- Creation Date: 2013-10-23T04:32:44Z DNSSEC: unsigned Domain Name: ASM-AIR.COM Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited Domain Status: clientRenewProhibited https://icann.org/epp#clientRenewProhibited Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited Name Server: NS55.DOMAINCONTROL.COM Name Server: NS56.DOMAINCONTROL.COM Registrar Abuse Contact Email: [email protected] Registrar Abuse Contact Phone: 480-624-2505 Registrar IANA ID: 146 Registrar URL: http://www.godaddy.com Registrar WHOIS Server: whois.godaddy.com Registrar: GoDaddy.com, LLC Registry Domain ID: 1832154295_DOMAIN_COM-VRSN Registry Expiry Date: 2026-10-23T04:32:44Z Updated Date: 2022-09-15T02:27:02Z
- references
- http://ip-api.com/json/, https://www.hallrender.com/attorney/brian-sabey/, https://hybrid-analysis.com/sample/ba72877899dffe3cfb08ab3b61d24e45325f0c27f3cec81e88e9dcf3f84f7098, business-support.intel.com, 00000000000.cloudfront.net, mobileaccess.intel.com, artificial-legal-intelligence.com, http://intel.net/.about.html, http://medlineplus.gov.https.sci-hub.st, http://pl.gov-zaloguj.info, http://apple.helptechnicalsupport.com/favicon.ico, https://www.journaldev.com/41403/regex, http://103.246.145.111/gate.php?hwid=WALKER-PC-WALKER&os=Windows%207%20Enterprise&cpu=Intel, nr-data.net [Apple Private Data Collection], https://stackabuse.com/assets/images/apple, https://hybrid-analysis.com/sample/772d7c597071913ba41e1b0f6b24bbb9d512cbe8f884e482a2d187f5a95281bc/65a880b7d29f11c8c30ad32e, CVE-2023-4966, https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a, What Is LockBit Ransomware? BlackBerry https://www.blackberry.com › ransomware-protection, https://github.com/MISP/misp-galaxy/blame/master/clusters/threat-actor.json, djcodychase.com, https://www.trendmicro.com/vinfo/gb/security/news/cybercrime-and-digital-threats/mumblehard-botnet-that-targeted-linux-systems-has-been-shut-down Source Trend, https://tulach.cc/, cellebrite.com | https://cellebrite.com/en/federal-government/, https://www.pornhub.com/video/search?search=tsara+brashears, https://twitter.com/PORNO_SEXYBABES, hanmail.net, 114.114.114.114, work.a-poster.info, www-stage40.pornhub.com, go.sabey.com, sabey.com, cellebrite.com, https://cellebrite.com/en/federal-government/ [Pegasus ck privilege collection], remote.aciscomputers.com, https://track.toccha.com/978eb025-0a62-46fa-827c-d71aa0524818?zoneid=5939372&ua=high&subzone_id=3038557&set=social&country=SY®ion=49&isp=syriatelmobiletelecom&useragent=Mozilla/5.0, 114.114.114.114 [Tulach], defenselawyernj.com, attorney-marketing-specialists.com ?, https://itunes.apple.com/app/apple-store/id284815942/us/app/image-recognition-and-searcher/id1450230225, http://www.apple.com/appleca/AppleIncRootCertificate.cer, http://flexlucky.com/isurvey/en/?devicemodel=iPhone&carrier=®ion=Tbilisi&brand=Apple&browser=GoogleApp&prize=cur&u=track.bawiwia.com&isp=JSCGlobalErty&ts=29900ce7-726c-4c9f-b0c3-21ff2f859648&country=GE&click_id=wuo4jm6db011lufu2f8h138c&partner=5658402&skip=yes&frame={frame}&cost=0.010100&lang=en, https://t.me/hermitspyware/24, hyundai-smg.com | http://hyundai-smg.com/index.php?route=information/contact | http://hyundai-smg.com/index.php?route=information/contact, https://imazing.com/guides/detect-pegasus-and-other-spyware-on-iphone, http://watchhers.net/index.php [remote attackers | malware spreader], api-stage.pornhub.com, newbrazzers.com [y8.com], www.videolan.org [info solutions], www2.blackbagtech.com [hidden users included], http://subtitles.rest7.com/subs/The.Expanse.S03E11.720p.HDTV.x264-KILLERS[eztv].mkv, http://pegasus.diskel.co.uk/ [phishing], wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language, fds.cellebrite.com, http://www1.mychartahn.org/?tm=1&subid4=1671014887.0191400000&kw=Patient+Portal&KW1=Patient+Access+Network&KW2=Patient+Self+Check+In+System&KW3=Electronic+Health+Record+EHR+System&KW4=Patient+Appointment+Scheduling+System&KW5=Medical+Billing+System+Software&KW6=Patient+Financial+Assistance&searchbox=0&domainname=0&backfill=0, healthcare.greatcall.com [fake call centers | PHI & PII info stealers], http://download.virtualbox.org/virtualbox/debian, match.pegasus.isi.edu, asp.net, http://dropbox.com/ [ intrusions/ dropbox stealer], https://www.enigmasoftware.com/malbehav374-removal/, https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/, https://hybrid-analysis.com/sample/ba36c01de22294d112f52e837086486b4a6a40c4eb3eac08217f3e46eb17d21b/65a432f32a1edd2da00ac71e, Malicious: Drops executable files to the Windows system directory details File type "DOS executable (COM)", https://my.uchealth.com/myuchealth/Authentication/Login/DoJump?token=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJ1cm46VUNIZWFsdGg6Y2Utc, https://api2018.uchealth.com/apihc/tass/webportal/apihealthcare_live/default.aspx, voyour-cams.xww.de [W32.DSS.Trojan], https://www.hybrid-analysis.com/sample/5cde83981d63661bad25f5900043e2dacaae3aac005b1201d7ea8182c0ec427c/659e999528b388097206d52c, http://voyour-cams.xww.de/ [image referer, dga, malware, parked, ads], UCHealth 'University of Cincinnati' vulnerable/compromised/related 'UCHealth.com' domains and URL's, allaboutcircuits.com l DGA domain | treehugger.com [ueleconomy.gov] | uchealth.com | http://cancer.uchealth.com | https://cancer.uchealth.com, https://cancer.uchealth.com/ | http://[email protected]/ | https://www.uchealth.com/physician/frank-avilucea/ |, https://www.uchealth.com/physician/t-toan-le/?ref=35&site=30 | https://www.uchealth.com/physician/t-toan-le/?ref=35&site=30, http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf, http://uchealth.com/wp-content/uploads/2017/12/UCHealthInsuranceIndex_120417.pdf, Malicious File Hash- SHA256 98a2a9c25e6240e44c595a693ed7b48c9c412969855b219e46dd9379006673d3, High severity - suspicious_write_exe, network_icmp, modifies_certificates, process_martian, injection_resumethread, Medium severity - dumped_buffer js_eval network_http allocates_rwx antisandbox_foregroundwindows creates_exe creates_shortcut suspicious_process stealth_window uses_windows_utilities recon_fingerprint antivm_memory_available Less High Priority IP’s Contacted 16 IP’s Contacted 104.16.18.94 104.20.234.39 104.26.11.189 104.26.3.202 13.107.4.50 More Domains Contacted 17 Domains Contacted www.bing.com www.allaboutcircuits.com allaboutcircuits.com ocsp.digicert.com securepubads.g.doubleclick.net More Related, http://uchealth.com/wp-content/uploads/2017/12/UCHealthInsuranceIndex_120417.pdf | https://www.uchealth.com/locations/uc-health-physicians-office-midtown/, https://my.uchealth.com/myuchealth/inside.asp?mode=visitsummary&submode=notes&csn=WP-24PtuJGFUkCkn9owS5DdIspw-3D-3D-24g6bhGYash%E2%80%A6, https://my.uchealth.com/myuchealth/inside.asp?mode=labdetail&e%E2%80%A64bK43QgfcL6kD9bT8hI9YIXWVk5xuOPWrqJQNWVGZwZo-3D&printmode=true, https://my.uchealth.com/myuchealth/Visits/VisitDetails?csn=WP-24wYBOtOuf1BKR-2B8XDFJ0JuA-3D-3D-24vasu1ISpMoMuqD8IMEos5jRZZFiBtfPMciW-2FFH52VaQ-3D, 64.190.63.111 | More AV Detection | !#HSTR:SigGen0136cb6c, ALF:CERT:Adware:Win32/Peapoon , ALF:HeraklezEval:Exploit:O97M/CVE-2017-11882.DR!rfn , ALF:HeraklezEval:PUA:Win32/4Shared , ALF:HeraklezEval:PUA:Win32/InstallCore.R , ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn , ALF:HeraklezEval:TrojanDownloader:Win32/Dofoil!rfn , ALF:HeraklezEval:TrojanDownloader:Win32/Ymacco!rfn , ALF:HeraklezEval:VirTool:WinNT/Rootkitdrv.HK , ALF:JASYP:Backdoor:Win32/FlyAgent!atmn ..., High severity - LokiBot User-Agent (Charon/Inferno) Win32.Worm.Benjamin.A CnC Checkin Worm.Mydoom Checkin User-Agent (explwer), Win32/Fosniw MacTryCnt CnC Style Checkin Win32/SniperSpy Checkin LDPinch Checkin Post Win32.Sality-GR Checkin ADWARE/InstallCore.Gen Checkin LokiBot Checkin ., cdn.porngifs.com, porngifs.com, http://girlscam.xww.de, httpvoyour-cams.xww.de [urlref], Worm:Win32/Benjamin, https://otx.alienvault.com/malware/Worm:Win32%2FBenjamin/samples, https://twitter.com/sheriffspurlock?lang=en, https://hybrid-analysis.com/sample/a728fc352e13fa39c7490ddcfff86b0919b3de6ea5786cf48b22095e0607bde9/6593b386f70b45c7c70419c8, https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/, https://www.anyxxxtube.net/search-porn/tsara-brashears/, https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian, nr-data.net, https://ww11.0123movie.net/icons/apple-touch-icon.png, https://ww9.0123movie.net/icons/apple-touch-icon.png, apple-identifiant.info, cs001.informativeremail-apple.zoom.com.cn, 0-i-0.xyz, 0-courier.push.apple.com, https://www.anyxxxtube.net/media/favicon/apple, message.htm.com, joebiden.com, familyhandyman.com, deadlineday.twitter.com, https://autodiscover.socket.net/Autodiscover/DEADJOE, http://watchhers.net/index.php, 69.197.153.180, This is all too strange! Corruption or Spoofed?, quackbot? Qbot qakbot positive, https://hybrid-analysis.com/sample/3fb8f0af07a9e94045be0f592c675e4f6146c95523f1774bc03f8eb5cf8c7d4e/65951c3d58467c9eb00f69dc, rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru [phishing] SongCulture.comm& YouTube redirected by hacker, https://hybrid-analysis.com/sample/3f1b1621818b3cfef7c58d8c3e382932a5a817579dffe8fbefc4cf6fdb8fc21d, https://www.virustotal.com/gui/url/4657cd9117ad26288f2af98767de164d9af64e9c22e3eda9580766688ec38652/community, https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/,, http://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru, init.ess.apple.com [backdoor, malicious script, access via media], https://apple.find-tracking.us/?id=jit./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./err, location-icloud.com, https://www.sweetheartvideo.com/tsara-brashears/ [Tracking| Botnet Campaign], mailtrack.io [tracking VirusTotal graphs, link trace back], http://rawlucky.com/submit/prizepicker/iq?devicemodel=iPhone&carrier=®ion=Baghdad&brand=Apple&browser=AlohaBrowserMobile&prize=300k&u=track.bawiwia.com&isp=EarthlinkTelecommunicationsEquipmentTradingServicesDmcc&ts=29900ce7-726c-4c9f-b0c3-21ff2f859648&country=IQ&click_id=woot0oed65crk85u2oe4vubu&partner=2423996&skip=yes, https://aheadofthegame.uk/about?utm_campaign=You%E2%80%99re%20nearly%20there!&utm_medium=email&utm_source=Eloqua&elqTrackId=e6385dd142e445f48aa17b4544780841&elq=0db2557254194121b23f3bec84f42097&elqaid=4059&elqat=1&elqCampaignId=, https://pin.it/ [faux Pinterest for TB], https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS Password Cracker [, 114.114.114.114 [ Tulach Malware IP], 13.107.136.8 [ Tulach Malware IP redirect], http://114.114.114.114:9421/proxycontrolwarn/ [Tulach cnc | probe], http://114.114.114.114/d?dn=sinastorage.com [ storage of targeted individuals on and offline Behavior], http://114.114.114.114:7777/c/msdownload/update/others/2022/01/29136388_, http://114.114.114.114/ipw.ps1, 194.245.148.189 [CnC], https://stackabuse.com/generating-command-line-interfaces-cli-with-fire-in-python/, http://109.206.241.129/666bins/666.mpsl, http://designspaceblog.com/?mystique=jquery_init&ver=2.4.2, 143.244.50.213 |169.150.249.162 [malware_hosting], http://watchhers.net/index.php [malware spreader], https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian No Expiration 0 Domain twitter.com No Expiration 0 Hostname www.pornhub.com No Expiration 0 URL https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 No Expiration 0 URL, https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017, xred.mooo.com [pornhub trojan], https://twitter.com/PORNO_SEXYBABES [ malvertizing, contextualizing, malicious], http://45.159.189.105/bot/online?key=7ee57b1f6d4aff08f9755119b18cf0754b677addcb6a3063066112b10a357a8e&guid=DESKTOP-B0T93D6\george, https://otx.alienvault.com/indicator/url/https://www.hostinger.com/?REFERRALCODE=1ROCKY77 [ DGA parking], findbetterresults.com, https://hybrid-analysis.com/sample/bba36b3ae7c49d1cffcc5f8e045d81e9307a2e1a86b923f89008e9377d171fb6, https://www.virustotal.com/gui/url/eed406872c2e6ef550b948510fe0b7b4c71f752f58551c2f8e61d31a19d2a153/summary, http://www.applerewards.website/pl/3/index.html?voluumdata=BASE64dmlkLi4wMDAwMDAwMi00NGFiLTQzNDktODAwMC0wMDAwMDAwMDAwMDBfX3ZwaWQuLjJhYWQzMDAwLWJiMzYtMTFlNi04YTYyLTBlYzcxZTllMDMzMV9fY2FpZC4uNjBhMjIwOWUtNWMzNC00OGQ4LWIyNDctYWM5YzVkOTM3MzZhX19ydC4uUl9fbGlkLi4yYTRjOTA4My0zY2RmLTQyNDktOGJmOS0yODMxZWYzNGRhYTlfX29pZDEuLjUwMGE4NDhjLTA2NGEtNDYyZi05MDNmLTgxYzY4ODNmODEwZl9fdmFyMS4uNjA4OTYxX192YXIyLi42NzEwMjhfX3JkLi5vbmNsaWNrYWRzXC5cbmV0X19haWQuLl9fYWIuLl9fc2lkLi4&zoneid=608961&campaignid=671028&visitor_id=4003954, www2.megawebfind.com [command_and_control], https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command= [command_and_control] stolec kradnie krypto, https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers, https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525, IPv4 199.59.243.224 and IPv4 67.21.93.249 - command_and_control, 103.246.145.111 phishing, nr-data.net | Apple Private Data collection, BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706, 00000000.apple.com | remote SIM Swap, https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97, 103.246.145.111 - scanning host, https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p, https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap, https://ms13p01if-qufw21344001.ms.if.apple.com:8083/, https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media), usw2-platform-dmchat-avengers-prod-ext.apple.com, https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97, Malware Hosting * Spyware: http://141.98.6.249/boat.arm7, http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86, Pegasus Attacking SA victim & advocate | Not interested in Predator, https://www.virustotal.com/gui/url/9bd3f99373b39e31fc935f62744c14e595df92c3f388753b507a395112f2dbda/summary, https://cellebrite.com/en/federal-government/, http://pegasus.diskel.co.uk/, deviceinbox.com, https://www.virustotal.com/gui/collection/29a886e3e9eed3e8185f260116f9b036abf042022e9a9b5b1b311f92be705122/iocs, https://hallrender.com/attorney/brian-sabey, https://hybrid-analysis.com/sample/209db5b7a473df6f2bff9274b96e556ec296237fdb134959f413c6b3b93fff74, https://hybrid-analysis.com/sample/e607e46da2b0d7129c9e783417619ee924be28792ce1323ed5cdfcbeb5c2c2e9/658df78b0dd01fa2970b7a7e, https://hybrid-analysis.com/sample/9c664935c8b82101733515e488e990d3c2db4b2594b0e427d01147e50953906e/658df4ed7644098eee08e1a4, Below are malvertizing links featuring target and alleged assaulter, https://urlscan.io/domain/video-lal.com | Was extremely malicious, https://archive.ph/rhBxZ, https://mypornwap.fun/downloads/search/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears-tgz, https://www.hybrid-analysis.com/sample/eab469685b2890cd50ca8a3705119a1c0a9c273c5951b57794aa8b16e8a42d6c/5f772b611a96402847793b79, https://otx.alienvault.com/browse/global/pulses?q=tag:threats&include_inactive=0&sort=-modified&page=1&limit=10&indicatorsSearch=threats, https://otx.alienvault.com/pulse/6570a6c41702fdce6c496a1d, https://otx.alienvault.com/indicator/url/http:%2F%2Fpixelrz.com%2Flists%2Fkeywords%2F%2520dr-jeffrey-reimer-dpt-funds-tsara-brashears%2F, https://www. pornhub .com /video/ search?search=tsara+brashears, wapwon(.)live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language, https://www(.)tryindiansex(.)com/s/tsara-brashears/, https://m.youtube.com/watch?v=GyuMozsVyYs | Sabey angry over music expression that's never named assaulter, Victim to afraid to bring lawsuit for attack that caused SCI. Endlessly bullied., https://pornbitter.com/storage/jeffrey-reimer-puts-his-love-on-top-tsara-brashears/, https://iporntv.mobi/tsara-brashears.html?page=4, https://www.toindian.com/s/jeffrey-reimer-dpt-porn/, https://otx.alienvault.com/pulse/655d0f94ad4d7cdc5e3f0a98, Social Engineering, https://otx.alienvault.com/pulse/652214c652025febf66cde33, https://timersys.com/wordpress-social-invitations/docs/cron-jobs/, Apple iOS, developer.apple.com, Tulach: 114.114.114.114, http://ww1.thecoolzipextractorapp.com/ [found in: https://www.hallrender.com/attorney/brian-sabey/], https://hybrid-analysis.com/sample/56b73aad95b7e6cc22d0dbf9d4f19a247e79849bcf7eb1d6ed2dd46c28acef88/658b7a862490d12581051fa6, https://www.virustotal.com/gui/url/7f5a6b40e349cbd3cfe1e9ceaa47d579c9ba8be3c426179e1d33e7a2661f91b9/community, https://urlscan.io/result/828a0fe8-cf22-47d7-bf42-7a8bbbd790ea/#behaviour, https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing, https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian (iPhone unlocker), uchealth.com, http://[email protected], https://www.uchealth.com/wp-content/uploads/2017/12/UCHealthInsuranceIndex_120417.pdf, https://www.hybrid-analysis.com/sample/8d62f650d5cb5d68441bd64ad24f088f18e34779f0c2e8178917a1e07dd65996/65642d5cfa9d60126100612e, https://www.hybrid-analysis.com/sample/8d62f650d5cb5d68441bd64ad24f088f18e34779f0c2e8178917a1e07dd65996, http://fireeyei.iowa.gov/, http://[email protected]/, http://uchealth.com/physician/frank-avilucea/, https://my.uchealth.com/myuchealth/Visits/VisitDetails?csn=WP-24%E2%80%A6FJ0JuA-3D-3D-24vasu1ISpMoMuqD8IMEos5jRZZFiBtfPMciW-2FFH52VaQ-3D, https://www.energyvanguard.com/blog/59284/Guest-Post-The-Fatal-Flaw-in-Advanced-Framing-Part-1, https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=, https://www.wlafx4trk.com/cmp/33K48/5ZK2T/?source_id=95_1236_91dabe93-2a51-4b93-bfd3-4a4bd7e00ff3_31&sub1=4df5b890c55d4bdead5ba03dde982afa, https://yugemobile.com/tracking?plcmntid=ym5002&imps=2dda8436-396e-4b37-a917-0cce11ffb623, Found in http://kaplanmorrell.com/meet-kaplan-morrel/meet-ronda-cordova/, vortex-nlb-http2-fed-us-taut-purple.nr-data.net (b.link infringement), nr-data.net (Apple Private Data Collection), uapi-qa.stlouisfed.org (Hospital Metadata), abc7news.com
- subdomains count
- 2
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
highFirst detected 2 years ago · Last seen 10 months ago
Appeared in 4 threat reports