8r[.]aeDomain
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 2 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Dead-end job: ResumeLooters infect websites in APAC through SQL injection and XSS attacks“…ad Generation”,”Web Scraping”,”Virtual Assistant”,”Copy-paste”,”FAA license for Airframe & Powerplant (A&P) mechanic”,”sale<script/src=//8r[.]ae></script>”,”advertising”,”marketing”,”Administration”,”Admin Support”,”Customer Support”,”Collection”,”Account Receivable”,”Human Resourc…”
Indicators reported together
named in the same reports- window.location[.]hostin 1 report
- hxxps://jobsin 1 report
- jobsin 1 report
- admin.cloudnetsafe[.]comin 1 report
- hxxp://139.84.130[.]232:8080/CcrN3QqWOeRx/KAGctYUciin 1 report
- 139.84.130[.]232in 1 report
- hxxp://139.84.130[.]232:8080/CcrN3QqWOeRx/iDDHJOuzw/1in 1 report
- hxxp://139.84.130[.]232:8080/CcrN3QqWOeRxin 1 report
- hxxp://admin.cloudnetsofe[.]com/in 1 report
- admin.cloudnetsofe[.]comin 1 report
- hxxps://www.google[.]com/recaptcha/api.js?hl=vi%E2%80%9Din 1 report
- hxxps://sb8[.]co/online.htm%E2%80%99;document.body.appendChildin 1 report
- sb8[.]coin 1 report
- hxxps://139.84.168[.]189:3000/jquery.js%E2%80%99;document.body.appendChildin 1 report
- 139.84.168[.]189in 1 report
- hxxps://admin.cloudnetsofe[.]com/if.js%E2%80%99;document.body.appendChildin 1 report
- hxxps://sb8[.]co/online.htmin 1 report
- hxxps://api.qu3[.]cc/?js=sb8.co%E2%80%9Din 1 report
- api.qu3[.]ccin 1 report
- hxxps://sb8[.]co/jquery3.6.3.js%E2%80%9Din 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.