afshapiro[.]comDomain
Reported by 1 independent source · first reported by Sophos X-Ops · last reported
Last reported 2 months ago
What the reports say
1 report, newest first · the exact sentence from each-
2608-volatility-interlock“…is executed a command via termina l on the end-user device to establish persistence by first downloading PowerShell code from domain afshapiro[.]com.”
Indicators reported together
named in the same reports- www.redacted[.]comin 1 report
- 64.95.11[.]22in 1 report
- voginc[.]comin 1 report
- 104.236.109[.]139in 1 report
- browser-updater[.]comin 1 report
- hxxp://216.203.20[.]36/debug.login 1 report
- 216.203.20[.]36in 1 report
Copy these 7 indicators · defanged
Also named with it: CVE-2026-20131
Thanks — we review every report.