carolinejuskus[.]comDomain
Reported by 1 independent source · first reported by Sekoia.io · last reported
Last reported 4 months ago
What the reports say
1 report, newest first · the exact sentence from each-
ClickFix tactic: The Phantom Meet Infostealer Campaign“A GET request to hxxps://carolinejuskus[.]com/kusaka.php?call=launcher, where the server responds with a second URL in the HTTP header Location.”
Indicators reported together
named in the same reports- meet.googie.com-join[.]usin 1 report
- meet.google.web-join[.]comin 1 report
- meet.google.cdm-join[.]usin 1 report
- hxxps://meet.google.com-join[.]us/wmq-qcdn-orjin 1 report
- meet.google.com-join[.]usin 1 report
- hxxps://meet.google.us-join[.]com/ywk-batf-sfhin 1 report
- meet.google.us-join[.]comin 1 report
- hxxps://meet.google.us07host[.]com/coc-btru-aysin 1 report
- meet.google.us07host[.]comin 1 report
- hxxps://meet.google.webjoining[.]com/exw-jfaj-hpain 1 report
- meet.google.webjoining[.]comin 1 report
- hxxps://googiedrivers[.]com/fix-errorin 1 report
- googiedrivers[.]comin 1 report
- 92a8cc4e385f170d…bee9e3453138in 1 report
- a834be6d2bec10f3…58df183f773cin 1 report
- 2853a61188b4446b…743b1a44cbfein 1 report
- hxxp://95.182.97[.]58/84b7b6f977dd1c65.php%E2%80%9Din 1 report
- 95.182.97[.]58in 1 report
- hxxp://91.103.140[.]200:9078/3936a074a2f65761a5eb8/6fmfpmi7.fwf4p%E2%80%9Din 1 report
- 91.103.140[.]200in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.