com[.]twDomain
Reported by 2 independent sources · first reported by Kaspersky Securelist · last reported
Last reported 1 month ago
What the reports say
2 reports, newest first · the exact sentence from each-
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation“hxxps://www.[redacted].com[.]tw/[redacted]/ssh”
-
The invisible passenger in your car“"packageName": "com[.]tw.jar1",”
Indicators reported together
named in the same reports- trojan-dropper.androidos.agent[.]vuin 1 report
- cardoor[.]cnin 1 report
- hxxp://144.217.243[.]201/vr34der34/dex3.68.pngin 1 report
- 144.217.243[.]201in 1 report
- hxxp://t2.kshahnd[.]sbsin 1 report
- t2.kshahnd[.]sbsin 1 report
- hxxp://t2.mdsjhd[.]sbsin 1 report
- t2.mdsjhd[.]sbsin 1 report
- hxxp://t2.nmnsny[.]sbsin 1 report
- t2.nmnsny[.]sbsin 1 report
- hxxps://t2.nmnsny[.]sbsin 1 report
- hxxp://a2.kshahnd[.]sbsin 1 report
- a2.kshahnd[.]sbsin 1 report
- hxxp://a2.mdsjhd[.]sbsin 1 report
- a2.mdsjhd[.]sbsin 1 report
- hxxp://a2.nmnsny[.]sbsin 1 report
- a2.nmnsny[.]sbsin 1 report
- hxxps://a2.nmnsny[.]sbsin 1 report
Copy these 18 indicators · defanged
Also named with it: CVE-2026-60004, CVE-2022-0847
Thanks — we review every report.