connect-71q.pages[.]devDomain
Reported by 1 independent source · first reported by Volexity · last reported
Last reported 20 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication“The “Join the meeting now” hyperlink, however, linked to a website controlled by UTA0307 (connect-71q.pages[.]dev).”
Indicators reported together
named in the same reports- hxxps://login.microsoftonline[.]com/common/oauth2/deviceauthin 1 report
- sen-comms[.]comin 1 report
- 107.189.27[.]41in 1 report
- afpi-sec[.]comin 1 report
- 144.172.113[.]77in 1 report
- chromeelevationservice[.]comin 1 report
- 167.88.162[.]72in 1 report
- comms-net[.]comin 1 report
- 107.189.26[.]199in 1 report
- rosejob[.]comin 1 report
- hxxps://aka[.]ms/deviceloginin 1 report
Copy these 11 indicators · defanged
Thanks — we review every report.