date[.]nowDomain
Reported by 2 independent sources · first reported by Datadog Security Labs · last reported
Last reported 1 month ago
What the reports say
2 reports, newest first · the exact sentence from each-
Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit“Per-victim id format: JWRCVV-{Date[.]now()}-{rand36}-{rand36}, persisted as JWRCID.”
-
Not-so-anonymous telemetry: The @injectivelabs/sdk-ts backdoor“_q.push(`${method}:${value}:${Date[.]now()}`)”
Indicators reported together
named in the same reports- obfuscator[.]ioin 1 report
- httpbin[.]orgin 1 report
- window[.]topin 1 report
- trsb[.]topin 1 report
- javascript-obfuscator[.]ioin 1 report
- workercrypto[.]postin 1 report
- hexhole.injective[.]networkin 1 report
- hxxps://testnet.archival.chain.grpc-web.injective[.]networkin 1 report
- testnet.archival.chain.grpc-web.injective[.]networkin 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.