de-fra.i3storage[.]comDomain
Reported by 3 independent sources · first reported by Sekoia.io · last reported
Last reported 3 months ago
What the reports say
3 reports, newest first · the exact sentence from each-
Gamaredon en 2025: uso de túneles, workers, dead drops y nuevas alianzas“… lo largo del año, las configuraciones migraron de Wasabi (wasabisys.com) a Tebi (tebi.io) y, posteriormente, a Intercolo (de-fra.i3storage[.]com), que para diciembre se había convertido en el destino principal de exfiltración.”
-
Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances“Over the course of the year, configurations moved from Wasabi (wasabisys.com) to Tebi (tebi.io) and then to Intercolo (de-fra.i3storage[.]com), which by December had become the primary exfiltration destination.”
-
FSB’s matryoshka #3/3: Gamaredon's Gammasteel Infostealer“The function checks if the configuration was set to set, it would use de-fra.i3storage[.]com; any other value is interpreted as a specific region subdomain, injected in hxxps://s3.[VALUE].wasabisys.com.”
Indicators reported together
named in the same reports- write[.]asin 3 reports
- lesma[.]euin 3 reports
- tebi[.]ioin 3 reports
- devtunnels[.]msin 2 reports
- loophole[.]sitein 2 reports
- loca[.]ltin 2 reports
- bore[.]pubin 2 reports
- cleverapps[.]ioin 2 reports
- teletype[.]inin 2 reports
- nopaste[.]netin 2 reports
- pastee[.]devin 2 reports
- s3.tebi[.]ioin 1 report
- hxxps://justsstop[.]ru/in 1 report
- justsstop[.]ruin 1 report
- hxxps://165.22.170[.]129/in 1 report
- 165.22.170[.]129in 1 report
- check-host[.]netin 1 report
- norosta[.]ruin 1 report
- selltosell[.]ruin 1 report
Copy these 19 indicators · defanged
Also named with it: CVE-2025-8088
Thanks — we review every report.