gov[.]tkDomain
Reported by 1 independent source · first reported by Sekoia.io · last reported
Last reported 4 months ago
What the reports say
1 report, newest first · the exact sentence from each-
FSB’s matryoshka #1/3: Inside Gamaredon Cyber Operations“… name] + [Separator 2] + [Serial disk (hex)] + [Separator 1] + [Separator 3] + "n" + [Random string] + [Separator 3]Referer“www” +.com, .gov[.]tk, .gov.md, .gov.sk, .pl, .it, .org, .nato.int, .net.ua, .mfa.gov.ua, .mil.gov.ua, .gov.pl, .gov.tr, .ua, .gov.uaCookie namepointed, goats…”
Indicators reported together
named in the same reports- mil.gov[.]uain 1 report
- teletype[.]inin 1 report
- 1794369214b7f62e70a0485e61335c61in 1 report
- hxxp://iiwdsxwamylbwwsoyrmj.supabase[.]co/functions/v1/clever-responder/KokonGoogle_09.12.2025in 1 report
- hxxps://[email redacted][.]co/functions/v1/clever-responder/GurGoogle_09.12.2025/audience/capture.pdfin 1 report
- 8e1624d110c090ff57d4b493a9107c66in 1 report
- hxxps://graph[.]org/in 1 report
- graph[.]orgin 1 report
- 104.194.140[.]6in 1 report
- moment-cat-qld-place.trycloudflare[.]comin 1 report
- shellobject[.]runin 1 report
- hxxps://www.telegram[.]me/s/oberfaririn 1 report
- gov[.]skin 1 report
- net[.]uain 1 report
- mfa.gov[.]uain 1 report
- gov[.]trin 1 report
- hxxps://efficiency-planes-emotions-fascinating.trycloudflare[.]com/@myrain/Xh1Lta2Ccro?84wtj9ob-01-31in 1 report
- efficiency-planes-emotions-fascinating.trycloudflare[.]comin 1 report
Copy these 18 indicators · defanged
Also named with it: CVE-2025-8088, CVE-2018-20250
Thanks — we review every report.