hessattorneys.co[.]zaDomain
Reported by 1 independent source · first reported by AhnLab ASEC · last reported
Last reported 24 days ago
What the reports say
1 report, newest first · the exact sentence from each-
RMM tools currently being distributed through phishing attacks (ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, N-able)“The “settings.Ini” file inside the N-able installer contains the threat actor’s email address, “[email redacted]@hessattorneys.Co[.]Za,” as shown below.”
Indicators reported together
named in the same reports- 1017a75cf19be75f6ba21148a9b646d1in 1 report
- 1562d523c2ebdc19c0ff8f3ea5f3763bin 1 report
- 594a652263e5e4eb96b5164d337bc1cain 1 report
- 5a49d0b22ced22f9cf8b2015a327f163in 1 report
- 5ac7526b582d9cf4f7854c52ee75f359in 1 report
- hxxp://216.250.252[.]58:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guestin 1 report
- 216.250.252[.]58in 1 report
- hxxps://178-83-121-6.cprapid[.]com/ReceiptDoc.vbsin 1 report
- 178-83-121-6.cprapid[.]comin 1 report
- hxxps://admin.lukiku[.]lol/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guestin 1 report
- admin.lukiku[.]lolin 1 report
- hxxps://adobpro3d.s[.]gy/X334zpo8tlin 1 report
- hxxps://bigsundoc[.]online/fold/package/in 1 report
- bigsundoc[.]onlinein 1 report
- alertxen[.]storein 1 report
- ddncsoso[.]comin 1 report
- relay.lukiku[.]lolin 1 report
- 86.106.143[.]132in 1 report
Copy these 18 indicators · defanged
Thanks — we review every report.