lb.propertyfind[.]ccDomain
Reported by 2 independent sources · first reported by Cisco Talos · last reported
Last reported 1 month ago
What the reports say
2 reports, newest first · the exact sentence from each-
HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation“…cific smart contracts (e.g., calling getData() or balanceOf(address)) to fetch the current active Command and Control domain (like lb.propertyfind[.]cc).”
-
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager“During our analysis, the contract returned "lb.propertyfind[.]cc", which ZigCryptoStealer then used as its C2 domain.”
Indicators reported together
named in the same reports- verification[.]googlein 1 report
- pf[.]chin 1 report
- leaguejazire[.]comin 1 report
- riyazinikokar[.]xyzin 1 report
- hxxps://telegra[.]ph/Functions-04-03in 1 report
- 145.249.109[.]147in 1 report
- 45.150.34[.]2in 1 report
- 279d04c0cfd700c8…772739aecb92in 1 report
- fd.gstats-api-contact[.]ccin 1 report
- pkg.vogueatelier[.]ccin 1 report
- kffd3.vogueatelier[.]ccin 1 report
- kffd3.vexlatech[.]ccin 1 report
- static.quorashift[.]ccin 1 report
- 643ef35536ff9273…44b02131b205in 1 report
- 1819827e17f31e72…da9f24179b25in 1 report
- update.dubbedmuch[.]ccin 1 report
- hxxps://kr.cedar2glanz[.]ru/jewel.jsin 1 report
- kr.cedar2glanz[.]ruin 1 report
- hxxps://phys.stunned-amniotic[.]com/hub.login 1 report
- phys.stunned-amniotic[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.