leaguejazire[.]comDomain
Reported by 1 independent source · first reported by Cisco Talos · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager“ The copied command opens a WebDAV path on a randomized subdomain of "leaguejazire[.]com", places the victim identifier in the path, and executes "pf.ch" through ordinal #1.”
Indicators reported together
named in the same reports- verification[.]googlein 1 report
- pf[.]chin 1 report
- riyazinikokar[.]xyzin 1 report
- hxxps://telegra[.]ph/Functions-04-03in 1 report
- 145.249.109[.]147in 1 report
- 45.150.34[.]2in 1 report
- 279d04c0cfd700c8…772739aecb92in 1 report
- lb.propertyfind[.]ccin 1 report
- fd.gstats-api-contact[.]ccin 1 report
- pkg.vogueatelier[.]ccin 1 report
- kffd3.vogueatelier[.]ccin 1 report
- kffd3.vexlatech[.]ccin 1 report
- static.quorashift[.]ccin 1 report
- 643ef35536ff9273…44b02131b205in 1 report
- 1819827e17f31e72…da9f24179b25in 1 report
- update.dubbedmuch[.]ccin 1 report
- hxxps://kr.cedar2glanz[.]ru/jewel.jsin 1 report
- kr.cedar2glanz[.]ruin 1 report
- hxxps://phys.stunned-amniotic[.]com/hub.login 1 report
- phys.stunned-amniotic[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.