locat[.]sbsDomain
Reported by 2 independent sources · first reported by Group-IB · last reported
Last reported 1 month ago
What the reports say
2 reports, newest first · the exact sentence from each-
Tortoiseshell Expands Malware Toolset With New Backdoor, SSH Tunnel“Two domains, locat[.]sbs and tiktok-u.sbs, resolved to related servers and contained subdomains using country or regional identifiers including UAE, Saudi Arabia, the UK, Belgium, Canada, Australia and Japan.”
-
Tortoiseshell: New Toolset and Operational Infrastructure Exposed“locat[.]sbs”
Indicators reported together
named in the same reports- tiktok-u[.]sbsin 2 reports
- 172.86.98[.]113in 1 report
- 07dd28b748656e9e1a870c538d6df68cin 1 report
- e39bb97415978fa3…20662a51f3abin 1 report
- d23c1b7b917f53e4…cf4a2b0bef4bin 1 report
- db58adc4a6c192520ed509b20a928279in 1 report
- c0dba95939f7fc1a…204f073a981din 1 report
- 597c40e0b23f38f3…3c8f200aa437in 1 report
- neexportfolio[.]comin 1 report
- neexportfolio.azurewebsites[.]netin 1 report
- aecert[.]orgin 1 report
- 185.253.116[.]81in 1 report
- 89.44.80[.]168in 1 report
- 89.44.80[.]234in 1 report
- 185.253.116[.]99in 1 report
- 95.174.68[.]199in 1 report
- 89.44.80[.]6in 1 report
- 185.253.116[.]166in 1 report
- 89.44.80[.]42in 1 report
- 89.44.80[.]56in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.