ns[.]neDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 4 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Playing defense against Gamaredon Group“JzESywut = "h" + "tt" + "p:" + "//l" + "ibcr" + "ash.dd" + "ns[.]ne" + "t/" & OYTgBXAP & "_" & HFzesifc & "//po" + "sol" + "re" + "boo" + "t.ph" + "p"”
Indicators reported together
named in the same reports- hopto[.]orgin 1 report
- pos[.]dotin 1 report
- ipt[.]nein 1 report
- ting[.]fiin 1 report
- t[.]phin 1 report
- hxxp://libcrash.ddns[.]net/ENDPOINT1_96L02G3D//posolreboot.phpin 1 report
- libcrash.ddns[.]netin 1 report
- bounceme[.]netin 1 report
- 86e0701349903105…ea1b1d7059d4in 1 report
- feb0596e9735e03a…5e591a55940fin 1 report
- document-out.hopto[.]orgin 1 report
- 141.8.195[.]60in 1 report
- 141.8.192[.]153in 1 report
- 188.225.25[.]50in 1 report
- c4089686965df5e5…623d531b505ein 1 report
- 02e6e2bfaaf6e77c…bbcadd85b47din 1 report
- 2f310c5b16620d9f…5fab659e9fa1in 1 report
- c1524a4573bc6acb…ca663b98a95fin 1 report
- 145a61a14ec6d32b…cdd464868eddin 1 report
- beercraft[.]spacein 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.