obfuscator[.]ioDomain
Reported by 4 independent sources · first reported by Sekoia.io · last reported
Last reported 1 month ago
What the reports say
6 reports, newest first · the exact sentence from each-
Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit“Layer 1: obfuscator[.]io string-array shuffle.”
-
ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2“… to change the signature of the code and used different random strings for variable and function names, consistent with output from “Obfuscator[.]io” and similar Javascript obfuscation tools.”
-
The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action“The Javascript file check.js is an input-validation and auto-formatting utility partially obfuscated using obfuscator[.]io.”
-
JavaScript obfuscation: From party trick to phishing kit“…afted masterpiece of JavaScript weirdness and more likely to meet output from tools like the npm package “javascript-obfuscator” or “obfuscator[.]io”.”
-
New North Korean campaign uses fake coding interviews to steal developer credentials“How obfuscator[.]io hides the malware's code”
-
SilentSelfie: Major Campaign Against Kurdish Websites“…it was the case with lekolin.org and ciwanensoresger.com, while others are contained in a single JavaScript file and obfuscated with Obfuscator[.]io, as seen with nuceciwan129.xyz.”
Indicators reported together
named in the same reports- javascript-obfuscator[.]ioin 2 reports
- hxxps://docs.google[.]com/spreadsheets/d/in 1 report
- swapzone[.]ioin 1 report
- simpleswap[.]ioin 1 report
- hxxps://paste[.]sh/dQfdExjo#AqjB4BBtin 1 report
- httpbin[.]orgin 1 report
- ronahi[.]netin 1 report
- ronahi[.]videoin 1 report
- lekolin[.]orgin 1 report
- ciwanensoresger[.]comin 1 report
- hawarnews[.]comin 1 report
- hxxps://rojnews[.]news/ku/wp-content/mobile.htmlin 1 report
- rojnews[.]newsin 1 report
- hxxps://targetplatform[.]net/mobile.htmlin 1 report
- targetplatform[.]netin 1 report
- webmail.onlinearuba[.]netin 1 report
- 23.95.14[.]63in 1 report
- hxxp://170.75.161[.]102/asd.jsin 1 report
- 170.75.161[.]102in 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.