passkeydeploy[.]comDomain
Reported by 2 independent sources · first reported by Google Threat Intelligence · last reported
Last reported 2 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Google Links Redact Extortion Group to BlackFile Rebrand“Root domains like passkeyhelpdesk.com and passkeydeploy[.]com were used by more than one of the groups.”
-
UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments“… (such as passkeyms.com and mysecurepasskey.com), which acted as intermediate bridges to another infrastructure cluster focused on passkeydeploy[.]com.”
Indicators reported together
named in the same reports- passkeyhelpdesk[.]comin 2 reports
- tucows[.]comin 1 report
- publicdomainregistry[.]comin 1 report
- portalpasskey[.]comin 1 report
- addssopasskey[.]comin 1 report
- passkeyms[.]comin 1 report
- mysecurepasskey[.]comin 1 report
- oskeysync[.]comin 1 report
- keysyncos[.]comin 1 report
- setupsso[.]comin 1 report
- idokta[.]comin 1 report
- passkeyuser[.]comin 1 report
- passkeyportal[.]comin 1 report
- createssopasskey[.]comin 1 report
- myoktasso[.]comin 1 report
- pipe[.]main 1 report
- mypasskeysso[.]comin 1 report
- setupssopasskey[.]comin 1 report
- mspasskey[.]comin 1 report
- activatepasskey[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.