president[.]mnDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 3 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Introducing the REF5961 intrusion set“While analyzing the Mongolian campaign samples, we found a previous webpage (hxxp://president[.]mn/en/ebooksheets.php) hosted under Mongolian infrastructure serving a RAR file named 20220921_2.rar.”
Indicators reported together
named in the same reports- decoded.avast[.]ioin 1 report
- hxxp://president[.]mn/en/ebooksheets.phpin 1 report
- www.president[.]mnin 1 report
- datacenter.gov[.]mnin 1 report
- hxxps://intranet.gov[.]mn/upload.phpin 1 report
- intranet.gov[.]mnin 1 report
- 45.90.58[.]103in 1 report
- 185.195.237[.]123in 1 report
- 185.82.217[.]164in 1 report
- 195.123.245[.]79in 1 report
- paper.hosted-by-bay[.]netin 1 report
- news.hosted-by-bay[.]netin 1 report
- hosted-by-bay[.]netin 1 report
- 45.133.194[.]106in 1 report
- paypal.goodspaypal[.]comin 1 report
- d218680140ad2c6e…41c02d889a59in 1 report
- redacted[.]mnin 1 report
- shop.redacted[.]mnin 1 report
- 192.123.245[.]79in 1 report
- 09005775fc587ac7…a87561aa0b06in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.