records[.]phDomain

Reported by 1 independent source · first reported 4 Apr 2019 by Group-IB · last reported 4 Apr 2019

Last reported 7 years ago

What the reports say

1 report, newest first · the exact sentence from each

“The result of the user’s interaction with the window will be sent to <%CnC%>/records[.]ph”

Group-IBVendor4 Apr 2019
Gustuff: Weapon of Mass Infection

named in the same reports

Copy these 2 indicators · defanged

2 indicators, defanged, one per line

ailistiterator[.]next
proxyconfigclass[.]host

Thanks — we review every report.

Report a wrong value