rnsnno.pristineitems[.]proDomain
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 2 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Smuggler’s Gambit“For example, one network request is hxxps://rnsnno.pristineitems[.]pro/owa/?login_hint=[targeted user’s email], which includes a shady domain (rnsnno.pristineitems.pro) but also includes a call to the OWA endpoint with a login_hint parameter.”
Indicators reported together
named in the same reports- hxxps://rnsnno.szyby[.]pro/in 1 report
- rnsnno.szyby[.]proin 1 report
- hxxps://rnsnno.kycmaxcapital[.]pro/in 1 report
- rnsnno.kycmaxcapital[.]proin 1 report
- hxxps://rnsnno.2398-ns[.]pro/in 1 report
- rnsnno.2398-ns[.]proin 1 report
- 18470571777ca262…60455a603e49in 1 report
- hxxps://rnsnno.pristineitems[.]pro/owa/?login_hint=in 1 report
- hxxps://rnsnno.vcsar[.]pro/?eymmdgau&qrc=in 1 report
- rnsnno.vcsar[.]proin 1 report
- cs1100.wpc.omegacdn[.]netin 1 report
Copy these 11 indicators · defanged
Thanks — we review every report.