serveftp[.]comDomain
Reported by 1 independent source · first reported by Sekoia.io · last reported
Last reported 4 months ago
What the reports say
1 report, newest first · the exact sentence from each-
FSB’s matryoshka #3/3: Gamaredon's Gammasteel Infostealer“Domains such as serveirc.com, webhop.me, serveftp[.]com, and myvnc.com are primarily observed during the initial access phase, with only a single occurrence noted within the first-stage loader.”
Indicators reported together
named in the same reports- write[.]asin 1 report
- lesma[.]euin 1 report
- tebi[.]ioin 1 report
- de-fra.i3storage[.]comin 1 report
- s3.tebi[.]ioin 1 report
- hxxps://justsstop[.]ru/in 1 report
- justsstop[.]ruin 1 report
- hxxps://165.22.170[.]129/in 1 report
- 165.22.170[.]129in 1 report
- check-host[.]netin 1 report
- norosta[.]ruin 1 report
- selltosell[.]ruin 1 report
- hxxps://rentry[.]co/hwzrmfkxin 1 report
- serveirc[.]comin 1 report
- webhop[.]mein 1 report
- myvnc[.]comin 1 report
- hxxps://api.telegra[.]ph/getPage/Hello-01-23-161in 1 report
- hxxps://write[.]as/api/posts/1nei1af6dnw8qin 1 report
- hxxps://mastodon[.]social/api/v1/statuses/115942411657067215in 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.