w3ll[.]storeDomain
Reported by 2 independent sources · first reported by Group-IB · last reported
Last reported 4 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Sneaky 2FA: exposing a new AiTM Phishing-as-a-Service“Excerpt of Sneaky 2FA source code authenticating to Microsoft 365 API, including a reference to the W3LL OV6 domain “w3ll[.]store””
-
W3LL Unmasked: Inside the Takedown of a Global BEC Phishing-as-a-Service Ecosystem“Identification of key infrastructure (AiTM and w3ll[.]store backend servers) used to fuel phishing operations with W3LL tools.”
Indicators reported together
named in the same reports- office365.context.correlation[.]idin 1 report
- hxxps://mysilverfox.com[.]my/00/#[email redacted]in 1 report
- mysilverfox.com[.]myin 1 report
- hxxps://highnationservices[.]com/n/#[email redacted]in 1 report
- highnationservices[.]comin 1 report
- hxxps://kagumigroup[.]id/wp-content/plugins/well/auth/j9P8KGpfDZyoHplo5XdnHOw79OCkDYo2l7TQcrrnclSz2XGLzmtCghFJwIWR1AaW33Rk36Z0ymZc6DIgMy4EFqTsiiqAKEBIN5jiTbYAUk1BfG4uoVhetLa2XWebUSShQOFq7L8Mpx1vf4Pum0xBVx/verifyin 1 report
- kagumigroup[.]idin 1 report
- hxxps://mysilverfox.com[.]my/00/7N0tV3XAh1yp4NFo9X6YsH3cOam6DYJhmMEXRky24mzGUuTE2RpwIIlI4olBypVCEYqiKFPDTAsRvKrS8bgiKBOZiPOUnxoCSHveA0zk5hcdjQ1UltSxdw7rdgZoo7HDWorfj9CzN8gc0q5PQ19nZe/indexin 1 report
- hxxps://highnationservices[.]com/n/uswDOVS70y9sjyPwtLieCJdZiEUGhokxRUvY7JApYlFo35Sb9o66AvhK8oNrHPTgj9aaJDHItTWDnPOo3t4mz8Tfhf7GBem0YE1cqx8O13VoKuWIbN4knGg6fRrvMIZXRQ2xgdEFzj2mVBzwSbpe5c/validatein 1 report
- 5d91563b6acd5446…c2195b9f6cbfin 1 report
- 8c4e78b1bc0a0923…5d2fddc5488din 1 report
- hxxps://href[.]li/?https://en.wikipedia.org/wiki/Category:Office_365in 1 report
- href[.]liin 1 report
- hxxps://href[.]li/?https://en.wikipedia.org/wiki/Client_access_licensein 1 report
- hxxps://href[.]li/?https://en.wikipedia.org/wiki/Emailin 1 report
- hxxps://href[.]li/?https://en.wikipedia.org/wiki/Email_clientin 1 report
- hxxps://href[.]li/?https://en.wikipedia.org/wiki/Internet_Explorer_11in 1 report
- hxxps://href[.]li/?https://en.wikipedia.org/wiki/List_of_Microsoft_365_Applicationsin 1 report
- hxxps://href[.]li/?https://en.wikipedia.org/wiki/Microsoft_365in 1 report
- hxxps://href[.]li/?https://en.wikipedia.org/wiki/Microsoft_Exchange_Serverin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.