webmail.onlinearuba[.]netDomain
Reported by 1 independent source · first reported by Sekoia.io · last reported
Last reported 4 months ago
What the reports say
1 report, newest first · the exact sentence from each-
SilentSelfie: Major Campaign Against Kurdish Websites“The data are sent to webmail.onlinearuba[.]net/7b2[redacted]600a/logs.php, a server rented by the attacker hosted under the AS 36352 (AS-COLOCROSSING) with the IP address 23.95.14.63.”
Indicators reported together
named in the same reports- obfuscator[.]ioin 1 report
- ronahi[.]netin 1 report
- ronahi[.]videoin 1 report
- lekolin[.]orgin 1 report
- ciwanensoresger[.]comin 1 report
- hawarnews[.]comin 1 report
- hxxps://rojnews[.]news/ku/wp-content/mobile.htmlin 1 report
- rojnews[.]newsin 1 report
- hxxps://targetplatform[.]net/mobile.htmlin 1 report
- targetplatform[.]netin 1 report
- 23.95.14[.]63in 1 report
- hxxp://170.75.161[.]102/asd.jsin 1 report
- 170.75.161[.]102in 1 report
- 24.246.223[.]228in 1 report
- orkesfm[.]comin 1 report
- yra-ufm[.]comin 1 report
- zindi24[.]comin 1 report
- star-fm[.]netin 1 report
- ypjrojava[.]netin 1 report
- hbdh[.]infoin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.