window.location[.]hostDomain
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 7 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
The Rise of Fake Shipment Tracking Scams in MEA“(wss://${window.location[.]host}/ws)”
-
Dead-end job: ResumeLooters infect websites in APAC through SQL injection and XSS attacks“let notice = “Host:” + window.location[.]host + “n” + “Cookie:” + document.cookie + “n” + “Referer:” + window.location.href + “n” + “Parent:” + parent.location.href;”
Indicators reported together
named in the same reports- meapostal[.]clickin 1 report
- posties[.]icuin 1 report
- estafmox[.]helpin 1 report
- nrcsnap[.]comin 1 report
- pkgov[.]shopin 1 report
- 8r[.]aein 1 report
- hxxps://jobsin 1 report
- jobsin 1 report
- admin.cloudnetsafe[.]comin 1 report
- hxxp://139.84.130[.]232:8080/CcrN3QqWOeRx/KAGctYUciin 1 report
- 139.84.130[.]232in 1 report
- hxxp://139.84.130[.]232:8080/CcrN3QqWOeRx/iDDHJOuzw/1in 1 report
- hxxp://139.84.130[.]232:8080/CcrN3QqWOeRxin 1 report
- hxxp://admin.cloudnetsofe[.]com/in 1 report
- admin.cloudnetsofe[.]comin 1 report
- hxxps://www.google[.]com/recaptcha/api.js?hl=vi%E2%80%9Din 1 report
- hxxps://sb8[.]co/online.htm%E2%80%99;document.body.appendChildin 1 report
- sb8[.]coin 1 report
- hxxps://139.84.168[.]189:3000/jquery.js%E2%80%99;document.body.appendChildin 1 report
- 139.84.168[.]189in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.