window[.]topDomain
Reported by 2 independent sources · first reported by Huntress · last reported
Last reported 1 month ago
What the reports say
2 reports, newest first · the exact sentence from each-
Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit“When running inside a hostile WordPress or Shopify plugin, the kit checks window !== window[.]top and uses postMessage to communicate with a parent popup window (closePopupWindowz, closePopupAndRedirect).”
-
How a Tax Search Leads to Kernel-Mode AV/EDR Kill“Iframe detection - window.self !== window[.]top checks if the page is loaded inside an iframe.”
Indicators reported together
named in the same reports- obfuscator[.]ioin 1 report
- httpbin[.]orgin 1 report
- anukitax[.]comin 1 report
- bringetax[.]comin 1 report
- grinvan[.]comin 1 report
- rpc.adspect[.]netin 1 report
- hxxps://jcibj[.]com/pcl.phpin 1 report
- jcibj[.]comin 1 report
- bjtrck[.]comin 1 report
- cdn.justcloakit[.]comin 1 report
- client.justcloakit[.]comin 1 report
- 192.175.104[.]189in 1 report
- gripsmonga[.]sbsin 1 report
- hxxps://github[.]com/RussianPanda95/Yara-Rules/blob/main/FatMalloc/win_mal_fatmalloc.yarin 1 report
- hxxps://github[.]com/RussianPanda95/Yara-Rules/blob/main/FatMalloc/HwAudKiller.yarin 1 report
- fioclouder[.]comin 1 report
- friugrime[.]comin 1 report
- 8a4033425d36cd99…42fbbe4c5531in 1 report
- 7509365935fc1bfa…45116106e026in 1 report
- 2b409a265f571dcc…dc5b0891da04in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.