workercrypto[.]postDomain
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit“The transport-routing decision lives in WorkerCrypto[.]post, which also reveals an artefact of development:”
Indicators reported together
named in the same reports- obfuscator[.]ioin 1 report
- httpbin[.]orgin 1 report
- window[.]topin 1 report
- trsb[.]topin 1 report
- date[.]nowin 1 report
- javascript-obfuscator[.]ioin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.