write[.]asDomain
Reported by 3 independent sources · first reported by Sekoia.io · last reported
Last reported 3 months ago
What the reports say
3 reports, newest first · the exact sentence from each-
Gamaredon en 2025: uso de túneles, workers, dead drops y nuevas alianzas“…ial de acortamiento de URLs de Telegram), publicaciones en las plataformas Telegra.ph (telegra.ph) y Teletype (teletype.in), rentry.co, write[.]as, Dropbox, GoFile, las redes sociales DEV Community (dev.to) y Mastodon (mastodon.social), lesma (lesma.eu), nopaste.net y Paste.ee (pas…”
-
Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances“…t.me; Telegram’s official URL shortener service), posts on the Telegra.ph (telegra.ph) and Teletype (teletype.in) platforms, rentry.co, write[.]as, Dropbox, GoFile, social networks DEV Community (dev.to) and Mastodon (mastodon.social), lesma (lesma.eu), nopaste.net, and Paste.ee (p…”
-
FSB’s matryoshka #3/3: Gamaredon's Gammasteel Infostealer“hxxps://write[.]as/api/posts/1nei1af6dnw8q”
Indicators reported together
named in the same reports- lesma[.]euin 3 reports
- tebi[.]ioin 3 reports
- de-fra.i3storage[.]comin 3 reports
- devtunnels[.]msin 2 reports
- loophole[.]sitein 2 reports
- loca[.]ltin 2 reports
- bore[.]pubin 2 reports
- cleverapps[.]ioin 2 reports
- teletype[.]inin 2 reports
- nopaste[.]netin 2 reports
- pastee[.]devin 2 reports
- s3.tebi[.]ioin 1 report
- hxxps://justsstop[.]ru/in 1 report
- justsstop[.]ruin 1 report
- hxxps://165.22.170[.]129/in 1 report
- 165.22.170[.]129in 1 report
- check-host[.]netin 1 report
- norosta[.]ruin 1 report
- selltosell[.]ruin 1 report
Copy these 19 indicators · defanged
Also named with it: CVE-2025-8088
Thanks — we review every report.