xxx.xxx[.]xxxDomain
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 18 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Unmasking the Classiscam in Central Asia“IP Address Tracking: The script includes references to an IP address (xxx.xxx[.]xxx.x) and an identifier (id_item value: Gtca24DwRo), suggesting that the phishing attempt might be tracking users or sessions.”
Indicators reported together
named in the same reports- hxxps://bts.id9772[.]com/login/login.phpin 1 report
- bts.id9772[.]comin 1 report
- axios[.]postin 1 report
- finuz[.]sitein 1 report
- submituz[.]sitein 1 report
- spaceuz[.]sitein 1 report
- id-327[.]comin 1 report
- hxxps://payme-uz.finuz[.]site/175305342in 1 report
- payme-uz.finuz[.]sitein 1 report
- hxxps://helpchildren-uz.submituz[.]site/178544569in 1 report
- helpchildren-uz.submituz[.]sitein 1 report
- hxxps://asaka-uz.spaceuz[.]site/242878979in 1 report
- asaka-uz.spaceuz[.]sitein 1 report
- hxxps://ipak-uz.id-327[.]com/248183531in 1 report
- ipak-uz.id-327[.]comin 1 report
- hxxps://asaka-uz.finuz[.]site/203634205in 1 report
- asaka-uz.finuz[.]sitein 1 report
- hxxps://payme-uz.submituz[.]site/188684714%E2%81%A0%E2%81%A0%E2%81%A0%E2%81%A0%E2%81%A0%E2%81%A0%E2%81%A0%E2%81%A0%E2%81%A0in 1 report
- payme-uz.submituz[.]sitein 1 report
- hxxps://truste-uz.id-327[.]com/202060204in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.