1649ad550c63513e4b3f77e23ecac040890192c70381ea350d699162ba9626d9SHA-256 hash
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 16 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Declaration trap: Crypto Drainers masquerading as European Tax Authorities“…d91f4e275) and the script, which is unique for each website, e.g., ba378635-89bf-43cd-955e-74d306dbe19c.js (1649ad550c63513e4b3f77e23ecac040890192c70381ea350d699162ba9626d9) is used for the website securedauth-no.su.”
Indicators reported together
named in the same reports- 96cdbb9f0456d0c4…09779234a356in 1 report
- 5e73f708c447d184…7b8977a04ccein 1 report
- f8226ca8f41f616d…e8ed91f4e275in 1 report
- securedauth-no[.]suin 1 report
- 342336d738165a46…6bf5312e7e6fin 1 report
- de94e8790ca66cde…16180ad93c74in 1 report
- mijnoverheid-nl[.]comin 1 report
- cryptoaangifteportaal[.]comin 1 report
- 6rbcc[.]comin 1 report
- securedauth-nl[.]suin 1 report
- mijnaangifte-2025[.]comin 1 report
- belastingcryptotoeslagen[.]infoin 1 report
- nlweb-wetgeving.dnsrd[.]comin 1 report
- mijnoverheld-app.duckdns[.]orgin 1 report
- 25280-6588.s3.webspace[.]rein 1 report
- sheckautnl[.]comin 1 report
- digid-online[.]nlin 1 report
- clientennota-webnl.ddns[.]infoin 1 report
- crypto-aangifte.mljnoverheldportaal[.]comin 1 report
- 176-65-134-35.cprapid[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.