96cdbb9f0456d0c46889ac322e434de40edf18974a7c887490c409779234a356SHA-256 hash
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 16 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Declaration trap: Crypto Drainers masquerading as European Tax Authorities“Also, this version of the phishing kit includes a distinctive script named check.js (96cdbb9f0456d0c46889ac322e434de40edf18974a7c887490c409779234a356), which is used to:”
Indicators reported together
named in the same reports- 5e73f708c447d184…7b8977a04ccein 1 report
- f8226ca8f41f616d…e8ed91f4e275in 1 report
- 1649ad550c63513e…9162ba9626d9in 1 report
- securedauth-no[.]suin 1 report
- 342336d738165a46…6bf5312e7e6fin 1 report
- de94e8790ca66cde…16180ad93c74in 1 report
- mijnoverheid-nl[.]comin 1 report
- cryptoaangifteportaal[.]comin 1 report
- 6rbcc[.]comin 1 report
- securedauth-nl[.]suin 1 report
- mijnaangifte-2025[.]comin 1 report
- belastingcryptotoeslagen[.]infoin 1 report
- nlweb-wetgeving.dnsrd[.]comin 1 report
- mijnoverheld-app.duckdns[.]orgin 1 report
- 25280-6588.s3.webspace[.]rein 1 report
- sheckautnl[.]comin 1 report
- digid-online[.]nlin 1 report
- clientennota-webnl.ddns[.]infoin 1 report
- crypto-aangifte.mljnoverheldportaal[.]comin 1 report
- 176-65-134-35.cprapid[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.