103.160.59[.]97IP address
Reported by 2 independent sources · first reported by Microsoft Security Blog · last reported
Last reported 25 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor“Two indicators appear in both Microsoft's list and the June report, a comparison by The Hacker News found: the IP address 103.160.59[.]97 and the domain secure-dns-hub.com.”
-
Star Blizzard refines phishing and malware delivery with the RedFlick technique“let ioc_ip_addr = dynamic(["103.245.231.248", "2.57.241.246", "89.125.209.168", "103.245.231.79", "45.84.59.66", "103.160.59[.]97"]);”
Indicators reported together
named in the same reports- secure-dns-hub[.]comin 2 reports
- 103.245.231[.]248in 1 report
- 2.57.241[.]246in 1 report
- 89.125.209[.]168in 1 report
- 103.245.231[.]79in 1 report
- 45.84.59[.]66in 1 report
- etia[.]cain 1 report
- groy[.]ccin 1 report
- gliderrompercycl[.]comin 1 report
- muvb[.]netin 1 report
- divekickspolic[.]orgin 1 report
- matjk[.]clickin 1 report
- bpdaersa[.]clickin 1 report
- stuseamandesilt[.]orgin 1 report
- itechx[.]telin 1 report
- guach[.]netin 1 report
- ruten[.]observerin 1 report
- byveo[.]orgin 1 report
- qumel[.]linkin 1 report
- cyrna[.]topin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.