155.138.240[.]251IP address
Reported by 2 independent sources · first reported by Group-IB · last reported
Last reported 3 years ago
What the reports say
2 reports, newest first · the exact sentence from each-
OWASSRF Explained“155.138.240[.]251, 66.42.116.130”
-
Roasting 0ktapus: The phishing campaign going after Okta identity credentials“155.138.240[.]251”
Indicators reported together
named in the same reports- 40outlook[.]comin 1 report
- hxxp://179.60.149[.]28:4427/in 1 report
- 179.60.149[.]28in 1 report
- hxxp://179.60.149[.]28:4427/22.exein 1 report
- hxxps://autodiscover.hofduncan[.]org/owa/auth/Current/themes/6.css%E2%80%99in 1 report
- autodiscover.hofduncan[.]orgin 1 report
- 66.42.116[.]130in 1 report
- mail.stannparish[.]orgin 1 report
Copy these 8 indicators · defanged
Also named with it: CVE-2022-41082, CVE-2022-41080
Thanks — we review every report.