185.149.120[.]3IP address
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 8 years ago
What the reports say
2 reports, newest first · the exact sentence from each-
NotPetya pulls BadRabbit out of the hat“When a user visited one of the infected websites, a malicious JavaScript sent information to the server 185.149.120[.]3, owned by the marketing company Jetmail.”
-
BadRabbit: spread of new cryptolocker“Eset detected that the malicious JS script send part of the information to server 185.149.120[.]3.”
Indicators reported together
named in the same reports- 1dnscontrol[.]comin 2 reports
- www.fontanka[.]ruin 2 reports
- hxxp://argumenti[.]ruin 2 reports
- argumenti[.]ruin 2 reports
- hxxp://argumentiru[.]comin 2 reports
- argumentiru[.]comin 2 reports
- fbbdc39af1139aebba4da004475e8839in 2 reports
- webcheck01[.]netin 2 reports
- webdefense1[.]netin 2 reports
- secure-check[.]hostin 2 reports
- firewebmail[.]comin 2 reports
- secureinbox[.]emailin 2 reports
- secure-dns1[.]netin 2 reports
- hxxp://www.fontanka[.]ruin 1 report
- hxxp://spbvoditel[.]ruin 1 report
- spbvoditel[.]ruin 1 report
- hxxp://www.sinematurk[.]comin 1 report
- www.sinematurk[.]comin 1 report
- hxxp://www.online812[.]ruin 1 report
- www.online812[.]ruin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.