hxxps://testflight.apple[.]com/join/URL

Reported by 1 independent source · first reported 15 Feb 2024 by Group-IB · last reported 15 Feb 2024

Last reported 2 years ago

What the reports say

1 report, newest first · the exact sentence from each

“When TestFlight is abused, victims receive seemingly innocent URLs such as hxxps://testflight.apple[.]com/join/<ID>.”

Group-IBVendor15 Feb 2024
Face Off: Group-IB identifies first iOS trojan stealing facial recognition data

Indicators reported together

named in the same reports

gname[.]comin 1 report
18.143.229[.]200in 1 report
ks8cb[.]ccin 1 report
bweri6[.]ccin 1 report
ms2ve[.]ccin 1 report
blsdk5[.]ccin 1 report
zu7kt[.]ccin 1 report
nnzf1[.]ccin 1 report
t8bc[.]xyzin 1 report
app.js6kk[.]xyzin 1 report
bv8k[.]xyzin 1 report
app.re6s[.]xyzin 1 report
hzc5[.]xyzin 1 report
app.bc2k[.]xyzin 1 report
4571f8c8560a8a66…a07d7a93a3dfin 1 report
b72d9a6bd2c350f4…298ad6631875in 1 report
d8834a21bc70fbe2…e35be1b7276bin 1 report
b5dd9b71d2a35945…b7218b69f3b9in 1 report
hds6y[.]ccin 1 report
smgeo[.]ccin 1 report

Copy these 20 indicators · defanged

20 indicators, defanged, one per line

gname[.]com
18.143.229[.]200
ks8cb[.]cc
bweri6[.]cc
ms2ve[.]cc
blsdk5[.]cc
zu7kt[.]cc
nnzf1[.]cc
t8bc[.]xyz
app.js6kk[.]xyz
bv8k[.]xyz
app.re6s[.]xyz
hzc5[.]xyz
app.bc2k[.]xyz
4571f8c8560a8a66a90763d7236f55273750cf8dd8f4fdf443b5a07d7a93a3df
b72d9a6bd2c350f47c06dfa443ff7baa59eed090ead34bd553c0298ad6631875
d8834a21bc70fbe202cb7c865d97301540d4c27741380e877551e35be1b7276b
b5dd9b71d2a359450d590bcd924ff3e52eb51916635f7731331ab7218b69f3b9
hds6y[.]cc
smgeo[.]cc

Thanks — we review every report.

Report a wrong value