Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
30 IOCs
Hold the Phone! International Revenue Share Fraud Driven by Fake CAPTCHAs
Threat Actors
Malware Families
Excerpt
Authors: David Brunsdon, Darby Wise Executive Summary CAPTCHAs, the mundane tasks where we demonstrate our ability to select bicycles or distinguish chihuahuas from blueberry muffins, are increasingly being weaponized to trick users into performing actions with unexpected consequences. Fake CAPTCHAs are commonly associated with ClickFix attacks but have also been leveraged in other kinds of campaigns, including those we’ve documented in our blog on malicious push…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →30 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://d.ruelomamuy.com/makeTrackerDownload.php?a=WEBSMS&s=5002320649344849&c=US&groupds=138&caf=5002320649344849&origSms=I%20want%20to%20continue%205002320649344849&step=9 | High | Score 58/100 | First seen |
| Domain | d.panzozerrot.com | High | Score 58/100 | First seen |
| Domain | d.vistertransit.com | High | Score 58/100 | First seen |
| SHA1 | aa3e8d3009d94b9c89ac744b2be0687643493b0c | Medium | Score 53/100 | First seen |
| Domain | zawsterris.com | High | Score 58/100 | First seen |
| Domain | chat.matchnewtoday.com | High | Score 58/100 | First seen |
| Domain | zerrotmamil.com | High | Score 58/100 | First seen |
| Domain | carrolvassin.top | High | Score 58/100 | First seen |
| Domain | vids.chatorizon.com | High | Score 58/100 | First seen |
| Domain | buffalosolpe.top | High | Score 58/100 | First seen |
| Domain | 4lifetips.com | High | Score 58/100 | First seen |
| Domain | hotnow.sweeffg.online | High | Score 58/100 | First seen |
| URL | http://megaplaylive.com/?enc=eyJwaG9uZU51bWJlcnMiOlsiKzIwMTAwNTc5NzQ1MiIsIisyMDEwMDQ5MzkxNzgiLCIrMjAxMDA1Nzk2Mzg5IiwiKzIwMTAwNDk1MTYyNiIsIisyMDEwMDU4MDMzNzkiLCIrMjAxMDA2MzQ4ODc5IiwiKzIwMTAwNDkzOTE0NSIsIisyMDEwMDUyMDk2NzYiLCIrMjAxMDA2MzQzOTk3IiwiKzIwMTAwNjM1MzY5MyIsIisyMDEwMDk0MDg1ODQiLCIrMjAxMDA1Nzk2Mzk5IiwiKzM4MDkyNzg4NTQ2MiIsIiszODA5MjI0MTg0MDQiLCIrNDQ3NDkwOTIwODEwIiwiKzQ2NzY2NzQ2NDUxIiwiKzQzNjcwMzA2ODEwNyIsIis3NzkwNTAwMDIyNSIsIiszMjQ2NzQ0MDQyNyIsIis0NDc4NDg1MDk0NDgiXSwiYWYiOiI1MDAyMzIwNjQ5MzQ0ODQ5IiwiZGV2IjpudWxsLCJ0eXBlIjoiZ2FtZXMiLCJsYW5nIjoiZW4iLCJsb2FkZXIiOmZhbHNlLCJjaWQiOm51bGwsInBpZCI6bnVsbH0= | High | Score 58/100 | First seen |
| Domain | r.carrolvassin.top | High | Score 58/100 | First seen |
| Domain | d.zerrotmamil.com | High | Score 58/100 | First seen |
| Domain | claimandwins.com | High | Score 58/100 | First seen |
| Domain | transitcaxip.com | High | Score 58/100 | First seen |
| Domain | vistertransit.com | High | Score 58/100 | First seen |
| Domain | d.fufecarrol.top | High | Score 58/100 | First seen |
| URL | https://verifysuper.com/cl/i/wopmej?aff_sub4=5002320649344849&aff_sub5=US | High | Score 58/100 | First seen |
| Domain | d.santafebuno.top | High | Score 58/100 | First seen |
| Domain | r.transitcaxip.com | High | Score 58/100 | First seen |
| Domain | d.remotesbuffalo.top | High | Score 58/100 | First seen |
| Domain | fufecarrol.top | High | Score 58/100 | First seen |
| Domain | panzozerrot.com | High | Score 58/100 | First seen |
| Domain | colnsdital.com | High | Score 58/100 | First seen |
| Domain | d.marraheltin.com | High | Score 58/100 | First seen |
| Domain | d.herbosfinx.com | High | Score 58/100 | First seen |
| Domain | r.buffalosolpe.top | High | Score 58/100 | First seen |
| Domain | remotesbuffalo.top | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…