Shakedown Social

Infoblox Threat IntelWe've seen it before, but it bears highlighting again: current affairs always lead to a domain gold rush! The newly announced "America Party" has already triggered a wave of sketchy-looking domain registrations, many using the .party TLD. Several redirect to rawdiary[.]com, a five-month-old site hosting third-party articles from sources like OANN, Newsmax and Breitbart, as well as more moderate sources like the FT and the BBC. Others are parked. These domains aren’t inherently malicious, but they're certainly opportunistic and built to look like news. Web content flips fast, so here’s a snapshot of domains unlikely to have been registered for anything in good-faith:ameirca[.]party amerca[.]party amercia[.]party americs[.]party amerika[.]party ameroca[.]party ameruca[.]party hyperamerica[.]party theunitedstates[.]party americanparty[.]pics americanparty[.]vip americaparty[.]ink americaparty[.]town theamericanparty[.]vip americanparty[.]pro<a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener" target="_blank">#dns</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintelligence</a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybercrime</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener" target="_blank">#infoblox</a> <a href="https://infosec.exchange/tags/infobloxthreatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#infobloxthreatintel</a> <a href="https://infosec.exchange/tags/americaparty" class="mention hashtag" rel="nofollow noopener" target="_blank">#americaparty</a> <a href="https://infosec.exchange/tags/osint" class="mention hashtag" rel="nofollow noopener" target="_blank">#osint</a> <a href="https://infosec.exchange/tags/typosquatting" class="mention hashtag" rel="nofollow noopener" target="_blank">#typosquatting</a>

Infoblox Threat IntelLet us introduce "La Fnac". As some of you may already know, La Fnac is a French retailer, and like most large retailers, they want to sell the coolest things that everyone is talking about. That's why, in 2008, they launched their most innovative service yet: an online portal where you could download the latest must-have ringtone for your flip phone. Of course, they didn't build that online portal themselves. They subcontracted that to another company, and to use their services, they set up a subdomain: 'sonneries-logos.fnac[.]com' on their corporate domain to use a CNAME record that the subcontractor then managed. You should know where this is going now. It seems clear that La Fnac forgot to remove this alias from their DNS after the service was retired. Surprisingly, they weren't alone! In 2017 (much later than we expected), when the CNAME record became dangling, there were 2 European tech companies that still had aliases pointed to it. So, when that ringtone download service started seeing activity again in 2025, it wasn't because of a sudden nostalgic resurgence in late naughties ringtones. Obviously, it was hijacked, and used to redirect people to various fake survey scams webpages. The longer a company exists for, the more tech debt it accumulates, which in the case of DNS can mean greater susceptibility to domain hijacking via dangling DNS records. This is not something exclusive to small companies, or companies with smaller tech teams. We've seen this issue affecting large organisations too. If something as cool as downloading ringtones on your flip phone can be forgotten about; don't be surprised when in 20 years, attackers start leveraging the tech debt you are currently procrastinating over. <a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener" target="_blank">#dns</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintelligence</a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybercrime</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener" target="_blank">#infoblox</a> <a href="https://infosec.exchange/tags/infobloxthreatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#infobloxthreatintel</a> <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#phishing</a> <a href="https://infosec.exchange/tags/scam" class="mention hashtag" rel="nofollow noopener" target="_blank">#scam</a>

Renée BurtonThe Russians aren't coming, they are already here. Without most anyone realizing, they've created an entire malicious adtech industry whose story is just as complex as the Chinese organized crime we're now realizing from their ventures into pig butchering. VexTrio is just one Russian organized crime group in the malicious adtech world, but they are a critical one. They have a very "special" relationship with website hackers that defies logic. I'd put my money on a contractual one. all your bases belong to russian adtech hackers.Today we've released the first piece of research that may eventually prove whether I am right. This paper is hard. i've been told. I know. We've condensed thousands of hours of research into about 30 pages. <a href="https://infosec.exchange/@briankrebs" class="u-url mention" rel="nofollow noopener" target="_blank">@briankrebs</a> tried to make the main points a lot more consumable -- and wrote a fabulous complimentary article : read both! There's so much more to say... but at the same time, between ourselves and Brian, we've released a lot of lead material ... and there's more to come. I've emphasized the Russian (technically Eastern European) crime here, but as Brian's article points out there is a whole Italian side too. and more. We've given SURBL, Spamhaus, Cloudflare, Domain Tools, several registrars, and many security companies over 100k domains. They are also posted on our open github.Super thanks to our collaborators at Qurium, GoDaddy Sucuri Security, and elsewhere. <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/scam" class="mention hashtag" rel="nofollow noopener" target="_blank">#scam</a> <a href="https://infosec.exchange/tags/tds" class="mention hashtag" rel="nofollow noopener" target="_blank">#tds</a> <a href="https://infosec.exchange/tags/vextrio" class="mention hashtag" rel="nofollow noopener" target="_blank">#vextrio</a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybercrime</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener" target="_blank">#dns</a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener" target="_blank">#infoblox</a> <a href="https://infosec.exchange/tags/InfobloxThreatIntel" class="mention hashtag" rel="nofollow noopener" target="_blank">#InfobloxThreatIntel</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#phishing</a> <a href="https://infosec.exchange/tags/spam" class="mention hashtag" rel="nofollow noopener" target="_blank">#spam</a> <a href="https://blogs.infoblox.com/threat-intelligence/vexing-and-vicious-the-eerie-relationship-between-wordpress-hackers-and-an-adtech-cabal/" rel="nofollow noopener" translate="no" target="_blank">https://blogs.infoblox.com/threat-intelligence/vexing-and-vicious-the-eerie-relationship-between-wordpress-hackers-and-an-adtech-cabal/</a><a href="https://krebsonsecurity.com/2025/06/inside-a-dark-adtech-empire-fed-by-fake-captchas/" rel="nofollow noopener" translate="no" target="_blank">https://krebsonsecurity.com/2025/06/inside-a-dark-adtech-empire-fed-by-fake-captchas/</a>

KrebsOnSecurity RSSInside a Dark Adtech Empire Fed by Fake CAPTCHAs<a href="https://krebsonsecurity.com/2025/06/inside-a-dark-adtech-empire-fed-by-fake-captchas/" rel="nofollow noopener" translate="no" target="_blank">https://krebsonsecurity.com/2025/06/inside-a-dark-adtech-empire-fed-by-fake-captchas/</a> <a href="https://burn.capital/tags/Ne" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ne</a>'er-Do-WellNews <a href="https://burn.capital/tags/SkyForgeDigitalAG" class="mention hashtag" rel="nofollow noopener" target="_blank">#SkyForgeDigitalAG</a> <a href="https://burn.capital/tags/ALittleSunshine" class="mention hashtag" rel="nofollow noopener" target="_blank">#ALittleSunshine</a> <a href="https://burn.capital/tags/PartnersHouse" class="mention hashtag" rel="nofollow noopener" target="_blank">#PartnersHouse</a> <a href="https://burn.capital/tags/Doppelganger" class="mention hashtag" rel="nofollow noopener" target="_blank">#Doppelganger</a> <a href="https://burn.capital/tags/WebFraud2" class="mention hashtag" rel="nofollow noopener" target="_blank">#WebFraud2</a>.0 <a href="https://burn.capital/tags/AimedGlobal" class="mention hashtag" rel="nofollow noopener" target="_blank">#AimedGlobal</a> <a href="https://burn.capital/tags/ReneeBurton" class="mention hashtag" rel="nofollow noopener" target="_blank">#ReneeBurton</a> <a href="https://burn.capital/tags/TeknologySA" class="mention hashtag" rel="nofollow noopener" target="_blank">#TeknologySA</a> <a href="https://burn.capital/tags/ByteCoreAG" class="mention hashtag" rel="nofollow noopener" target="_blank">#ByteCoreAG</a> <a href="https://burn.capital/tags/smartlinks" class="mention hashtag" rel="nofollow noopener" target="_blank">#smartlinks</a> <a href="https://burn.capital/tags/Spamshield" class="mention hashtag" rel="nofollow noopener" target="_blank">#Spamshield</a> <a href="https://burn.capital/tags/LosPollos" class="mention hashtag" rel="nofollow noopener" target="_blank">#LosPollos</a> <a href="https://burn.capital/tags/wordpress" class="mention hashtag" rel="nofollow noopener" target="_blank">#wordpress</a> <a href="https://burn.capital/tags/DollyWay" class="mention hashtag" rel="nofollow noopener" target="_blank">#DollyWay</a> <a href="https://burn.capital/tags/Holacode" class="mention hashtag" rel="nofollow noopener" target="_blank">#Holacode</a> <a href="https://burn.capital/tags/Infoblox" class="mention hashtag" rel="nofollow noopener" target="_blank">#Infoblox</a> <a href="https://burn.capital/tags/TacoLoco" class="mention hashtag" rel="nofollow noopener" target="_blank">#TacoLoco</a> <a href="https://burn.capital/tags/BroPush" class="mention hashtag" rel="nofollow noopener" target="_blank">#BroPush</a> <a href="https://burn.capital/tags/GoDaddy" class="mention hashtag" rel="nofollow noopener" target="_blank">#GoDaddy</a> <a href="https://burn.capital/tags/HelpTDS" class="mention hashtag" rel="nofollow noopener" target="_blank">#HelpTDS</a> <a href="https://burn.capital/tags/RichAds" class="mention hashtag" rel="nofollow noopener" target="_blank">#RichAds</a> <a href="https://burn.capital/tags/VexTrio" class="mention hashtag" rel="nofollow noopener" target="_blank">#VexTrio</a> <a href="https://burn.capital/tags/AdsPro" class="mention hashtag" rel="nofollow noopener" target="_blank">#AdsPro</a> <a href="https://burn.capital/tags/Qurium" class="mention hashtag" rel="nofollow noopener" target="_blank">#Qurium</a> <a href="https://burn.capital/tags/RexAds" class="mention hashtag" rel="nofollow noopener" target="_blank">#RexAds</a>

Infoblox Threat IntelSelling your car? Scammers still have it 'VIN' for you! We've recently seen a large cluster of domains hosting fake Vehicle Identification Number (VIN) lookup sites — and private car sellers are the target. While this trick isn’t new, it still catches many off guard — especially first-time sellers. Here’s how it usually plays out: - You list your car on platforms like AutoTrader, Craigslist, or Facebook Marketplace. - You're contacted by a keen 'buyer', perhaps asking a few questions to build trust. - The buyer then asks *you* to get a VIN report — but only from a site *they* provide. Red flag: Legitimate buyers wanting to know a vehicle's history are to be expected - they may ask for the VIN to do this themselves - but insisting on a specific site is a classic scam move. Here’s what happens next: - You enter your VIN on the fake site - it teases you with basic info like make and model. - To get the 'full report' you’re asked to pay $20–$40. - At best, you're sent to a legitimate payment provider — but the money goes straight to the scammer. - At worst, you've just entered your card details into a phishing site. Got your report? Good luck contacting that buyer, they're 'Audi 5000' — long gone. As for the report, it's usually worthless — no odometer readings, no previous owners, no insurance history - and of no value to you or a legit buyer. Unsurprisingly, 'VIN' features in their devious domain names, and at the time of writing we identrified a large cluster using it with U.S. states and locations, for example: - goldstatevin[.]com - gulfstatevin[.]com - kansasvin[.]com - misissippivin[.]com - utahvincheck[.]com These have since gone offline, hopefully for good. They're not alone though, the following domains appear to target sellers in Australia and are currently active: - proregocheck[.]com - smartcheckvin[.]com - smartvincheck[.]com - vincheckzone[.]com Tip: If a buyer wants a VIN report, let them sort it out — or use a trusted provider of your own. If they refuse? Tell 'em to hit the road! <a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener" target="_blank">#dns</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintelligence</a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybercrime</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener" target="_blank">#infoblox</a> <a href="https://infosec.exchange/tags/infobloxthreatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#infobloxthreatintel</a> <a href="https://infosec.exchange/tags/scam" class="mention hashtag" rel="nofollow noopener" target="_blank">#scam</a>

Infoblox Threat IntelOur latest blog is out! It covers a rising issue that many major organization experiences: Subdomain hijacking through abandoned cloud resources. This research follows our reporting from earlier in the year about the CDC subdomain hijack. We initially assumed that this was an isolated incident. Well… We were wrong. We tied some of this activity to a threat actor, dubbed Hazy Hawk, who hijacks high-profile subdomains which they use to conduct large-scale scams and malware distribution.<a href="https://blogs.infoblox.com/threat-intelligence/cloudy-with-a-chance-of-hijacking-forgotten-dns-records-enable-scam-actor/" rel="nofollow noopener" translate="no" target="_blank">https://blogs.infoblox.com/threat-intelligence/cloudy-with-a-chance-of-hijacking-forgotten-dns-records-enable-scam-actor/</a> <a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener" target="_blank">#dns</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintelligence</a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybercrime</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener" target="_blank">#infoblox</a> <a href="https://infosec.exchange/tags/infobloxthreatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#infobloxthreatintel</a> <a href="https://infosec.exchange/tags/scam" class="mention hashtag" rel="nofollow noopener" target="_blank">#scam</a> <a href="https://infosec.exchange/tags/HazyHawk" class="mention hashtag" rel="nofollow noopener" target="_blank">#HazyHawk</a>

Infoblox Threat IntelOver the past few years, we've been discussing our research into Traffic Distribution Systems (TDSs), especially those that power malicious adtech. We've created this cheatsheet to help those unfamiliar with TDSs get up to speed. Tell us what you think and if there are any other cheatsheets you feel would be helpful!<a href="https://infosec.exchange/tags/tds" class="mention hashtag" rel="nofollow noopener" target="_blank">#tds</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintelligence</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybercrime</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener" target="_blank">#infoblox</a> <a href="https://infosec.exchange/tags/infobloxthreatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#infobloxthreatintel</a>

Infoblox Threat IntelThere is another Lizard on the radar! Looming Lizard is an actor creating hundreds of lookalike domains impersonating popular banks and telecommunication companies targeting Spanish speaking countries, such as Mexico. Not only they are lookalikes, but are also RDGAs (Registered DGAs), with new domains created on a daily basis. These are some of the entities they impersonate: - Banks: Banorte, BBVA, Citi, HSBC, Itaú, Santander, Scotiabank - Telecommunications: AT&T, BTC, Claro, Liberty, Movistar, Telcel, Tigo - Others: post offices, department stores, energy companiesFor one of the lookalikes to Tigo (tigoppy[.]club), the actor was kind enough and offered the ability to trade our (fake) account points for nice prizes (wink wink). Sample of domains for each mentioned company: - banortex[.]vip, banortepmex[.]store, banorteoi[.]icu, banorteoi[.]sbs, banortebc[.]top - bbvamex[.]xin, bbvamex[.]xyz, bbvamxn[.]cyou, bbvamxn[.]store, bbvamxn[.]sbs - citiprr[.]top, citipr[.]top, citipr[.]vip, citiipir[.]top, citiipir[.]vip - mex-hsbc[.]xyz, mexhsbc[.]icu, mex-hsbc[.]icu, mex-hsbc[.]xin, mexhsbck[.]pro - itauupy[.]top, ittau[.]top, itauupyi[.]top, itaui[.]cfd, itaupy[.]top - santander-mex[.]xin, santandermox[.]vip, santander-mex[.]sbs, santander-mex[.]icu, santandermox[.]xyz - scotiabank-mx.xyz, scotiabok[.]xyz, scotiiiai[.]vip, scotiabanukmx[.]sbs, scotiiiai[.]xin - attmiex[.]pro, att-com-mx[.]top, attmmex[.]xyz, att-com-mx[.]xin, attmmex[.]vip - btcbahamass[.]vip, btcbahamasni[.]vip, btcbahamasni[.]xin, btcbahamasi[.]top, btcbahamasni[.]top - claroar[.]top, claroec[.]vip, clarosv[.]top, claropy[.]vip, clarolo[.]top - liberty-cr[.]xyz, liberty-cr[.]vip, liberty-cr[.]icu, liberty-cr[.]xin, liberty-cr[.]cc - movisstar[.]pro, movisstar[.]xyz, movistar-uy[.]xin, movisstar[.]sbs, movistarui[.]icu - telcelsi[.]top, telcelt[.]bond, telcele[.]info, telceln[.]qpon, telcel0[.]online - tiiigopy[.]xyz, tigosv[.]top, tigosv[.]cc, tigosvi[.]top, tigoipy[.]top <a href="https://urlscan.io/result/375469cb-d1ac-4b91-8dbe-18c5f42d427d/" rel="nofollow noopener" translate="no" target="_blank">https://urlscan.io/result/375469cb-d1ac-4b91-8dbe-18c5f42d427d/</a> <a href="https://urlscan.io/result/019656a1-67b5-7007-acc9-8834551420f7/" rel="nofollow noopener" translate="no" target="_blank">https://urlscan.io/result/019656a1-67b5-7007-acc9-8834551420f7/</a> <a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener" target="_blank">#dns</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintelligence</a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybercrime</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener" target="_blank">#infoblox</a> <a href="https://infosec.exchange/tags/infobloxthreatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#infobloxthreatintel</a> <a href="https://infosec.exchange/tags/lookalike" class="mention hashtag" rel="nofollow noopener" target="_blank">#lookalike</a> <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#phishing</a> <a href="https://infosec.exchange/tags/rdga" class="mention hashtag" rel="nofollow noopener" target="_blank">#rdga</a> <a href="https://infosec.exchange/tags/scam" class="mention hashtag" rel="nofollow noopener" target="_blank">#scam</a>

Infoblox Threat IntelInfoblox Threat Intel had the opportunity to collaborate with the United Nations Office on Drugs and Crime (<a href="https://infosec.exchange/tags/UNODC" class="mention hashtag" rel="nofollow noopener" target="_blank">#UNODC</a>) for their latest report on South East Asian Crime. The report is titled "Inflection Point". It is a great in-depth analysis of the triads and how they fuel the current scam epidemic. Organized crime is booming - as you can see with the picture below which shows the growth in the physical footprint of the compounds they operate. Our part of the collaboration (pages 37-42 of the 90+ page report) were around a single actor that we can track in <a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener" target="_blank">#dns</a> -- naturally! We analysed a number of illegal Chinese-operated gambling websites and soon found out they were operated by the same 'gambling provider' we named Vault Viper. Vault viper develops its very own "secure gambling browser". Of course it's <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a>. Through DNS, we discovered the companies behind Vault Viper were in fact controlled by Suncity - a criminal junket whose founder has been convicted of laundering billions of dollars. <a href="https://www.unodc.org/roseap/en/2025/04/cyberfraud-inflection-point-mekong/story.html" rel="nofollow noopener" translate="no" target="_blank">https://www.unodc.org/roseap/en/2025/04/cyberfraud-inflection-point-mekong/story.html</a> Illegal gambling is not harmless fun. It fuels some of the largest criminal networks in the world. The entire report is worth reading to get the latest view from experts on the world of organized crime in Asia that is running <a href="https://infosec.exchange/tags/scam" class="mention hashtag" rel="nofollow noopener" target="_blank">#scam</a>, <a href="https://infosec.exchange/tags/pigbutchering" class="mention hashtag" rel="nofollow noopener" target="_blank">#pigbutchering</a>, <a href="https://infosec.exchange/tags/humantrafficking" class="mention hashtag" rel="nofollow noopener" target="_blank">#humantrafficking</a>, <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybercrime</a>, <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a>, <a href="https://infosec.exchange/tags/illegalgambling" class="mention hashtag" rel="nofollow noopener" target="_blank">#illegalgambling</a>, illegal porn and who knows what else. The image below shows just how much it has grown in a few years from physical footprints. We'll be releasing a detailed report on Vault Viper in the coming months. <a href="https://infosec.exchange/tags/infobloxthreatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#infobloxthreatintel</a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener" target="_blank">#infoblox</a> <a href="https://infosec.exchange/tags/organizedcrime" class="mention hashtag" rel="nofollow noopener" target="_blank">#organizedcrime</a> <a href="https://infosec.exchange/tags/china" class="mention hashtag" rel="nofollow noopener" target="_blank">#china</a>

Infoblox Threat Intel“Your device has been blocked due to illegal activity” — 🙄 sure it has. After fat-fingering github[.]com, we were redirected to a domain running a fake Microsoft tech support scams: pop-ups that lock your browser, shout scary messages, and push you to call a “support” number (aka the scammer who’ll walk you through installing remote access tools). They're hosted on legit infra like Azure blobs or Cloudflare Pages. That one redirect led to uncovering 1,200+ other domains hosting identical fake support pages. Of course, whenever a redirect like this happens, there's a malicious traffic distribution system (TDS) involved. Examples include: - tenecitur.z1.web.core.windows[.]net- neon-kleicha-36b137[.]netlify[.]app- us6fixyourwindowsnow[.]pages[.]dev- microsoft-coral-app-6xv89.ondigitalocean[.]app<a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener" target="_blank">#dns</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintelligence</a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybercrime</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener" target="_blank">#infoblox</a> <a href="https://infosec.exchange/tags/infobloxthreatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#infobloxthreatintel</a> <a href="https://infosec.exchange/tags/scam" class="mention hashtag" rel="nofollow noopener" target="_blank">#scam</a> <a href="https://infosec.exchange/tags/tds" class="mention hashtag" rel="nofollow noopener" target="_blank">#tds</a>

Infoblox Threat IntelOnline gambling operators are sponsoring charities?? If only :(We've identified a malicious gambling affiliate whose specialty is to buy expired domain names which used to belong to charities or reputable organisations. Once they own a domain, they host a website impersonating its previous owner, where they claim to "deeply appreciate the support from [their] sponsors", which surprise surprise, all turn out to be dubious online gambling companies.Because the domain they are taking over is often abandoned or managed by non-technical people, its previous owner often doesn't notify anyone that they've lost control of their website, so it continues being referenced in genuine content, and it continues getting traffic from old links scattered throughout the internet.teampiersma[.]org (screenshots below) americankayak[.]org getelevateapp[.]com hotshotsarena[.]com nehilp[.]org questionner-le-numerique[.]org sip-events[.]co[.]uk studentlendinganalytics[.]com thegallatincountynews[.]comComparison content: 2018: <a href="https://web.archive.org/web/20180119043432/https://teampiersma.org/" rel="nofollow noopener" translate="no" target="_blank">https://web.archive.org/web/20180119043432/https://teampiersma.org/</a> 2025: <a href="https://web.archive.org/web/20250401092253/https://teampiersma.org/" rel="nofollow noopener" translate="no" target="_blank">https://web.archive.org/web/20250401092253/https://teampiersma.org/</a><a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener" target="_blank">#dns</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintelligence</a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybercrime</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener" target="_blank">#infoblox</a> <a href="https://infosec.exchange/tags/infobloxthreatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#infobloxthreatintel</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/scam" class="mention hashtag" rel="nofollow noopener" target="_blank">#scam</a> <a href="https://infosec.exchange/tags/dropcatch" class="mention hashtag" rel="nofollow noopener" target="_blank">#dropcatch</a> <a href="https://infosec.exchange/tags/charity" class="mention hashtag" rel="nofollow noopener" target="_blank">#charity</a>

Infoblox Threat IntelIs the sky fluxxing?! Last week a CISA advisory on DNS Fast Flux created a lot of buzz. We have an insider's take. Fast Flux is a nearly 20 year old technique and is essentially the malicious use of dynamic DNS. It is critical that protective DNS services understand this -- and all other DNS techniques -- on that we agree. What we also know as experts in DNS is that there are many ways to skin a cat, as they say. <a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener" target="_blank">#dns</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/cisa" class="mention hashtag" rel="nofollow noopener" target="_blank">#cisa</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#phishing</a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintelligence</a> <a href="https://infosec.exchange/tags/infobloxthreatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#infobloxthreatintel</a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener" target="_blank">#infoblox</a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybercrime</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://blogs.infoblox.com/threat-intelligence/disrupting-fast-flux-and-much-more-with-protective-dns/" rel="nofollow noopener" translate="no" target="_blank">https://blogs.infoblox.com/threat-intelligence/disrupting-fast-flux-and-much-more-with-protective-dns/</a>

Infoblox Threat IntelSome days ago, one of our specialists received a call from a scammer - who even knew his name - and he didn't miss the opportunity to potentially gather some threat intelligence. The scammer said he was from a company called Blockchain and wanted to inform him that his Bitcoin wallet hadn't been touched for a long time. Don't you think that's really nice of Blockchain? Of course, our specialist knew what to do. He asked for the company website, and the scammer eagerly provided it. After running the domain through our data, it turns out it is owned by (surprise, surprise) a crypto gang running their scams out of Georgia and Israel. How does this scam work? This group creates extensive networks of fake trading websites promising high returns. To profit, victims just need to share their phone numbers. They are then contacted by multilingual call centers and encouraged to "invest" in crypto, AI, or other ventures. The fake website shows the victim's assets increasing in value, prompting further engagement. The criminals continue to call and entice victims to deposit more money. Unfortunately, the victim won't profit from this. As DNS experts, we have been monitoring their infrastructure for a while now, and they have 1,133 other domains such as: - apexcapitalmarket[.]com - bitmininexpert[.]com - coinfxbrokers[.]com - cryptorinfo[.]com - goldcapitalstocks[.]net - kingstrades[.]net - profxcapitalgroup[.]com - smartcointrades[.]com - stocktradefastminers[.]com - tradeproinvest[.]com - trusttrade21[.]com Here is a reporting reference: <a href="https://www.eurojust.europa.eu/news/support-arrest-online-scammers-georgia-and-israel" rel="nofollow noopener" translate="no" target="_blank">https://www.eurojust.europa.eu/news/support-arrest-online-scammers-georgia-and-israel</a> <a href="https://infosec.exchange/tags/Infoblox" class="mention hashtag" rel="nofollow noopener" target="_blank">#Infoblox</a> <a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatIntel</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybercrime</a> <a href="https://infosec.exchange/tags/scam" class="mention hashtag" rel="nofollow noopener" target="_blank">#scam</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infobloxthreatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#infobloxthreatintel</a> <a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener" target="_blank">#dns</a> <a href="https://infosec.exchange/tags/domains" class="mention hashtag" rel="nofollow noopener" target="_blank">#domains</a> <a href="https://infosec.exchange/tags/iocs" class="mention hashtag" rel="nofollow noopener" target="_blank">#iocs</a> <a href="https://infosec.exchange/tags/crypto" class="mention hashtag" rel="nofollow noopener" target="_blank">#crypto</a> <a href="https://infosec.exchange/tags/cryptoscams" class="mention hashtag" rel="nofollow noopener" target="_blank">#cryptoscams</a>

Nonilex<a href="https://masto.ai/tags/DNS" class="mention hashtag" rel="nofollow noopener" target="_blank">#DNS</a> manipulation is something of a specialty among Chinese govt <a href="https://masto.ai/tags/hacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#hacking</a> groups. A mysterious campaign identified earlier this year by <a href="https://masto.ai/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> experts at <a href="https://masto.ai/tags/Infoblox" class="mention hashtag" rel="nofollow noopener" target="_blank">#Infoblox</a> & attributed to <a href="https://masto.ai/tags/China" class="mention hashtag" rel="nofollow noopener" target="_blank">#China</a> involved using the so-called Great <a href="https://masto.ai/tags/Firewall" class="mention hashtag" rel="nofollow noopener" target="_blank">#Firewall</a> of China, which normally misdirects people on the mainland trying to reach restricted services or content.<a href="https://masto.ai/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#InfoSec</a> <a href="https://masto.ai/tags/espionage" class="mention hashtag" rel="nofollow noopener" target="_blank">#espionage</a> <a href="https://masto.ai/tags/ISP" class="mention hashtag" rel="nofollow noopener" target="_blank">#ISP</a> <a href="https://masto.ai/tags/Internet" class="mention hashtag" rel="nofollow noopener" target="_blank">#Internet</a> <a href="https://masto.ai/tags/tech" class="mention hashtag" rel="nofollow noopener" target="_blank">#tech</a> <a href="https://masto.ai/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://masto.ai/tags/US" class="mention hashtag" rel="nofollow noopener" target="_blank">#US</a> <a href="https://masto.ai/tags/geopolitics" class="mention hashtag" rel="nofollow noopener" target="_blank">#geopolitics</a>

Infoblox Threat IntelDozens of Google Play Store lookalikes registered over the weekend. In one example, play-google-jophysitur[.]xyz, visiting the domain led to a page that looks similar to the Google Play Store and appears to offer a download for a game called "Plane Adventure". Pressing install did not actually download a file, it redirected to happywithvegas[.]com and asks users to sign up and entices them with free spins when they make their first deposit.Sample of the domains: play-google-adviparcha[.]xyz,play-google-amersemicotru[.]xyz,play-google-garfrienlegit[.]xyz,play-google-homelatche[.]xyz,play-google-interedbl[.]xyz,play-google-introunpro[.]xyz,play-google-jophysitur[.]xyz<a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener" target="_blank">#dns</a> <a href="https://infosec.exchange/tags/lookalike" class="mention hashtag" rel="nofollow noopener" target="_blank">#lookalike</a> <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#phishing</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener" target="_blank">#infoblox</a>

squealermusicAmazing networking professionals of earth! The Library of Congress has an excellent opportunity for a (computer) networking pro to lead our team. Lots of exciting fun! Reasonable humans! Interesting technical challenges! <a href="https://www.usajobs.gov/job/760997800" rel="nofollow noopener" target="_blank">https://www.usajobs.gov/job/760997800</a> <a href="https://mastodon.sdf.org/tags/ComputerNetworks" class="mention hashtag" rel="nofollow noopener" target="_blank">#ComputerNetworks</a> <a href="https://mastodon.sdf.org/tags/DNS" class="mention hashtag" rel="nofollow noopener" target="_blank">#DNS</a> <a href="https://mastodon.sdf.org/tags/infoblox" class="mention hashtag" rel="nofollow noopener" target="_blank">#infoblox</a>

Renée BurtonA few months ago I posted about a DNS malware C2 we had discovered— Decoy Dog — that was based on Pupy, had been undetected for over a year, and had some inexplicable behavior. We hoped the community would easily find the infected devices based on the info we provided. No suck luck. Since then we have used DNS to learn and an astonishing amount about the operations. Once we realized Decoy Dog was more advanced than Pupy, and we saw how the actors responded to our original relesases, we went back to the binaries. Today we released an indepth technical analysis of Decoy Dog, a Pupy research data set, and a new Yara rule. This is the exec summary. Link to the full technical paper and other tidbits in the comments. <a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener" target="_blank">#dns</a> <a href="https://infosec.exchange/tags/theatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#theatintel</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/decoydog" class="mention hashtag" rel="nofollow noopener" target="_blank">#decoydog</a> <a href="https://infosec.exchange/tags/rat" class="mention hashtag" rel="nofollow noopener" target="_blank">#rat</a> <a href="https://infosec.exchange/tags/c2" class="mention hashtag" rel="nofollow noopener" target="_blank">#c2</a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener" target="_blank">#infoblox</a> <a href="https://infosec.exchange/tags/datascience" class="mention hashtag" rel="nofollow noopener" target="_blank">#datascience</a> <a href="https://infosec.exchange/tags/threatresearch" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatresearch</a> <a href="https://blogs.infoblox.com/cyber-threat-intelligence/decoy-dog-is-no-ordinary-pupy-distinguishing-malware-via-dns/" rel="nofollow noopener" translate="no" target="_blank">https://blogs.infoblox.com/cyber-threat-intelligence/decoy-dog-is-no-ordinary-pupy-distinguishing-malware-via-dns/</a>

Recent searches

Search options

Administered by:

Server stats:

#infoblox