Historical OSINT - A Diversified Portfolio of Pharmacautical Scams Spotted in the Wild

Cybercriminals continue actively speading fraudulent and malicious campaigns potentially targeting the confidentiality availability and integrity of the targeted host to a multi-tude of malicious software further earning fraudulent revenue in the process of monetizing access to malware-infected hosts further spreading malicious and fraudulent campaigns potentially affecting hundreds of thousands of users globally.

We've recently came across to a currently active diversified portfolio of pharmaceutical scams with the cybercriminals behind it successfully earning fraudulent revenue in the process of monetizing access to malware-infected hosts including the active utilization of an affiliate-network based type of revenue sharing scheme.

In this post we'll profile the campaign, provide actionable intelligence, on the infrastructure behind it, and discuss in depth, the tactics techniques and procedures of the cybercriminals behind it.

hxxp://lightmcusic.com
hxxp://darkclosed.com
hxxp://raintable.com
hxxp://rainthing.com
hxxp://lamptrail.com
hxxp://rainopen.com
hxxp://newsmillion.com
hxxp://paintlamp.com
hxxp://newssilver.com
hxxp://singerspa.ru
hxxp://belllead.ru
hxxp://dealfence.ru
hxxp://beachpage.ru
hxxp://sweatybottle.ru
hxxp://superring.ru
hxxp://betaflash.ru
hxxp://petgal.ru
hxxp://beastball.ru
hxxp://chartarm.ru
hxxp://roomcoin.ru
hxxp://armsgun.ru
hxxp://keyhero.ru
hxxp://sisterlover.ru
hxxp://pitstops.ru
hxxp://ballnet.ru
hxxp://betacourt.ru
hxxp://moviecourt.ru
hxxp://bandrow.ru
hxxp://rainmcusic.com
hxxp://lightmcusic.com
hxxp://diskwind.com
hxxp://disklarge.com
hxxp://silverlarge.com
hxxp://totaldomainname.com
hxxp://mcusicmouse.com
hxxp://diskbig.com
hxxp://rainthing.com
hxxp://thunderhigh.com
hxxp://raintruck.com
hxxp://mcusictank.com
hxxp://diskdark.com
hxxp://thunderdark.com
hxxp://raintowel.com
hxxp://mcusicball.com
hxxp://diskwarm.com
hxxp://silverwarsm.com
hxxp://diskopen.com
hxxp://diskfashion.com
hxxp://goldlgs.com
hxxp://silverdarks.com
hxxp://silveropens.com
hxxp://goldapers.com
hxxp://goldslvers.com
hxxp://diskhot.com
hxxp://bluedrow.com
hxxp://flashdrow.com
hxxp://raindrow.com
hxxp://thunderdrow.com
hxxp://rainmcusic.com
hxxp://rainpen.com
hxxp://rainthing.com
hxxp://spotsoda.ru
hxxp://mediamultimedia.ru
hxxp://boozetuna.ru
hxxp://singerspa.ru
hxxp://eyepizza.ru
hxxp://ringmic.ru
hxxp://belllead.ru
hxxp://roselid.ru
hxxp://homemold.ru
hxxp://tuneworld.ru
hxxp://happendepend.ru
hxxp://fruitmind.ru
hxxp://groupmud.ru
hxxp://showbabe.ru
hxxp://juicetube.ru
hxxp://kidrace.ru
hxxp://zoomtrace.ru
hxxp://lawice.ru
hxxp://dealfence.ru
hxxp://wipeagree.ru
hxxp://coverimage.ru
hxxp://beachpage.ru
hxxp://waxylanguage.ru
hxxp://jazzedge.ru
hxxp://casemale.ru
hxxp://spotsoda.ru
hxxp://mediamultimedia.ru
hxxp://boozetuna.ru
hxxp://singerspa.ru
hxxp://eyepizza.ru
hxxp://kittyweb.ru
hxxp://bedrib.ru
hxxp://yourib.ru
hxxp://antthumb.ru
hxxp://ringmic.ru
hxxp://belllead.ru
hxxp://roselid.ru
hxxp://homemold.ru
hxxp://tuneworld.ru
hxxp://happendepend.ru
hxxp://fruitmind.ru
hxxp://groupmud.ru
hxxp://showbabe.ru
hxxp://juicetube.ru
hxxp://kidrace.ru
hxxp://zoomtrace.ru
hxxp://lawice.ru
hxxp://dealfence.ru
hxxp://wipeagree.ru
hxxp://coverimage.ru
hxxp://beachpage.ru
hxxp://waxylanguage.ru
hxxp://jazzedge.ru
hxxp://casemale.ru
hxxp://czarsale.ru
hxxp://sweatybottle.ru
hxxp://boxlane.ru
hxxp://rubyfire.ru
hxxp://radiohorse.ru
hxxp://sodakite.ru
hxxp://armissue.ru
hxxp://houraxe.ru
hxxp://smokeeye.ru
hxxp://anteye.ru
hxxp://salesbarf.ru
hxxp://shelfleg.ru
hxxp://superring.ru
hxxp://timematch.ru
hxxp://sewermatch.ru
hxxp://betaflash.ru
hxxp://wovenbath.ru
hxxp://imagebirth.ru
hxxp://shelfjack.ru
hxxp://ringmack.ru
hxxp://gigaknack.ru
hxxp://filetack.ru
hxxp://busybrick.ru
hxxp://giantdock.ru
hxxp://wormduck.ru
hxxp://roundtruck.ru
hxxp://labfolk.ru
hxxp://malespark.ru
hxxp://petgal.ru
hxxp://hitpal.ru
hxxp://beastball.ru
hxxp://baysmell.ru
hxxp://beachhill.ru
hxxp://giantpill.ru
hxxp://runtvenom.ru
hxxp://soaproom.ru
hxxp://chartarm.ru
hxxp://deedsum.ru
hxxp://firmcan.ru
hxxp://sofafan.ru
hxxp://chinqueen.ru
hxxp://lightpen.ru
hxxp://fishgain.ru
hxxp://shiptrain.ru
hxxp://canbin.ru
hxxp://roomcoin.ru
hxxp://caseion.ru
hxxp://miciron.ru
hxxp://metalcorn.ru
hxxp://roadbun.ru
hxxp://armsgun.ru
hxxp://landclown.ru
hxxp://weedego.ru
hxxp://kidsolo.ru
hxxp://waxsolo.ru
hxxp://hitpiano.ru
hxxp://keyhero.ru
hxxp://hitzero.ru
hxxp://ziptap.ru
hxxp://arealamp.ru
hxxp://sunnystamp.ru
hxxp://freeproshop.ru
hxxp://clanpup.ru
hxxp://silkyear.ru
hxxp://jarpeer.ru
hxxp://cobrariver.ru
hxxp://sisterlover.ru
hxxp://rocktower.ru
hxxp://yearshoes.ru
hxxp://grapefrogs.ru
hxxp://papercoins.ru
hxxp://pitstops.ru
hxxp://ginboss.ru
hxxp://greedpants.ru
hxxp://rulebat.ru
hxxp://kidssplat.ru
hxxp://havocfleet.ru
hxxp://ballnet.ru
hxxp://statezit.ru
hxxp://elfsalt.ru
hxxp://zooant.ru
hxxp://finksnot.ru
hxxp://bluffheart.ru
hxxp://wifechart.ru
hxxp://ladyskirt.ru
hxxp://betacourt.ru
hxxp://moviecourt.ru
hxxp://bluecourt.ru
hxxp://actbeast.ru
hxxp://waterfast.ru
hxxp://beachquest.ru
hxxp://passexist.ru
hxxp://rareyou.ru
hxxp://bandrow.ru
hxxp://applewax.ru
hxxp://rockpony.ru
hxxp://feetboy.ru
hxxp://arguebury.ru
hxxp://chairchevy.ru
hxxp://birthsea.com
hxxp://sourcegood.com
hxxp://lamplarsge.com
hxxp://trailhuge.com
hxxp://raintable.com
hxxp://platepeople.com
hxxp://tablebig.com
hxxp://lampbig.com
hxxp://traillong.com
hxxp://whitebirth.com
hxxp://trailbirth.com
hxxp://tabledisk.com
hxxp://lampdissk.com
hxxp://trucktowel.com
hxxp://lamptrail.com
hxxp://trailwarm.com
hxxp://paperwarm.com
hxxp://lampwasrm.com
hxxp://birthocean.com
hxxp://trailocean.com
hxxp://rainopen.com
hxxp://lampfashion.com
hxxp://newsmillion.com
hxxp://trailsummer.com
hxxp://mcusicpaper.com
hxxp://lamppapser.com
hxxp://newssilver.com
hxxp://platedrops.com
hxxp://lampcups.com
hxxp://tablemindss.com
hxxp://tablecupss.com
hxxp://newssweet.com
hxxp://trailbasket.com
hxxp://trailgift.com
hxxp://goldblow.com
hxxp://truckdrow.com
hxxp://roverkey.com
hxxp://protopsite.ru
hxxp://frontstand.com
hxxp://greystand.com
hxxp://ballmind.com
hxxp://mindlarge.com
hxxp://windlarge.com
hxxp://darklarge.com
hxxp://balltable.com
hxxp://listplate.com
hxxp://frontblue.com
hxxp://lightskye.com
hxxp://balllong.com
hxxp://frontlong.com
hxxp://greylong.com
hxxp://largebisg.com
hxxp://greywalk.com
hxxp://minddark.com
hxxp://largedark.com
hxxp://balldisk.com
hxxp://largetrail.com
hxxp://balltrail.com
hxxp://largewarm.com
hxxp://skyewarm.com
hxxp://listlap.com
hxxp://flowlap.com
hxxp://frontstop.com
hxxp://ballsilver.com
hxxp://flowsilver.com
hxxp://jobsilvesr.com
hxxp://fastpads.com
hxxp://jobpeoples.com
hxxp://bluewaris.com
hxxp://joblaps.com
hxxp://listdrops.com
hxxp://flowchairs.com
hxxp://backgrass.com
hxxp://greygrass.com
hxxp://greyfront.com
hxxp://dropslist.com
hxxp://longgrey.com
hxxp://backgrey.com
hxxp://frontgrey.com
hxxp://hatroad.com
hxxp://hatweather.com
hxxp://hatcool.com
hxxp://weatherfloor.com
hxxp://drinkfloor.com
hxxp://hatbrowse.com
hxxp://roadbrowse.com
hxxp://roadinternet.com
hxxp://whiterdes.com
hxxp://hatcools.com
hxxp://hatbrowses.com
hxxp://hatflow.com
hxxp://hatride.com
hxxp://whitefloors.com
hxxp://hatducks.com
hxxp://whitebrwses.com
hxxp://hattables.com
hxxp://hatfloos.com
hxxp://hatdrinks.com
hxxp://blowlight.com
hxxp://longwrite.com
hxxp://bridelamp.com
hxxp://bridelong.com
hxxp://bridefast.com
hxxp://bridebottle.com
hxxp://longletter.com
hxxp://brideword.com
hxxp://bridetowel.com
hxxp://screenchairs.com
hxxp://boxscreens.com
hxxp://screenbirth.com
hxxp://touchcup.com
hxxp://boxboxs.com
hxxp://boxlams.com
hxxp://touchchair.com
hxxp://screencup.com
hxxp://lamptool.com
hxxp://touchbirth.com
hxxp://weathersand.com
hxxp://summerwarms.com
hxxp://summerwall.com
hxxp://weathersummer.com
hxxp://warmruns.com
hxxp://weathercold.com
hxxp://weatherwarm.com
hxxp://warmskye.com
hxxp://weatherskye.com
hxxp://weatheropens.com
hxxp://weatherocean.com
hxxp://weatherrun.com
hxxp://rovercorner.com
hxxp://rangepeople.com
hxxp://rangesand.com
hxxp://rangecorner.com
hxxp://rangespeed.com
hxxp://roverweather.com
hxxp://rangekey.com
hxxp://roverfast.com
hxxp://roverroad.com
hxxp://rangerange.com
hxxp://rovertrack.com
hxxp://rangetunes.com
hxxp://socketpaper.com
hxxp://trailgold.com
hxxp://booksocket.com
hxxp://brushtrail.com
hxxp://brushround.com
hxxp://brushchair.com
hxxp://brushsocket.com
hxxp://brushfast.com
hxxp://socketfast.com
hxxp://tablebrush.com
hxxp://brushpaper.com
hxxp://brushopen.com
hxxp://sockettrail.com
hxxp://socketround.com
hxxp://brushplane.com
hxxp://sourcebrush.com
hxxp://tabletrail.com
hxxp://truckblus.com

We'll continue monitoring the campaign and post updates as soon as new developments take place.