Tuesday, August 13, 2024

What is Nassef from Darkode Up To?

In this post I'll elaborate more on some of the current activities of a well known Darkode forum member namely Nassef which we can clearly see here in the Darkode repository of research.

Known email: xavi-linuxer@live.com

Sample currently active known domain registrations:

hxxp://tonymontana.su
hxxp://hack-mirror.net
hxxp://tonymontana.cards
hxxp://tonymontana.cash
hxxp://tonymontana.biz

Sample photos of related Darkode members:



Sample personal photo of Eric L Crocker also known as Phastman


Sample personal photo of Phillip R Fleitz also known as Strife

Related posts:
What we have here are several E-Shops for stolen credit card numbers part of his brand franchise including a web site defacement mirror run by him.

Known Darkode domains:
hxxp://darkode.com - 81.27.98.152 - briankrebson@gmail.com
hxxp://darkode.pro
hxxp://darkode.com
hxxp://darkode.me
hxxp://darkode.cc
hxxp://darkode.su - Email: ctouma2@gmail.com

Known Darkode personal email address account:
darkode.notice@gmail.com

Full names of Darkode members:

Johan Anders Gudmunds

Morgan C Culbertson

Eric L Crocker

Naveed Ahmed

Phillip R Fleitz

Dewayne Watts

Murtaza Saifuddin

Daniel Placek

Matjaz Skorjanc

Florencio Carro Ruiz

Mentor Leniqi

Rory Stephen Guidry

We also have an interesting malicious infrastructure discovery in the context of TA505, Darkode (hxxp://darkode.su; ctouma2@gmail.com) and the following portfolio of malicious domains.

hxxp://arculus.su
hxxp://bestsup.su
hxxp://abcstore.su
hxxp://usdcoin.su
hxxp://loads.su
hxxp://adsk.su
hxxp://newbond.su
hxxp://moserant.su
hxxp://huntersinternational.su
hxxp://exploit.su
hxxp://mazurax.su
hxxp://mocaverse.su
hxxp://firemarket.su
hxxp://accounts-login.su
hxxp://drkatzen.su
hxxp://zeebira.su
hxxp://fedex-tracking.su
hxxp://officesupportdoc.com
hxxp://amazon-security-deutschland-safer-certification-info.com
hxxp://aspendok.com
hxxp://trailandra.com
hxxp://flumenco.com
hxxp://agliesc.com
hxxp://technicalpreviews.com
hxxp://thipissney.com
hxxp://paalai.su
hxxp://portfolio-metamask.su
hxxp://allbridge.su
hxxp://manta.su
hxxp://commerzebank.net
hxxp://aerulonoured.su
hxxp://aswurdaes.su
hxxp://cerofixt.su

hxxp://loads.su - semik@protonmail.com; gendir@dtrs.ru; vlayura@yandex.ru

Related personally identifiable information on Matjaz Skorjanc - Iserdo -  ButterFly Bot which was also a well known Darkode member:

mafioso@xmpp.jp

hxxp://lizardstresser.su

k@exploit.im

hackerx24@hotmail.fr

duckylord@priv.in

hxxp://80.242.123.196

hxxp://142.11.230.18/b.php

smile@tsec.pro

Related ButterFly Bot personally identifiable email address accounts:

weke79@hotmail.com
iserdo@gmail.com
admin@1337crew.info
wg.fatal@gmail.com
gov.hack@gmail.com
jernej_5@hotmail.com
waisted.time@hotmail.com
netkairo@hotmail.com
floxter@hotmail.com
hamlet1917@hotmail.com
ice@iceman.in
leniqi.mentor@siol.net
icemangjk@hotmail.com

Related URL:
hxxp://bfsystems.net
hxxp://webmail.ngulesh.info

Related domain (wg.fatal@gmail.com) registrations:
hxxp://voc.cash
hxxp://deepbluesecurity.nl
hxxp://threatforce.net
hxxp://erc20collector.com
hxxp://b2bradio.net
hxxp://intelhub.link

Related domain (ice@iceman.in) registrations:
hxxp://albaname.com
hxxp://albahost.net
hxxp://albaname.net
hxxp://mpuq.net

Related domain (weke79@hotmail.com) registrations:
hxxp://jbcine.com
hxxp://futboltele.com
hxxp://clinicablanco.com
hxxp://clinica-blanco.com

Related domain (hamlet1917@hotmail.com) registrations:
hxxp://tamiflux.net

No comments:

Post a Comment