From China With "Love" - Exposing the HKLeaks Propaganda Campaign - An OSINT Analysis

0
October 29, 2021

I've recently came across to a currently active information warfare operation propaganda campaign courtesy of China that somehow aims to successfully identify protesters using a variety of "leak" based Web sites.

In this analysis I'll provide actionable intelligence on the whereabouts of the individuals behind these campaigns and offer an in-depth technical discussion on their online whereabouts.

Based on a variety of publicly accessible sources including the use of  WhoisXML API's WHOIS database I've managed to find the following domains which are known to have been involved in the campaign including one personally identifiable email address which could lead to possible cyber campaign attribution campaigns.


Sample domains known to have been involved in the HKLeaks information warfare propaganda campaign:


hxxp://hkleaks.pk

hxxp://hkleaks.ru

hxxp://hkleaks.pk

hxxp://hkleaks.tj

hxxp://hkleaks.ml - Email: spiker@elude.in

hxxp://hkleaks.af

hxxp://hkleaks.cc

hxxp://hkleaks.pw

hxxp://hkleaks.kz

hxxp://hkleaks.kg


Sample email address accounts known to have been involved in the campaign:


hkleaks@yandex.com

hongkongmob@163.com

Hongkongmob@protonmail.com

hongkongmob@yandex.com

Sample responding IPs known to have been involved in the campaign:

185.178.208.132
185.178.208.152
96.126.123.244
194.58.112.174
45.33.18.44
45.33.23.183
72.14.178.174
186.2.163.203
45.33.20.235
72.14.185.43
173.255.194.134
45.79.19.196
186.2.163.140
45.56.79.23
186.2.163.60
186.2.163.7
45.33.2.79
186.2.163.210
198.58.118.167
185.53.177.31
45.33.30.197
186.2.163.216

Sample related photos from the HKLeaks information warfare online propaganda campaign:




Stay tuned!

Continue reading →

Introducing Dancho Danchev's "Intelligence Community" 2.0 Dark Web Onion - Exclusive Content Available!

0
October 18, 2021

 
Dear blog readers,

It's been approximately 12 years since I've originally launched my Dancho Danchev's Blog - Mind Streams of Information Security Knowledge blog which quickly became one of the security industry's leading publications and since I've recently received quite a few censorship attempts that basically say that some of my research violates Google's Terms of Service I've decided to migrate my personal blog including to resume my research at the official Dark Web Onion for this blog which is:
and therefore I've decided that this is my last post on my personal Dancho Danchev's Blog.

Users and readers interested in continuing to follow my research can grab the Tor browser and visit - http://aklw6fojficmu3zqsdsffprbas3kqrheej4ntvynfl5xkrjpqhlq55yd.onion where I'll ensure that I'll be posting high-quality and never-published and discussed before research and OSINT type of analysis.

Sample screenshots from my "Intelligence Community" 2.0 Dark Web Onion blog:








Sample content which you can find at the Dark Web Onion:

  • A Compilation of Currently Active and Related Scams Scammer Email Addresses – An OSINT Analysis
  • A Compilation of Currently Active Cyber Jihad Themed Personal Email Addresses – An OSINT Analysis
  • A Compilation of Currently Active Full Offline Copies of Cybercrime-Friendly Forum Communities – Direct Technical Collection Download -[RAR]
  • A Compilation of Personally Identifiable Information on Various Iran-based Hacker Groups and Lone Hacker Teams – Direct Technical Collection Download – [RAR]
  • A Koobface Botnet Themed Infographic Courtesy of my Keynote at CyberCamp – A Photo
  • Advanced Bulletproof Malicious Infrastructure Investigation – WhoisXML API Analysis
  • Advanced Mapping and Reconnaissance of Botnet Command and Control Infrastructure using Hostinger’s Legitimate Infrastructure – WhoisXML API Analysis
  • Advanced Mapping and Reconnaissance of the Emotet Botnet – WhoisXML API Analysis
  • Assessing The Computer Network Operation (CNO) Capabilities of the Islamic Republic of Iran – Free Research Report
  • Astalavista Security Newsletter - 2003-2006 - Full Offline Reading Copy
  • Compilations of Personally Identifiable Information Including XMPP/Jabber and Personal Emails Belonging to Cybercriminals and Malicious Threat Actors Internationally – An OSINT Analysis
  • Cyber Intelligence – Personal Memoir – Dancho Danchev – – Download Free Copy Today!
  • Cybercriminals Impersonate Legitimate Security Researcher Launch a Typosquatting C&C Server Campaign – WhoisXML API Analysis
  • Dancho Danchev – Cyber Intelligence – Personal Memoir – Direct Download Copy Available
  • Dancho Danchev’s “A Qualitative and Technical Collection OSINT-Enriched Analysis of the Iranian Hacking Scene Through the Prism of the Infamous Ashiyane Digital Security Team” Report – [PDF]
  • Dancho Danchev’s “Assessing The Computer Network Operation (CNO) Capabilities of the Islamic Republic of Iran” Report – [PDF]
  • Dancho Danchev’s “Astalavista Security Group – Investment Proposal” Presentation – A Photos Compilation
  • Dancho Danchev’s “Building and Implementing a Successful Information Security Policy” White Paper – [PDF]
  • Dancho Danchev’s “Cyber Jihad vs Cyberterrorim – Separating Hype from Reality” Presentation – [PDF]
  • Dancho Danchev’s “Cyber Jihad vs Cyberterrorism – Separating Hype from Reality – A Photos Compilation
  • Dancho Danchev’s “Exposing Koobface – The World’s Largest Botnet” Presentation – A Photos Compilation
  • Dancho Danchev’s “Exposing Koobface – The World’s Largest Botnet” Presentation – [PDF]
  • Dancho Danchev’s “Exposing the Dynamic Money Mule Recruitment Ecosystem” Presentation – A Photos Compilation
  • Dancho Danchev’s “Exposing the Dynamic Money Mule Recruitment Ecosystem” Presentation – [PDF]
  • Dancho Danchev’s “Intell on the Criminal Underground – Who’s Who in Cybercrime for ” Presentation – [PDF]
  • Dancho Danchev’s “Intell on the Criminal Underground – Who’s Who in Cybercrime for ?” – A Photos Compilation
  • Dancho Danchev’s – Cybercrime Forum Data Set – Free Direct Technical Collection Download Available – GB – [RAR]
  • Dancho Danchev’s Blog – Full Offline Copy Available – Volume – [PDF]
  • Dancho Danchev’s Blog – Full Offline Copy Available – Volume – [PDF]
  • Dancho Danchev’s Blog – Full Offline Copy Available – Volume – [PDF]
  • Dancho Danchev’s Blog – Full Offline Copy Available – Volume – [PDF]
  • Dancho Danchev’s Blog – Full Offline Copy Available – Volume – [PDF]
  • Dancho Danchev’s Blog – Full Offline Copy Available – Volume – [PDF]
  • Dancho Danchev’s Blog – Full Offline Copy Available – Volume – [PDF]
  • Dancho Danchev’s Blog – Full Offline Copy Available – Volume – [PDF]
  • Dancho Danchev’s Blog – Full Offline Copy Available – Volume – [PDF]
  • Dancho Danchev’s Blog – Full Offline Copy Available – Volume – [PDF]
  • Dancho Danchev’s Blog – Full Offline Copy Available – Volume – [PDF]
  • Dancho Danchev’s Blog – Full Offline Copy Available – Volume – [PDF]
  • Dancho Danchev’s Blog – Full Offline Copy Available – Volume – [PDF]
  • Dancho Danchev’s Blog – Full Offline Copy Available – Volume – [PDF]
  • Dancho Danchev’s Comeback Livestream Today – Join me on Facebook Live!
  • Dancho Danchev’s CV – Direct Download Copy Available
  • Dancho Danchev’s Cybercrime Forum Data Set for – Upcoming Direct Technical Collection Download Available
  • Dancho Danchev’s Primary Contact Points for this Project – Email/XMPP/Jabber/OMEMO and PGP Key Accounts
  • Dancho Danchev’s Privacy and Security Research Compilation – Medium Account Research Compilation – [PDF]
  • Dancho Danchev’s Private Party Videos – Direct Video Download Available
  • Dancho Danchev’s Private Party Videos – Part Three – Direct Video Download Available
  • Dancho Danchev’s Private Party Videos – Part Two – Direct Video Download Available
  • Dancho Danchev’s Random Conference and Event Photos – A Compilation
  • Dancho Danchev’s Random Personal Photos and Research Photos Compilation – A Compilation
  • Dancho Danchev’s Research for Unit-.org – Direct Download Copy Available
  • Dancho Danchev’s Research for Webroot – Direct Download Copy Available
  • Dancho Danchev’s RSA Europe Conference Event Photos – A Photos Compilation
  • Dancho Danchev’s Security Articles and Research for ZDNet’s Zero Day Blog – Full Offline Copy Available – [PDF]
  • Dancho Danchev’s Security/OSINT/Cybercrime Research and Threat Intelligence Gathering Research Compilations – [PDF]
  • Dancho Danchev’s Twitter Archive – Direct Download – [ZIP]
  • Dancho Danchev’s Upcoming Cybercrime Research OSINT and Threat Intelligence Gathering E-Book Titles – Sample E-Book Covers
  • Dancho Danchev’s Video Keynote Presentation – “Exposing Koobface – The World’s Largest Botnet” – Video Download Available
  • Dancho Danchev’s Random Personal Photos and Research Photos Compilation – Part Three – A Compilation
  • Dancho Danchev’s Random Personal Photos and Research Photos Compilation – Part Two – A Compilation
  • Exposing A Virus Coding Group – An OSINT Analysis
  • Exposing a Boutique Fraudulent and Rogue Cybercrime-Friendly Forum Community – WhoisXML API Analysis
  • Exposing a Currently Active “Jabber ZeuS” also known as “Aqua ZeuS” Gang Personal Email Portfolio – An OSINT Analysis
  • Exposing a Currently Active CoolWebSearch Rogue and Malicious Domains Portfolio – An OSINT Analysis
  • Exposing a Currently Active CoolWebSearch Rogue and Malicious Domains Portfolio – Part Two – An OSINT Analysis
  • Exposing a Currently Active CoolWebSearch Rogue and Malicious Domains Portfolio – Part Four – An OSINT Analysis
  • Exposing a Currently Active CoolWebSearch Rogue and Malicious Domains Portfolio – Part Three – An OSINT Analysis
  • Exposing a Currently Active CoolWebSearch Rogue and Malicious IPs Portfolio – An OSINT Analysis
  • Exposing a Currently Active CoolWebSearch Rogue and Malicious IPs Portfolio – Part Two – An OSINT Analysis
  • Exposing a Currently Active Cyber Jihad Domain Portfolio – An OSINT Analysis
  • Exposing a Currently Active Cyber Jihad Domains Portfolio – WhoisXML API Analysis
  • Exposing a Currently Active Cyber Jihad Social Media Twitter Accounts – An OSINT Analysis
  • Exposing a Currently Active Domain Portfolio Belonging to Iran’s Mabna Hackers – An OSINT Analysis
  • Exposing a Currently Active Domain Portfolio Managed and Operated by Members of the Ashiyane Digital Security Team – WhoisXML API Analysis
  • Exposing a Currently Active Domain Portfolio of Currently Active High-Profile Cybercriminals Internationally – WhoisXML API Analysis
  • Exposing A Currently Active Domain Portfolio of Cybercrime Friendly Forum Communities – An OSINT Analysis
  • Exposing A Currently Active Domain Portfolio of Cybercrime Friendly Forum Communities – Part Two – An 
  • OSINT Analysis
  • Exposing A Currently Active Domain Portfolio of Cybercrime Friendly Forum Communities – Part Three – An 
  • OSINT Analysis
  • Exposing a Currently Active Domain Portfolio of Tech Support Scam Domains – An OSINT Analysis
  • Exposing a Currently Active Free Rogue VPN Domains Portfolio Courtesy of the NSA – WhoisXML API Analysis
  • Exposing a Currently Active Iran-Based Lone Hacker and Hacker Group’s Personal Web Sites Full Offline Copies – Direct Technical Collection Download – [RAR]
  • Exposing a Currently Active Kaseya Ransomware Domains Portfolio – WhoisXML API Analysis
  • Exposing a Currently Active Koobface Botnet C&C Server Domains Portfolio – Historical OSINT
  • Exposing a Currently Active List of Iran-Based Hacker and Hacker Team’s Handles – An OSINT Analysis
  • Exposing a Currently Active List of Iran-Based Hacker and Hacker Team’s Handles – Part Two – An OSINT Analysis
  • Exposing a Currently Active List of Iran-Based Hacker and Hacker Team’s Handles – Part Three – An OSINT Analysis
  • Exposing a Currently Active List of Iran-Based Hacker and Hacker Team’s Handles – Part Two – An OSINT Analysis
  • Exposing a Currently Active Money Mule Recruitment Domain Registrant Portfolio – Historical OSINT
  • Exposing a Currently Active NSO Spyware Group’s Domain Portfolio – WhoisXML API Analysis
  • Exposing a Currently Active Portfolio of Personal Web Sites Belonging to Iran-Based Hackers and Hacking Teams and Groups – An OSINT Analysis
  • Exposing a Currently Active Portfolio of Personal Web Sites Belonging to Iran-Based Hackers and Hacking Teams and Groups – Part Two – An OSINT Analysis
  • Exposing a Currently Active Portfolio of Ransomware-Themed Protonmail Personal Email Address Accounts – An OSINT Analysis
  • Exposing a Currently Active Portfolio of RAT (Remote Access Tool) C&C Server IPs and Domains – An OSINT Analysis
  • Exposing a Currently Active Rock Phish Domain Portfolio – Historical OSINT
  • Exposing a Currently Active SolarWinds Rogue and Malicious C&C Domains Portfolio – An OSINT Analysis
  • Exposing a Currently Active WannaCry Ransomware Domains Portfolio – WhoisXML API Analysis
  • Exposing a Personal Photo Portfolio of Iran Hack Security Team – An OSINT Analysis
  • Exposing A Personal Photos Portfolio of Ashiyane Digital Security Group Team Members – An OSINT Analysis
  • Exposing a Personal Ransomware-Themed Email Address Portfolio – An OSINT Analysis
  • Exposing a Personal Ransomware-Themed Email Address Portfolio – Part Two – An OSINT Analysis
  • Exposing a Portfolio of Ashiyane Digital Security Team Hacking Tools – Direct Technical Collection Download – [RAR]
  • Exposing a Portfolio of Personal Photos of Iran-Based Hacker and Hacker Teams and Groups – An OSINT Analysis
  • Exposing a Rogue Domain Portfolio of Fake News Sites – WhoisXML API Analysis
  • Exposing Bulgarian Cyber Army Hacking Group – An OSINT Analysis
  • Exposing HackPhreak Hacking Group – An OSINT Analysis
  • Exposing Personally Identifiable Information on Ashiyane Digital Security Group Team Members – An OSINT Analysis
  • Exposing Random Koobface Botnet Related Screenshots – An OSINT Analysis
  • Exposing Team Code Zero Hacking Group – An OSINT Analysis
  • From the “Definitely Busted” Department – A Compilation of Personally Identifiable Information on Various Cyber Threat Actors Internationally – An OSINT Analysis – [PDF]
  • Introducing Astalavista.box.sk’s “Threat Crawler” Project – Earn Cryptocurrency for Catching the Bad Guys – Hardware Version Available
  • Introducing Dancho Danchevs’s “Blog” Android Mobile Application – Google Play Version Available
  • Malware – Future Trends – Research Paper – Copy
  • Person on the U.S Secret Service Most Wanted Cybercriminals Identified Runs a Black Energy DDoS Botnet – 
  • WhoisXML API
  • Profiling a Currently Active CoolWebSearch Domains Portfolio – WhoisXML API Analysis
  • Profiling a Currently Active Domain Portfolio of Fake Job Proposition and Pharmaceutical Scam Domains – An OSINT Analysis
  • Profiling a Currently Active Domain Portfolio of Pay-Per-Install Rogue and Fraudulent Affiliate Network Domains – An OSINT Analysis
  • Profiling a Currently Active Personal Email Address Portfolio of Members of Iran’s Ashiyane Digital Security Team – An OSINT Analysis
  • Profiling a Currently Active Personal Email Addresses Portfolio Operated by Cybercriminals Internationally – An OSINT Analysis
  • Profiling a Currently Active Portfolio of Rogue and Malicious Domains – An OSINT Analysis
  • Profiling a Currently Active Portfolio of Scareware and Malicious Domain Registrants – Historical OSINT
  • Profiling a Currently Active Portfolio of Scareware Domains – Historical OSINT
  • Profiling a Currently Active Portfolio of Spam Domains that Hit ZDNet.com Circa – An OSINT Analysis
  • Profiling a Currently Active Scareware Domains Portfolio – An OSINT Analysis
  • Profiling a Money Mule Recruitment Registrant Emails Portfolio – WhoisXML API Analysis
  • Profiling a Portfolio of Cybercriminal Email Addresses – WhoisXML API Analysis
  • Profiling a Portfolio of Personal Photos Courtesy of Koobface Botnet Master Anton Korotchenko – An OSINT Analysis
  • Profiling a Portfolio of Personal Photos of Behrooz Kamalian Team Member of Ashiyane Digital Security Team – An OSINT Analysis
  • Profiling a Portfolio of Personally Identifiable OSINT Artifacts from Law Enforcement and OSINT Operation “Uncle George” – An OSINT Analysis
  • Profiling a Rogue Fast-Flux Botnet Infrastructure Currently Hosting Multiple Online Cybercrime Enterprises – WhoisXML API Analysis
  • Profiling Iran’s Hacking Scene Using Maltego – A Practical Case Study and a Qualitative Approach – An Analysis
  • Profiling Russia’s U.S Election Interference – WhoisXML API Analysis
  • Profiling the “Jabber ZeuS” Rogue Botnet Enterprise – WhoisXML API Analysis
  • Profiling the Emotet Botnet C&C Infrastructure – An OSINT Analysis
  • Profiling the Internet Connected Infrastructure of the Individuals on the U.S Sanctions List –WhoisXML API Analysis
  • Profiling the Liberty Front Press Network Online – WhoisXML API Analysis
  • Profiling the U.S Election Interference – An OSINT Analysis
  • Random Photos from the “Lab” Circa up to Present Day – A Compilation
  • Sample Random Cybercrime Ecosystem Screenshots – A Compilation of Images – Direct Technical Collection Download – An Analysis
  • Sample Random Cybercrime Ecosystem Screenshots – A Compilation of , Images – An Analysis
  • Sample Random Cybercrime Ecosystem Screenshots – A Compilation of , Images – An Analysis
  • Sample Random Cybercrime Ecosystem Screenshots – A Compilation of Images – An Analysis
  • Security Researchers Targeted in Spear Phishing Campaign – WhoisXML API Analysis
  • Shots from the Wild West – Random Cybercrime Ecosystem Screenshots – An OSINT Analysis – Part Three
  • The Pareto Botnet – Advanced Cross-Platform Android Malware Using Amazon AWS Spotted in the Wild – WhoisXML API Analysis
  • Who’s Behind the Conficker Botnet? – WhoisXML API Analysis
  • Who’s on Twitter?


Stay tuned!

Continue reading →

Massive Phishing Campaign Domain Farm Spotted in the Wild Uses Google's Firebase Thousands of Users Affected - An OSINT Analysis

0
October 18, 2021

I've just stumbled across a pretty decent and massive phishing domains farm that using Google's for the purpose of hosting and distributing the rogue and malicious content.

In this post I'll provide actionable intelligence on the infrastructure behind it including to discuss in-depth the TTPs (Tactics Techniques and Procedures) of the cybercriminals behind it.


Sample rogue and malicious URL known to have participated in the campaign:


hxxp://js-82wha8sw738.web.app/sc/css.css


Sample malicious and rogue responding IPs known to have participated in the campaign:


199.36.158.100

151.101.1.195

151.101.65.195


Sample screenshots of the rogue and malicious phishing domains known to have been involved in the campaign:









Sample rogue and malicious phishing domain portfolio known to have participated in the campaign:


0000.firebaseapp.com

02a8.web.app

11spielmacherbeta.firebaseapp.com

131023.firebaseapp.com

144110.firebaseapp.com

1493735036650.firebaseapp.com

164200.firebaseapp.com

177010.firebaseapp.com

177610.firebaseapp.com

17cc7.firebaseapp.com

212820.firebaseapp.com

abmay-d9b3b.web.app

abmay2-4abdf.web.app

adamlouie-c87d1.firebaseapp.com

adda-fenase.web.app

admininstatiles-5e702.firebaseapp.com

ads-restricted-id.web.app

aglae-f0665.firebaseapp.com

ahwma-de0bf.web.app

airbnb-70aba.firebaseapp.com

ajarwebsite-7d033.firebaseapp.com

all-scanner-cdf80.web.app

amao-dc021.web.app

ambitowebapp-2e394.firebaseapp.com

analytics-6a184.firebaseapp.com

angular2-hn.firebaseapp.com

angular7firestore-155e4.firebaseapp.com

aniapp-7ddc2.firebaseapp.com

anna-prone.web.app

api-project-723816548444.firebaseapp.com

appeal-form-fb-copyright102872.web.app

appeal-form-fb-copyright18258.web.app

appeal-form-fb-copyright187265.web.app

appeal-page-unpublish-1827589.web.app

appeal-page-unpublish1107276.web.app

appeal-page-unpublish118172861.web.app

appeal-page-unpublish18275.web.app

appeal-page-unpublish182758.web.app

appeal-page-unpublish1827586.web.app

appeal-page-unpublish182759.web.app

appeal-page-unpublish18278652.web.app

appeal-page-unpublish1827890.web.app

appeal-page-unpublish187-36ac4.web.app

appeal-page-unpublish18769.web.app

appemailhostingcha2.web.app

appy-760b5.firebaseapp.com

ararestaurant1.firebaseapp.com

arco-website-f9750.firebaseapp.com

aruba-postmaster-info.web.app

asmorx-1f6a2.web.app

asna-mod.web.app

ass-mote.web.app

asse-mofe.web.app

assets-0l61.firebaseapp.com

atarashii-atsui.web.app

au-ma-di.web.app

aude-mofe.web.app

audiscover-owawebapplications.web.app

auri-mo-da.web.app

auth-task1-m.web.app

auth20-outlook.web.app

authdemo-177a0.firebaseapp.com

authenticationuchu23.web.app

baffe-level.web.app

bandspace-console.web.app

baren-od.web.app

battle-22f22.firebaseapp.com

benali-acbe6.web.app

bestofjs-api-v1.firebaseapp.com

bi-1020101000x0.web.app

bigbt-aten.web.app

bingbrossvocalintel.web.app

bitbaink.web.app

bithunnb.web.app

bjqrasuoup.web.app

blockchain-assets-protection.web.app

blockchain-recovery-dda4d.web.app

bmazy2-0.web.app

bnp-verifi.web.app

boma-ren.firebaseapp.com

booking-hotesses-d7920.firebaseapp.com

bred-authentification-97-7.web.app

buten-dare.web.app

bzbikeruko.web.app

ca-regionale-department-a.web.app

cabs-ole.web.app

cadeau-par-plaisir.web.app

cale-mothe.web.app

camoam-d97a4.web.app

case-ofa.web.app

case100091254778.web.app

caseforpage100089481844.web.app

caseforpages100049151.web.app

caseforpages108412.web.app

caseforpages1885777.web.app

caseforpages1888888.web.app

caseforpages55222.web.app

caseforpages777422.web.app

caseforpages88174714.web.app

caten-opa.web.app

cau-quate.web.app

cen-kenase.web.app

cenle-one.web.app

centre-telephoneproinfo.web.app

chargement-service.web.app

chat-b2982.firebaseapp.com

chat-finpolo.firebaseapp.com

checkmailsawo5.web.app

checkmessagerievocalewebtel.web.app

checksweetmail6.web.app

cinhatena.web.app

cloud-space-auth-service.web.app

clouddoc-authorize.firebaseapp.com

club-note-vocale.web.app

code-mesme.web.app

cogne-menta.web.app

cojet-mole.web.app

cokade-made.firebaseapp.com

colimat-done.web.app

colo-mate.web.app

comasse-unade.web.app

come-measa.web.app

companyemailresync1.web.app

con-firma.firebaseapp.com

cones-dore.web.app

conh-ma.web.app

cop-ado.web.app

cope-ilna.web.app

cora-gas-me.web.app

cphost-7edd4.web.app

crawer-sur.web.app

credit-et-assurance07.web.app

cres-mate.web.app

crime-aune.web.app

crive-cible.web.app

csen-ted.web.app

d-validate.web.app

d3iioor0753gvdbfewypqb64.web.app

daisma-e7e6c.web.app

darrin-pendleton-j5286.web.app

dc4u-6e803.firebaseapp.com

decdo-chat2.firebaseapp.com

demachatendi36.web.app

demoitau-d3428.web.app

denabere-2c382.web.app

digital-book-9f870.firebaseapp.com

dmacenda.web.app

docsharex-authorize.firebaseapp.com

docuproject39-277-383-files.firebaseapp.com

dope-ufen.web.app

downloadfreeebookspdf-6e806.firebaseapp.com

downloadpdfreader-d7702.firebaseapp.com

drafty-43c88.firebaseapp.com

driveintuksouteast-falcaopla.web.app

dropdocument-c3829.web.app

dskdirect-5ba26.web.app

dw-website-fbc19.firebaseapp.com

eagle10.firebaseapp.com

ebookwngfgewarwle.web.app

edret-tropm.web.app

efetgreds.web.app

eins-done.web.app

eleven-bot-399b7.web.app

elimu-c1a38.firebaseapp.com

email-mweb-co-za-zimbra-1.firebaseapp.com

email-update-verify.web.app

email-verificationservices365.web.app

empacte-do.web.app

ems-obe.web.app

emsi-lobo.firebaseapp.com

end-losup.web.app

erfders-f6013.web.app

esote-mode.web.app

exness-mobile.web.app

explore-wetriansfering-web.web.app

exposedacne.web.app

f0ldgonn.firebaseapp.com

facebook-appeal1749902610052.web.app

facebook-appelcase32q1.web.app

facebookappeal-case10351001.web.app

facebookappealcase1884888444.web.app

facebookappealcase7174747444.web.app

facebookcase187444441.web.app

facebookcase188444.web.app

fares-one.web.app

fb-appeal-form-70f46.web.app

fb-appeal-form-791bd.web.app

fb-restricted-d12c2.web.app

fbappealform13111.web.app

fbforpages1848151.web.app

fbmail-case199418414.web.app

fbmail-pages100049194.web.app

fbpages-case10004915.web.app

fema-tode.web.app

fetfetaa-81119.web.app

fines-gining.web.app

firtserverunithpp.web.app

flape-man.web.app

flape-odade.web.app

fmvfhagpab.web.app

focus-online-news.web.app

fodes-mota.web.app

font-makeupe.web.app

foresta-mod.firebaseapp.com

foten-moda.web.app

francesbbv.web.app

freeebookspdf-9ab41.firebaseapp.com

freejobsnews-f8cb8.firebaseapp.com

freis-mode.web.app

gadjabadjala1.web.app

gare-train3.web.app

gene-marso.web.app

genie-alba.firebaseapp.com

girly-wallpaper-5b75f.web.app

godadyxs.web.app

gomas-12c01.web.app

gospel-living.web.app

goswapp-bsc.web.app

gotan-one.web.app

gotcha-67060.firebaseapp.com

grace-bijoux-14910.firebaseapp.com

green656dfbb5f31b1fe48c2391a6.web.app

gridsend-98f14.web.app

groupe-ca-authenticati-caisse.web.app

groupe-sa-accueil-autnenti.web.app

gweb-gc-gather-production.firebaseapp.com

gweb-miyagi.firebaseapp.com

hagenpau.web.app

histoire-clik.web.app

hiworksservicecenter.web.app

hon-macona.web.app

hounbvc-c7661.web.app

hsfkrkqogo.web.app

httpsaudiscover-owawebapplications.web.app

httpsdocument-download-902123.web.app

httpsfyregym-wetransfer.web.app

httpsjojo-wiza124.web.app

httpsjoovkuebea.web.app

httpsminxtex.firebaseapp.com

httpsprice-per-unit.firebaseapp.com

httpsprotectmimemimefrem.web.app

httpsworldvision-419f2.firebaseapp.com

hunin-one.web.app

hyle-fb82f.web.app

info-telephone-vocale.web.app

international-web-fb75a.web.app

isfane-osade.web.app

iydd-1b2d8.web.app

jams-jamz1234.web.app

jecta-f45df.firebaseapp.com

jentame-add.web.app

jes-mo-sad.web.app

jex-ulto.web.app

kaunte-mone.web.app

kebote-moda.web.app

kes-mole.web.app

kodrefse-nsf.web.app

l09162020-fixmailhelpdesk.web.app

laefhfdhkdsdv.web.app

lamaf-50e45.web.app

les-more.web.app

lg-roudcubeblack-access.web.app

lgeyfuusmg.web.app

licloud.web.app

licos-date.web.app

line-9ca1c.web.app

link-bb76d.web.app

lisen-ocun.web.app

live-support-82d11.firebaseapp.com

login-442v3f.web.app

loginfo-tkconf.web.app

lohsam-86765.web.app

lommsrecu3.firebaseapp.com

lono-jena.web.app

lote-masme.web.app

louams-62870.web.app

lthouse.web.app

m-cabanqueenligne-particuliers.web.app

m-orangebankenligne-id.web.app

m1technology.firebaseapp.com

maedz-5fdff.web.app

mail-8583e.web.app

mail-account-verify-f4723.web.app

mail-lcloud-com-account.web.app

mail-ovhcloud.web.app

mansan-4ca1c.web.app

may1110genstanbk.web.app

mbqbfhfmgr.web.app

memo-vocale-52636.web.app

mentipdf.web.app

mercadolibre-research.web.app

mms-sms-alert.firebaseapp.com

mo-aska-da.web.app

mobialmysyf.web.app

mobizzmperb.web.app

moce-add.web.app

moce-aude.web.app

molases-b652e.web.app

mon-tome.web.app

msgmessage-7f854.firebaseapp.com

mswordg.web.app

mta-round-cube.web.app

mxflexsub.web.app

my-bithumb.web.app

my-winbamk.web.app

mylogin-config.web.app

nale-ping.web.app

name-ocina.web.app

ne01u59l.firebaseapp.com

nera-mode.web.app

netw0rksolutions.web.app

newlink-c8a8f.web.app

njnapcdvzc.web.app

nopin-dod.web.app

nozed-uname.firebaseapp.com

ntzmttpmnttoepnlant.web.app

o-orangebank18-id.web.app

oaism-72827.web.app

ocaque-domen.firebaseapp.com

ocuso-aken.web.app

office-webmail-login-f0e3c.web.app

officeindex-file.web.app

officemailsharing-20cd3.web.app

offices-voicemail.web.app

oftenas-oweb.web.app

ojin-madij.web.app

olet-mado.web.app

omawo-14b8c.web.app

on-me-ro.firebaseapp.com

onee-a0488.web.app

oneone-19cd8.web.app

onga-moce.web.app

onlinepdfkwpmmkl.web.app

onsa-mode.web.app

orange-my-app.web.app

orangesmsprovocale.web.app

oras-moria.web.app

oroma-42f59.web.app

osale-mape.web.app

osaute-moca.web.app

others1-f7ce9.web.app

outline-auth-d7f99.web.app

outlookloffice365user09ngxsmd.web.app

outlookloffice365userp86aese6.web.app

outlooks-userserver.web.app

owa-signon-officeaccount.web.app

owablu84349439434.web.app

owserv220020.web.app

padma-3fbb8.web.app

page-appeal-unpublish1253631.web.app

pagebusiness-copyrightcase1256.web.app

pay-sera.web.app

phuongpndev.web.app

pokajca.web.app

poltunefrdonecodesms.web.app

popuyecash7.web.app

portail-messagerieorangesms.web.app

postmailservr-panel-centr.web.app

project2021c-42b13.firebaseapp.com

pry-ecommerce.web.app

put-media-lan.web.app

r-web-2a3a9.web.app

rbc-mainline.web.app

rbc-verifylogin5.web.app

rbclogin-line.web.app

readingwtagzdm.web.app

recording-c12f5.web.app

renard-trouillard.web.app

restore70174-coinbase-us.web.app

rjabldfrbg.web.app

romas-512bf.web.app

rooted-4da8a.web.app

rouncubemail.web.app

royalbill-a3y4.web.app

rufe-sun.web.app

saal-kejriwal.web.app

samda-3c88f.web.app

sarba-one.web.app

scorchvc.web.app

scorchvc.web.app0

serve-8e8dc.web.app

server-authentication-332e1.web.app

servercpanel-afa12.web.app

service-vocalesmsprotelfixe.web.app

sharebox-onedrive-file-f692f.web.app

side-esone.web.app

sim-ote.web.app

skype-online04171.web.app

slackchatv1.firebaseapp.com

snaptik.web.app

soci-molen.web.app

sode-mape.web.app

soden-olma.web.app

sofe-inchena.web.app

sofe-tane.web.app

solen-conda.web.app

somas-b88a0.web.app

sone-masa.web.app

sonta-maline.web.app

sore-modabe.web.app

soure-made.web.app

sparkassbank-de.web.app

srey-deocs.web.app

sroxma-ab2cc.web.app

sudo-mone.web.app

sugen-oda.web.app

sun-maupe.web.app

sunge-ode.firebaseapp.com

suone-bena.web.app

swiftshare-content-auth.web.app

tittot-a8505.web.app

tm-etiquetado.web.app

tome-done.web.app

totem1.web.app

totem2.web.app

tousou-posoto3.web.app

trdsmccdb7386cbf3ba0b0b8d.web.app

truein-264db.web.app

ugen-orabe.web.app

uiinlcuo37oed.web.app

un-foreste.web.app

unt-morelle.web.app

update-45190ca.web.app

user-45190ca21.web.app

userca-58ce4.web.app

usmin-moda.web.app

validate-clientrbc.web.app

vandameman4.web.app

verberuyer7.web.app

verif-loginrbc.web.app

verify-48181.web.app

verify-user-rbc.web.app

verifywell-85477.web.app

vkmqnvyfwd1111.web.app

vmta-mod.web.app

vocaleproidorange.web.app

votre-boitevocale-fixe.firebaseapp.com

wdfyxklmba.web.app

web-bf4.web.app

web-e1f6d.web.app

web874830-98375-90232.web.app

webmail-a2846.web.app

webmail-control-9efc7.web.app

wecluihfrf-76tygh.web.app

wedpfoaliculate-resmazm.web.app

westernfoodmaincourse.web.app

wetranslatetransfers-coxsola.firebaseapp.com

wetrnafers.web.app

whatsapp-clone-teamwork.firebaseapp.com

win-more-0x.web.app

winx-fbac0.web.app

wix-engage-visitors-prod-0.firebaseapp.com

wix-engage-visitors-prod-10.firebaseapp.com

wix-engage-visitors-prod-20.firebaseapp.com

wo0923536-902453-908563.web.app

wraxdne.web.app

www.firebaseapp.com

www.web.app

x0x0x10010-0100.web.app

x48652.web.app

xamua-7cb66.web.app

xcio-00000auth.web.app

xm01-18c1f.web.app

xn--87487387348739-16aa.web.app

xtpma4ep.firebaseapp.com

zoho-active.web.app

zoho-adminserv.web.app

zoho-mailservices.web.app

zoho-online.web.app

zoho-validationserv.web.app

zxtst-44902.firebaseapp.com


Stay tuned!

Continue reading →

The Dark Web Market Segment - FUD or Hype? - An Analysis

0
October 18, 2021

In recent years it became clearly evident that the over-population of the Dark Web with hundreds of thousands of active low profile and high-profile Dark Web Onion web sites

Continue reading →

Dancho Danchev's "Cybercrime Research and Cybercrime Fighting" USB Stick - Grab the Torrent!

0
October 10, 2021
This summary is not available. Please click here to view the post. Continue reading →

Dancho Danchev's Ultimate "Cybercrime Research and Fighting Toolkit" - Order a USB Stick Today!

0
October 08, 2021

 
Dear blog readers,

Order today!


Stay tuned!
 

Continue reading →

Dancho Danchev's Keynote on "Exposing Koobface - The World's Largest Botnet" at CyberCamp 2016 - Watch Online!

0
October 07, 2021

Dear blog readers,

I've decided to share with everyone my Keynote from CyberCamp 2016 - "Exposing Koobface - The World's Largest Botnet" with the idea to help everyone improve their situational awareness on current and emerging cyber threats. 

Here's the actual PPT.


Stay tuned!

Continue reading →

Deep from the Trenches in Bulgaria! - Part Four

0
October 06, 2021

define:moron

Big thanks to all the dipshits based in Bulgaria who basically broke my life for the sake of their own well being. Mad props kudos all god bless and don't forget to bow down and behold to the almighty -- the dollar is not for you -- savior and basically everything that you don't understand and don't forget we're always there "looking for you".

Stay tuned!
Continue reading →

Looking for a Cyber Security Project Investor?

0
October 04, 2021

Dear blog readers,

I've just received a direct acquisition proposal for a high-profile cyber security project and I need an investment partner who can work with me and make it happen.

Are you interested in working with me for this project? Drop me a line at dancho.danchev@hush.com


 Sample project screenshots:



Stay tuned!

Continue reading →

New Dark Web Onion Address!

0
October 04, 2021

Dear blog readers,

Check out my new Dark Web Onion address which is - http://aklw6fojficmu3zqsdsffprbas3kqrheej4ntvynfl5xkrjpqhlq55yd.onion/wordpress where I intend to continue publishing high-quality and never-released before cybercrime research and threat intelligence including OSINT analysis type of research on a daily basis.

Big thanks to everyone visiting my Dark Web Onion on the Dark Web and keep it coming.

Stay tuned! Continue reading →

"Exposing Protonmail and Tutanota's Illicit Abuse by Ransomware Gangs - A Compilation of Currently Active Ransomware-Themed Email Addresses - Part Three

0
October 04, 2021

Dear blog readers,

This is Dancho and I've decided to share yet another currently active Tutanota ransomware themed email address accounts with the idea to attempt to take them offline potentially causing financial and related issues to the individuals behind these campaigns.

Sample currently active Tutanota ransomware themed email address accounts known to have been involved in related malicious and fraudulent campaigns:

 123@tutanota.com

4lok3r@tutanota.com

9ea6e85bd12b@tutanota.com

BCPFILE17@tutanota.com

BlackSpyro@tutanota.com

Blacknord@tutanota.com

BobGreen85@tutanota.com

Ctorsenoria@tutanota.com

Decfile431@tutanota.com

Decrpt@tutanota.com

DouariX@tutanota.com

E-Mail-HappyNewYear2021@tutanota.com

EnceryptedFiles@tutanota.com

Encrypt4u@tutanota.com

EpsilonCrypt@tutanota.com

Figskici@tutanota.com

FileEngineering@tutanota.com

FilesHelp@tutanota.com

GooodMorning@tutanota.com

HappyNewYear2021@tutanota.com

Helpcrypt1@tutanota.com

Helps@tutanota.com

Helpsdec@tutanota.com

Hiden_pro@tutanota.com

HydaHelp1@tutanota.com

ICanFixYourFiles@tutanota.com

JohnMuller88@tutanota.com

Kromber@tutanota.com

Patagonoa92@tutanota.com

RestorFile@tutanota.com

ReturnEncerypted@tutanota.com

Sacura889@tutanota.com

Sherminator.help@tutanota.com

SimpleSup@tutanota.com

Soportevoid@tutanota.com

SpadeEncrypt@tutanota.com

StuardRitchi@tutanota.com

Swordf1sh@tutanota.com

Szems@tutanota.com

TheZenis@Tutanota.com

VoidFiles@tutanota.com

Wenuptwen1@tutanota.com

ammon0503@tutanota.com

artemy75@tutanota.com

askhelp@tutanota.com

axitrun2@tutanota.com

axitrun@tutanota.com

barboza40@tutanota.com

bbbitcrypt@tutanota.com

blackmax@tutanota.com

charlieSuport@tutanota.com

clifieb@tutanota.com

clyde.barrow15@tutanota.com

coleman.dec@tutanota.com

com-gloria@tutanota.com

coronavirus19@tutanota.com

cricket@tutanota.com

cryptget@tutanota.com

cryptlocker@tutanota.com

darkencryptor@tutanota.com

darkwaiderr@tutanota.com

datareesstore@tutanota.com

decode.emf@tutanota.com

decoderma@tutanota.com

dfvdv@tutanota.com

dokulus@tutanota.com

dozusopo@tutanota.com

dryidik@tutanota.com

dts1024@tutanota.com

eternalnightmare@tutanota.com

filekerk@tutanota.com

filesrestore@tutanota.com

fixbyfinch@tutanota.com

flower.harris@tutanota.com

garrymagic@tutanota.com

getthekey@tutanota.com

giveyoukey@tutanota.com

grdoks@tutanota.com

hallome@tutanota.com

help73@tutanota.com

help@tutanota.com

helpyoubus11@tutanota.com

hildaseriesnetflix125@tutanota.com

hinduism0720@tutanota.com

hlper4y@tutanota.com

host2021@tutanota.com

jakie.nunes@tutanota.com

jamesbond2021@tutanota.com

job2019@tutanota.com

johnsmith987654@tutanota.com

johnsonwhate@tutanota.com

khalate@tutanota.com

klowershit1835@tutanota.com

kokux@tutanota.com

konxnobx@tutanota.com

legalrestore@tutanota.com

lossdata@tutanota.com

mammon0503@tutanota.com

mccreight.ellery@tutanota.com

member987@tutanota.com

moloch_helpdesk@tutanota.com

mr.dec@tutanota.com

nAskHelp@tutanota.com

nBobGreen85@tutanota.com

nEpsilonCrypt@tutanota.com

nHydaHelp1@tutanota.com

nbarboza40@tutanota.com

ncoleman.dec@tutanota.com

neftet@tutanota.com

ngiveyoukey@tutanota.com

nklowershit1835@tutanota.com

nmode@tutanota.com

notgoodnews@tutanota.com

nretrnyoufiles23@tutanota.com

openthefile@tutanota.com

ormecha19@tutanota.com

pashmak@tutanota.com

patrik008@tutanota.com

pecunia0318@tutanota.com

peloment@tutanota.com

phobosrecovery@tutanota.com

pixell@tutanota.com

poker021@tutanota.com

psychopath7@tutanota.com

pvphlp@tutanota.com

python100@tutanota.com

qar48@tutanota.com

raynorzlol@tutanota.com

recover10@tutanota.com

remotePChelper@tutanota.com

retrnyoufiles23@tutanota.com

rsaencrypt@tutanota.com

samsung00700@tutanota.com

savemyself1@tutanota.com

serhio.vale@tutanota.com

skgrhk2018@tutanota.com

skgrhk2018me@tutanota.com

smartrecav@tutanota.com

spacexhuman@tutanota.com

subik099@tutanota.com

systems@tutanota.com

szem@tutanota.com

tHydaHelp1@tutanota.com

tchukopchu@tutanota.com

tcprx@tutanota.com

triplock@tutanota.com

unl0ckerpkx@tutanota.com

wang.chang888@tutanota.com

whiopera@tutanota.com

whizoze@tutanota.com

wyooy@tutanota.com

xilttbg@tutanota.com

xser@tutanota.com

xzet@tutanota.com

yasomoto@tutanota.com

yongloun@tutanota.com

yuzhou13@tutanota.com

yyuzhou13@tutanota.com

zxqwopnm@tutanota.com

Sample related Tutanota ransomware themed email address accounts known to have been involved in related fraudulent and malicious campaigns:

dts1024@tutanota.com

vassago_0203@tutanota.com

moloch_helpdesk@tutanota.com

triplock@tutanota.com

Benford333@tutanota.com

nBenford333@tutanota.com

shadowghosts@tutanota.com

nshadowghosts@tutanota.com

helpforyoupc@tutanota.com

RestorFile@tutanota.com

adresspower@tutanota.com

Hiden_pro@tutanota.com

Blacknord@tutanota.com

systems@tutanota.com

xzet@tutanota.com

szem@tutanota.com

help@tutanota.com

Szems@tutanota.com

Patagonoa92@tutanota.com

mr.dec@tutanota.com

nmode@tutanota.com

python100@tutanota.com

yasomoto@tutanota.com

dokulus@tutanota.com

axitrun2@tutanota.com

hlper4y@tutanota.com

patrik008@tutanota.com

tchukopchu@tutanota.com

pashmak@tutanota.com

savemyself1@tutanota.com

yyuzhou13@tutanota.com

tcprx@tutanota.com

pvphlp@tutanota.com

dryidik@tutanota.com

notgoodnews@tutanota.com

clifieb@tutanota.com

blackmax@tutanota.com

askhelp@tutanota.com

ragnar0k@tutanota.com

barboza40@tutanota.com

HydaHelp1@tutanota.com

neftet@tutanota.com

EpsilonCrypt@tutanota.com

hinduism0720@tutanota.com

mammon0503@tutanota.com

ammon0503@tutanota.com

samsung00700@tutanota.com

klowershit1835@tutanota.com

retrnyoufiles23@tutanota.com

clyde.barrow15@tutanota.com

Decrpt@tutanota.com

Encrypt4u@tutanota.com

Helpsdec@tutanota.com

Soportevoid@tutanota.com

getthekey@tutanota.com

whizoze@tutanota.com

DouariX@tutanota.com

poker021@tutanota.com

ZadarusFiles@tutanota.com

xsmaxs@tutanota.com

Sacura889@tutanota.com

yongloun@tutanota.com

dozusopo@tutanota.com

EnceryptedFiles@tutanota.com

ReturnEncerypted@tutanota.com

nbarboza40@tutanota.com

nklowershit1835@tutanota.com

nragnar0k@tutanota.com

nretrnyoufiles23@tutanota.com

nEpsilonCrypt@tutanota.com

nAskHelp@tutanota.com

filesrestore@tutanota.com

garrymagic@tutanota.com

darkwaiderr@tutanota.com

job2019@tutanota.com

pixell@tutanota.com

phobosrecovery@tutanota.com

com-gloria@tutanota.com

raynorzlol@tutanota.com

member987@tutanota.com

bbbitcrypt@tutanota.com

kokux@tutanota.com

mccreight.ellery@tutanota.com

SimpleSup@tutanota.com

subik099@tutanota.com

spacexhuman@tutanota.com

serhio.vale@tutanota.com

helpyoubus11@tutanota.com

johnsonwhate@tutanota.com

remotePChelper@tutanota.com

BCPFILE17@tutanota.com

xilttbg@tutanota.com

legalrestore@tutanota.com

Swordf1sh@tutanota.com

host2021@tutanota.com

skgrhk2018@tutanota.com

skgrhk2018me@tutanota.com

cryptlocker@tutanota.com

help73@tutanota.com

johnsmith987654@tutanota.com

filekerk@tutanota.com

cricket@tutanota.com

artemy75@tutanota.com

Helpcrypt1@tutanota.com

FilesHelp@tutanota.com

darkencryptor@tutanota.com

smartrecav@tutanota.com

Decfile431@tutanota.com

9ea6e85bd12b@tutanota.com

cryptget@tutanota.com

flower.harris@tutanota.com

hildaseriesnetflix125@tutanota.com

datareesstore@tutanota.com

zxqwopnm@tutanota.com

lafoievologjanin123@tutanota.com

buratino2@tutanota.com

onlinebigbrotheriswatchingyou@tutanota.com

MattCohn@tutanota.com

restmefast@tutanota.com

grdoks@tutanota.com

unl0ckerpkx@tutanota.com

decoderma@tutanota.com

VoidFiles@tutanota.com

coronavirus19@tutanota.com

rsaencrypt@tutanota.com

SpadeEncrypt@tutanota.com

recover10@tutanota.com

lossdata@tutanota.com

decode.emf@tutanota.com

whiopera@tutanota.com

openthefile@tutanota.com

wyooy@tutanota.com

4lok3r@tutanota.com

FileEngineering@tutanota.com

ICanFixYourFiles@tutanota.com

psychopath7@tutanota.com

BlackSpyro@tutanota.com

Helps@tutanota.com

StuardRitchi@tutanota.com

venomous.files@tutanota.com

Figskici@tutanota.com

axitrun@tutanota.com

markusdoc88@tutanota.com

dryeye21@tutanota.com

giveyoukey@tutanota.com

Wenuptwen1@tutanota.com

soft2018@tutanota.com

nmarkusdoc88@tutanota.com

ngiveyoukey@tutanota.com

jakie.nunes@tutanota.com

TheZenis@Tutanota.com

dfvdv@tutanota.com

hallome@tutanota.com

yuzhou13@tutanota.com

konxnobx@tutanota.com

HappyNewYear2021@tutanota.com

Kromber@tutanota.com

eternalnightmare@tutanota.com

wang.chang888@tutanota.com

E-Mail-HappyNewYear2021@tutanota.com

123@tutanota.com

pecunia0318@tutanota.com

Stay tuned!

Continue reading →

"Exposing Protonmail and Tutanota's Illicit Abuse by Ransomware Gangs - A Compilation of Currently Active Ransomware-Themed Email Addresses - Part Two

0
October 04, 2021

Dear blog readers,

This is Dancho and I've decided to share a recently obtained portfolio of Protonmail ransomware themed email address accounts with the idea to attempt to take them offline potentially causing financial and related troubles to the individuals involved in these campaigns.

Sample currently active Protonmail ransomware themed email address accounts known to have been involved in related fraudulent and malicious campaigns:

05250lock@protonmail.com
0x1service@protonmail.com
1_kill_yourself_1@protonmail.com
1rest0re@protonmail.com
2020x0@protonmail.com
4lok3r@protonmail.com
AbbsChevis@protonmail.com
AdvancedBackup@protonmail.com
BTCBREWERY@protonmail.com
BackFileHelp@protonmail.com
Bossi_tosi@protonmail.com
Brilliancebk@protonmail.com
Catsexy@protonmail.com
Corpseworm@protonmail.com
CottleAkela@protonmail.com
Cryptmanager@protonmail.com
Datarest0re@protonmail.com
DavidsHelper@protonmail.com
Deccoder431@protonmail.com
DecrypterSupport@protonmail.com
Decryptharma@protonmail.com
Decryptions@protonmail.com
Decryptutility@protonmail.com
DharmaParrack@protonmail.com
DiskDoctor@protonmail.com
Dsupport@protonmail.com
EMAIL@protonmail.com
Encryptedxtredboy@protonmail.com
F-data@protonmail.com
Filedecryptor@protonmail.com
Filegorilla1388@protonmail.com
FilesRecoverEN@Protonmail.com
Folieloi@protonmail.com
FreeWizard9@protonmail.com
GetYourFilesBack@protonmail.com
Hichkasam@protonmail.com
Honeylock@protonmail.com
HydraHelp1@protonmail.com
Jack76Duran@protonmail.com
JeanRenoAParis@protonmail.com
JinMaglaya@protonmail.com
JoniCarter@protonmail.com
Keta990@protonmail.com
Killback@protonmail.com
Kromber@protonmail.com
Leviathan13@protonmail.com
Lizardbkup@protonmail.com
Look1213@protonmail.com
Mammon-decrypt@protonmail.com
MayarChenot@protonmail.com
MerlinStusan@protonmail.com
MerlinVelso@protonmail.com
Mespinoza980@protonmail.com
MilesFlannagan@protonmail.com
Mr.TeslaBrain@protonmail.com
NetGanster@protonmail.com
Oktropys@protonmail.com
Openfileyou@protonmail.com
PabFox@protonmail.com
Panzergen552@protonmail.com
Pentagon11@protonmail.com
PhanthavongsaNeveyah@protonmail.com
Pringls_us@protonmail.com
Quantroei@protonmail.com
RECOVERUNKNOWN@protonmail.com
Recoverybat@protonmail.com
Recoveryhelp2019@protonmail.com
Recuperadados@protonmail.com
RemotePChelper@protonmail.com
RomanchukEyla@protonmail.com
SafeGman@protonmail.com
Santa_helper@protonmail.com
SayanWalsworth96@protonmail.com
SchreiberEleonora@protonmail.com
ScorpionEncryption@protonmail.com
SpadeEncrypt@protonmail.com
Steven77xx@protonmail.com
SupportOdveta@protonmail.com
SuzuMcpherson@protonmail.com
Tbr66@protonmail.com
TentwenUpper1@protonmail.com
TimisoaraHackerTeam@protonmail.com
TimothyCrabtree@protonmail.com
Tizer77234@protonmail.com
Unlock11@protonmail.com
UnlockAlexKingman@protonmail.com
Vitaly.Yermakov@protonmail.com
VoidFiles@protonmail.com
Wecanhelp@protonmail.com
William_Kidd_2019@protonmail.com
X280@protonmail.com
Xtredboy@protonmail.com
aam_sysadmin@protonmail.com
achtung_admin@protonmail.com
admincrypt@protonmail.com
agent.dmr@protonmail.com
aid.keepcalm@protonmail.com
andrey.taranov@protonmail.com
anna.kurtz@protonmail.com
anon4113@protonmail.com
anonymoushacks33@protonmail.com
aperfectday2018@protonmail.com
apoyo2019@protonmail.com
artemy75@protonmail.com
askhelp@protonmail.com
asmodey3301@protonmail.com
aztecdecrypt@protonmail.com
backinfo@protonmail.com
backuppc1@protonmail.com
backuppc@protonmail.com
bakfiles@protonmail.com
barracudahelp@protonmail.com
batary5588@protonmail.com
bbitcrypt@protonmail.com
billwong73@protonmail.com
bit_decrypt@protonmail.com
bitsupportz@protonmail.com
blackheel@protonmail.com
blackroot54@protonmail.com
brian.r.goodwin@protonmail.com
bronmerkberpa1976@protonmail.com
bsprj1020@protonmail.com
btc_bitts@protonmail.com
btcontact@protonmail.com
callmegoat@protonmail.com
cashdashsentme@protonmail.com
castor-troy-restore@protonmail.com
cheet0s_de@protonmail.com
cleverhorse@protonmail.com
com-gloria@protonmail.com
crioso@protonmail.com
cryptgh0st@protonmail.com
crypto_wannacash@protonmail.com
cryptofiles20202020@protonmail.com
cryptomadbusiness@protonmail.com
cryptoplant@protonmail.com
cyber.duskfly@protonmail.com
cynthia-it@protonmail.com
data1992@protonmail.com
databack2@protonmail.com
dawndec001@protonmail.com
dec.service@protonmail.com
decodeodveta@protonmail.com
decoderma@protonmail.com
decphob@protonmail.com
decrypt.russ@protonmail.com
decrypt24@protonmail.com
decrypt4data@protonmail.com
decrypterfile@protonmail.com
decryptmystuff@protonmail.com
decryptxxx@protonmail.com
deltatechit@protonmail.com
devilguy666@protonmail.com
dresdent@protonmail.com
duskeer@protonmail.com
egalytyy@protonmail.com
eladovin1975@protonmail.com
encryptc4@protonmail.com
encryptfile@protonmail.com
fahydremu1981@protonmail.com
fairman0023@protonmail.com
fileb@protonmail.com
filedownload2020@protonmail.com
files2@protonmail.com
filesreturn247@protonmail.com
flapalinta1950@protonmail.com
flopored@protonmail.com
flower.harris@protonmail.com
flowerboard@protonmail.com
fox2278@protonmail.com
freefoams@protonmail.com
friends2019@protonmail.com
g.kulahmet@protonmail.com
gareth.mckie3l@protonmail.com
geneve010@protonmail.com
geneve020@protonmail.com
getscoin2@protonmail.com
getscoin3@protonmail.com
getyourdata@protonmail.com
guaranteedsupport@protonmail.com
haunexuwofwuf@protonmail.com
help.me24@protonmail.com
help73@protonmail.com
helpadmin2@protonmail.com
helpdiamond@protonmail.com
helpnetin@protonmail.com
helpteam38@protonmail.com
helpyourdesk11@protonmail.com
hidebak@protonmail.com
hjelp.main@protonmail.com
honestman0023@protonmail.com
ialpatntedu@protonmail.com
imBoristheBlade@protonmail.com
incognitoman@protonmail.com
incongnitoman@protonmail.com
ivanmalahov@protonmail.com
j0ra@protonmail.com
jackiesmith176@protonmail.com
johnsonwhate@protonmail.com
jokeroo@protonmail.com
jonskuper578@protonmail.com
keepcredit015@protonmail.com
keychild@protonmail.com
khalate@protonmail.com
khfsuca@protonmail.com
kickclakus@protonmail.com
koxic@protonmail.com
lion7872@protonmail.com
loybranunun1975@protonmail.com
lucky_top@protonmail.com
lxhlp@protonmail.com
m4xroothackerteam@protonmail.com
maill_helpme@protonmail.com
mammon0503@protonmail.com
mantiticvi1976@protonmail.com
mattpear@protonmail.com
maxidecrypt@protonmail.com
missdecryptor@protonmail.com
momsbestfriend@protonmail.com
mr.crypteur@protonmail.com
mr.dec@protonmail.com
mrbin775@protonmail.com
nAskHelp@protonmail.com
nDiskDoctor@protonmail.com
nHydraHelp1@protonmail.com
nRecoverybat@protonmail.com
nationalsiense@protonmail.com
newneo1312@protonmail.com
nohopeproject@protonmail.com
nostro19@protonmail.com
oceannew_vb@protonmail.com
omegax0@protonmail.com
onepconebtc@protonmail.com
onimransom@protonmail.com
ooosferaplus@protonmail.com
pacman.support@protonmail.com
painplain98@protonmail.com
panda7499@protonmail.com
patern32@protonmail.com
pentaxyz777@protonmail.com
pentros30@protonmail.com
petersburgrecover@protonmail.com
petrov441@protonmail.com
pizdasobaki@protonmail.com
po2977@protonmail.com
pyyring23@protonmail.com
qkhooks0708@protonmail.com
raingemaximo@protonmail.com
raynorzlol@protonmail.com
rdpconnect@protonmail.com
rebushelp@protonmail.com
recfiles@protonmail.com
recover85@protonmail.com
recover_24_7@protonmail.com
recoverycode@protonmail.com
recoverysql@protonmail.com
rep_stosd@protonmail.com
reservedecryption@protonmail.com
ripntfs@protonmail.com
rusoftfond@protonmail.com
s1an1er111@protonmail.com
sailormorgan@protonmail.com
salutem@protonmail.com
savemyfiles@protonmail.com
securityit123@protonmail.com
servicedeskpay@protonmail.com
shellexec@protonmail.com
siniyzabor@protonmail.com
soft.russian@protonmail.com
softs98@protonmail.com
sp00f3rsupp0rt@protonmail.com
sp02@protonmail.com
spacexhuman@protonmail.com
support4you@protonmail.com
support_blackkingdom2@protonmail.com
supportcrypt2019@protonmail.com
t310ea89b4347@protonmail.com
teamvi@protonmail.com
teamvv@protonmail.com
tellyouthepass@protonmail.com
the.dodger@protonmail.com
tomascry@protonmail.com
trees.jpg.bepabepababy1@protonmail.com
tuhafcoderus@protonmail.com
unibovwood1984@protonmail.com
unlock0101@protonmail.com
unlockme123@protonmail.com
unlockransomware@protonmail.com
upfileme@protonmail.com
use_harrd@protonmail.com
vashmail@protonmail.com
vendetta553@protonmail.com
villiamsscorj_rembly@protonmail.com
vine77725@protonmail.com
virtualhorse1@protonmail.com
vurten_knyert@protonmail.com
wayneevenson@protonmail.com
werichbin@protonmail.com
worldofdonkeys@protonmail.com
xersami@protonmail.com
youneedmail@protonmail.com
zagrec@protonmail.com
zorab28@protonmail.com
zoye596@protonmail.com

Sample currently active Protonmail ransomware themed email address accounts known to have been involved in related fraudulent and malicious campaigns include:

getscoin3@protonmail.com
mstr.hack@protonmail.com
stevemartin777@protonmail.com
Benford333@protonmail.com
nBenford333@protonmail.com
fortihooks@protonmail.com
nfortihooks@protonmail.com
thecurelegion@protonmail.com
support981723721@protonmail.com
sifremicoz@protonmail.com
yourfile2020@protonmail.com
Catsexy@protonmail.com
Recuperadados@protonmail.com
youneedmail@protonmail.com
Decryptutility@protonmail.com
MerlinStusan@protonmail.com
Tizer77234@protonmail.com
recfiles@protonmail.com
mr.dec@protonmail.com
JoniCarter@protonmail.com
servicedeskpay@protonmail.com
castor-troy-restore@protonmail.com
Mammon-decrypt@protonmail.com
wayneevenson@protonmail.com
incongnitoman@protonmail.com
Santa_helper@protonmail.com
F-data@protonmail.com
decryptxxx@protonmail.com
Mespinoza980@protonmail.com
backinfo@protonmail.com
rdpconnect@protonmail.com
tomascry@protonmail.com
loybranunun1975@protonmail.com
securityit123@protonmail.com
ripntfs@protonmail.com
khfsuca@protonmail.com
getscoin2@protonmail.com
zagrec@protonmail.com
teamvv@protonmail.com
databack2@protonmail.com
lxhlp@protonmail.com
teamvi@protonmail.com
onepconebtc@protonmail.com
bit_decrypt@protonmail.com
help.me24@protonmail.com
mr.crypteur@protonmail.com
recoverysql@protonmail.com
anna.kurtz@protonmail.com
agent.dmr@protonmail.com
painplain98@protonmail.com
askhelp@protonmail.com
AstraRansomware@protonmail.com
blackheel@protonmail.com
btcontact@protonmail.com
HydraHelp1@protonmail.com
mammon0503@protonmail.com
PabFox@protonmail.com
Jack76Duran@protonmail.com
RemotePChelper@protonmail.com
Recoverybat@protonmail.com
Brilliancebk@protonmail.com
Deccoder431@protonmail.com
Lizardbkup@protonmail.com
Xtredboy@protonmail.com
TimothyCrabtree@protonmail.com
cheet0s_de@protonmail.com
Pringls_us@protonmail.com
crioso@protonmail.com
GetYourFilesBack@protonmail.com
Kelly.lb@protonmail.com
nRecoverybat@protonmail.com
nAskHelp@protonmail.com
jackiesmith176@protonmail.com
nohopeproject@protonmail.com
salutem@protonmail.com
ivanmalahov@protonmail.com
ooosferaplus@protonmail.com
rusoftfond@protonmail.com
andrey.taranov@protonmail.com
g.kulahmet@protonmail.com
soft.russian@protonmail.com
momsbestfriend@protonmail.com
the.dodger@protonmail.com
j0ra@protonmail.com
sp00f3rsupp0rt@protonmail.com
shellexec@protonmail.com
rep_stosd@protonmail.com
support4you@protonmail.com
devilguy666@protonmail.com
batary5588@protonmail.com
Panzergen552@protonmail.com
vendetta553@protonmail.com
Filegorilla1388@protonmail.com
vine77725@protonmail.com
panda7499@protonmail.com
jonskuper578@protonmail.com
fox2278@protonmail.com
lion7872@protonmail.com
filesreturn247@protonmail.com
s1an1er111@protonmail.com
mrbin775@protonmail.com
decryptmystuff@protonmail.com
oceannew_vb@protonmail.com
decrypt24@protonmail.com
Wecanhelp@protonmail.com
hidebak@protonmail.com
com-gloria@protonmail.com
fileb@protonmail.com
upfileme@protonmail.com
helpteam38@protonmail.com
William_Kidd_2019@protonmail.com
cleverhorse@protonmail.com
Keta990@protonmail.com
supportcrypt2019@protonmail.com
zoye596@protonmail.com
Quantroei@protonmail.com
sailormorgan@protonmail.com
raynorzlol@protonmail.com
friends2019@protonmail.com
worldofdonkeys@protonmail.com
bbitcrypt@protonmail.com
files2@protonmail.com
patern32@protonmail.com
kickclakus@protonmail.com
Admincrypt@protonmail.com
decrypt4data@protonmail.com
lucky_top@protonmail.com
apoyo2019@protonmail.com
werichbin@protonmail.com
cynthia-it@protonmail.com
deltatechit@protonmail.com
2020x0@protonmail.com
decphob@protonmail.com
DavidsHelper@protonmail.com
spacexhuman@protonmail.com
recoverycode@protonmail.com
pyyring23@protonmail.com
virtualhorse1@protonmail.com
use_harrd@protonmail.com
helpyourdesk11@protonmail.com
maxidecrypt@protonmail.com
JeanRenoAParis@protonmail.com
Leviathan13@protonmail.com
brian.r.goodwin@protonmail.com
imBoristheBlade@protonmail.com
johnsonwhate@protonmail.com
1rest0re@protonmail.com
aid.keepcalm@protonmail.com
rebushelp@protonmail.com
cryptgh0st@protonmail.com
backuppc@protonmail.com
backuppc1@protonmail.com
TimisoaraHackerTeam@protonmail.com
m4xroothackerteam@protonmail.com
Vitaly.Yermakov@protonmail.com
UnlockAlexKingman@protonmail.com
barracudahelp@protonmail.com
crypto_wannacash@protonmail.com
help73@protonmail.com
petrov441@protonmail.com
MilesFlannagan@protonmail.com
dec.service@protonmail.com
incognitoman@protonmail.com
siniyzabor@protonmail.com
recover_24_7@protonmail.com
achtung_admin@protonmail.com
aam_sysadmin@protonmail.com
helpadmin2@protonmail.com
CottleAkela@protonmail.com
AbbsChevis@protonmail.com
JinMaglaya@protonmail.com
SuzuMcpherson@protonmail.com
DharmaParrack@protonmail.com
MayarChenot@protonmail.com
PhanthavongsaNeveyah@protonmail.com
RomanchukEyla@protonmail.com
SayanWalsworth96@protonmail.com
SchreiberEleonora@protonmail.com
artemy75@protonmail.com
jokeroo@protonmail.com
tellyouthepass@protonmail.com
BackFileHelp@protonmail.com
RECOVERUNKNOWN@protonmail.com
DecrypterSupport@protonmail.com
unlockme123@protonmail.com
Decryptions@protonmail.com
ScorpionEncryption@protonmail.com
Steven77xx@protonmail.com
Datarest0re@protonmail.com
Recoveryhelp2019@protonmail.com
blackroot54@protonmail.com
Mr.TeslaBrain@protonmail.com
filedownload2020@protonmail.com
Honeylock@protonmail.com
AdvancedBackup@protonmail.com
recover85@protonmail.com
unlock0101@protonmail.com
SupportOdveta@protonmail.com
softs98@protonmail.com
vashmail@protonmail.com
Filedecryptor@protonmail.com
decodeodveta@protonmail.com
t310ea89b4347@protonmail.com
cryptomadbusiness@protonmail.com
FreeWizard9@protonmail.com
omegax0@protonmail.com
flower.harris@protonmail.com
flowerboard@protonmail.com
X280@protonmail.com
decrypt.russ@protonmail.com
petersburgrecover@protonmail.com
dawndec001@protonmail.com
lafoievologjanin123@protonmail.com
mantiticvi1976@protonmail.com
fahydremu1981@protonmail.com
flapalinta1950@protonmail.com
xersami@protonmail.com
cheot0s_de@protonmail.com
puljaipopre1981@protonmail.com
viomukinam1978@protonmail.com
onlinebigbrotheriswatchingyou@protonmail.com
msupport2019@protonmail.com
BruceCohn88@protonmail.com
runlocker@protonmail.com
yesbay@protonmail.com
helpoperator2@protonmail.com
05250lock@protonmail.com
tuhafcoderus@protonmail.com
support_blackkingdom2@protonmail.com
Bossi_tosi@protonmail.com
maill_helpme@protonmail.com
newneo1312@protonmail.com
bitsupportz@protonmail.com
asmodey3301@protonmail.com
btc_bitts@protonmail.com
reservedecryption@protonmail.com
po2977@protonmail.com
Tbr66@protonmail.com
Encryptedxtredboy@protonmail.com
Hichkasam@protonmail.com
helpdiamond@protonmail.com
encryptc4@protonmail.com
decoderma@protonmail.com
missdecryptor@protonmail.com
VoidFiles@protonmail.com
Pentagon11@protonmail.com
guaranteedsupport@protonmail.com
decrypterfile@protonmail.com
encryptfile@protonmail.com
SpadeEncrypt@protonmail.com
Openfileyou@protonmail.com
zorab28@protonmail.com
4lok3r@protonmail.com
keepcredit015@protonmail.com
honestman0023@protonmail.com
fairman0023@protonmail.com
geneve010@protonmail.com
geneve020@protonmail.com
haunexuwofwuf@protonmail.com
cyber.duskfly@protonmail.com
duskeer@protonmail.com
anon4113@protonmail.com
egalytyy@protonmail.com
onimransom@protonmail.com
FilesRecoverEN@Protonmail.com
nationalsiense@protonmail.com
freefoams@protonmail.com
1_kill_yourself_1@protonmail.com
Look1213@protonmail.com
bronmerkberpa1976@protonmail.com
BTCBREWERY@protonmail.com
data1992@protonmail.com
pentros30@protonmail.com
pentaxyz777@protonmail.com
TentwenUpper1@protonmail.com
DiskDoctor@protonmail.com
ialpatntedu@protonmail.com
cryptofiles20202020@protonmail.com
pacman.support@protonmail.com
nDiskDoctor@protonmail.com
vurten_knyert@protonmail.com
Dsupport@protonmail.com
SafeGman@protonmail.com
aztecdecrypt@protonmail.com
pizdasobaki@protonmail.com
cryptoplant@protonmail.com
callmegoat@protonmail.com
NetGanster@protonmail.com
dresdent@protonmail.com
eladovin1975@protonmail.com
cashdashsentme@protonmail.com
Cryptmanager@protonmail.com
Corpseworm@protonmail.com
trees.jpg.bepabepababy1@protonmail.com
MerlinVelso@protonmail.com
0x1service@protonmail.com
Unlock11@protonmail.com
qkhooks0708@protonmail.com
Kromber@protonmail.com
raingemaximo@protonmail.com
gareth.mckie3l@protonmail.com
aperfectday2018@protonmail.com
bakfiles@protonmail.com
frosculandra1975@protonmail.com
trafyralhi1988@protonmail.com
sanctornopul1986@protonmail.com
ringpawslanin1984@protonmail.com
liebupneoplan19@protonmail.com
stivobemun1979@protonmail.com
guifullcharti1970@protonmail.com
phrasitliter1981@protonmail.com
elsleepamlen1988@protonmail.com
southbvilolor1973@protonmail.com
glocadboysun1978@protonmail.com
carbedispgret1983@protonmail.com
listun@protonmail.com
mirtum@protonmail.com
maxgary777@protonmail.com
ranosfinger@protonmail.com
bootsdurslecne1976@protonmail.com
rinmayturly1972@protonmail.com
niggchiphoter1974@protonmail.com
lebssickronne1982@protonmail.com
daybayriki1970@protonmail.com
southbvillor1973@protonmail.com
bottesdurslecne1976@protonmail.com
unlockransomware@protonmail.com
fahidremu1981@protonmail.com
neybvilolor1973@protonmail.com
frasesitliter1981@protonmail.com
getyourdata@protonmail.com
nostro19@protonmail.com
RestoreFile@protonmail.com

Stay tuned!
Continue reading →
Subscribe to: Comments (Atom)