In this post I'll elaborate more on some of the current activities of a well known Darkode forum member namely Nassef which we can clearly see here in the
Darkode repository of research.
Known email: xavi-linuxer@live.com
Sample currently active known domain registrations:
hxxp://tonymontana.su
hxxp://hack-mirror.net
hxxp://tonymontana.cards
hxxp://tonymontana.cash
hxxp://tonymontana.biz
Sample photos of related Darkode members:
Sample personal photo of Eric L Crocker also known as Phastman
Sample personal photo of Phillip R Fleitz also known as Strife
Related posts:
What we have here are several E-Shops for stolen credit card numbers part of his brand franchise including a web site defacement mirror run by him.
Known Darkode domains:
hxxp://darkode.com - 81.27.98.152 - briankrebson@gmail.com
hxxp://darkode.pro
hxxp://darkode.com
hxxp://darkode.me
hxxp://darkode.cc
hxxp://darkode.su - Email: ctouma2@gmail.com
Known Darkode personal email address account:
darkode.notice@gmail.com
Full names of Darkode members:
Johan Anders Gudmunds
Morgan C Culbertson
Eric L Crocker
Naveed Ahmed
Phillip R Fleitz
Dewayne Watts
Murtaza Saifuddin
Daniel Placek
Matjaz Skorjanc
Florencio Carro Ruiz
Mentor Leniqi
Rory Stephen Guidry
We also have an interesting malicious infrastructure discovery in the context of TA505, Darkode (hxxp://darkode.su; ctouma2@gmail.com) and the following portfolio of malicious domains.
hxxp://arculus.su
hxxp://bestsup.su
hxxp://abcstore.su
hxxp://usdcoin.su
hxxp://loads.su
hxxp://adsk.su
hxxp://newbond.su
hxxp://moserant.su
hxxp://huntersinternational.su
hxxp://exploit.su
hxxp://mazurax.su
hxxp://mocaverse.su
hxxp://firemarket.su
hxxp://accounts-login.su
hxxp://drkatzen.su
hxxp://zeebira.su
hxxp://fedex-tracking.su
hxxp://officesupportdoc.com
hxxp://amazon-security-deutschland-safer-certification-info.com
hxxp://aspendok.com
hxxp://trailandra.com
hxxp://flumenco.com
hxxp://agliesc.com
hxxp://technicalpreviews.com
hxxp://thipissney.com
hxxp://paalai.su
hxxp://portfolio-metamask.su
hxxp://allbridge.su
hxxp://manta.su
hxxp://commerzebank.net
hxxp://aerulonoured.su
hxxp://aswurdaes.su
hxxp://cerofixt.su
hxxp://loads.su - semik@protonmail.com; gendir@dtrs.ru; vlayura@yandex.ru
Related personally identifiable information on Matjaz Skorjanc - Iserdo - ButterFly Bot which was also a well known Darkode member:
mafioso@xmpp.jp
hxxp://lizardstresser.su
k@exploit.im
hackerx24@hotmail.fr
duckylord@priv.in
hxxp://80.242.123.196
hxxp://142.11.230.18/b.php
smile@tsec.pro
Related ButterFly Bot personally identifiable email address accounts:
weke79@hotmail.com
iserdo@gmail.com
admin@1337crew.info
wg.fatal@gmail.com
gov.hack@gmail.com
jernej_5@hotmail.com
waisted.time@hotmail.com
netkairo@hotmail.com
floxter@hotmail.com
hamlet1917@hotmail.com
ice@iceman.in
leniqi.mentor@siol.net
icemangjk@hotmail.com
Related URL:
hxxp://bfsystems.net
hxxp://webmail.ngulesh.info
Related domain (wg.fatal@gmail.com) registrations:
hxxp://voc.cash
hxxp://deepbluesecurity.nl
hxxp://threatforce.net
hxxp://erc20collector.com
hxxp://b2bradio.net
hxxp://intelhub.link
Related domain (ice@iceman.in) registrations:
hxxp://albaname.com
hxxp://albahost.net
hxxp://albaname.net
hxxp://mpuq.net
Related domain (weke79@hotmail.com) registrations:
hxxp://jbcine.com
hxxp://futboltele.com
hxxp://clinicablanco.com
hxxp://clinica-blanco.com
Related domain (hamlet1917@hotmail.com) registrations:
hxxp://tamiflux.net
Continue reading →
.jpg)
.jpg)
.jpg)
.jpg)
.jpg)
.jpg)
RSS Feed