Trends in Web Threats: Old Web Skimmer Still Active Today
Unit 42 detected 577,000 landing URL incidents in Q1 2022, with an old web skimmer family still actively stealing payment card data.
Palo Alto Unit 42 detected 577,275 landing URL incidents (116,643 unique) and 2,043,862 malicious host URL incidents (180,370 unique) between January and March 2022. Web threat volumes declined after the November 2021 holiday peak, but an old web skimmer family remained active. Business and economy sites overtook personal sites as the most common apparently benign entry points. Most malicious domains geolocated to the United States, Germany, and Russia, though proxy servers and VPNs obscure true locations.
- 577,275 landing URL incidents; 116,643 unique in Q1 2022.
- 2,043,862 malicious host URL incidents; 180,370 unique across 17,660 domains.
- Threat volumes declined from the November 2021 holiday peak.
- An old web skimmer family is still actively harvesting payment data.
- Business and economy sites topped apparently benign entry points this quarter.
- Vendors
- Palo Alto Networks
- Malware
- web skimmers
- Organizations
- Unit 42
- Countries
- United StatesGermanyRussia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cloudfusion.me | 1, we can extract the collection server of the web skimmer: cloudfusion[.]me . This web skimmer is simple, yet classic. It checks whet |
| domain | misuperblog.com | are traffic based on another similar request to the URL www.misuperblog[.]com/tmz/?sRjPP6ZH=21Ru2Nt5y6IynFa8dNKfckGmLKuTraB2ebSZxsJ3CJw |
| domain | voques-tfr.xyz | fb11f468a1f ). They connect to these IPs through the domain voques-tfr[.]xyz . Although this domain is not resolvable anymore, we anal |
| domain | yhys93.site | ed JS that triggers several redirects to an adult website ( yhys93[.]site ). Conclusion As we highlighted in this blog, this quarte |
| ipv4 | 198.54.117.197 | n[.]m e has started pointing to the following IP addresses: 198.54.117[.]197 198.54.117[.]198 198.54.117[.]199 198.54.117[.]200 These |
| ipv4 | 198.54.117.198 | ed pointing to the following IP addresses: 198.54.117[.]197 198.54.117[.]198 198.54.117[.]199 198.54.117[.]200 These IP addresses are |
| ipv4 | 198.54.117.199 | e following IP addresses: 198.54.117[.]197 198.54.117[.]198 198.54.117[.]199 198.54.117[.]200 These IP addresses are actively involved |
| ipv4 | 198.54.117.200 | dresses: 198.54.117[.]197 198.54.117[.]198 198.54.117[.]199 198.54.117[.]200 These IP addresses are actively involved in other malware |
| sha256 | 79eedf9c1b974992a4beada1bd6343ecadece0b413acccd4deded4a49a4ad220 | 0200 Indicators of Compromise Malicious Web Skimmer SHA256: 79eedf9c1b974992a4beada1bd6343ecadece0b413acccd4deded4a49a4ad220 992cfcb5790664d02204e5356e3dd6e109f0cba90b8e552598f2afb11f4 |
| sha256 | 992cfcb5790664d02204e5356e3dd6e109f0cba90b8e552598f2afb11f468a1f | er malware campaigns, such as the following Trojan (SHA256: 992cfcb5790664d02204e5356e3dd6e109f0cba90b8e552598f2afb11f468a1f ). They connect to these IPs through the domain voques-tfr[ |
From the original article
9 min read at unit42.paloaltonetworks.com
Palo Alto Networks Advanced URL Filtering subscription collects data regarding two types of URLs; landing URLs and host URLs. We define a malicious landing URL as one that provides an opportunity for a user to click a malicious link. A malicious host URL is a web page that contains a malicious code snippet that could abuse someone’s computing power, steal sensitive information or perform other types of attacks.
By Tao Yan, Jin Chen, Taojie Wang, Cecilia Hu · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.