The Domains Keep Disappearing, but the Malware Infrastructure Behind Them Never Moves
AI summary · grok-4.7Summaries by Vani AI
ActiveSOC found fake-CAPTCHA malware lures rotating domains while Seychelles hosting infrastructure stayed put.
Over five months ActiveSOC tracked four attack chains that began on the same Seychelles-registered hosting network, AS202412, while lure domains, downloads, and command servers changed. Most victims reached fake CAPTCHA pages through ads, and one arrived via an emailed link; the pages copied a command for the Windows Run dialog. Reviewing about 150 alerts, analysts found four cases reached command execution, including a reboot-persistent stealer and a Node.js implant active for nearly two days. One implant retrieved its command server through a blockchain lookup rather than a conventional domain.
Key facts
- Shared lure hosting was Seychelles-registered AS202412 across multiple ranges.
- Fake CAPTCHA pages pushed clipboard commands into the Windows Run box.
- Four cases reached execution, including a stealer and a Node.js implant.
- One implant resolved its command server through a blockchain lookup.
- Blocking individual domains misses infrastructure that keeps adding space.
- ATT&CK
- T1189 Drive-by CompromiseT1566.002 Spearphishing LinkT1204 User ExecutionT1059.003 Windows Command ShellT1574.002 DLL Side-Loading
- Organizations
- ActiveSOC
- Countries
- Seychelles
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ai-nexora.sbs | nd in public scans, not observed on monitored hosts. Domain ai-nexora[.]sbs Additional name found in public scans, not observed on mo |
| domain | alianzeg.shop | . Domain newtdsone[.]shop Traffic-distribution name. Domain alianzeg[.]shop Traffic-distribution name. Domain getfix[.]win Historical |
| domain | approvalrequest-api.com | ipt host in one setting and stager front in another. Domain approvalrequest-api[.]com Installer source in a pasted command. Domain 2d4e5f6-7a8b |
| domain | auth-code-check.info | me not observed resolving in monitored environments. Domain auth-code-check[.]info Related name not observed resolving in monitored environm |
| domain | auth-id-browser.info | ounced during observation; verify current ownership. Domain auth-id-browser[.]info Lure domain observed resolving to the shared host. Domain |
| domain | authorization-cdn-press-enter.info | o Lure domain observed resolving to the shared host. Domain authorization-cdn-press-enter[.]info Lure domain observed resolving to the shared host. Domain |
| domain | authorization-code.info | o Lure domain observed resolving to the shared host. Domain authorization-code[.]info Lure domain observed resolving to the shared host. Domain |
| domain | authorization-press-enter.info | me not observed resolving in monitored environments. Domain authorization-press-enter[.]info Related name not observed resolving in monitored environm |
| domain | biyaconserver.beer | nd in public scans, not observed on monitored hosts. Domain biyaconserver[.]beer Additional name found in public scans, not observed on mo |
| domain | bnsclod.beer | nd in public scans, not observed on monitored hosts. Domain bnsclod[.]beer Additional name found in public scans, not observed on mo |
| domain | bootstrap-maxcdn.beer | nd in public scans, not observed on monitored hosts. Domain bootstrap-maxcdn[.]beer Additional name found in public scans, not observed on mo |
| domain | capcha-cdn-js.beer | me not observed resolving in monitored environments. Domain capcha-cdn-js[.]beer Related name not observed resolving in monitored environm |
| domain | carrotbunnies.com | ain getfix[.]win Historical TLS certificate subject. Domain carrotbunnies[.]com Stealer command domain resolving to the listed data-sink |
| domain | catholicsma.com | nd in public scans, not observed on monitored hosts. Domain catholicsma[.]com Lure serving a padded Run-box command. Domain rsvpopenh[. |
| domain | cdn-2faclov.sbs | nd in public scans, not observed on monitored hosts. Domain cdn-2faclov[.]sbs Additional name found in public scans, not observed on mo |
| domain | cdn-plugin-js.beer | nd in public scans, not observed on monitored hosts. Domain cdn-plugin-js[.]beer Additional name found in public scans, not observed on mo |
| domain | chekbrow.beer | nd in public scans, not observed on monitored hosts. Domain chekbrow[.]beer Additional name found in public scans, not observed on mo |
| domain | clacndjsvulnarbi.beer | o Lure domain observed resolving to the shared host. Domain clacndjsvulnarbi[.]beer Lure domain observed resolving to the shared host. Domain |
| domain | claritydelivr.com | ge download destination; execution was not observed. Domain claritydelivr[.]com Newly registered staging-related parent domain. Domain cd |
| domain | clnsdns.beer | o Lure domain observed resolving to the shared host. Domain clnsdns[.]beer Lure domain observed resolving to the shared host. Domain |
| domain | codeverificatrorcl.info | r Lure domain observed resolving to the shared host. Domain codeverificatrorcl[.]info Lure domain observed resolving to the shared host; also s |
| domain | dnsnewtds.shop | c-distribution name also present in script failover. Domain dnsnewtds[.]shop Traffic-distribution name also present in script failover |
| domain | dntds.shop | ssociated with a 32-hex-character subdomain pattern. Domain dntds[.]shop Traffic-distribution name. Domain nttdss[.]shop Traffic-d |
| domain | enter-code-cdn.info | o Lure domain observed resolving to the shared host. Domain enter-code-cdn[.]info Lure domain observed resolving to the shared host. Domain |
| domain | enter-press-cdn.info | o Lure domain observed resolving to the shared host. Domain enter-press-cdn[.]info Lure domain observed resolving to the shared host. Domain |
| domain | enter-press-code.info | me not observed resolving in monitored environments. Domain enter-press-code[.]info Related name not observed resolving in monitored environm |
| domain | enter-pverif-code.info | o Lure domain observed resolving to the shared host. Domain enter-pverif-code[.]info Lure domain observed resolving to the shared host. Domain |
| domain | fingerprint-verification.info | r Lure domain observed resolving to the shared host. Domain fingerprint-verification[.]info Lure domain observed resolving to the shared host. Domain |
| domain | fingerprint-veri.info | me not observed resolving in monitored environments. Domain fingerprint-veri[.]info Additional name found in public scans, not observed on mo |
| domain | framework-css-styles-js.beer | r Lure domain observed resolving to the shared host. Domain framework-css-styles-js[.]beer Lure domain observed resolving to the shared host. Domain |
| domain | fraudtechnology.com | r Lure domain observed resolving to the shared host. Domain fraudtechnology[.]com Related name not observed resolving in monitored environm |
| domain | getfix.win | e. Domain alianzeg[.]shop Traffic-distribution name. Domain getfix[.]win Historical TLS certificate subject. Domain carrotbunnies[ |
| domain | gettrack.my | pcapps[.]my Delivery domain using random subdomains. Domain gettrack[.]my Delivery domain using random subdomains. Domain securecab |
| domain | id-verif-code.info | me not observed resolving in monitored environments. Domain id-verif-code[.]info Related name not observed resolving in monitored environm |
| domain | idverification-code.beer | g to the shared host; also seen prepared in advance. Domain idverification-code[.]beer Lure domain observed resolving to the shared host. Domain |
| domain | kerosand.net | nd domain resolving to the listed data-sink address. Domain kerosand[.]net Blockchain-resolved command domain. Domain shorturl[.]at |
| domain | lcates-vs.beer | nd in public scans, not observed on monitored hosts. Domain lcates-vs[.]beer Additional name found in public scans, not observed on mo |
| domain | lockpopclickgetfile.monster | e source; confirm its unusual label before pivoting. Domain lockpopclickgetfile[.]monster Payload-delivery domain. Domain pipeplane[.]cfd Delivery |
| domain | marketing080company.one | nh[.]one Lure reached through an emailed short link. Domain marketing080company[.]one Lure resolving to the provider’s network. Domain thegreen |
| domain | mnoskemp.beer | s network. Domain thegreenfortune[.]com Lure domain. Domain mnoskemp[.]beer Archive utility and payload archive host. Domain pilotkad |
| domain | newtdsone.shop | c-distribution name also present in script failover. Domain newtdsone[.]shop Traffic-distribution name. Domain alianzeg[.]shop Traffic |
| domain | ntdnewtds.shop | ame. Domain sdntds[.]shop Traffic-distribution name. Domain ntdnewtds[.]shop Traffic-distribution name also present in script failover |
| domain | nttdss.shop | tern. Domain dntds[.]shop Traffic-distribution name. Domain nttdss[.]shop Traffic-distribution name. Domain sdntds[.]shop Traffic-d |
| domain | pcapps.my | livery domain. Domain pipeplane[.]cfd Delivery host. Domain pcapps[.]my Delivery domain using random subdomains. Domain gettrack[ |
| domain | pilotkadomen.club | emp[.]beer Archive utility and payload archive host. Domain pilotkadomen[.]club Recovered second-stage download destination; execution wa |
| domain | pipeplane.cfd | ckpopclickgetfile[.]monster Payload-delivery domain. Domain pipeplane[.]cfd Delivery host. Domain pcapps[.]my Delivery domain using r |
| domain | rsvpopenh.one | olicsma[.]com Lure serving a padded Run-box command. Domain rsvpopenh[.]one Lure reached through an emailed short link. Domain market |
| domain | sdntds.shop | ame. Domain nttdss[.]shop Traffic-distribution name. Domain sdntds[.]shop Traffic-distribution name. Domain ntdnewtds[.]shop Traffi |
| domain | securecab.fit | ttrack[.]my Delivery domain using random subdomains. Domain securecab[.]fit Delivery domain using random subdomains. Domain uruvita[. |
| domain | shorturl.at | n kerosand[.]net Blockchain-resolved command domain. Domain shorturl[.]at Legitimate shortening service used as an emailed-link wra |
| domain | thegreenfortune.com | pany[.]one Lure resolving to the provider’s network. Domain thegreenfortune[.]com Lure domain. Domain mnoskemp[.]beer Archive utility and p |
| domain | trunnsns.beer | nd in public scans, not observed on monitored hosts. Domain trunnsns[.]beer Additional name found in public scans, not observed on mo |
| domain | unhosting.site | om subdomains. Domain uruvita[.]com Delivery domain. Domain unhosting[.]site Delivery domain associated with a 32-hex-character subdom |
| domain | uruvita.com | recab[.]fit Delivery domain using random subdomains. Domain uruvita[.]com Delivery domain. Domain unhosting[.]site Delivery domain |
| domain | verico-de-id.beer | nd in public scans, not observed on monitored hosts. Domain verico-de-id[.]beer Additional name found in public scans, not observed on mo |
| ipv4 | 130.12.180.174 | Lure host reached through an emailed short link. IP address 130.12.180[.]174 Outbound contact. IP address 91.92.240[.]127 Script sourc |
| ipv4 | 130.12.180.63 | ct. IP address 158.94.211[.]76 Outbound contact. IP address 130.12.180[.]63 Lure host reached through an emailed short link. IP addre |
| ipv4 | 158.94.208.104 | 58.94.208[.]213 Lure host in the 41-second case. IP address 158.94.208[.]104 Browser contact. IP address 91.92.243[.]161 Browser conta |
| ipv4 | 158.94.208.213 | 158.94.211[.]92 In-memory payload staging host. IP address 158.94.208[.]213 Lure host in the 41-second case. IP address 158.94.208[.] |
| ipv4 | 158.94.211.76 | ct. IP address 91.92.241[.]111 Outbound contact. IP address 158.94.211[.]76 Outbound contact. IP address 130.12.180[.]63 Lure host re |
| ipv4 | 158.94.211.92 | 7 Injected-script and advertising redirect host. IP address 158.94.211[.]92 In-memory payload staging host. IP address 158.94.208[.]2 |
| ipv4 | 16.15.228.38 | in a sandbox, not observed on a monitored host. IP address 16.15.228[.]38 Cloud storage endpoint used in the timeline; not attacker |
| ipv4 | 176.65.144.127 | 02.84[.]17 Primary command server and data sink. IP address 176.65.144[.]127 Blockchain-resolved command server observed on TCP port 3 |
| ipv4 | 178.16.52.101 | nts before blocking. activesoc.blackhillsinfosec IP address 178.16.52[.]101 Lure host linked to observed and publicly scanned domains |
| ipv4 | 178.16.53.137 | linked to observed and publicly scanned domains. IP address 178.16.53[.]137 Injected-script and advertising redirect host. IP address |
| ipv4 | 178.16.54.253 | .]161 Browser contact; no lure domain recovered. IP address 178.16.54[.]253 Lure host; also hosted an unrelated site. IP address 178. |
| ipv4 | 178.16.54.40 | [.]253 Lure host; also hosted an unrelated site. IP address 178.16.54[.]40 Outbound contact. IP address 178.16.55[.]232 Outbound con |
| ipv4 | 178.16.55.232 | ite. IP address 178.16.54[.]40 Outbound contact. IP address 178.16.55[.]232 Outbound contact. IP address 91.92.241[.]111 Outbound con |
| ipv4 | 193.202.84.17 | and should not be blocked solely on this basis. IP address 193.202.84[.]17 Primary command server and data sink. IP address 176.65.1 |
| ipv4 | 91.92.240.127 | k. IP address 130.12.180[.]174 Outbound contact. IP address 91.92.240[.]127 Script source recovered in a sandbox, not observed on a m |
| ipv4 | 91.92.241.111 | ct. IP address 178.16.55[.]232 Outbound contact. IP address 91.92.241[.]111 Outbound contact. IP address 158.94.211[.]76 Outbound con |
| ipv4 | 91.92.243.161 | se. IP address 158.94.208[.]104 Browser contact. IP address 91.92.243[.]161 Browser contact; no lure domain recovered. IP address 178 |
| sha256 | 81ecbf004dc9dbf8ea4c50bde1ed55806fb5fdf689d165856112ea9f4d5021e0 | 87b280d5acd2fde499da4a8f24e916 Trojanized obs.dll . SHA-256 81ecbf004dc9dbf8ea4c50bde1ed55806fb5fdf689d165856112ea9f4d5021e0 WSql-2.dll . SHA-256 a410c89db9140ed9dff55bff00b0338fbdffcc |
| sha256 | 9a736f4812b485f9cf5b1332a791b205b5135a4b3a0c41f473ad9cc9fbe2d75c | including its unusual backslash and redacted token. SHA-256 9a736f4812b485f9cf5b1332a791b205b5135a4b3a0c41f473ad9cc9fbe2d75c MSI dropper. SHA-256 b004acacd8ef5d7e8a2fd99a7931af0ced87b2 |
| sha256 | a410c89db9140ed9dff55bff00b0338fbdffcc709490782c7b28e8a10c11eb3b | ed55806fb5fdf689d165856112ea9f4d5021e0 WSql-2.dll . SHA-256 a410c89db9140ed9dff55bff00b0338fbdffcc709490782c7b28e8a10c11eb3b cred64.dll plugin; cited from upstream intelligence rather |
| sha256 | b004acacd8ef5d7e8a2fd99a7931af0ced87b280d5acd2fde499da4a8f24e916 | 91b205b5135a4b3a0c41f473ad9cc9fbe2d75c MSI dropper. SHA-256 b004acacd8ef5d7e8a2fd99a7931af0ced87b280d5acd2fde499da4a8f24e916 Trojanized obs.dll . SHA-256 81ecbf004dc9dbf8ea4c50bde1ed55 |
| sha256 | d77bc0bb3018b6cc834c1af1eefaa1c0b906314308d6ab88588f8d41eb62090c | ligence rather than a chain ActiveSOC investigated. SHA-256 d77bc0bb3018b6cc834c1af1eefaa1c0b906314308d6ab88588f8d41eb62090c cmd.cmd loader; cited from upstream intelligence rather tha |
From the original article
8 min read at cybersecuritynews.com
Fake verification pages are steering people toward malware, but the web addresses behind the lures keep changing. Over five months, investigators tracked four different attack chains that began with the same hosting network, even as domains, downloads and command servers shifted. The pattern makes blocking individual websites a poor way to stop the first step.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.