We have noted a large amount of MIT related email accounts showing up on Darknet forums and in leaks posted to Paste sites.
The information posted includes 98 accounts and additional information. The information is verified as we have been able to get confirmation from several students and staff.
The purpose of this page is to provide awareness to individuals and organizations that are leaking information and the information of their customers. The entities listed on this site are verified to be leaking personal information sometimes without the company even being aware. SLC Security is now owned and operated by Jigsaw Security Enterprise. We are currently in process and as such this blog will eventually be taken offline and merged with Jigsaw Security resources.
Showing posts with label Activity Report. Show all posts
Showing posts with label Activity Report. Show all posts
Tuesday, January 19, 2016
Sunday, January 17, 2016
Credit Suisse accounts start appearing online
We started noticing credit-suisse accounts showing up online this evening. Our system that collects information on compromised accounts started alerting to accounts at the firm. It is not known if the accounts detected are end user accounts or corporate accounts.
Friday, January 8, 2016
2 Big Stories Next Week
We are currently reviewing 2 issues both of which are confirmed issues of PII and/or PHI data that we uncovered in the course of reading user submissions this week. Both involve some high profile entities of which neither has replied to our request for comments.
We have provided evidence of the issues to both and are awaiting any response.
We have provided evidence of the issues to both and are awaiting any response.
Thursday, August 27, 2015
CONFIRMED BREACHED: August Benefits Inc - Attack on SLC Security
The following host have been detected as being potentially breached based on data from SLC Security owned and operated sensors. We have decided that we would start publishing a daily list to help these organizations get their network under control. While we believe these host to be breached they may also be involved in hacking attempts on other entities or may be used by hackers as a jump point to conduct other attacks. The following list are the bad entities for the last 24 hours. Our volunteers have detected the following attackers:
Our Security Operations Center has detected a US company attempting to hack into our network. We believe this host to be compromised and have sent a notification to August Benefits to alert them of the situation.
173.220.57.150 - Observed in Attacks
Our Security Operations Center has detected a US company attempting to hack into our network. We believe this host to be compromised and have sent a notification to August Benefits to alert them of the situation.
173.220.57.150 - Observed in Attacks
Wednesday, August 12, 2015
US Government and Military Hacked by ISIS?
Absolutely. It's the same information I posted yesterday.
See this article - Click Here
Now we have seen information being leaked and cannot name individual companies at this time but they are getting in through Government contractors. Information has been shared to confirm that they have actively stolen information on communications facilities and may have used that information in farther attacks. We have 6 days left in our notification wait period and then we will post the information we received in our Threat Intelligence Platform to our subscribers.
Government contracting companies should start looking through their systems and get real security vendors to help you protect your networks.
Here we go again...
See this article - Click Here
Now we have seen information being leaked and cannot name individual companies at this time but they are getting in through Government contractors. Information has been shared to confirm that they have actively stolen information on communications facilities and may have used that information in farther attacks. We have 6 days left in our notification wait period and then we will post the information we received in our Threat Intelligence Platform to our subscribers.
Government contracting companies should start looking through their systems and get real security vendors to help you protect your networks.
Here we go again...
Tuesday, August 11, 2015
Large Telecommunications Company Appears to have been Breached
SLC Security researchers have located information indicating that a large telecommunications company servicing Government clients has had a database compromised. We are in the process of notifying the affected company and will wait our standard 7 days until we release the information that we have located.
Notifications Sent: 8-11-2015
After farther review it appears as though the information found may also impact a large Government contractor. Additional research is currently being performed but it appears as though the leaked information is confirmed based on OSINT research that was conducted earlier.
Related Article: http://www.nbcnews.com/storyline/isis-terror/isis-group-claims-have-hacked-information-military-personnel-n408236
8-12-2015: As of 8-12-2015 none of the notified entities have responded to our notification. We will wait 6 more days before posting the entities involved giving them time to perform remediation on any issues they may have discovered as part of this incident.
8-19-2015: None of the notified entities have responded. SLC Security Services LLC has posted information concerning the release of proprietary information from Zayo concerning facilities in Northern Virginia. to our Threat Intelligence Platform.
For a trial of of our threat intelligence platform please visit www.slcsecurity.com.
Notifications Sent: 8-11-2015
After farther review it appears as though the information found may also impact a large Government contractor. Additional research is currently being performed but it appears as though the leaked information is confirmed based on OSINT research that was conducted earlier.
Related Article: http://www.nbcnews.com/storyline/isis-terror/isis-group-claims-have-hacked-information-military-personnel-n408236
8-12-2015: As of 8-12-2015 none of the notified entities have responded to our notification. We will wait 6 more days before posting the entities involved giving them time to perform remediation on any issues they may have discovered as part of this incident.
8-19-2015: None of the notified entities have responded. SLC Security Services LLC has posted information concerning the release of proprietary information from Zayo concerning facilities in Northern Virginia. to our Threat Intelligence Platform.
For a trial of of our threat intelligence platform please visit www.slcsecurity.com.
Monday, August 3, 2015
AshleyMadison data appearing in the underground
Our researchers have started uncovering large amounts of information possibly from the AshleyMadison breach. We have identified several files containing the name, phone number and billing information as well as profile locations on the Ashley Madison website over the last several hours.
It appears as though some of the high frequency users of the systems information is starting to be posted so we are watching to see if a full dump of the stolen data appears.
UPDATE 8/5/2015:
As of today we have not seen a full dump of data on very specific information on high frequency users of the system. We are seeing some additional personal information being posted as well such as employment information which may be an attempt to ruin the persons reputation. This makes sense as the attacker had stated via Twitter that he wanted to get back at the immoral use of these sites.
If we see any additional information we will be posting it to our Threat Intelligence Platform. If you would like to get access to our threat intelligence platform please goto http://ui.slcsecurity.com/ and click on create an account. This service is only available to paid subscribers or trusted industry partners.
It appears as though some of the high frequency users of the systems information is starting to be posted so we are watching to see if a full dump of the stolen data appears.
UPDATE 8/5/2015:
As of today we have not seen a full dump of data on very specific information on high frequency users of the system. We are seeing some additional personal information being posted as well such as employment information which may be an attempt to ruin the persons reputation. This makes sense as the attacker had stated via Twitter that he wanted to get back at the immoral use of these sites.
If we see any additional information we will be posting it to our Threat Intelligence Platform. If you would like to get access to our threat intelligence platform please goto http://ui.slcsecurity.com/ and click on create an account. This service is only available to paid subscribers or trusted industry partners.
Wednesday, July 15, 2015
Potentially Breached Entities (From Sensor Data) - 7-15-2014 2:59 (M EST
The following host have been detected as being potentially breached based on data from SLC Security owned and operated sensors. We have decided that we would start publishing a daily list to help these organizations get their network under control. While we believe these host to be breached they may also be involved in hacking attempts on other entities or may be used by hackers as a jump point to conduct other attacks. The following list are the bad entities for the last 24 hours. Our volunteers have detected the following attackers:
- Concord Consortium - Concord, MA
- American Credit Card - Huntington, NY
- Atlas Professional Services - Tampa, FL
- Grand Plaza Owners LLC - Plano, TX
We have not notified the individual companies but we have archived the logs if needed.
Sunday, May 17, 2015
Info: 216.146.38.70 being used by malware to get current IP address
Malware MD5's associated with this dynamic DNS domain checkip.dyndns.com and checkip9.dyndns.com.
May 11th 2015, 13:33:04.358 iocs-slcmaster fc0af5d923b7988fe9ba24f440a10929734a2050', '2015-05-01 03:13:53')"
May 11th 2015, 13:33:04.332 iocs-slcmaster 8234df6eb626e024a625bd8f56c2163a5eac81cc', '2015-05-01 03:14:00')"
May 11th 2015, 13:33:04.329 iocs-slcmaster e447039272c445c4d7fc267aa40f171ff41c8776', '2015-05-01 03:14:11')"
May 11th 2015, 13:33:04.327 iocs-slcmaster b7abd0f35f1fe95824bf06713dd9e843c6a5591f', '2015-05-01 03:14:12')"
May 11th 2015, 13:33:04.324 iocs-slcmaster 84ee1fbf48c42603363ebf90a39e4510ec5101c6', '2015-05-01 03:14:41')"
May 11th 2015, 13:33:04.322 iocs-slcmaster bb5f649a820c430a259483cd9d2a115fe914b45b', '2015-05-01 03:15:01')"
May 11th 2015, 13:33:04.279 iocs-slcmaster c2680a7c46835edf6f611eb4138994e68ec9ef16', '2015-05-01 03:15:16')"
May 11th 2015, 13:33:04.275 iocs-slcmaster 7eb1dfb485b6983b35e9e44c8e33e40e07ace90c', '2015-05-01 03:15:17')"
May 11th 2015, 13:33:04.269 iocs-slcmaster 0763172dd8ba0fc48909dbe756f9ef876869d385', '2015-05-01 03:15:24')"
May 11th 2015, 13:33:04.263 iocs-slcmaster 9060966a2db161ca466a1c6ed391429ec1668e86', '2015-05-01 03:16:13')"
May 11th 2015, 13:33:04.256 iocs-slcmaster a57ff42c44cc36241bf6510bfd30891b5dd874f8', '2015-05-01 03:17:36')"
May 11th 2015, 13:33:04.251 iocs-slcmaster d0cad125c5f192aabab217dc2180bb710bbe74b9', '2015-05-01 03:17:44')"
May 11th 2015, 13:33:04.230 iocs-slcmaster 2680e0ae5bcc7858e03907ccacae4e4acd6ee400', '2015-05-01 03:18:29')"
May 11th 2015, 13:33:04.211 iocs-slcmaster 87b3d7aec495b971cf501c2776f2540b40dd24e6', '2015-05-01 03:18:57')"
May 11th 2015, 13:33:04.204 iocs-slcmaster 90776a7645c6d005f2cc238fbce10d392f1026f8', '2015-05-01 03:20:25')"
May 11th 2015, 13:33:04.197 iocs-slcmaster b35b2dc00dd216581f91f56c5c25f5559f7cfcf0', '2015-05-01 03:20:38')"
May 11th 2015, 13:33:04.192 iocs-slcmaster 184f89c5a6443774a212c1e1eaa6dddb13710774', '2015-05-01 03:20:38')"
May 11th 2015, 13:33:04.187 iocs-slcmaster 37fa1251617a0f5b88dca55ac1efd33a0a66f95b', '2015-05-01 03:21:45')"
May 11th 2015, 13:33:04.183 iocs-slcmaster d80a5b67b2b5199528c27af18ac5086238330e16', '2015-05-01 03:24:46')"
May 11th 2015, 13:33:04.178 iocs-slcmaster ac148f94cc80ca5ba6e5d086006b6b33da526174', '2015-05-01 03:29:21')"
May 11th 2015, 13:33:04.358 iocs-slcmaster fc0af5d923b7988fe9ba24f440a10929734a2050', '2015-05-01 03:13:53')"
May 11th 2015, 13:33:04.332 iocs-slcmaster 8234df6eb626e024a625bd8f56c2163a5eac81cc', '2015-05-01 03:14:00')"
May 11th 2015, 13:33:04.329 iocs-slcmaster e447039272c445c4d7fc267aa40f171ff41c8776', '2015-05-01 03:14:11')"
May 11th 2015, 13:33:04.327 iocs-slcmaster b7abd0f35f1fe95824bf06713dd9e843c6a5591f', '2015-05-01 03:14:12')"
May 11th 2015, 13:33:04.324 iocs-slcmaster 84ee1fbf48c42603363ebf90a39e4510ec5101c6', '2015-05-01 03:14:41')"
May 11th 2015, 13:33:04.322 iocs-slcmaster bb5f649a820c430a259483cd9d2a115fe914b45b', '2015-05-01 03:15:01')"
May 11th 2015, 13:33:04.279 iocs-slcmaster c2680a7c46835edf6f611eb4138994e68ec9ef16', '2015-05-01 03:15:16')"
May 11th 2015, 13:33:04.275 iocs-slcmaster 7eb1dfb485b6983b35e9e44c8e33e40e07ace90c', '2015-05-01 03:15:17')"
May 11th 2015, 13:33:04.269 iocs-slcmaster 0763172dd8ba0fc48909dbe756f9ef876869d385', '2015-05-01 03:15:24')"
May 11th 2015, 13:33:04.263 iocs-slcmaster 9060966a2db161ca466a1c6ed391429ec1668e86', '2015-05-01 03:16:13')"
May 11th 2015, 13:33:04.256 iocs-slcmaster a57ff42c44cc36241bf6510bfd30891b5dd874f8', '2015-05-01 03:17:36')"
May 11th 2015, 13:33:04.251 iocs-slcmaster d0cad125c5f192aabab217dc2180bb710bbe74b9', '2015-05-01 03:17:44')"
May 11th 2015, 13:33:04.230 iocs-slcmaster 2680e0ae5bcc7858e03907ccacae4e4acd6ee400', '2015-05-01 03:18:29')"
May 11th 2015, 13:33:04.211 iocs-slcmaster 87b3d7aec495b971cf501c2776f2540b40dd24e6', '2015-05-01 03:18:57')"
May 11th 2015, 13:33:04.204 iocs-slcmaster 90776a7645c6d005f2cc238fbce10d392f1026f8', '2015-05-01 03:20:25')"
May 11th 2015, 13:33:04.197 iocs-slcmaster b35b2dc00dd216581f91f56c5c25f5559f7cfcf0', '2015-05-01 03:20:38')"
May 11th 2015, 13:33:04.192 iocs-slcmaster 184f89c5a6443774a212c1e1eaa6dddb13710774', '2015-05-01 03:20:38')"
May 11th 2015, 13:33:04.187 iocs-slcmaster 37fa1251617a0f5b88dca55ac1efd33a0a66f95b', '2015-05-01 03:21:45')"
May 11th 2015, 13:33:04.183 iocs-slcmaster d80a5b67b2b5199528c27af18ac5086238330e16', '2015-05-01 03:24:46')"
May 11th 2015, 13:33:04.178 iocs-slcmaster ac148f94cc80ca5ba6e5d086006b6b33da526174', '2015-05-01 03:29:21')"
Saturday, May 2, 2015
Phishing Target: Oregon Health and Science University
Over the past week we have been seeing indications on our system that Oregon Health and Science University may have been the target of a targeted phishing campaign.
Sensors on an upstream ISP network captured the following:
April 28th 2015, 23:21:55.219 iocs-phishing
April 28th 2015, 23:21:51.528 iocs-phishing
April 28th 2015, 23:21:46.435 iocs-phishing
April 28th 2015, 23:21:46.407 iocs-phishing
April 28th 2015, 23:21:45.290 iocs-phishing
April 28th 2015, 23:21:44.085 iocs-phishing
April 28th 2015, 23:21:43.850 iocs-phishing
April 28th 2015, 23:21:40.513 iocs-phishing
April 28th 2015, 23:21:39.931 iocs-phishing
April 28th 2015, 23:21:39.581 iocs-phishing
April 28th 2015, 23:21:37.889 iocs-phishing
April 28th 2015, 23:21:37.877 iocs-phishing
April 28th 2015, 23:21:37.866 iocs-phishing
April 28th 2015, 23:21:35.422 iocs-phishing
April 28th 2015, 23:21:34.757 iocs-phishing
April 28th 2015, 23:21:34.163 iocs-phishing
April 28th 2015, 23:21:32.817 iocs-phishing
April 28th 2015, 23:21:32.813 iocs-phishing
April 28th 2015, 23:21:32.292 iocs-phishing
April 28th 2015, 23:21:31.954 iocs-phishing
April 28th 2015, 23:21:29.227 iocs-phishing
April 28th 2015, 23:21:27.985 iocs-phishing
April 28th 2015, 23:21:25.912 iocs-phishing
April 28th 2015, 23:21:25.370 iocs-phishing
April 28th 2015, 23:21:24.252 iocs-phishing
April 28th 2015, 23:21:16.234 iocs-phishing
April 28th 2015, 23:21:16.223 iocs-phishing
April 27th 2015, 14:18:54.410 iocs-phishing
April 27th 2015, 14:18:51.617 iocs-phishing
April 27th 2015, 14:18:51.601 iocs-phishing
April 27th 2015, 14:18:50.170 iocs-phishing
April 27th 2015, 14:18:49.845 iocs-phishing
April 27th 2015, 14:18:49.483 iocs-phishing
April 27th 2015, 14:18:47.442 iocs-phishing
April 27th 2015, 14:18:46.466 iocs-phishing
April 27th 2015, 14:18:46.004 iocs-phishing
April 27th 2015, 14:18:45.447 iocs-phishing
April 27th 2015, 14:18:45.418 iocs-phishing
April 27th 2015, 14:18:45.385 iocs-phishing
April 27th 2015, 14:18:43.473 iocs-phishing
April 27th 2015, 14:18:43.006 iocs-phishing
April 27th 2015, 14:18:42.687 iocs-phishing
April 27th 2015, 14:18:41.553 iocs-phishing
April 27th 2015, 14:18:41.552 iocs-phishing
April 27th 2015, 14:18:41.400 iocs-phishing
April 27th 2015, 14:18:41.299 iocs-phishing
April 27th 2015, 14:18:40.634 iocs-phishing
April 27th 2015, 14:18:40.509 iocs-phishing
April 27th 2015, 14:18:39.393 iocs-phishing
April 27th 2015, 14:18:39.310 iocs-phishing
April 27th 2015, 14:18:39.185 iocs-phishing
April 27th 2015, 14:18:38.294 iocs-phishing
April 27th 2015, 14:18:38.293 iocs-phishing
April 27th 2015, 14:18:37.323 iocs-phishing
April 27th 2015, 14:18:34.208 iocs-phishing
April 27th 2015, 14:18:34.191 iocs-phishing
April 27th 2015, 14:18:33.046 iocs-phishing
April 27th 2015, 14:18:32.771 iocs-phishing
April 27th 2015, 14:18:31.819 iocs-phishing
April 27th 2015, 14:18:29.084 iocs-phishing
April 27th 2015, 14:18:28.786 iocs-phishing
April 27th 2015, 14:18:28.276 iocs-phishing
April 27th 2015, 14:18:26.891 iocs-phishing
April 27th 2015, 14:18:26.880 iocs-phishing
April 27th 2015, 14:18:26.870 iocs-phishing
April 27th 2015, 14:18:25.522 iocs-phishing
April 27th 2015, 14:18:24.364 iocs-phishing
April 27th 2015, 14:18:24.010 iocs-phishing
April 27th 2015, 14:18:23.471 iocs-phishing
April 27th 2015, 14:18:23.470 iocs-phishing
April 27th 2015, 14:18:23.333 iocs-phishing
April 27th 2015, 14:18:23.244 iocs-phishing
April 27th 2015, 14:18:21.945 iocs-phishing
April 27th 2015, 14:18:21.795 iocs-phishing
April 27th 2015, 14:18:21.525 iocs-phishing
April 27th 2015, 14:18:21.337 iocs-phishing
April 27th 2015, 14:18:21.195 iocs-phishing
April 27th 2015, 14:18:19.650 iocs-phishing
April 27th 2015, 14:18:19.649 iocs-phishing
April 27th 2015, 14:18:19.170 iocs-phishing
April 27th 2015, 14:18:16.608 iocs-phishing
April 27th 2015, 14:18:16.592 iocs-phishing
April 27th 2015, 14:18:16.534 iocs-phishing
April 27th 2015, 14:18:13.092 iocs-phishing
April 27th 2015, 14:18:13.076 iocs-phishing
April 27th 2015, 14:18:11.484 iocs-phishing
April 27th 2015, 14:18:11.217 iocs-phishing
April 27th 2015, 14:18:11.020 iocs-phishing
April 27th 2015, 14:18:08.989 iocs-phishing
April 27th 2015, 14:18:08.820 iocs-phishing
April 27th 2015, 14:18:08.513 iocs-phishing
April 27th 2015, 14:18:07.109 iocs-phishing
April 27th 2015, 14:18:07.097 iocs-phishing
April 27th 2015, 14:18:07.081 iocs-phishing
April 27th 2015, 14:18:05.093 iocs-phishing
April 27th 2015, 14:18:04.694 iocs-phishing
April 27th 2015, 14:18:04.384 iocs-phishing
April 27th 2015, 14:18:03.954 iocs-phishing
April 27th 2015, 14:18:03.953 iocs-phishing
April 27th 2015, 14:18:02.962 iocs-phishing
April 27th 2015, 14:18:02.871 iocs-phishing
April 27th 2015, 14:18:02.312 iocs-phishing
April 27th 2015, 14:18:02.188 iocs-phishing
April 27th 2015, 14:18:01.959 iocs-phishing
April 27th 2015, 14:18:00.890 iocs-phishing
April 27th 2015, 14:18:00.755 iocs-phishing
April 27th 2015, 14:17:59.922 iocs-phishing
April 27th 2015, 14:17:59.919 iocs-phishing
April 27th 2015, 14:17:59.226 iocs-phishing
April 27th 2015, 14:17:55.680 iocs-phishing
April 27th 2015, 14:17:55.663 iocs-phishing
April 27th 2015, 14:17:54.580 iocs-phishing
April 27th 2015, 14:17:54.310 iocs-phishing
April 27th 2015, 14:17:52.798 iocs-phishing
April 27th 2015, 14:17:50.545 iocs-phishing
April 27th 2015, 14:17:50.379 iocs-phishing
April 27th 2015, 14:17:50.057 iocs-phishing
April 27th 2015, 14:17:48.507 iocs-phishing
April 27th 2015, 14:17:48.492 iocs-phishing
April 27th 2015, 14:17:48.482 iocs-phishing
April 27th 2015, 14:17:47.323 iocs-phishing
April 27th 2015, 14:17:46.003 iocs-phishing
April 27th 2015, 14:17:45.691 iocs-phishing
April 27th 2015, 14:17:45.162 iocs-phishing
April 27th 2015, 14:17:45.161 iocs-phishing
April 27th 2015, 14:17:44.919 iocs-phishing
April 27th 2015, 14:17:44.742 iocs-phishing
April 27th 2015, 14:17:43.081 iocs-phishing
April 27th 2015, 14:17:42.565 iocs-phishing
April 27th 2015, 14:17:41.451 iocs-phishing
April 27th 2015, 14:17:40.054 iocs-phishing
April 27th 2015, 14:17:35.364 iocs-phishing
April 27th 2015, 14:17:35.362 iocs-phishing
April 27th 2015, 13:40:17.303 iocs-REDACTED
April 27th 2015, 13:40:16.083 iocs-REDACTED
April 23rd 2015, 03:27:02.867 iocs-phishing
April 23rd 2015, 03:27:00.073 iocs-phishing
April 23rd 2015, 03:27:00.056 iocs-phishing
April 23rd 2015, 03:26:58.395 iocs-phishing
April 23rd 2015, 03:26:58.125 iocs-phishing
April 23rd 2015, 03:26:57.698 iocs-phishing
April 23rd 2015, 03:26:55.767 iocs-phishing
April 23rd 2015, 03:26:55.464 iocs-phishing
April 23rd 2015, 03:26:55.163 iocs-phishing
April 23rd 2015, 03:26:53.844 iocs-phishing
April 23rd 2015, 03:26:53.834 iocs-phishing
April 23rd 2015, 03:26:53.824 iocs-phishing
April 23rd 2015, 03:26:52.639 iocs-phishing
April 23rd 2015, 03:26:51.413 iocs-phishing
April 23rd 2015, 03:26:51.100 iocs-phishing
April 23rd 2015, 03:26:50.634 iocs-phishing
April 23rd 2015, 03:26:50.633 iocs-phishing
April 23rd 2015, 03:26:49.722 iocs-phishing
April 23rd 2015, 03:26:49.634 iocs-phishing
April 23rd 2015, 03:26:48.117 iocs-phishing
April 23rd 2015, 03:26:47.993 iocs-phishing
April 23rd 2015, 03:26:47.755 iocs-phishing
April 23rd 2015, 03:26:47.546 iocs-phishing
April 23rd 2015, 03:26:46.296 iocs-phishing
April 23rd 2015, 03:26:46.264 iocs-phishing
April 23rd 2015, 01:15:22.229 iocs-phishing
April 23rd 2015, 01:15:19.192 iocs-phishing
April 23rd 2015, 01:15:11.223 iocs-phishing
April 23rd 2015, 01:15:11.128 iocs-phishing
April 23rd 2015, 01:15:09.295 iocs-phishing
April 23rd 2015, 01:15:08.315 iocs-phishing
April 23rd 2015, 01:15:06.993 iocs-phishing
April 23rd 2015, 01:15:00.362 iocs-phishing
April 23rd 2015, 01:14:59.399 iocs-phishing
April 23rd 2015, 01:14:58.780 iocs-phishing
April 23rd 2015, 01:14:57.684 iocs-phishing
April 23rd 2015, 01:14:57.598 iocs-phishing
April 23rd 2015, 01:14:57.551 iocs-phishing
April 23rd 2015, 01:14:53.843 iocs-phishing
April 23rd 2015, 01:14:51.402 iocs-phishing
April 23rd 2015, 01:14:49.773 iocs-phishing
April 23rd 2015, 01:14:46.749 iocs-phishing
April 23rd 2015, 01:14:46.747 iocs-phishing
April 23rd 2015, 01:14:46.074 iocs-phishing
April 23rd 2015, 01:14:45.726 iocs-phishing
April 23rd 2015, 01:14:43.551 iocs-phishing
April 23rd 2015, 01:14:42.273 iocs-phishing
April 23rd 2015, 01:14:41.242 iocs-phishing
April 23rd 2015, 01:14:39.119 iocs-phishing
April 23rd 2015, 01:14:32.108 iocs-phishing
April 23rd 2015, 01:14:32.076 iocs-phishing
April 23rd 2015, 01:14:27.795 iocs-phishing
April 23rd 2015, 01:13:58.054 iocs-phishing
April 23rd 2015, 01:13:57.450 iocs-phishing
April 23rd 2015, 01:13:34.367 iocs-phishing
April 21st 2015, 17:02:14.810 iocs-phishing
April 21st 2015, 17:02:13.211 iocs-phishing
April 21st 2015, 17:02:07.059 iocs-phishing
April 21st 2015, 17:02:07.015 iocs-phishing
April 21st 2015, 17:02:05.108 iocs-phishing
April 21st 2015, 17:02:04.261 iocs-phishing
April 21st 2015, 17:02:03.133 iocs-phishing
April 21st 2015, 17:01:57.851 iocs-phishing
April 21st 2015, 17:01:57.689 iocs-phishing
April 21st 2015, 17:01:57.059 iocs-phishing
April 21st 2015, 17:01:54.100 iocs-phishing
April 21st 2015, 17:01:54.081 iocs-phishing
April 21st 2015, 17:01:54.053 iocs-phishing
April 21st 2015, 17:01:45.697 iocs-phishing
April 21st 2015, 17:01:44.394 iocs-phishing
April 21st 2015, 17:01:42.733 iocs-phishing
April 21st 2015, 17:01:41.648 iocs-phishing
April 21st 2015, 17:01:41.643 iocs-phishing
April 21st 2015, 17:01:41.343 iocs-phishing
April 21st 2015, 17:01:41.053 iocs-phishing
April 21st 2015, 17:01:37.309 iocs-phishing
April 21st 2015, 17:01:36.619 iocs-phishing
April 21st 2015, 17:01:36.213 iocs-phishing
April 21st 2015, 17:01:35.790 iocs-phishing
April 21st 2015, 17:01:32.737 iocs-phishing
April 21st 2015, 17:01:32.737 iocs-phishing
April 21st 2015, 17:01:28.544 iocs-phishing
April 21st 2015, 17:01:23.326 iocs-phishing
April 21st 2015, 17:01:05.381 iocs-phishing
April 21st 2015, 17:01:05.050 iocs-phishing
April 21st 2015, 17:00:48.680 iocs-phishing
April 21st 2015, 17:00:43.925 iocs-phishing
April 21st 2015, 17:00:40.598 iocs-phishing
April 21st 2015, 17:00:24.375 iocs-phishing
April 21st 2015, 17:00:22.686 iocs-phishing
April 21st 2015, 17:00:19.869 iocs-phishing
April 21st 2015, 17:00:15.241 iocs-phishing
April 21st 2015, 17:00:15.040 iocs-phishing
April 21st 2015, 17:00:14.924 iocs-phishing
April 21st 2015, 17:00:05.801 iocs-phishing
April 21st 2015, 17:00:01.596 iocs-phishing
April 21st 2015, 16:59:58.323 iocs-phishing
April 21st 2015, 16:59:53.245 iocs-phishing
April 21st 2015, 16:59:53.243 iocs-phishing
April 21st 2015, 16:59:52.242 iocs-phishing
April 21st 2015, 16:59:51.274 iocs-phishing
April 21st 2015, 16:59:43.907 iocs-phishing
April 21st 2015, 16:59:41.274 iocs-phishing
April 21st 2015, 16:59:36.137 iocs-phishing
April 21st 2015, 16:59:30.816 iocs-phishing
April 21st 2015, 16:59:09.740 iocs-phishing
April 21st 2015, 16:59:09.724 iocs-phishing
April 20th 2015, 10:18:29.559 iocs-phishing
April 20th 2015, 10:18:28.220 iocs-phishing
April 20th 2015, 10:18:25.483 iocs-phishing
April 20th 2015, 10:18:25.464 iocs-phishing
April 20th 2015, 10:18:23.755 iocs-phishing
April 20th 2015, 10:18:23.316 iocs-phishing
April 20th 2015, 10:18:22.742 iocs-phishing
April 20th 2015, 10:18:18.217 iocs-phishing
April 20th 2015, 10:18:17.660 iocs-phishing
April 20th 2015, 10:18:15.014 iocs-phishing
April 20th 2015, 10:18:13.012 iocs-phishing
April 20th 2015, 10:18:12.992 iocs-phishing
April 20th 2015, 10:18:12.979 iocs-phishing
April 20th 2015, 10:18:07.924 iocs-phishing
April 20th 2015, 10:18:06.096 iocs-phishing
April 20th 2015, 10:18:03.338 iocs-phishing
April 20th 2015, 10:18:02.131 iocs-phishing
April 20th 2015, 10:18:02.124 iocs-phishing
April 20th 2015, 10:18:01.531 iocs-phishing
April 20th 2015, 10:18:01.131 iocs-phishing
April 20th 2015, 10:17:58.025 iocs-phishing
April 20th 2015, 10:17:57.393 iocs-phishing
April 20th 2015, 10:17:56.176 iocs-phishing
April 20th 2015, 10:17:55.491 iocs-phishing
April 20th 2015, 10:17:51.421 iocs-phishing
April 20th 2015, 10:17:51.412 iocs-phishing
April 20th 2015, 10:17:48.697 iocs-phishing
April 20th 2015, 10:17:43.425 iocs-phishing
April 20th 2015, 10:17:43.378 iocs-phishing
April 20th 2015, 10:17:39.386 iocs-phishing
April 20th 2015, 10:17:37.899 iocs-phishing
April 20th 2015, 10:17:37.286 iocs-phishing
April 20th 2015, 10:17:25.099 iocs-phishing
April 20th 2015, 10:17:23.902 iocs-phishing
April 20th 2015, 10:17:21.439 iocs-phishing
April 20th 2015, 10:17:19.354 iocs-phishing
April 20th 2015, 10:17:19.316 iocs-phishing
April 20th 2015, 10:17:19.196 iocs-phishing
April 20th 2015, 10:17:14.045 iocs-phishing
April 20th 2015, 10:17:11.563 iocs-phishing
April 20th 2015, 10:17:09.678 iocs-phishing
April 20th 2015, 10:17:05.783 iocs-phishing
April 20th 2015, 10:17:05.780 iocs-phishing
April 20th 2015, 10:17:05.472 iocs-phishing
April 20th 2015, 10:17:05.010 iocs-phishing
April 20th 2015, 10:16:58.499 iocs-phishing
April 20th 2015, 10:16:57.521 iocs-phishing
April 20th 2015, 10:16:55.436 iocs-phishing
April 20th 2015, 10:16:53.135 iocs-phishing
April 20th 2015, 10:16:37.603 iocs-phishing
April 20th 2015, 10:16:37.524 iocs-phishing
April 20th 2015, 10:10:01.341 iocs-REDACTED
April 20th 2015, 10:09:58.109 iocs-REDACTED
April 18th 2015, 12:47:14.934 iocs-phishing
April 18th 2015, 12:47:09.531 iocs-phishing
April 18th 2015, 12:46:58.774 iocs-phishing
April 18th 2015, 12:46:58.728 iocs-phishing
April 18th 2015, 12:46:52.673 iocs-phishing
April 18th 2015, 12:46:49.185 iocs-phishing
April 18th 2015, 12:46:46.284 iocs-phishing
April 18th 2015, 12:46:33.325 iocs-phishing
April 18th 2015, 12:46:31.587 iocs-phishing
April 18th 2015, 12:46:28.002 iocs-phishing
April 18th 2015, 12:46:23.507 iocs-phishing
April 18th 2015, 12:46:23.392 iocs-phishing
April 18th 2015, 12:46:23.227 iocs-phishing
April 18th 2015, 12:46:09.755 iocs-phishing
April 18th 2015, 12:46:06.014 iocs-phishing
April 18th 2015, 12:46:02.776 iocs-phishing
April 18th 2015, 12:45:57.440 iocs-phishing
April 18th 2015, 12:45:57.435 iocs-phishing
April 18th 2015, 12:45:56.039 iocs-phishing
April 18th 2015, 12:45:55.198 iocs-phishing
April 18th 2015, 12:45:43.674 iocs-phishing
April 18th 2015, 12:45:40.719 iocs-phishing
April 18th 2015, 12:45:34.053 iocs-phishing
April 18th 2015, 12:45:27.953 iocs-phishing
April 18th 2015, 12:45:03.562 iocs-phishing
April 18th 2015, 12:45:03.541 iocs-phishing
April 17th 2015, 12:42:24.010 iocs-phishing
April 17th 2015, 12:42:20.044 iocs-phishing
April 17th 2015, 12:42:19.018 iocs-phishing
April 17th 2015, 12:42:13.416 iocs-phishing
April 17th 2015, 12:42:13.390 iocs-phishing
April 17th 2015, 12:42:10.828 iocs-phishing
April 17th 2015, 12:42:10.361 iocs-phishing
April 17th 2015, 12:42:10.152 iocs-phishing
April 17th 2015, 12:42:06.901 iocs-phishing
April 17th 2015, 12:42:06.569 iocs-phishing
April 17th 2015, 12:42:05.323 iocs-phishing
April 17th 2015, 12:42:03.745 iocs-phishing
April 17th 2015, 12:42:03.715 iocs-phishing
April 17th 2015, 12:42:03.686 iocs-phishing
April 17th 2015, 12:42:00.112 iocs-phishing
April 17th 2015, 12:41:58.801 iocs-phishing
April 17th 2015, 12:41:57.160 iocs-phishing
April 17th 2015, 12:41:55.086 iocs-phishing
April 17th 2015, 12:41:55.085 iocs-phishing
April 17th 2015, 12:41:54.809 iocs-phishing
April 17th 2015, 12:41:54.658 iocs-phishing
April 17th 2015, 12:41:52.653 iocs-phishing
April 17th 2015, 12:41:52.316 iocs-phishing
April 17th 2015, 12:41:51.756 iocs-phishing
April 17th 2015, 12:41:50.875 iocs-phishing
April 17th 2015, 12:41:48.130 iocs-phishing
April 17th 2015, 12:41:48.127 iocs-phishing
April 17th 2015, 12:41:45.998 iocs-phishing
April 17th 2015, 12:41:41.377 iocs-phishing
April 17th 2015, 12:41:41.356 iocs-phishing
April 17th 2015, 12:41:39.354 iocs-phishing
April 17th 2015, 12:41:37.594 iocs-phishing
April 17th 2015, 12:41:37.056 iocs-phishing
April 17th 2015, 12:41:33.623 iocs-phishing
April 17th 2015, 12:41:33.218 iocs-phishing
April 17th 2015, 12:41:31.984 iocs-phishing
April 17th 2015, 12:41:29.848 iocs-phishing
April 17th 2015, 12:41:29.835 iocs-phishing
April 17th 2015, 12:41:29.820 iocs-phishing
April 17th 2015, 12:41:27.070 iocs-phishing
April 17th 2015, 12:41:25.205 iocs-phishing
April 17th 2015, 12:41:24.201 iocs-phishing
April 17th 2015, 12:41:22.811 iocs-phishing
April 17th 2015, 12:41:22.809 iocs-phishing
April 17th 2015, 12:41:22.503 iocs-phishing
April 17th 2015, 12:41:22.187 iocs-phishing
April 17th 2015, 12:41:18.811 iocs-phishing
April 17th 2015, 12:41:17.700 iocs-phishing
April 17th 2015, 12:41:15.381 iocs-phishing
April 17th 2015, 12:41:12.823 iocs-phishing
April 17th 2015, 12:41:06.318 iocs-phishing
April 17th 2015, 12:41:06.307 iocs-phishing
April 17th 2015, 02:24:11.263 iocs-phishing
April 17th 2015, 02:24:10.062 iocs-phishing
April 17th 2015, 02:24:04.908 iocs-phishing
April 17th 2015, 02:24:04.868 iocs-phishing
April 17th 2015, 02:24:01.659 iocs-phishing
April 17th 2015, 02:24:01.220 iocs-phishing
April 17th 2015, 02:24:00.796 iocs-phishing
April 17th 2015, 02:23:57.325 iocs-phishing
April 17th 2015, 02:23:56.847 iocs-phishing
April 17th 2015, 02:23:55.863 iocs-phishing
April 17th 2015, 02:23:53.581 iocs-phishing
April 17th 2015, 02:23:53.501 iocs-phishing
April 17th 2015, 02:23:53.453 iocs-phishing
April 17th 2015, 02:23:48.102 iocs-phishing
April 17th 2015, 02:23:46.442 iocs-phishing
April 17th 2015, 02:23:45.596 iocs-phishing
April 17th 2015, 02:23:43.982 iocs-phishing
April 17th 2015, 02:23:43.980 iocs-phishing
April 17th 2015, 02:23:43.455 iocs-phishing
April 17th 2015, 02:23:42.589 iocs-phishing
April 17th 2015, 02:23:40.460 iocs-phishing
April 17th 2015, 02:23:39.601 iocs-phishing
April 17th 2015, 02:23:38.820 iocs-phishing
April 17th 2015, 02:23:37.661 iocs-phishing
April 17th 2015, 02:23:34.679 iocs-phishing
April 17th 2015, 02:23:34.677 iocs-phishing
April 17th 2015, 02:23:32.243 iocs-phishing
April 17th 2015, 02:23:23.458 iocs-phishing
April 17th 2015, 02:23:23.418 iocs-phishing
April 17th 2015, 02:23:19.272 iocs-phishing
April 17th 2015, 02:23:17.163 iocs-phishing
April 17th 2015, 02:23:16.374 iocs-phishing
April 17th 2015, 02:23:10.324 iocs-phishing
April 17th 2015, 02:23:09.686 iocs-phishing
April 17th 2015, 02:23:08.307 iocs-phishing
April 17th 2015, 02:23:05.630 iocs-phishing
April 17th 2015, 02:23:05.591 iocs-phishing
April 17th 2015, 02:23:05.554 iocs-phishing
April 17th 2015, 02:23:00.293 iocs-phishing
April 17th 2015, 02:22:57.688 iocs-phishing
April 17th 2015, 02:22:55.637 iocs-phishing
April 17th 2015, 02:22:54.541 iocs-phishing
April 17th 2015, 02:22:54.540 iocs-phishing
April 17th 2015, 02:22:54.015 iocs-phishing
April 17th 2015, 02:22:53.109 iocs-phishing
April 17th 2015, 02:22:49.605 iocs-phishing
April 17th 2015, 02:22:49.108 iocs-phishing
April 17th 2015, 02:22:47.455 iocs-phishing
April 17th 2015, 02:22:46.470 iocs-phishing
April 17th 2015, 02:22:42.024 iocs-phishing
April 17th 2015, 02:22:42.022 iocs-phishing
April 17th 2015, 02:22:38.888 iocs-phishing
April 17th 2015, 02:22:27.403 iocs-phishing
April 17th 2015, 02:22:27.376 iocs-phishing
April 17th 2015, 02:22:24.490 iocs-phishing
April 17th 2015, 02:22:23.023 iocs-phishing
April 17th 2015, 02:22:21.924 iocs-phishing
April 17th 2015, 02:22:16.455 iocs-phishing
April 17th 2015, 02:22:15.606 iocs-phishing
April 17th 2015, 02:22:14.469 iocs-phishing
April 17th 2015, 02:22:11.718 iocs-phishing
April 17th 2015, 02:22:11.691 iocs-phishing
April 17th 2015, 02:22:11.667 iocs-phishing
April 17th 2015, 02:22:01.951 iocs-phishing
April 17th 2015, 02:21:58.485 iocs-phishing
April 17th 2015, 02:21:56.313 iocs-phishing
April 17th 2015, 02:21:53.767 iocs-phishing
April 17th 2015, 02:21:53.764 iocs-phishing
April 17th 2015, 02:21:52.248 iocs-phishing
April 17th 2015, 02:21:51.482 iocs-phishing
April 17th 2015, 02:21:47.088 iocs-phishing
April 17th 2015, 02:21:46.047 iocs-phishing
April 17th 2015, 02:21:45.237 iocs-phishing
April 17th 2015, 02:21:44.008 iocs-phishing
April 17th 2015, 02:21:38.428 iocs-phishing
April 17th 2015, 02:21:38.425 iocs-phishing
April 17th 2015, 02:21:32.649 iocs-phishing
April 17th 2015, 02:21:14.980 iocs-phishing
April 17th 2015, 02:21:14.921 iocs-phishing
April 17th 2015, 02:21:09.377 iocs-phishing
April 17th 2015, 02:21:07.338 iocs-phishing
April 17th 2015, 02:21:05.895 iocs-phishing
April 17th 2015, 02:20:52.442 iocs-phishing
April 17th 2015, 02:20:51.031 iocs-phishing
April 17th 2015, 02:20:45.585 iocs-phishing
April 17th 2015, 02:20:40.146 iocs-phishing
April 17th 2015, 02:20:40.081 iocs-phishing
April 17th 2015, 02:20:39.972 iocs-phishing
April 17th 2015, 02:20:30.182 iocs-phishing
April 17th 2015, 02:20:23.560 iocs-phishing
April 17th 2015, 02:20:13.307 iocs-phishing
April 17th 2015, 02:20:04.801 iocs-phishing
April 17th 2015, 02:20:04.781 iocs-phishing
April 17th 2015, 02:19:59.905 iocs-phishing
April 17th 2015, 02:19:57.242 iocs-phishing
April 17th 2015, 02:19:43.673 iocs-phishing
April 17th 2015, 02:19:38.763 iocs-phishing
April 17th 2015, 02:19:29.139 iocs-phishing
April 17th 2015, 02:19:20.502 iocs-phishing
April 16th 2015, 12:26:16.884 iocs-phishing
April 16th 2015, 12:26:16.848 iocs-phishing
April 14th 2015, 16:01:40.069 iocs-REDACTED
April 14th 2015, 16:00:30.342 iocs-REDACTED
April 14th 2015, 15:58:20.368 iocs-REDACTED
April 14th 2015, 15:54:52.206 iocs-REDACTED
April 14th 2015, 15:52:26.131 iocs-REDACTED
April 14th 2015, 15:50:51.527 iocs-REDACTED
April 14th 2015, 15:49:40.191 iocs-REDACTED
April 13th 2015, 18:46:50.362 iocs-phishing
April 13th 2015, 18:46:39.156 iocs-phishing
April 13th 2015, 18:46:38.954 iocs-phishing
April 13th 2015, 18:46:33.783 iocs-phishing
April 13th 2015, 18:46:31.639 iocs-phishing
April 13th 2015, 18:46:28.755 iocs-phishing
April 13th 2015, 18:46:20.368 iocs-phishing
April 13th 2015, 18:46:19.194 iocs-phishing
April 13th 2015, 18:46:15.986 iocs-phishing
April 13th 2015, 18:46:11.949 iocs-phishing
April 13th 2015, 18:46:11.895 iocs-phishing
April 13th 2015, 18:46:11.853 iocs-phishing
April 13th 2015, 18:46:02.574 iocs-phishing
April 13th 2015, 18:45:56.101 iocs-phishing
April 13th 2015, 18:45:54.437 iocs-phishing
April 13th 2015, 18:45:54.434 iocs-phishing
April 13th 2015, 18:45:53.729 iocs-phishing
April 13th 2015, 18:45:53.293 iocs-phishing
April 13th 2015, 18:45:49.574 iocs-phishing
While we cannot release the actual information because it would expose the actual targets we have also seen specific malware similar to Dyre but modified specifically for this attack. Customers of SLC Security Services LLC have been provided additional information in direct messages to their consoles for review.
It is our policy not to release any identifiable information but we continue to see activity directed at this entity. We will release information to the University if they make a formal request.
Sensors on an upstream ISP network captured the following:
April 28th 2015, 23:21:55.219 iocs-phishing
April 28th 2015, 23:21:51.528 iocs-phishing
April 28th 2015, 23:21:46.435 iocs-phishing
April 28th 2015, 23:21:46.407 iocs-phishing
April 28th 2015, 23:21:45.290 iocs-phishing
April 28th 2015, 23:21:44.085 iocs-phishing
April 28th 2015, 23:21:43.850 iocs-phishing
April 28th 2015, 23:21:40.513 iocs-phishing
April 28th 2015, 23:21:39.931 iocs-phishing
April 28th 2015, 23:21:39.581 iocs-phishing
April 28th 2015, 23:21:37.889 iocs-phishing
April 28th 2015, 23:21:37.877 iocs-phishing
April 28th 2015, 23:21:37.866 iocs-phishing
April 28th 2015, 23:21:35.422 iocs-phishing
April 28th 2015, 23:21:34.757 iocs-phishing
April 28th 2015, 23:21:34.163 iocs-phishing
April 28th 2015, 23:21:32.817 iocs-phishing
April 28th 2015, 23:21:32.813 iocs-phishing
April 28th 2015, 23:21:32.292 iocs-phishing
April 28th 2015, 23:21:31.954 iocs-phishing
April 28th 2015, 23:21:29.227 iocs-phishing
April 28th 2015, 23:21:27.985 iocs-phishing
April 28th 2015, 23:21:25.912 iocs-phishing
April 28th 2015, 23:21:25.370 iocs-phishing
April 28th 2015, 23:21:24.252 iocs-phishing
April 28th 2015, 23:21:16.234 iocs-phishing
April 28th 2015, 23:21:16.223 iocs-phishing
April 27th 2015, 14:18:54.410 iocs-phishing
April 27th 2015, 14:18:51.617 iocs-phishing
April 27th 2015, 14:18:51.601 iocs-phishing
April 27th 2015, 14:18:50.170 iocs-phishing
April 27th 2015, 14:18:49.845 iocs-phishing
April 27th 2015, 14:18:49.483 iocs-phishing
April 27th 2015, 14:18:47.442 iocs-phishing
April 27th 2015, 14:18:46.466 iocs-phishing
April 27th 2015, 14:18:46.004 iocs-phishing
April 27th 2015, 14:18:45.447 iocs-phishing
April 27th 2015, 14:18:45.418 iocs-phishing
April 27th 2015, 14:18:45.385 iocs-phishing
April 27th 2015, 14:18:43.473 iocs-phishing
April 27th 2015, 14:18:43.006 iocs-phishing
April 27th 2015, 14:18:42.687 iocs-phishing
April 27th 2015, 14:18:41.553 iocs-phishing
April 27th 2015, 14:18:41.552 iocs-phishing
April 27th 2015, 14:18:41.400 iocs-phishing
April 27th 2015, 14:18:41.299 iocs-phishing
April 27th 2015, 14:18:40.634 iocs-phishing
April 27th 2015, 14:18:40.509 iocs-phishing
April 27th 2015, 14:18:39.393 iocs-phishing
April 27th 2015, 14:18:39.310 iocs-phishing
April 27th 2015, 14:18:39.185 iocs-phishing
April 27th 2015, 14:18:38.294 iocs-phishing
April 27th 2015, 14:18:38.293 iocs-phishing
April 27th 2015, 14:18:37.323 iocs-phishing
April 27th 2015, 14:18:34.208 iocs-phishing
April 27th 2015, 14:18:34.191 iocs-phishing
April 27th 2015, 14:18:33.046 iocs-phishing
April 27th 2015, 14:18:32.771 iocs-phishing
April 27th 2015, 14:18:31.819 iocs-phishing
April 27th 2015, 14:18:29.084 iocs-phishing
April 27th 2015, 14:18:28.786 iocs-phishing
April 27th 2015, 14:18:28.276 iocs-phishing
April 27th 2015, 14:18:26.891 iocs-phishing
April 27th 2015, 14:18:26.880 iocs-phishing
April 27th 2015, 14:18:26.870 iocs-phishing
April 27th 2015, 14:18:25.522 iocs-phishing
April 27th 2015, 14:18:24.364 iocs-phishing
April 27th 2015, 14:18:24.010 iocs-phishing
April 27th 2015, 14:18:23.471 iocs-phishing
April 27th 2015, 14:18:23.470 iocs-phishing
April 27th 2015, 14:18:23.333 iocs-phishing
April 27th 2015, 14:18:23.244 iocs-phishing
April 27th 2015, 14:18:21.945 iocs-phishing
April 27th 2015, 14:18:21.795 iocs-phishing
April 27th 2015, 14:18:21.525 iocs-phishing
April 27th 2015, 14:18:21.337 iocs-phishing
April 27th 2015, 14:18:21.195 iocs-phishing
April 27th 2015, 14:18:19.650 iocs-phishing
April 27th 2015, 14:18:19.649 iocs-phishing
April 27th 2015, 14:18:19.170 iocs-phishing
April 27th 2015, 14:18:16.608 iocs-phishing
April 27th 2015, 14:18:16.592 iocs-phishing
April 27th 2015, 14:18:16.534 iocs-phishing
April 27th 2015, 14:18:13.092 iocs-phishing
April 27th 2015, 14:18:13.076 iocs-phishing
April 27th 2015, 14:18:11.484 iocs-phishing
April 27th 2015, 14:18:11.217 iocs-phishing
April 27th 2015, 14:18:11.020 iocs-phishing
April 27th 2015, 14:18:08.989 iocs-phishing
April 27th 2015, 14:18:08.820 iocs-phishing
April 27th 2015, 14:18:08.513 iocs-phishing
April 27th 2015, 14:18:07.109 iocs-phishing
April 27th 2015, 14:18:07.097 iocs-phishing
April 27th 2015, 14:18:07.081 iocs-phishing
April 27th 2015, 14:18:05.093 iocs-phishing
April 27th 2015, 14:18:04.694 iocs-phishing
April 27th 2015, 14:18:04.384 iocs-phishing
April 27th 2015, 14:18:03.954 iocs-phishing
April 27th 2015, 14:18:03.953 iocs-phishing
April 27th 2015, 14:18:02.962 iocs-phishing
April 27th 2015, 14:18:02.871 iocs-phishing
April 27th 2015, 14:18:02.312 iocs-phishing
April 27th 2015, 14:18:02.188 iocs-phishing
April 27th 2015, 14:18:01.959 iocs-phishing
April 27th 2015, 14:18:00.890 iocs-phishing
April 27th 2015, 14:18:00.755 iocs-phishing
April 27th 2015, 14:17:59.922 iocs-phishing
April 27th 2015, 14:17:59.919 iocs-phishing
April 27th 2015, 14:17:59.226 iocs-phishing
April 27th 2015, 14:17:55.680 iocs-phishing
April 27th 2015, 14:17:55.663 iocs-phishing
April 27th 2015, 14:17:54.580 iocs-phishing
April 27th 2015, 14:17:54.310 iocs-phishing
April 27th 2015, 14:17:52.798 iocs-phishing
April 27th 2015, 14:17:50.545 iocs-phishing
April 27th 2015, 14:17:50.379 iocs-phishing
April 27th 2015, 14:17:50.057 iocs-phishing
April 27th 2015, 14:17:48.507 iocs-phishing
April 27th 2015, 14:17:48.492 iocs-phishing
April 27th 2015, 14:17:48.482 iocs-phishing
April 27th 2015, 14:17:47.323 iocs-phishing
April 27th 2015, 14:17:46.003 iocs-phishing
April 27th 2015, 14:17:45.691 iocs-phishing
April 27th 2015, 14:17:45.162 iocs-phishing
April 27th 2015, 14:17:45.161 iocs-phishing
April 27th 2015, 14:17:44.919 iocs-phishing
April 27th 2015, 14:17:44.742 iocs-phishing
April 27th 2015, 14:17:43.081 iocs-phishing
April 27th 2015, 14:17:42.565 iocs-phishing
April 27th 2015, 14:17:41.451 iocs-phishing
April 27th 2015, 14:17:40.054 iocs-phishing
April 27th 2015, 14:17:35.364 iocs-phishing
April 27th 2015, 14:17:35.362 iocs-phishing
April 27th 2015, 13:40:17.303 iocs-REDACTED
April 27th 2015, 13:40:16.083 iocs-REDACTED
April 23rd 2015, 03:27:02.867 iocs-phishing
April 23rd 2015, 03:27:00.073 iocs-phishing
April 23rd 2015, 03:27:00.056 iocs-phishing
April 23rd 2015, 03:26:58.395 iocs-phishing
April 23rd 2015, 03:26:58.125 iocs-phishing
April 23rd 2015, 03:26:57.698 iocs-phishing
April 23rd 2015, 03:26:55.767 iocs-phishing
April 23rd 2015, 03:26:55.464 iocs-phishing
April 23rd 2015, 03:26:55.163 iocs-phishing
April 23rd 2015, 03:26:53.844 iocs-phishing
April 23rd 2015, 03:26:53.834 iocs-phishing
April 23rd 2015, 03:26:53.824 iocs-phishing
April 23rd 2015, 03:26:52.639 iocs-phishing
April 23rd 2015, 03:26:51.413 iocs-phishing
April 23rd 2015, 03:26:51.100 iocs-phishing
April 23rd 2015, 03:26:50.634 iocs-phishing
April 23rd 2015, 03:26:50.633 iocs-phishing
April 23rd 2015, 03:26:49.722 iocs-phishing
April 23rd 2015, 03:26:49.634 iocs-phishing
April 23rd 2015, 03:26:48.117 iocs-phishing
April 23rd 2015, 03:26:47.993 iocs-phishing
April 23rd 2015, 03:26:47.755 iocs-phishing
April 23rd 2015, 03:26:47.546 iocs-phishing
April 23rd 2015, 03:26:46.296 iocs-phishing
April 23rd 2015, 03:26:46.264 iocs-phishing
April 23rd 2015, 01:15:22.229 iocs-phishing
April 23rd 2015, 01:15:19.192 iocs-phishing
April 23rd 2015, 01:15:11.223 iocs-phishing
April 23rd 2015, 01:15:11.128 iocs-phishing
April 23rd 2015, 01:15:09.295 iocs-phishing
April 23rd 2015, 01:15:08.315 iocs-phishing
April 23rd 2015, 01:15:06.993 iocs-phishing
April 23rd 2015, 01:15:00.362 iocs-phishing
April 23rd 2015, 01:14:59.399 iocs-phishing
April 23rd 2015, 01:14:58.780 iocs-phishing
April 23rd 2015, 01:14:57.684 iocs-phishing
April 23rd 2015, 01:14:57.598 iocs-phishing
April 23rd 2015, 01:14:57.551 iocs-phishing
April 23rd 2015, 01:14:53.843 iocs-phishing
April 23rd 2015, 01:14:51.402 iocs-phishing
April 23rd 2015, 01:14:49.773 iocs-phishing
April 23rd 2015, 01:14:46.749 iocs-phishing
April 23rd 2015, 01:14:46.747 iocs-phishing
April 23rd 2015, 01:14:46.074 iocs-phishing
April 23rd 2015, 01:14:45.726 iocs-phishing
April 23rd 2015, 01:14:43.551 iocs-phishing
April 23rd 2015, 01:14:42.273 iocs-phishing
April 23rd 2015, 01:14:41.242 iocs-phishing
April 23rd 2015, 01:14:39.119 iocs-phishing
April 23rd 2015, 01:14:32.108 iocs-phishing
April 23rd 2015, 01:14:32.076 iocs-phishing
April 23rd 2015, 01:14:27.795 iocs-phishing
April 23rd 2015, 01:13:58.054 iocs-phishing
April 23rd 2015, 01:13:57.450 iocs-phishing
April 23rd 2015, 01:13:34.367 iocs-phishing
April 21st 2015, 17:02:14.810 iocs-phishing
April 21st 2015, 17:02:13.211 iocs-phishing
April 21st 2015, 17:02:07.059 iocs-phishing
April 21st 2015, 17:02:07.015 iocs-phishing
April 21st 2015, 17:02:05.108 iocs-phishing
April 21st 2015, 17:02:04.261 iocs-phishing
April 21st 2015, 17:02:03.133 iocs-phishing
April 21st 2015, 17:01:57.851 iocs-phishing
April 21st 2015, 17:01:57.689 iocs-phishing
April 21st 2015, 17:01:57.059 iocs-phishing
April 21st 2015, 17:01:54.100 iocs-phishing
April 21st 2015, 17:01:54.081 iocs-phishing
April 21st 2015, 17:01:54.053 iocs-phishing
April 21st 2015, 17:01:45.697 iocs-phishing
April 21st 2015, 17:01:44.394 iocs-phishing
April 21st 2015, 17:01:42.733 iocs-phishing
April 21st 2015, 17:01:41.648 iocs-phishing
April 21st 2015, 17:01:41.643 iocs-phishing
April 21st 2015, 17:01:41.343 iocs-phishing
April 21st 2015, 17:01:41.053 iocs-phishing
April 21st 2015, 17:01:37.309 iocs-phishing
April 21st 2015, 17:01:36.619 iocs-phishing
April 21st 2015, 17:01:36.213 iocs-phishing
April 21st 2015, 17:01:35.790 iocs-phishing
April 21st 2015, 17:01:32.737 iocs-phishing
April 21st 2015, 17:01:32.737 iocs-phishing
April 21st 2015, 17:01:28.544 iocs-phishing
April 21st 2015, 17:01:23.326 iocs-phishing
April 21st 2015, 17:01:05.381 iocs-phishing
April 21st 2015, 17:01:05.050 iocs-phishing
April 21st 2015, 17:00:48.680 iocs-phishing
April 21st 2015, 17:00:43.925 iocs-phishing
April 21st 2015, 17:00:40.598 iocs-phishing
April 21st 2015, 17:00:24.375 iocs-phishing
April 21st 2015, 17:00:22.686 iocs-phishing
April 21st 2015, 17:00:19.869 iocs-phishing
April 21st 2015, 17:00:15.241 iocs-phishing
April 21st 2015, 17:00:15.040 iocs-phishing
April 21st 2015, 17:00:14.924 iocs-phishing
April 21st 2015, 17:00:05.801 iocs-phishing
April 21st 2015, 17:00:01.596 iocs-phishing
April 21st 2015, 16:59:58.323 iocs-phishing
April 21st 2015, 16:59:53.245 iocs-phishing
April 21st 2015, 16:59:53.243 iocs-phishing
April 21st 2015, 16:59:52.242 iocs-phishing
April 21st 2015, 16:59:51.274 iocs-phishing
April 21st 2015, 16:59:43.907 iocs-phishing
April 21st 2015, 16:59:41.274 iocs-phishing
April 21st 2015, 16:59:36.137 iocs-phishing
April 21st 2015, 16:59:30.816 iocs-phishing
April 21st 2015, 16:59:09.740 iocs-phishing
April 21st 2015, 16:59:09.724 iocs-phishing
April 20th 2015, 10:18:29.559 iocs-phishing
April 20th 2015, 10:18:28.220 iocs-phishing
April 20th 2015, 10:18:25.483 iocs-phishing
April 20th 2015, 10:18:25.464 iocs-phishing
April 20th 2015, 10:18:23.755 iocs-phishing
April 20th 2015, 10:18:23.316 iocs-phishing
April 20th 2015, 10:18:22.742 iocs-phishing
April 20th 2015, 10:18:18.217 iocs-phishing
April 20th 2015, 10:18:17.660 iocs-phishing
April 20th 2015, 10:18:15.014 iocs-phishing
April 20th 2015, 10:18:13.012 iocs-phishing
April 20th 2015, 10:18:12.992 iocs-phishing
April 20th 2015, 10:18:12.979 iocs-phishing
April 20th 2015, 10:18:07.924 iocs-phishing
April 20th 2015, 10:18:06.096 iocs-phishing
April 20th 2015, 10:18:03.338 iocs-phishing
April 20th 2015, 10:18:02.131 iocs-phishing
April 20th 2015, 10:18:02.124 iocs-phishing
April 20th 2015, 10:18:01.531 iocs-phishing
April 20th 2015, 10:18:01.131 iocs-phishing
April 20th 2015, 10:17:58.025 iocs-phishing
April 20th 2015, 10:17:57.393 iocs-phishing
April 20th 2015, 10:17:56.176 iocs-phishing
April 20th 2015, 10:17:55.491 iocs-phishing
April 20th 2015, 10:17:51.421 iocs-phishing
April 20th 2015, 10:17:51.412 iocs-phishing
April 20th 2015, 10:17:48.697 iocs-phishing
April 20th 2015, 10:17:43.425 iocs-phishing
April 20th 2015, 10:17:43.378 iocs-phishing
April 20th 2015, 10:17:39.386 iocs-phishing
April 20th 2015, 10:17:37.899 iocs-phishing
April 20th 2015, 10:17:37.286 iocs-phishing
April 20th 2015, 10:17:25.099 iocs-phishing
April 20th 2015, 10:17:23.902 iocs-phishing
April 20th 2015, 10:17:21.439 iocs-phishing
April 20th 2015, 10:17:19.354 iocs-phishing
April 20th 2015, 10:17:19.316 iocs-phishing
April 20th 2015, 10:17:19.196 iocs-phishing
April 20th 2015, 10:17:14.045 iocs-phishing
April 20th 2015, 10:17:11.563 iocs-phishing
April 20th 2015, 10:17:09.678 iocs-phishing
April 20th 2015, 10:17:05.783 iocs-phishing
April 20th 2015, 10:17:05.780 iocs-phishing
April 20th 2015, 10:17:05.472 iocs-phishing
April 20th 2015, 10:17:05.010 iocs-phishing
April 20th 2015, 10:16:58.499 iocs-phishing
April 20th 2015, 10:16:57.521 iocs-phishing
April 20th 2015, 10:16:55.436 iocs-phishing
April 20th 2015, 10:16:53.135 iocs-phishing
April 20th 2015, 10:16:37.603 iocs-phishing
April 20th 2015, 10:16:37.524 iocs-phishing
April 20th 2015, 10:10:01.341 iocs-REDACTED
April 20th 2015, 10:09:58.109 iocs-REDACTED
April 18th 2015, 12:47:14.934 iocs-phishing
April 18th 2015, 12:47:09.531 iocs-phishing
April 18th 2015, 12:46:58.774 iocs-phishing
April 18th 2015, 12:46:58.728 iocs-phishing
April 18th 2015, 12:46:52.673 iocs-phishing
April 18th 2015, 12:46:49.185 iocs-phishing
April 18th 2015, 12:46:46.284 iocs-phishing
April 18th 2015, 12:46:33.325 iocs-phishing
April 18th 2015, 12:46:31.587 iocs-phishing
April 18th 2015, 12:46:28.002 iocs-phishing
April 18th 2015, 12:46:23.507 iocs-phishing
April 18th 2015, 12:46:23.392 iocs-phishing
April 18th 2015, 12:46:23.227 iocs-phishing
April 18th 2015, 12:46:09.755 iocs-phishing
April 18th 2015, 12:46:06.014 iocs-phishing
April 18th 2015, 12:46:02.776 iocs-phishing
April 18th 2015, 12:45:57.440 iocs-phishing
April 18th 2015, 12:45:57.435 iocs-phishing
April 18th 2015, 12:45:56.039 iocs-phishing
April 18th 2015, 12:45:55.198 iocs-phishing
April 18th 2015, 12:45:43.674 iocs-phishing
April 18th 2015, 12:45:40.719 iocs-phishing
April 18th 2015, 12:45:34.053 iocs-phishing
April 18th 2015, 12:45:27.953 iocs-phishing
April 18th 2015, 12:45:03.562 iocs-phishing
April 18th 2015, 12:45:03.541 iocs-phishing
April 17th 2015, 12:42:24.010 iocs-phishing
April 17th 2015, 12:42:20.044 iocs-phishing
April 17th 2015, 12:42:19.018 iocs-phishing
April 17th 2015, 12:42:13.416 iocs-phishing
April 17th 2015, 12:42:13.390 iocs-phishing
April 17th 2015, 12:42:10.828 iocs-phishing
April 17th 2015, 12:42:10.361 iocs-phishing
April 17th 2015, 12:42:10.152 iocs-phishing
April 17th 2015, 12:42:06.901 iocs-phishing
April 17th 2015, 12:42:06.569 iocs-phishing
April 17th 2015, 12:42:05.323 iocs-phishing
April 17th 2015, 12:42:03.745 iocs-phishing
April 17th 2015, 12:42:03.715 iocs-phishing
April 17th 2015, 12:42:03.686 iocs-phishing
April 17th 2015, 12:42:00.112 iocs-phishing
April 17th 2015, 12:41:58.801 iocs-phishing
April 17th 2015, 12:41:57.160 iocs-phishing
April 17th 2015, 12:41:55.086 iocs-phishing
April 17th 2015, 12:41:55.085 iocs-phishing
April 17th 2015, 12:41:54.809 iocs-phishing
April 17th 2015, 12:41:54.658 iocs-phishing
April 17th 2015, 12:41:52.653 iocs-phishing
April 17th 2015, 12:41:52.316 iocs-phishing
April 17th 2015, 12:41:51.756 iocs-phishing
April 17th 2015, 12:41:50.875 iocs-phishing
April 17th 2015, 12:41:48.130 iocs-phishing
April 17th 2015, 12:41:48.127 iocs-phishing
April 17th 2015, 12:41:45.998 iocs-phishing
April 17th 2015, 12:41:41.377 iocs-phishing
April 17th 2015, 12:41:41.356 iocs-phishing
April 17th 2015, 12:41:39.354 iocs-phishing
April 17th 2015, 12:41:37.594 iocs-phishing
April 17th 2015, 12:41:37.056 iocs-phishing
April 17th 2015, 12:41:33.623 iocs-phishing
April 17th 2015, 12:41:33.218 iocs-phishing
April 17th 2015, 12:41:31.984 iocs-phishing
April 17th 2015, 12:41:29.848 iocs-phishing
April 17th 2015, 12:41:29.835 iocs-phishing
April 17th 2015, 12:41:29.820 iocs-phishing
April 17th 2015, 12:41:27.070 iocs-phishing
April 17th 2015, 12:41:25.205 iocs-phishing
April 17th 2015, 12:41:24.201 iocs-phishing
April 17th 2015, 12:41:22.811 iocs-phishing
April 17th 2015, 12:41:22.809 iocs-phishing
April 17th 2015, 12:41:22.503 iocs-phishing
April 17th 2015, 12:41:22.187 iocs-phishing
April 17th 2015, 12:41:18.811 iocs-phishing
April 17th 2015, 12:41:17.700 iocs-phishing
April 17th 2015, 12:41:15.381 iocs-phishing
April 17th 2015, 12:41:12.823 iocs-phishing
April 17th 2015, 12:41:06.318 iocs-phishing
April 17th 2015, 12:41:06.307 iocs-phishing
April 17th 2015, 02:24:11.263 iocs-phishing
April 17th 2015, 02:24:10.062 iocs-phishing
April 17th 2015, 02:24:04.908 iocs-phishing
April 17th 2015, 02:24:04.868 iocs-phishing
April 17th 2015, 02:24:01.659 iocs-phishing
April 17th 2015, 02:24:01.220 iocs-phishing
April 17th 2015, 02:24:00.796 iocs-phishing
April 17th 2015, 02:23:57.325 iocs-phishing
April 17th 2015, 02:23:56.847 iocs-phishing
April 17th 2015, 02:23:55.863 iocs-phishing
April 17th 2015, 02:23:53.581 iocs-phishing
April 17th 2015, 02:23:53.501 iocs-phishing
April 17th 2015, 02:23:53.453 iocs-phishing
April 17th 2015, 02:23:48.102 iocs-phishing
April 17th 2015, 02:23:46.442 iocs-phishing
April 17th 2015, 02:23:45.596 iocs-phishing
April 17th 2015, 02:23:43.982 iocs-phishing
April 17th 2015, 02:23:43.980 iocs-phishing
April 17th 2015, 02:23:43.455 iocs-phishing
April 17th 2015, 02:23:42.589 iocs-phishing
April 17th 2015, 02:23:40.460 iocs-phishing
April 17th 2015, 02:23:39.601 iocs-phishing
April 17th 2015, 02:23:38.820 iocs-phishing
April 17th 2015, 02:23:37.661 iocs-phishing
April 17th 2015, 02:23:34.679 iocs-phishing
April 17th 2015, 02:23:34.677 iocs-phishing
April 17th 2015, 02:23:32.243 iocs-phishing
April 17th 2015, 02:23:23.458 iocs-phishing
April 17th 2015, 02:23:23.418 iocs-phishing
April 17th 2015, 02:23:19.272 iocs-phishing
April 17th 2015, 02:23:17.163 iocs-phishing
April 17th 2015, 02:23:16.374 iocs-phishing
April 17th 2015, 02:23:10.324 iocs-phishing
April 17th 2015, 02:23:09.686 iocs-phishing
April 17th 2015, 02:23:08.307 iocs-phishing
April 17th 2015, 02:23:05.630 iocs-phishing
April 17th 2015, 02:23:05.591 iocs-phishing
April 17th 2015, 02:23:05.554 iocs-phishing
April 17th 2015, 02:23:00.293 iocs-phishing
April 17th 2015, 02:22:57.688 iocs-phishing
April 17th 2015, 02:22:55.637 iocs-phishing
April 17th 2015, 02:22:54.541 iocs-phishing
April 17th 2015, 02:22:54.540 iocs-phishing
April 17th 2015, 02:22:54.015 iocs-phishing
April 17th 2015, 02:22:53.109 iocs-phishing
April 17th 2015, 02:22:49.605 iocs-phishing
April 17th 2015, 02:22:49.108 iocs-phishing
April 17th 2015, 02:22:47.455 iocs-phishing
April 17th 2015, 02:22:46.470 iocs-phishing
April 17th 2015, 02:22:42.024 iocs-phishing
April 17th 2015, 02:22:42.022 iocs-phishing
April 17th 2015, 02:22:38.888 iocs-phishing
April 17th 2015, 02:22:27.403 iocs-phishing
April 17th 2015, 02:22:27.376 iocs-phishing
April 17th 2015, 02:22:24.490 iocs-phishing
April 17th 2015, 02:22:23.023 iocs-phishing
April 17th 2015, 02:22:21.924 iocs-phishing
April 17th 2015, 02:22:16.455 iocs-phishing
April 17th 2015, 02:22:15.606 iocs-phishing
April 17th 2015, 02:22:14.469 iocs-phishing
April 17th 2015, 02:22:11.718 iocs-phishing
April 17th 2015, 02:22:11.691 iocs-phishing
April 17th 2015, 02:22:11.667 iocs-phishing
April 17th 2015, 02:22:01.951 iocs-phishing
April 17th 2015, 02:21:58.485 iocs-phishing
April 17th 2015, 02:21:56.313 iocs-phishing
April 17th 2015, 02:21:53.767 iocs-phishing
April 17th 2015, 02:21:53.764 iocs-phishing
April 17th 2015, 02:21:52.248 iocs-phishing
April 17th 2015, 02:21:51.482 iocs-phishing
April 17th 2015, 02:21:47.088 iocs-phishing
April 17th 2015, 02:21:46.047 iocs-phishing
April 17th 2015, 02:21:45.237 iocs-phishing
April 17th 2015, 02:21:44.008 iocs-phishing
April 17th 2015, 02:21:38.428 iocs-phishing
April 17th 2015, 02:21:38.425 iocs-phishing
April 17th 2015, 02:21:32.649 iocs-phishing
April 17th 2015, 02:21:14.980 iocs-phishing
April 17th 2015, 02:21:14.921 iocs-phishing
April 17th 2015, 02:21:09.377 iocs-phishing
April 17th 2015, 02:21:07.338 iocs-phishing
April 17th 2015, 02:21:05.895 iocs-phishing
April 17th 2015, 02:20:52.442 iocs-phishing
April 17th 2015, 02:20:51.031 iocs-phishing
April 17th 2015, 02:20:45.585 iocs-phishing
April 17th 2015, 02:20:40.146 iocs-phishing
April 17th 2015, 02:20:40.081 iocs-phishing
April 17th 2015, 02:20:39.972 iocs-phishing
April 17th 2015, 02:20:30.182 iocs-phishing
April 17th 2015, 02:20:23.560 iocs-phishing
April 17th 2015, 02:20:13.307 iocs-phishing
April 17th 2015, 02:20:04.801 iocs-phishing
April 17th 2015, 02:20:04.781 iocs-phishing
April 17th 2015, 02:19:59.905 iocs-phishing
April 17th 2015, 02:19:57.242 iocs-phishing
April 17th 2015, 02:19:43.673 iocs-phishing
April 17th 2015, 02:19:38.763 iocs-phishing
April 17th 2015, 02:19:29.139 iocs-phishing
April 17th 2015, 02:19:20.502 iocs-phishing
April 16th 2015, 12:26:16.884 iocs-phishing
April 16th 2015, 12:26:16.848 iocs-phishing
April 14th 2015, 16:01:40.069 iocs-REDACTED
April 14th 2015, 16:00:30.342 iocs-REDACTED
April 14th 2015, 15:58:20.368 iocs-REDACTED
April 14th 2015, 15:54:52.206 iocs-REDACTED
April 14th 2015, 15:52:26.131 iocs-REDACTED
April 14th 2015, 15:50:51.527 iocs-REDACTED
April 14th 2015, 15:49:40.191 iocs-REDACTED
April 13th 2015, 18:46:50.362 iocs-phishing
April 13th 2015, 18:46:39.156 iocs-phishing
April 13th 2015, 18:46:38.954 iocs-phishing
April 13th 2015, 18:46:33.783 iocs-phishing
April 13th 2015, 18:46:31.639 iocs-phishing
April 13th 2015, 18:46:28.755 iocs-phishing
April 13th 2015, 18:46:20.368 iocs-phishing
April 13th 2015, 18:46:19.194 iocs-phishing
April 13th 2015, 18:46:15.986 iocs-phishing
April 13th 2015, 18:46:11.949 iocs-phishing
April 13th 2015, 18:46:11.895 iocs-phishing
April 13th 2015, 18:46:11.853 iocs-phishing
April 13th 2015, 18:46:02.574 iocs-phishing
April 13th 2015, 18:45:56.101 iocs-phishing
April 13th 2015, 18:45:54.437 iocs-phishing
April 13th 2015, 18:45:54.434 iocs-phishing
April 13th 2015, 18:45:53.729 iocs-phishing
April 13th 2015, 18:45:53.293 iocs-phishing
April 13th 2015, 18:45:49.574 iocs-phishing
While we cannot release the actual information because it would expose the actual targets we have also seen specific malware similar to Dyre but modified specifically for this attack. Customers of SLC Security Services LLC have been provided additional information in direct messages to their consoles for review.
It is our policy not to release any identifiable information but we continue to see activity directed at this entity. We will release information to the University if they make a formal request.
Tuesday, April 21, 2015
ALERT: 43.255.0.0/16 Netblock Extremely Active and Noisy
We wanted to put out an alert that many of our sensors and clients are reporting inbound SMTP infected dyzera and ssh scanning. What's interesting is that the actors appears to not care how noisy they are. We highly recommend blocking the entire /16 netblock.
Saturday, April 18, 2015
What we have seen in the last 24 hours
Our analyst have noted the following attacks in the last 24 hours. We are tracking 311,510 attacks on our sensors. Out of our sensors we noted that 6 financial organizations have been compromised, 12 sites were infected with spyware, 4 medical institutions were compromised, 613 banks were attacked but we saw no new compromises in the banking sector, 9 research organizations were seen attacking other infrastructure, there were a total of 57 new attackers identified in the last 24 hours.
Friday, April 17, 2015
20 Years Later SSH Brute Force Persist
For the past few weeks I have been looking at an old issue. You see in 1995 I started an Internet Service and as soon as I started bringing servers online I noted that there were random ssh login attempts to our systems. Back then it was easy to block IP addresses and be done with it but it's not that cut and dry today. With natting, apache name directives and web server naming conventions a single IP address can host thousands of individual websites and the chances of blocking a legitimate service is pretty high but guess what? We don't care.
We have taken the stance that if we see your boxes behaving badly and your not taking any action to resolve the situation then we will block you from our systems and all systems that we manage. A quick check our our system indicates that we have 57 million indicators of attack or compromise. When we filter with ssh as a keyword we noted that 255,096 host are currently on our blacklist for ssh brute force attempts and another 2.7 million are on the alert list for scanning. The 255,096 number may look small on the scale of things but the originating sources are very interesting in deed.
The majority of the scanning activity being seen is coming from some predictable locations to include Asia/China, Russia and some locations in South America. In fact 79% of the attacks on our sensors are from the listed locations.
Our top 5 locations seen brute forcing ssh accounts this past week:
1. China
2. Russia
3. Amsterdam
4. Valenzuela
5. Turkey
What's interesting is that the attacks are noisy and easily detected yet many network administrators continue to allow traffic from these locations. In an upcoming post we will be sharing a list of country blocks that should eliminate around 95% of the ssh scanning activity you will see on your networks.
One things for sure, ssh scanning will be here for many, many years to come. A solution is to eliminate interactive logins and utilize certificate based login. This method allows you to collect information and be fairly certain that your systems won't be attacked in this manner. Adding 2 factor authentication pretty much ensures that nobody will get by your ssh defense.
We have taken the stance that if we see your boxes behaving badly and your not taking any action to resolve the situation then we will block you from our systems and all systems that we manage. A quick check our our system indicates that we have 57 million indicators of attack or compromise. When we filter with ssh as a keyword we noted that 255,096 host are currently on our blacklist for ssh brute force attempts and another 2.7 million are on the alert list for scanning. The 255,096 number may look small on the scale of things but the originating sources are very interesting in deed.
The majority of the scanning activity being seen is coming from some predictable locations to include Asia/China, Russia and some locations in South America. In fact 79% of the attacks on our sensors are from the listed locations.
Our top 5 locations seen brute forcing ssh accounts this past week:
1. China
2. Russia
3. Amsterdam
4. Valenzuela
5. Turkey
What's interesting is that the attacks are noisy and easily detected yet many network administrators continue to allow traffic from these locations. In an upcoming post we will be sharing a list of country blocks that should eliminate around 95% of the ssh scanning activity you will see on your networks.
One things for sure, ssh scanning will be here for many, many years to come. A solution is to eliminate interactive logins and utilize certificate based login. This method allows you to collect information and be fairly certain that your systems won't be attacked in this manner. Adding 2 factor authentication pretty much ensures that nobody will get by your ssh defense.
Monday, April 13, 2015
Today's Attacks - Note the uptick in attacks from proxy servers
We are seeing a spike in attacks originating from proxy servers today. It seems that some recent post on some vulnerabilities at Universities and Campuses is fueling an attack frenzy. You can read Data Breaches post on the activity here. In addition we are seeing some attacks that are targeting medical facilities as well. This activity started around 4PM EST earlier today.
Very soon we will be opening up our data sources to researchers so if you are on our research team or a trusted partner look for an email from the SOC with your login instructions.
Friday, April 10, 2015
REPORT: Jefferson County Public Library (Active Hacking)
We have been monitoring activity on our sensors from Jefferson County Public Library from IP 199.117.70.6 most of the evening. The attacks are happening at multiple sensor locations to include Chicago and Texas as well as a sensor in the EU.
We have actively blocked this attacker in our customer systems and will update if we receive any additional information.
We have actively blocked this attacker in our customer systems and will update if we receive any additional information.
Tuesday, April 7, 2015
Subscribe to:
Posts (Atom)