Wow, now I'm getting malware URLs via reverb.com - way to hand over a long-time threat intel person the IoC's

nothing on VT yet https://www.virustotal.com/gui/url/3086617690b3b089bff0dd7b96f0e389a57ad32630fd93b6a29d6cdc8256edfe/detection
Zero detections:
https://www.urlvoid.com/scan/matyshkazemlya.com/
scan failed 403 forbidden: https://sitecheck.sucuri.net/results/www.matyshkazemlya.com

https://urlquery.net/report/7840c1b4-791d-47d1-b531-4ac3b7fd0f92 redirect and is sinkholed via DNS4EU
Submitted to Pulsedive: https://pulsedive.com/indicator/?ioc=d3d3Lm1hdHlzaGthemVtbHlhLmNvbQ==

Showing a redirect to Google on checkphish (LOL)
https://app.checkphish.ai/public/insights/1772914041531/3086617690b3b089bff0dd7b96f0e389a57ad32630fd93b6a29d6cdc8256edfe

IoC:
www.matyshkazemlya [DOT] com

Message on Reverb.com:
Hey, I've been trying to buy your listing but keep getting a payment error. The site gave me a link with some info for the seller to check — www.matyshkazemlya [DOT] com Could you take a look? Mia Brown

#IR #incidentRespose #CTI #IOC #infosec #cyberz #cybersecurity #infosec #reverb
#suspectdomain #virustotal #pulsedive #URLvoid #threatIntel #ThreatInteligence

Who is running #corelight
at home?

https://corelight.com/blog/corelight-at-home

Seems like a good use of a spare raspi

#raspi #raspi4 #zeek #suricata
#networking #networkmonitoring #DNS #infosec #cyberz #cybersecurity

『８６―エイティシックス―』レーナがcantabileシリーズよりフィギュア化！印象的なコスチュームや芯のある表情、透きとおるような白い肌を再現！
https://hobby.dengeki.com/news/2707493/

#hobby_dengeki #86_エイティシックス #KADOKAWA #フィギュア #美少女フィギュア #電撃キャラクター #エイティシックス #レーナ #CyberZ

Trying something new with #GitHub and posting my spam #UCE #UBE and suspect / #malicious #emails and their associated attachments. Putting everything in a #mastodon post was problematic with space limitations, and was hard to find/organize/search.

Providing the redacted headers and URLs to the malware sandboxes used:

https://github.com/obrientg/Analysis/blob/main/Fri%2C%2025%20Oct%202024%20JS%20Phish.AAL

Received two (2) of the same samples, with different file names & hashes but the same detection of JS/Phish.AAL
Both were sent to the email address I use for threat intel & incident response collaboration efforts.
Email SRC on both was Google Cloud (#GCP) with an #openproxy, abuse reporting submitted.

#MD5 5cf33dd39d6db60423ac89fd63e5f500
#SHA1 863c95b7e7ff0bb8299cbae93dfaed12cc619332
#SHA256 c4e40b137e43c89261ee89a34db843477a8c994a21a92c98c7b15193face8c35

#MD5 8a9af78b0a4cdade6df9f71e7e5b1362
#SHA1 b03fdf0891adacc1995fdd1e2f043343c20a45e5
#SHA256 317aaea9d9ef39c9b85b9ce6e0f68ec83a06b2f3298aded981b19063b2f44737

#malware #incidentResponse #malwareAnalysis
#InfoSec #informationSecurity #cybersecurity #cyberz #cyber #cybercrime
#phish #phishing
#threatIntel #IoC #threatIntelligence #cyberthreatintelligence #CTI

「ずんだもん」おなじみの“あのイラスト”がプライズ化。坂本アヒル氏による大人気の立ち絵素材が全6種のアクスタとなり、2月26日からナムコオンラインクレーンに先行登場
https://news.denfaminicogamer.jp/news/240219h

#denfaminicogamer #アクリルスタンド #ニュース #プライズ #グッズ #ずんだもん #久田晴 #CyberZ #eStream #ぬいぐるみ