So.. twice this year a DNS threat actor changed behavior when we were investigating and they soared from suspicious to malicious. lol. clever. first #decoydog then #prolificpuma ... anyhow.. kinda funny.. we fully expected them to regroup... it's their job after all to do the crime thing.. but they just can't let go of music references.. new email address 6lackrules@proton[.]me. no more anon usTLD registrations it looks like.

Here's some domains. a slight change in hosting. i don't see the shorteners set up yet but for these'll be for sms bad activities again i'm sure.

zk0[.]us,zg5[.]us,yl4[.]us,yg2[.]us,y4f[.]us,xa4[.]us,x8i[.]us,wu7[.]us,wn3[.]us,w1m[.]us,v9e[.]us,v3y[.]us,uv5[.]us,uj2[.]us,ud4[.]us,u7n[.]us,u2f[.]us,tr0[.]us,tl1[.]us,t7x[.]us,s9k[.]us,qb9[.]us,q8r[.]us,q6d[.]us,q3u[.]us,q2u[.]us,pj8[.]us,p6s[.]us,p6h[.]us,o8r[.]us,o8l[.]us,o1i[.]us,lh8[.]us,ks0[.]us,kf8[.]us,k7x[.]us,k3o[.]us,jx4[.]us,jf4[.]us,hz0[.]us,h7s[.]us,h6l[.]us,g9s[.]us,g9j[.]us,fy3[.]us,f5y[.]us,f3z[.]us,er7[.]us,ecyz[.]us,e9c[.]us,d8c[.]us,c9i[.]us,c9a[.]us,bk7[.]us,a8m[.]us,a8j[.]us,a6r[.]us,9yl[.]us,9xl[.]us,9ou[.]us,9ma[.]us,9jy[.]us,9iq[.]us,8qe[.]us,8mv[.]us,8im[.]us,8fv[.]us,7ov[.]us,7nv[.]us,7cb[.]us,6np[.]us,6bu[.]us,5jc[.]us,5ja[.]us,3kc[.]us,2jk[.]us,2cl[.]us,0ho[.]us,piyt[.]us,zlyx[.]us,wyop[.]us,wk0[.]us,k0z[.]us,8ec[.]us,7ol[.]us,kaqu[.]us,jdhr[.]us,ivdo[.]us,w6r[.]us,t6s[.]us,sg4[.]us,j8q[.]us,f1d[.]us,aehv[.]us,utpy[.]us,jqcu[.]us,kxjm[.]us

#dns #malware #smishing #phishing #cybersecurity #infosec #infoblox