sysoieaosgwoeesa.xyz

[g0d33p3rsec]

Comments

When exploring AS215540 earlier, I came across http://5.181.3.225:8080/ which is an open directory for guardianviewer.com. The site hosts an attack chain for an info stealer http://guardianviewer.com/html/dl/Form%20I-19.pdf.url -> https://guardianviewer.com/docu/Form%20I-19.pdf.lnk -> http://guardianviewer.com/box/setup.msi -> stolen information exfiltrated to sysoieaosgwoeesa.xyz. See also: Phishing-Database/phishing#734

Wildcard domain records

sysoieaosgwoeesa.xyz|malicious,phishing

Sub-Domain records

Hosts (RFC:952) specific records, not used by DNS RPZ firewalls

Safe Search records

Screenshots

Screenshot, click to expand

Links to external sources

http://guardianviewer.com/box/setup.msi
http://guardianviewer.com/html/dl/Form%20I-19.pdf.url
https://guardianviewer.com/docu/Form%20I-19.pdf.lnk

Name servers

dns1.registrar-servers.com.
dns2.registrar-servers.com.

logs from uBlock Origin

N/A