Threat Intelligence

Are Cybersquatting Campaigns Targeting Airlines Taking Off?

Details about an ongoing cybersquatting campaign targeting Turkish Airlines were recently unveiled, naming 13 malicious domains connected to the threat. As one of our primary goals is to expand published lists of indicators of compromise (IoCs), we dug deeper into the campaign to determine if the threat is confined to Turkish Airlines or if other industry players are at risk as well. more

Exposing an Active Kaseya Ransomware Attack Infrastructure

Kaseya, an IT solution developer targeting managed service providers (MSPs) and enterprises, became a victim of a massive ransomware attack last July. While the company’s CEO said that less than 0.1% of its clients were affected, the fact that it mostly served MSPs, the data belonging to as many as 1,500 small businesses could have been compromised. more

Exposing Rogue Free VPN Users – An OSINT Analysis

According to recent research conducted by DNS Threat Researcher Dancho Danchev, the National Security Agency (NSA) seemingly runs a free VPN domain portfolio to lure malicious users and learn more about their Internet activities. more

What Are the Internet Domains Connected to the Conficker Botnet?

Conficker gained prominence back in 2008, when it was then considered possibly the most widespread worm affecting millions of Windows computers worldwide. For several years, the worm, also known as "Downup," "Downadup," "Downad," or "Kido," was the top malware infector. more

Investigation of an Iranian Misinformation Network: Are Some IRGC Domains Still Up?

June 2021 saw the U.S. Department of Justice (DOJ) shutting down and seizing several websites believed to be involved in misinformation campaigns. These websites published news-related content and seemingly had connections to Irani governmental entities. In fact, some of them were found to be the property of the Iranian Islamic Radio and Television Union (IRTVU). more

Could the LGBTQ Community Be a Target of Internet Threat Actors?

Pride month is celebrated worldwide. While it's meant to be a time of celebration for members of the LGBTQ community and their families and supporters, its popularity has also made it a possible target of cyber threats. In this post, we look at potentially dangerous Internet properties that have been registered both recently and over the years. more

Uncovering Office 365-Related Artifacts with IP and Domain Intelligence

While Office 365 is one of the most prevalent office suites out in the market today, its users can't rest easy. Cybercriminals and threat actors will always find ways to abuse the most popular brands in various ways. more

The Joe Biden-Kamala Harris Tandem’s Effects on Domain and Subdomain Registrations

It has been months after Joe Biden and Kamala Harris took office as president and vice president of the U.S., respectively. And since that time, they were naturally featured in most news outlets. What we wanted to know, though, is how all the attention has been affecting the domain registration world. more

Zero-Trust Implementation Using WHOIS, IP, and DNS Data

The U.S. government released the Executive Order on Improving the Nation's Cybersecurity in May 2021, highlighting the rationale of a zero-trust security approach. While the order only covers the government's digital infrastructure, this initiative could also serve as a catalyst for more robust global cybersecurity. more

Analyzing Recently Discovered Windows 11-Themed Assets

The release of a new application or operating system (OS) is typically greeted by enthusiasm, diverse opinions, and potential threats. Windows 11's case is no different as we identified various assets that could be misused on the Internet. more