urlquery

- a service for detecting and analyzing malicious websites.

[urlquery @urlquery]

That is one nice open redirect

https://t.co/xppxXHLrGa

#phishing #rockstar2fa

[urlquery @urlquery]

https://t.co/0hqZrf9Cwx

[urlquery @urlquery]

#phishing
For the last weeks there as been quite a few domains detected related to #tycoon at least a few hundred daily. Mostly towards Microsoft

[urlquery @urlquery]

This was a triumph.
I'm making a note here:
HUGE SUCCESS.

[urlquery @urlquery]

@hetznerabuse @banthisguy9349 @AezaLTD @pigeonovv @spamhaus @abuse_ch @pfcloudio @correctiv_org @mxbernhard @RETNnet @Hetzner_Online just totally a random name then i guess, what a coincidence when reply in a thread about hosting providers.

[Fox_threatintel @banthisguy9349]

and another ~10k are being send today. Keep a eye out on this https://t.co/HarLz7pb5D to find urls with a sample giving 1+ Positive as a minimum

The hits are giving a strong indication of malware/source does being shared for either educational purposes or malicious intend!

[Fox_threatintel @banthisguy9349]

5k more github urls being send! awesome work @urlquery

[Fox_threatintel @banthisguy9349]

In collab with @urlquery 9.6k github urls are being send that are potentially used for malicious purposes! Detection rules are hunted over the urls/samples that are discovered!

You can find the datastream under the following query/tag: https://t.co/YQ6tOqYNA2

[Fox_threatintel @banthisguy9349]

Did you know that you can Utileze @urlquery to search for body results?

https://t.co/h7pNwMAKQl

cc: @RacWatchin8872

[urlquery @urlquery]

Make your browser look like a sandbox and you'll get free anti-phishing

[urlquery @urlquery]

@banthisguy9349 @abuse_ch https://t.co/tsTrmP45a8

several common file extensions padded with .lnk in the recent days.
pdf, jpg and png being the most common
#lummastealer
payload:
https://t.co/02nHMd7gR3

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

Check out the new blog I wrote on #Gabagool AiTM Phishing we discovered at @TRACLabs_ 🐟 targeting corporate and government employees.

https://t.co/6ZdRTLwc6J

[urlquery @urlquery]

@banthisguy9349 @lontze7 @500mk500 or if you want to keep the original expression:

https://t.co/ZDoPGaJVik

[Fox_threatintel @banthisguy9349]

#lummastealer is still heavily using b-cdn[.]net domains

IOC's
hxxps://privatebin.net/?d92c797cbe6e4c07#GZwqvzUKVzRRQrr1CuVLLKwXFQVdAQwAy1BV2HJk1dB2

[Fox_threatintel @banthisguy9349]

I have had a big pleasure exploring @urlquery dataflow and existing IDS/YARA rules.

I have used scraping methods in order to send IOC's/malware towards @abuse_ch and I am willing to share my hunting rules in the following bin.

https://t.co/U40ur048Uh

[Fox_threatintel @banthisguy9349]

Secret sauce how i ended up @ this ransomware IOC.
https://t.co/BJ510Ba7id
within @urlquery you have the ability to scan URLS but also IDS/YARA rules get triggered on the file download. This is very essential to hunt malicious files.

[urlquery @urlquery]

@banthisguy9349 Have you tried DM?

[urlquery @urlquery]

@atluxity @Quad9DNS Adding @Quad9DNS should not be a big issue as long as they are ok with it. It will just use the service for lookups during analysis. No need for a full offline blacklist.

[urlquery @urlquery]

Looking for sites using coin-hive?
https://t.co/4GszgMDlvE
or sites which uses a specific key:
https://t.co/6ke27rQaxo