bkengineersindia.com

[g0d33p3rsec]

Blacklist domain as

• Wildcard, The domain should be entirely blacklisted
• Subdomain, We should not blacklist the entire domain, only sub-domains
• Both types, category depended, How to Blacklist, depends on category assign per (sub-)domain

Comments

This domain is now hosting the phishing kit that was previously at englishplusmore[.]com(#404), carnesboinobre[.]com[.]br,  technowide[.]com[.]tr,  jestertunes[.]com, safecartusa[.]com, foreverfarley[.]com, azezieldraconous[.]com, westernautomobileassembly[.]com , littleswanaircon[.]com[.]sg, iwan2travel[.]com, applesforfred[.]com, theaerie[.]ca, nico[.]sa, ajstelecom[.]com[.]mx, and many others (approximately 120 domains since 2021).

Domain records

bkengineersindia.com|phishing

Hosts specific records, not used by DNS RPZ firewalls

No response

Screenshots

Screenshot

Links to external sources

https://bkengineersindia.com/M3AzSDVuMUQ3SjNZOWw=
https://bkengineersindia.com/M2sxMzhFNm4wZjNJNnk=
https://bkengineersindia.com/M04zTjF1MVE0MTNPNVk=
https://bkengineersindia.com/MnU4RDM4MTE5MDQyNG0=
https://bkengineersindia.com/M0QyMTlMME01VDh3MmE=

### logs from uBlock Origin

_No response_

[g0d33p3rsec]

I'm noticing that most hosts seem to be vulnerable to CVE-2008-3844 when I run them through Shodan.
https://www.shodan.io/host/166.62.28.145

compare with the host that was being used yesterday
https://www.shodan.io/host/50.87.249.228

This is a vuln that has consistently shown up on hosts related to this activity group.

[spirillen]

Nice notice, Thanks for sharing