Breaking News

Historical OSINT - A Diversified Portfolio of Pharmacautical Scams Spotted in the Wild

Cybercriminals continue actively speading fraudulent and malicious campaigns potentially targeting the confidentiality availability and integrity of the targeted host to a multi-tude of malicious software further earning fraudulent revenue in the process of monetizing access to malware-infected hosts further spreading malicious and fraudulent campaigns potentially affecting hundreds of thousands of users globally.

We've recently came across to a currently active diversified portfolio of pharmaceutical scams with the cybercriminals behind it successfully earning fraudulent revenue in the process of monetizing access to malware-infected hosts including the active utilization of an affiliate-network based type of revenue sharing scheme.

In this post we'll profile the campaign, provide actionable intelligence, on the infrastructure behind it, and discuss in depth, the tactics techniques and procedures of the cybercriminals behind it.

hxxp://lightmcusic.com
hxxp://darkclosed.com
hxxp://raintable.com
hxxp://rainthing.com
hxxp://lamptrail.com
hxxp://rainopen.com
hxxp://newsmillion.com
hxxp://paintlamp.com
hxxp://newssilver.com
hxxp://singerspa.ru
hxxp://belllead.ru
hxxp://dealfence.ru
hxxp://beachpage.ru
hxxp://sweatybottle.ru
hxxp://superring.ru
hxxp://betaflash.ru
hxxp://petgal.ru
hxxp://beastball.ru
hxxp://chartarm.ru
hxxp://roomcoin.ru
hxxp://armsgun.ru
hxxp://keyhero.ru
hxxp://sisterlover.ru
hxxp://pitstops.ru
hxxp://ballnet.ru
hxxp://betacourt.ru
hxxp://moviecourt.ru
hxxp://bandrow.ru
hxxp://rainmcusic.com
hxxp://lightmcusic.com
hxxp://diskwind.com
hxxp://disklarge.com
hxxp://silverlarge.com
hxxp://totaldomainname.com
hxxp://mcusicmouse.com
hxxp://diskbig.com
hxxp://rainthing.com
hxxp://thunderhigh.com
hxxp://raintruck.com
hxxp://mcusictank.com
hxxp://diskdark.com
hxxp://thunderdark.com
hxxp://raintowel.com
hxxp://mcusicball.com
hxxp://diskwarm.com
hxxp://silverwarsm.com
hxxp://diskopen.com
hxxp://diskfashion.com
hxxp://goldlgs.com
hxxp://silverdarks.com
hxxp://silveropens.com
hxxp://goldapers.com
hxxp://goldslvers.com
hxxp://diskhot.com
hxxp://bluedrow.com
hxxp://flashdrow.com
hxxp://raindrow.com
hxxp://thunderdrow.com
hxxp://rainmcusic.com
hxxp://rainpen.com
hxxp://rainthing.com
hxxp://spotsoda.ru
hxxp://mediamultimedia.ru
hxxp://boozetuna.ru
hxxp://singerspa.ru
hxxp://eyepizza.ru
hxxp://ringmic.ru
hxxp://belllead.ru
hxxp://roselid.ru
hxxp://homemold.ru
hxxp://tuneworld.ru
hxxp://happendepend.ru
hxxp://fruitmind.ru
hxxp://groupmud.ru
hxxp://showbabe.ru
hxxp://juicetube.ru
hxxp://kidrace.ru
hxxp://zoomtrace.ru
hxxp://lawice.ru
hxxp://dealfence.ru
hxxp://wipeagree.ru
hxxp://coverimage.ru
hxxp://beachpage.ru
hxxp://waxylanguage.ru
hxxp://jazzedge.ru
hxxp://casemale.ru
hxxp://spotsoda.ru
hxxp://mediamultimedia.ru
hxxp://boozetuna.ru
hxxp://singerspa.ru
hxxp://eyepizza.ru
hxxp://kittyweb.ru
hxxp://bedrib.ru
hxxp://yourib.ru
hxxp://antthumb.ru
hxxp://ringmic.ru
hxxp://belllead.ru
hxxp://roselid.ru
hxxp://homemold.ru
hxxp://tuneworld.ru
hxxp://happendepend.ru
hxxp://fruitmind.ru
hxxp://groupmud.ru
hxxp://showbabe.ru
hxxp://juicetube.ru
hxxp://kidrace.ru
hxxp://zoomtrace.ru
hxxp://lawice.ru
hxxp://dealfence.ru
hxxp://wipeagree.ru
hxxp://coverimage.ru
hxxp://beachpage.ru
hxxp://waxylanguage.ru
hxxp://jazzedge.ru
hxxp://casemale.ru
hxxp://czarsale.ru
hxxp://sweatybottle.ru
hxxp://boxlane.ru
hxxp://rubyfire.ru
hxxp://radiohorse.ru
hxxp://sodakite.ru
hxxp://armissue.ru
hxxp://houraxe.ru
hxxp://smokeeye.ru
hxxp://anteye.ru
hxxp://salesbarf.ru
hxxp://shelfleg.ru
hxxp://superring.ru
hxxp://timematch.ru
hxxp://sewermatch.ru
hxxp://betaflash.ru
hxxp://wovenbath.ru
hxxp://imagebirth.ru
hxxp://shelfjack.ru
hxxp://ringmack.ru
hxxp://gigaknack.ru
hxxp://filetack.ru
hxxp://busybrick.ru
hxxp://giantdock.ru
hxxp://wormduck.ru
hxxp://roundtruck.ru
hxxp://labfolk.ru
hxxp://malespark.ru
hxxp://petgal.ru
hxxp://hitpal.ru
hxxp://beastball.ru
hxxp://baysmell.ru
hxxp://beachhill.ru
hxxp://giantpill.ru
hxxp://runtvenom.ru
hxxp://soaproom.ru
hxxp://chartarm.ru
hxxp://deedsum.ru
hxxp://firmcan.ru
hxxp://sofafan.ru
hxxp://chinqueen.ru
hxxp://lightpen.ru
hxxp://fishgain.ru
hxxp://shiptrain.ru
hxxp://canbin.ru
hxxp://roomcoin.ru
hxxp://caseion.ru
hxxp://miciron.ru
hxxp://metalcorn.ru
hxxp://roadbun.ru
hxxp://armsgun.ru
hxxp://landclown.ru
hxxp://weedego.ru
hxxp://kidsolo.ru
hxxp://waxsolo.ru
hxxp://hitpiano.ru
hxxp://keyhero.ru
hxxp://hitzero.ru
hxxp://ziptap.ru
hxxp://arealamp.ru
hxxp://sunnystamp.ru
hxxp://freeproshop.ru
hxxp://clanpup.ru
hxxp://silkyear.ru
hxxp://jarpeer.ru
hxxp://cobrariver.ru
hxxp://sisterlover.ru
hxxp://rocktower.ru
hxxp://yearshoes.ru
hxxp://grapefrogs.ru
hxxp://papercoins.ru
hxxp://pitstops.ru
hxxp://ginboss.ru
hxxp://greedpants.ru
hxxp://rulebat.ru
hxxp://kidssplat.ru
hxxp://havocfleet.ru
hxxp://ballnet.ru
hxxp://statezit.ru
hxxp://elfsalt.ru
hxxp://zooant.ru
hxxp://finksnot.ru
hxxp://bluffheart.ru
hxxp://wifechart.ru
hxxp://ladyskirt.ru
hxxp://betacourt.ru
hxxp://moviecourt.ru
hxxp://bluecourt.ru
hxxp://actbeast.ru
hxxp://waterfast.ru
hxxp://beachquest.ru
hxxp://passexist.ru
hxxp://rareyou.ru
hxxp://bandrow.ru
hxxp://applewax.ru
hxxp://rockpony.ru
hxxp://feetboy.ru
hxxp://arguebury.ru
hxxp://chairchevy.ru
hxxp://birthsea.com
hxxp://sourcegood.com
hxxp://lamplarsge.com
hxxp://trailhuge.com
hxxp://raintable.com
hxxp://platepeople.com
hxxp://tablebig.com
hxxp://lampbig.com
hxxp://traillong.com
hxxp://whitebirth.com
hxxp://trailbirth.com
hxxp://tabledisk.com
hxxp://lampdissk.com
hxxp://trucktowel.com
hxxp://lamptrail.com
hxxp://trailwarm.com
hxxp://paperwarm.com
hxxp://lampwasrm.com
hxxp://birthocean.com
hxxp://trailocean.com
hxxp://rainopen.com
hxxp://lampfashion.com
hxxp://newsmillion.com
hxxp://trailsummer.com
hxxp://mcusicpaper.com
hxxp://lamppapser.com
hxxp://newssilver.com
hxxp://platedrops.com
hxxp://lampcups.com
hxxp://tablemindss.com
hxxp://tablecupss.com
hxxp://newssweet.com
hxxp://trailbasket.com
hxxp://trailgift.com
hxxp://goldblow.com
hxxp://truckdrow.com
hxxp://roverkey.com
hxxp://protopsite.ru
hxxp://frontstand.com
hxxp://greystand.com
hxxp://ballmind.com
hxxp://mindlarge.com
hxxp://windlarge.com
hxxp://darklarge.com
hxxp://balltable.com
hxxp://listplate.com
hxxp://frontblue.com
hxxp://lightskye.com
hxxp://balllong.com
hxxp://frontlong.com
hxxp://greylong.com
hxxp://largebisg.com
hxxp://greywalk.com
hxxp://minddark.com
hxxp://largedark.com
hxxp://balldisk.com
hxxp://largetrail.com
hxxp://balltrail.com
hxxp://largewarm.com
hxxp://skyewarm.com
hxxp://listlap.com
hxxp://flowlap.com
hxxp://frontstop.com
hxxp://ballsilver.com
hxxp://flowsilver.com
hxxp://jobsilvesr.com
hxxp://fastpads.com
hxxp://jobpeoples.com
hxxp://bluewaris.com
hxxp://joblaps.com
hxxp://listdrops.com
hxxp://flowchairs.com
hxxp://backgrass.com
hxxp://greygrass.com
hxxp://greyfront.com
hxxp://dropslist.com
hxxp://longgrey.com
hxxp://backgrey.com
hxxp://frontgrey.com
hxxp://hatroad.com
hxxp://hatweather.com
hxxp://hatcool.com
hxxp://weatherfloor.com
hxxp://drinkfloor.com
hxxp://hatbrowse.com
hxxp://roadbrowse.com
hxxp://roadinternet.com
hxxp://whiterdes.com
hxxp://hatcools.com
hxxp://hatbrowses.com
hxxp://hatflow.com
hxxp://hatride.com
hxxp://whitefloors.com
hxxp://hatducks.com
hxxp://whitebrwses.com
hxxp://hattables.com
hxxp://hatfloos.com
hxxp://hatdrinks.com
hxxp://blowlight.com
hxxp://longwrite.com
hxxp://bridelamp.com
hxxp://bridelong.com
hxxp://bridefast.com
hxxp://bridebottle.com
hxxp://longletter.com
hxxp://brideword.com
hxxp://bridetowel.com
hxxp://screenchairs.com
hxxp://boxscreens.com
hxxp://screenbirth.com
hxxp://touchcup.com
hxxp://boxboxs.com
hxxp://boxlams.com
hxxp://touchchair.com
hxxp://screencup.com
hxxp://lamptool.com
hxxp://touchbirth.com
hxxp://weathersand.com
hxxp://summerwarms.com
hxxp://summerwall.com
hxxp://weathersummer.com
hxxp://warmruns.com
hxxp://weathercold.com
hxxp://weatherwarm.com
hxxp://warmskye.com
hxxp://weatherskye.com
hxxp://weatheropens.com
hxxp://weatherocean.com
hxxp://weatherrun.com
hxxp://rovercorner.com
hxxp://rangepeople.com
hxxp://rangesand.com
hxxp://rangecorner.com
hxxp://rangespeed.com
hxxp://roverweather.com
hxxp://rangekey.com
hxxp://roverfast.com
hxxp://roverroad.com
hxxp://rangerange.com
hxxp://rovertrack.com
hxxp://rangetunes.com
hxxp://socketpaper.com
hxxp://trailgold.com
hxxp://booksocket.com
hxxp://brushtrail.com
hxxp://brushround.com
hxxp://brushchair.com
hxxp://brushsocket.com
hxxp://brushfast.com
hxxp://socketfast.com
hxxp://tablebrush.com
hxxp://brushpaper.com
hxxp://brushopen.com
hxxp://sockettrail.com
hxxp://socketround.com
hxxp://brushplane.com
hxxp://sourcebrush.com
hxxp://tabletrail.com
hxxp://truckblus.com

We'll continue monitoring the campaign and post updates as soon as new developments take place.
Share:

Featured Security Image

Featured Security Image
The Heart of KOOBFACE. C&C and Social Network Propagation

Featured Cyber Intelligence Service

Featured Cyber Intelligence Service
DDanchev is for Hire!

Featured Cyber Intelligence Project

Featured Cyber Intelligence Project
Project Proposal - Cybercrime Research - Seeking Investment

Featured Threat Intelligence Project

Featured Threat Intelligence Project
Dancho Danchev's Mind Streams of Information Security Knowledge - The World's Most Comprehensive Threats Database

Featured Threat Intelligence Consultancy

Featured Threat Intelligence Consultancy
Threat Intelligence - An Adaptive Approach to Information Security - Free Consultation Available

Featured Hacking Project

Featured Hacking Project
Book Proposal - Seeking Sponsorship - Publisher Contact

Popular Posts

Featured Privacy Service

Featured Privacy Service
Pi-hole Privacy Blocking

Featured Video

Recent Posts

Featured Service

Featured Service
SurfWatch Threat Analyst

Featured Video

Featured Privacy Tool

Featured Privacy Tool
DNSCrypt

Featured Product

Featured Product
Sentinel Visualizer

Unordered List

  • Lorem ipsum dolor sit amet, consectetuer adipiscing elit.
  • Aliquam tincidunt mauris eu risus.
  • Vestibulum auctor dapibus neque.

Featured Privacy Tool

Featured Privacy Tool
OnionShare