danmartin.ro

[g0d33p3rsec]

Comments

Current host of phishing kit. For more information see: Phishing-Database/phishing#869

Wildcard domain records

danmartin.ro|phishing

Sub-Domain records

Hosts (RFC:952) specific records, not used by DNS RPZ firewalls

Safe Search records

Screenshots

Screenshot, click to expand

Links to related contents

https://danmartin.ro/M003WTZXM2g5STdsNE8=
https://danmartin.ro/M004QTdHOUUwRjNjOU4=
https://danmartin.ro/M004VDNxMFgyZjU2MTk=
https://danmartin.ro/M0E4VjdlOUQ5RThxNzE=
https://danmartin.ro/M0EwZzliMFk0TTZXMG0=
https://danmartin.ro/M0Q4RTJ1MmE0Yjd6N08=
https://danmartin.ro/M0g3UzhyMkYwRjdMNFM=
https://danmartin.ro/M0w4aTgyMTE4MjZuODU=
https://danmartin.ro/M1E4WjdHMlU5djI0OTk=
https://danmartin.ro/M1M4MjZCOTM4MTNzN1k=
https://danmartin.ro/M1Q3djZTM1A5QzdwNGU=
https://danmartin.ro/M1Q4TzhSMW02MDRUOHQ=
https://danmartin.ro/M1U4STdwNGs1cDcyNUM=
https://danmartin.ro/M1k4QjcwNEQ2bDFnMU0=
https://danmartin.ro/M204MDdZNHU2cTFPMUc=
https://danmartin.ro/M204UDhrMnIwbTlsNXQ=
https://danmartin.ro/M244ejJSMVkxYTQ0M3g=
https://danmartin.ro/M2g1WTRpM1Y2eDJVMkc=
https://danmartin.ro/M2k4ZjUzODMweDlIOXU=
https://danmartin.ro/M3E4NjExOHAwazZxN0Q=
https://danmartin.ro/M3M4OThvNHoxSDlNNXg=
https://danmartin.ro/M3c3WTY0MkozazRCMHg=
https://danmartin.ro/M3c4WjdUNGw2YjE1MWw=
https://danmartin.ro/M3g2cjBaM2kyQjNMNG4=
https://danmartin.ro/M3o4ZTdnNHg2TTFRMUo=
https://danmartin.ro/M3o4ejRVNTQ0bTY4N08=
https://danmartin.ro/MzEzdjhxMTM4azVrMlU=
https://danmartin.ro/MzI4eDhiMDA3VjJWNFU=
https://danmartin.ro/MzQ4UTdFNHo2ZzFBMWM=

https://urlscan.io/result/019896a7-ac0f-714c-b29e-a20ddaf3e9a4/
https://urlscan.io/result/019896a7-e017-749d-ba2a-36ddc0b57c54/
https://urlscan.io/result/019896a8-1442-775b-9e81-3a4f3f328e0f/
https://urlscan.io/result/019896a8-46f0-72c8-97a2-77234f9b245b/
https://urlscan.io/result/019896a8-7a8a-744e-8aff-6ab87b9f1c8e/
https://urlscan.io/result/019896a8-b2bd-70fc-8d3c-8e72e17344e9/
https://urlscan.io/result/019896a8-e6e0-76d9-812e-84313ac7b8b1/
https://urlscan.io/result/019896a9-1bbc-7150-bbc8-d9060ae066ce/
https://urlscan.io/result/019896a9-4e4b-737d-af98-4eaa31188e9a/
https://urlscan.io/result/019896a9-818c-743e-8e02-ee1d70771b86/
https://urlscan.io/result/019896a9-bc44-73cc-b7f1-f48e4ce83ddf/
https://urlscan.io/result/019896a9-f049-72c7-ac51-c0609fe9d39e/
https://urlscan.io/result/019896aa-23dc-77dc-b919-8de59714d196/
https://urlscan.io/result/019896aa-57b4-728d-9c9b-e060e35c7a45/
https://urlscan.io/result/019896aa-8b7e-7663-aac1-155df1629547/
https://urlscan.io/result/019896aa-c011-7435-a954-e0d179aa3686/
https://urlscan.io/result/019896aa-f48b-7759-aa19-bd1f6f2a602d/
https://urlscan.io/result/019896ab-28ee-7090-aca4-efe2e05dafc7/
https://urlscan.io/result/019896ab-5d45-72e9-bff8-e848eddba818/
https://urlscan.io/result/019896ab-9238-75d9-a55d-7495da09c747/
https://urlscan.io/result/019896ab-c504-75a9-be34-c64cc67bd395/
https://urlscan.io/result/019896ab-f92e-74c0-9bbd-5976040dbfad/
https://urlscan.io/result/019896ac-2d78-71c8-9ec2-1adcda86fe04/
https://urlscan.io/result/019896ac-61a5-778c-8ffd-aca2f029a21b/
https://urlscan.io/result/019896ac-95e9-736d-94bc-f7afaed48fb6/
https://urlscan.io/result/019896ac-ca42-725b-ab13-793cd1c08c4f/
https://urlscan.io/result/019896ac-feab-72d8-9e99-eb3acd19bf44/
https://urlscan.io/result/019896ad-32bb-7052-a50c-9d8cc08b0da1/
https://urlscan.io/result/019896ad-6593-72ac-bccd-b0d20fc3de38/

Name servers

dns2.host-vision.com.
dns3.host-vision.com.
dns1.host-vision.com.

logs from uBlock Origin

N/A

[spirillen]

Are these domains – together with the other phishing URLs you mentioned – still worth submitting? I’m getting 404 responses for the links you provided (I can see again 👀 , albeit not at full strength, but I'm definitely on the right track).

[g0d33p3rsec]

I wouldn't worry about them; they tend to be ephemeral. I've started adding the domains from this activity group to the temp list instead of adding them permanently to the phishing database, to hopefully avoid future false positives. The same is also true of the smishing triad-related indicators that I sometimes track. The algorithmically generated domain names are usually rotated daily, and the IPs are typically abandoned once enough vendors begin to flag them.

I can see again 👀 , albeit not at full strength, but I'm definitely on the right track

That's excellent news, I'm glad to hear you're on the mend. Hopefully, the trend continues into the new year.

Now if I could just find about another 48 hours in the day.