| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.beerporn .org domain |
rev 1 |
2024-12-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.beerporn .org domain |
rev 1 |
2024-12-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.beerporn .org domain |
rev 1 |
2024-12-28 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.port82 .net domain |
rev 1 |
2024-12-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.port82 .net domain |
rev 1 |
2024-12-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.port82 .net domain |
rev 1 |
2024-12-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.port82 .net domain |
rev 1 |
2024-12-27 |
| suricata |
ET PHISHING Observed Transit Scams Domain in TLS SNI |
rev 1 |
2024-12-26 |
| suricata |
ET PHISHING Transit Scam Domain in DNS Lookup |
rev 1 |
2024-12-26 |
| snort |
ET TROJAN W32/BitCoinMiner.MultiThreat Getblocktemplate Protocol Server Coinbasetxn Begin Mining Response |
rev 3 |
2024-12-24 |
| snort |
ET TROJAN Obfuscated Batch Script Inbound M2 |
rev 3 |
2024-12-24 |
| snort |
ET TROJAN Win32/Unk.Coinminer Checkin |
rev 2 |
2024-12-24 |
| snort |
ET TROJAN W32/BitCoinMiner.MultiThreat Getblocktemplate Protocol Server Connection |
rev 4 |
2024-12-24 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.karsten .com .mx domain |
rev 1 |
2024-12-24 |
| snort |
ET TROJAN Fake FlashPlayer Update Leading to CoinMiner M1 2018-10-12 |
rev 3 |
2024-12-24 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.hitam .id domain |
rev 1 |
2024-12-24 |
| snort |
ET TROJAN W32/BitCoinMiner.MultiThreat Stratum Protocol Mining.Notify Initial Connection Server Response |
rev 2 |
2024-12-24 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.record-point .com .au domain |
rev 1 |
2024-12-24 |
| snort |
ET TROJAN Fake FlashPlayer Update Leading to CoinMiner M2 2018-10-12 |
rev 3 |
2024-12-24 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.record-point .com .au domain |
rev 1 |
2024-12-24 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.karsten .com .mx domain |
rev 1 |
2024-12-24 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.hitam .id domain |
rev 1 |
2024-12-24 |
| snort |
ET TROJAN PrimeCoinMiner.Protominer |
rev 3 |
2024-12-24 |
| snort |
ET TROJAN CoinMiner Malicious Authline Seen After CVE-2017-10271 Exploit |
rev 2 |
2024-12-24 |
| snort |
ET TROJAN W32/BitCoinMiner.MultiThreat Stratum Protocol Mining.Notify Work Server Response |
rev 3 |
2024-12-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.karsten .com .mx domain |
rev 1 |
2024-12-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.record-point .com .au domain |
rev 1 |
2024-12-24 |
| suricata |
ET MALWARE Win32/Unk.Coinminer Checkin |
rev 3 |
2024-12-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.hitam .id domain |
rev 1 |
2024-12-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.record-point .com .au domain |
rev 1 |
2024-12-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.karsten .com .mx domain |
rev 1 |
2024-12-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.hitam .id domain |
rev 1 |
2024-12-24 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.polytama .co .id domain |
rev 1 |
2024-12-23 |
| snort |
ET TROJAN Observed ClickFix Powershell Delivery Page Inbound |
rev 1 |
2024-12-23 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.polytama .co .id domain |
rev 1 |
2024-12-23 |
| suricata |
ET MALWARE Observed ClickFix Powershell Delivery Page Inbound |
rev 1 |
2024-12-23 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.polytama .co .id domain |
rev 1 |
2024-12-23 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.polytama .co .id domain |
rev 1 |
2024-12-23 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.toprank21 .com domain |
rev 1 |
2024-12-20 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.toprank21 .com domain |
rev 1 |
2024-12-20 |