Summary
This technical report presents an analysis of WHOIS and DNS records related to international fraud activities. The report outlines the efforts of threat researchers, specifically Dancho Danchev, in identifying indicators of compromise (IoCs) associated with fraudulent campaigns. The research team discovered three unredacted email addresses linked to these activities and expanded the list of IoCs to include 3,751 additional artifacts. Among these, the report details findings such as 75 domains registered with the identified email addresses, nine IP addresses hosting these domains, and 1,811 domains sharing the same IP hosts. The report also highlights the presence of brand names in the domains, indicating potential scams targeting financial services and government institutions. Furthermore, the analysis includes a search for new domains registered since January 2023, revealing 1,856 more artifacts, of which 61 were identified as malicious. The report concludes with a call for further investigation into these findings.
