{"id":7661,"date":"2022-04-08T13:14:26","date_gmt":"2022-04-08T20:14:26","guid":{"rendered":"https:\/\/blogs.infoblox.com\/?p=7661"},"modified":"2024-04-26T13:20:05","modified_gmt":"2024-04-26T20:20:05","slug":"the-smish-is-coming-from-inside-the-house","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/the-smish-is-coming-from-inside-the-house\/","title":{"rendered":"The Smish is Coming from Inside the House"},"content":{"rendered":"

Author: Nick Sundvall and Vadym Tymchenko<\/strong><\/h3>\n

 <\/p>\n

1. Executive summary<\/h3>\n

A new technique for bypassing mobile spam filters and distributing malicious content was recently observed in text messages received by a number of users. Where mobile phishing often includes a fake sender phone number, these malicious messages appear to come from the victims themselves. The messages include a link that, if clicked on, enables threat actors to steal victims\u2019 information. We analyzed one campaign in depth and uncovered a large infrastructure and a complex pattern of redirection to overcome automated security filtering. Operations of this size require significant planning but allow the actors to profit even when only a small number of users fall victim to the lures.<\/p>\n

In this report, we will step through a case study of a malicious text message, an analysis of the domain names, and an overview of the threat actor\u2019s redirection infrastructure, including what we will refer to as the front-end domains, campaign broker domains, clickbait pages\/domains, and final landing pages\/domains.<\/p>\n

2. Smishing Background<\/h3>\n

Smishing is the combination of the terms \u201cphishing\u201d and \u201cSMS\u201d (short message service, also known as text messages). Smishing messages are sent by bad actors to get victims to reveal private information, including passwords, identity, and financial data. The messages typically include some incentive for the recipient to click a link, which may be for a site that hosts malware or a page that attempts to convince the user to submit data through a form.<\/p>\n

Actors have regularly used spoofed sender numbers in the text messages to evade spam filters. However, those messages that are not automatically detected by the mobile provider can be stopped by blocking the sender\u2019s phone number. In response, threat actors continue to evolve their own techniques. In a well-known version of mobile phone spoofing, a recipient receives a text or phone call from someone who appears to be in the area close to the recipient. Users are hesitant to block local phone numbers for fear it would also block legitimate phone calls and messages.<\/p>\n

Spoofing the recipient’s phone number is another advance by actors to overcome spam filtering and blocking, and to convince users to click on the embedded links.<\/p>\n

3. Case Study<\/h3>\n

On March 29 and 30, we observed multiple smishing texts from one campaign, and we will analyze the details on one of the messages, as a case study, below. All of the messages we saw in this campaign began with the same content; the only part that changed was the URL. The text we will discuss is shown in Figure 1 below.
\nFigure 1. Case study message; the full URL is redacted because it may uniquely identify the recipient
\n\"\"<\/p>\n

The link in Figure 1 above used the domain oifc21[.]xyz, but we saw a variety of domains used. We will call the domains in the text messages the \u201cfront-end domains\u201d. We saw these domains use only the top-level domain (TLD) .xyz. When we clicked on the link, it did not lead us to oifc21[.]xyz; instead, multiple redirects occurred before a final landing page was presented. In this instance, we were redirected to goodasgold[.]shop, then takeoneforlove[.]com, and then eshatl[.]xyz, which presented a fake Verizon survey page. After completing the survey, a message appeared that thanked us \u201cfor being a great customer\u201d and asked us to click the displayed button to claim a new Apple Watch.<\/p>\n

Figure 2. Example of one of the faked survey questions
\nFake Verizon survey
\n\"\"<\/p>\n

The threat actors tried to imbue their content with a sense of urgency; this is a common tactic used to pressure victims into complying with the scam. After we completed the survey, the webpage warned: \u201cif you leave this page without claiming your reward, we have no choice but to give another loyal customer\u201d. Clicking the button again redirected us to a new website, smartfashiondaily[.]com, where the actors asked us to pay $6.85 for \u201cShipping & Handling\u201d. The actors also asked for our name, email address, phone number, mailing address, and credit card information.<\/p>\n

Figure 3. Fake checkout page
\n\"\"<\/p>\n

After providing the information, we were told that our credit card number was not valid.
\nFigure 4. The message shown after we submitted shipping and credit card details
\n\"\"<\/p>\n

4 Campaign Study<\/h3>\n

a. Campaigns<\/strong><\/p>\n

Our analysis shows that the same actor carried out at least two campaigns in March:<\/p>\n

    \n
  • The first took place between 6 and 8 March. We call it the CDC campaign because the requests that did not pass the actor\u2019s validations were redirected to cdc[.]gov.<\/li>\n
  • The second took place between 26 and 31 March; it appears that the campaign may have stopped after less than a week, because no activity has been observed after March 31. We call it the 1TV campaign because the requests that did not pass the actor\u2019s validations were redirected to 1tv[.]ru or 1tv[.]com.<\/li>\n<\/ul>\n

     <\/p>\n

    Both campaigns share the same set of domain names registered on 6 March.<\/p>\n

    b. Domain Names<\/strong><\/p>\n

    From several examples, we have noticed that the domains used in the SMS messages have a distinct pattern: four or five alphabetical characters followed by one or two digits, all in the TLD .xyz. This allowed us to create a simple regex and apply it to data for March and the start of April.<\/p>\n

    Figure 5. Domain creation and update activity
    \n\"\"<\/p>\n

    The activity histogram shows when the domains associated with this campaign were registered (\u201ccreated\u201d) and\/or updated. All of the domains we believe to be associated with the campaign have the following characteristics:<\/p>\n

      \n
    • All the domains were registered between 5 and 10 March.<\/li>\n
    • Their names follow the regex pattern ^[a-z]{4,5}[0-9]{1,2}.xyz.<\/li>\n
    • The numeric components of their names use consecutive numbers.<\/li>\n
    • Their registrar is Hosting Concepts.<\/li>\n
    • They use CloudFlare for their name servers and hosting.<\/li>\n<\/ul>\n

      There were several groups of domains registered in March. Most of the domain names followed a pattern of 4 or 5 alphabetic characters followed by a sequential number within the group.<\/p>\n

      c. Observed Activity<\/strong><\/p>\n

      Figure 6 below shows activity related to the domains associated with this campaign. We can see a small amount of activity from 5 to 8 March, and then a much greater spike between 26 and 31 March. This second, larger spike is associated with the smishing campaign that our case study above came from.<\/p>\n

      Figure 6. Observed activity from 1 March to 2 April
      \n\"\"<\/p>\n

      Figure 7. Sample of dates and smishing campaign URLs
      \n\"\"<\/p>\n

      5. Campaign Generalization<\/h3>\n

      The structure and activity we observed in the two campaigns described in this paper match that of several older smishing campaigns that we have analyzed. The domains used in the redirect patterns all appear to share similar naming conventions and other properties. A deep study of both older and these more recent campaigns show that they have similar structures of redirect requests and groups of domains used for very specific purposes. The diagram below illustrates the flow of requests and redirects between domains in the infrastructure and the assumed functionality of each layer. We think this is a valid model of infrastructure that, with variations, is likely used by multiple threat actors.<\/p>\n

      Figure 8. Smishing campaigns\u2019 redirection layers and activity
      \n\"\"<\/p>\n

      Analyzing the redirect structure showed that it consists of at least 4 layers, all with clearly identifiable purposes. Note that there are some minor differences between the 1TV and CDC campaigns, which we will identify below.<\/p>\n

        \n
      • Front-end URL:\n
          \n
        • The domain in the smishing URL typically has a short lifespan because it is the most exposed component of the campaign and thus the most easily identified and blocked by security providers. In most of the previous campaigns, threat actors used the domain within a few hours after registering it. In the 1TV campaign, however, the front-end domains were \u201caged\u201d for about two weeks before the threat actor put them to use. This aging approach allows the actor to bypass the security provider\u2019s attempts to block threats based on newly registered domains.<\/li>\n
        • The URL provided in the SMS provides unique identification of the user. The front-end code seems to have very limited functionality checking if the request has not expired (we observed some links expiring in under 2 days). The link will not work with any other domain associated with the campaign, probably due to redirect conditions coded in the web server\u2019s configuration.<\/li>\n
        • In most cases, the front-end URL is accessed by HTTP protocol. This is likely due to the throw-away nature of the front-end domains. Redirects from these domains to subsequent layers are always encrypted with HTTPS.<\/li>\n
        • In some cases, we observed the front-end domain perform additional validation of incoming requests, such as user-agent string comparison. If a user-agent string does not match the targeted device, it redirects to a \u201csafe\u201d domain, in our case 1tv[.]ru or 1tv[.]com.<\/li>\n<\/ul>\n<\/li>\n
        • Redirect domain (campaign broker):\n
            \n
          • This domain receives the HTTPS request redirected from the front-end domain. The request contains the victim identifier (in many cases the phone number), mobile provider, campaign name, and other information.<\/li>\n
          • The redirect domain verifies the user-agent header; if any mismatches are found, the domain redirects the victim to the \u201csafe\u201d domain.<\/li>\n
          • There may be several redirect domains in the chain.<\/li>\n
          • There is often a call to a click-tracking site, for statistics-collection purposes.<\/li>\n
          • After all the checks are successfully passed, the user is redirected to a clickbait page that matches the content of the SMS message.<\/li>\n
          • Threat actors typically keep their redirect domains active much longer than their front-end domains because users never see them. We have seen redirect domains live for over a year and serve several campaigns.<\/li>\n<\/ul>\n<\/li>\n
          • Clickbait domain or page:\n
              \n
            • Our understanding of the purpose of this layer is that it introduces an interaction point that prevents automated URL-tracing tools from reaching the final phishing site. We have seen several variations of this layer; typically, it is a button that when clicked, takes a user to a \u201csurvey\u201d site. In other cases, it is a simple single-click page that takes the user directly to the final phishing page.<\/li>\n
            • In many cases, the clickbait domain is short-lived due to its relatively high visibility.<\/li>\n<\/ul>\n<\/li>\n
            • Landing page (phishing site): this is the final phishing site that requests credit card information or other sensitive data.<\/li>\n<\/ul>\n

              6. Prevention and Mitigation<\/h3>\n

              Smishing messages are a common method for sending phishing links. Infoblox recommends the following precautions for avoiding smishing attacks:<\/p>\n

                \n
              • Always be suspicious of unexpected text messages, especially those that appear to contain financial or delivery correspondences, documents, or links.<\/li>\n
              • Never click URLs in text messages from unknown sources. In the campaign under discussion, the source was the recipient, who did not send the message, and that is a red flag.<\/li>\n<\/ul>\n

                7. Conclusion<\/h3>\n

                In this campaign, threat actors sent spam SMS messages to Verizon Wireless customers. The messages contained malicious links and appeared to have come from the recipients themselves. The links led to fake survey pages where the victims were asked to submit their personal and financial information, which ended up in the hands of the threat actors.
                \nThe actors redirected victims through a series of domains to avoid analysis and detection. We have observed multiple campaigns that used this kind of technique in the past; it makes it particularly challenging for researchers to analyze the malicious URLs. Our analysis of the URL data enabled us to discover additional domains used by the actors.<\/p>\n

                8. Indicators of compromise<\/h3>\n

                For a downloadable list of our IOCs on this topic, see the cta_indicators folder of our GitHub repository infobloxopen:threat-intelligence.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
                Indicator<\/strong><\/td>\nRegistration Date<\/strong><\/td>\nProperties<\/strong><\/td>\nDescription<\/strong><\/td>\n<\/tr>\n
                smsw1[.]xyz<\/p>\n

                mfso1[.]xyz<\/p>\n

                pely2[.]xyz<\/p>\n

                wtwx2[.]xyz<\/p>\n

                khed3[.]xyz<\/p>\n

                mgdi3[.]xyz<\/p>\n

                laea4[.]xyz<\/p>\n

                omyq4[.]xyz<\/p>\n

                qyef5[.]xyz<\/p>\n

                idvk5[.]xyz<\/p>\n

                dqvy6[.]xyz<\/p>\n

                dnmc6[.]xyz<\/p>\n

                igtf7[.]xyz<\/p>\n

                kiwv7[.]xyz<\/p>\n

                jjao8[.]xyz<\/p>\n

                kvde8[.]xyz<\/p>\n

                okil9[.]xyz<\/p>\n

                harn9[.]xyz<\/p>\n

                nill10[.]xyz<\/p>\n

                ulht10[.]xyz<\/p>\n

                nijf11[.]xyz<\/p>\n

                qgjt11[.]xyz<\/p>\n

                hcip12[.]xyz<\/p>\n

                jcal12[.]xyz<\/p>\n

                rezb13[.]xyz<\/p>\n

                tslz13[.]xyz<\/p>\n

                hlns14[.]xyz<\/p>\n

                izhm14[.]xyz<\/p>\n

                bgfv15[.]xyz<\/p>\n

                jbeq15[.]xyz<\/p>\n

                mbdq16[.]xyz<\/p>\n

                acgv16[.]xyz<\/p>\n

                nkeh17[.]xyz<\/p>\n

                wzae17[.]xyz<\/p>\n

                rtpe18[.]xyz<\/p>\n

                yhan18[.]xyz<\/p>\n

                yamn19[.]xyz<\/p>\n

                sjwf19[.]xyz<\/p>\n

                zdip20[.]xyz<\/p>\n

                culs20[.]xyz<\/p>\n

                ezks21[.]xyz<\/p>\n

                ysfz21[.]xyz<\/p>\n

                cmrc22[.]xyz<\/p>\n

                vuau22[.]xyz<\/p>\n

                jqiz23[.]xyz<\/p>\n

                hadq23[.]xyz<\/p>\n

                ixyv24[.]xyz<\/p>\n

                lhkp24[.]xyz<\/p>\n

                hpfd25[.]xyz<\/p>\n

                vjhk25[.]xyz<\/p>\n

                uyqb26[.]xyz<\/p>\n

                chkn26[.]xyz<\/p>\n

                aust27[.]xyz<\/p>\n

                ltsg27[.]xyz<\/p>\n

                lcsh28[.]xyz<\/p>\n

                aqfo28[.]xyz<\/p>\n

                erae29[.]xyz<\/p>\n

                mgjg29[.]xyz<\/p>\n

                ithn30[.]xyz<\/p>\n

                qinh30[.]xyz<\/p>\n

                mszp31[.]xyz<\/p>\n

                pomz31[.]xyz<\/p>\n

                ciww32[.]xyz<\/p>\n

                nooa32[.]xyz<\/p>\n

                mvfe33[.]xyz<\/p>\n

                zmtt33[.]xyz<\/p>\n

                jzwc34[.]xyz<\/p>\n

                ktfu34[.]xyz<\/p>\n

                opdb35[.]xyz<\/p>\n

                rrhn35[.]xyz<\/p>\n

                gptp36[.]xyz<\/p>\n

                dtus36[.]xyz<\/p>\n

                qjag37[.]xyz<\/p>\n

                swbt37[.]xyz<\/p>\n

                upah38[.]xyz<\/p>\n

                ixbc38[.]xyz<\/p>\n

                qfac39[.]xyz<\/p>\n

                xifj39[.]xyz<\/p>\n

                aped40[.]xyz<\/p>\n

                jaig40[.]xyz<\/p>\n

                ckex41[.]xyz<\/p>\n

                wgrp41[.]xyz<\/p>\n

                hegz42[.]xyz<\/p>\n

                ciuu42[.]xyz<\/p>\n

                lawn43[.]xyz<\/p>\n

                zoqw43[.]xyz<\/p>\n

                zcyj44[.]xyz<\/p>\n

                qbas44[.]xyz<\/p>\n

                usha45[.]xyz<\/p>\n

                zvlg45[.]xyz<\/p>\n

                zlxg46[.]xyz<\/p>\n

                qhrq46[.]xyz<\/p>\n

                fuir47[.]xyz<\/p>\n

                ixsf47[.]xyz<\/p>\n

                vtpf48[.]xyz<\/p>\n

                ejia48[.]xyz<\/p>\n

                pvut49[.]xyz<\/p>\n

                sgqz49[.]xyz<\/p>\n

                glju50[.]xyz<\/p>\n

                zmxu50[.]xyz<\/td>\n

                		5 March 2022<\/td>\n100 domains<\/strong><\/p>\n

                \u00a0<\/strong><\/p>\n

                Registrar<\/strong>: Hosting Concepts<\/p>\n

                \u00a0<\/strong><\/p>\n

                NS<\/strong>: *.ns.cloudflare.com<\/p>\n

                \u00a0<\/strong><\/p>\n

                Pattern<\/strong>: ^[a-z]{4}[0-9]{1,2}.xyz<\/p>\n

                 <\/p>\n

                Numeric part<\/strong>: Sequence of numbers from 1 through 50, each number used twice<\/td>\n

                		Front-end domains from SMS<\/p>\n

                 <\/p>\n

                It was observed in two campaigns: a small CDC-associated campaign on 2022-03-06, and one large 1TV campaign on\u00a0 2022-03-26<\/td>\n<\/tr>\n

                hggq1[.]xyz<\/p>\n

                wkcq2[.]xyz<\/p>\n

                vfar3[.]xyz<\/p>\n

                svgd4[.]xyz<\/p>\n

                fgoy5[.]xyz<\/p>\n

                gvhj6[.]xyz<\/p>\n

                bepf7[.]xyz<\/p>\n

                vkri8[.]xyz<\/p>\n

                eknz9[.]xyz<\/p>\n

                mslx10[.]xyz<\/p>\n

                dfys11[.]xyz<\/p>\n

                djzy12[.]xyz<\/p>\n

                gytr13[.]xyz<\/p>\n

                qhdd14[.]xyz<\/p>\n

                sbqs15[.]xyz<\/p>\n

                pmlx16[.]xyz<\/p>\n

                iphk17[.]xyz<\/p>\n

                opqk18[.]xyz<\/p>\n

                ntfr19[.]xyz<\/p>\n

                cvwm20[.]xyz<\/td>\n

                		6 March 2022<\/td>\n20 domains<\/strong><\/p>\n

                \u00a0<\/strong><\/p>\n

                Registrar<\/strong>: Hosting Concepts<\/p>\n

                 <\/p>\n

                NS<\/strong>: *.ns.cloudflare.com<\/p>\n

                \u00a0<\/strong><\/p>\n

                Pattern<\/strong>: ^[a-z]{4}[0-9]{1,2}.xyz<\/p>\n

                 <\/p>\n

                Numeric part<\/strong>: Sequence of numbers from 1 through 20<\/td>\n

                		Front-end domains from SMS<\/p>\n

                 <\/p>\n

                Observed in the 1TV campaign on\u00a0 2022-03-26<\/td>\n<\/tr>\n

                wtmz1[.]xyz<\/p>\n

                xwjv1[.]xyz<\/p>\n

                nyxk2[.]xyz<\/p>\n

                pwnx2[.]xyz<\/p>\n

                dbmy3[.]xyz<\/p>\n

                nvso4[.]xyz<\/p>\n

                vooy4[.]xyz<\/p>\n

                hzkr5[.]xyz*<\/p>\n

                gddr6[.]xyz<\/p>\n

                hhjx7[.]xyz<\/p>\n

                shcw7[.]xyz<\/p>\n

                oxwe8[.]xyz<\/p>\n

                rpws8[.]xyz<\/p>\n

                aqsz9[.]xyz<\/p>\n

                ijph9[.]xyz<\/p>\n

                sqyc10[.]xyz<\/p>\n

                wszd10[.]xyz<\/p>\n

                cegs11[.]xyz<\/p>\n

                odkp11[.]xyz<\/p>\n

                gshu12[.]xyz<\/p>\n

                tfll12[.]xyz<\/p>\n

                dysj13[.]xyz<\/p>\n

                tbsb13[.]xyz<\/p>\n

                ccpt14[.]xyz<\/p>\n

                oyfn14[.]xyz<\/p>\n

                fgvz15[.]xyz<\/p>\n

                hquu15[.]xyz<\/p>\n

                jenh16[.]xyz<\/p>\n

                nrfe16[.]xyz<\/p>\n

                fjow17[.]xyz<\/p>\n

                flgk17[.]xyz<\/p>\n

                anwa18[.]xyz<\/p>\n

                dtxp18[.]xyz<\/p>\n

                inen19[.]xyz<\/p>\n

                ozhn19[.]xyz<\/p>\n

                avyc20[.]xyz<\/p>\n

                oifc21[.]xyz*<\/p>\n

                ukuu21[.]xyz<\/p>\n

                dcdh22[.]xyz<\/p>\n

                htur22[.]xyz<\/p>\n

                ohmv23[.]xyz<\/p>\n

                qflr24[.]xyz<\/p>\n

                xnrh24[.]xyz<\/p>\n

                snqu25[.]xyz<\/p>\n

                hklk26[.]xyz<\/p>\n

                vqsr26[.]xyz<\/p>\n

                ahct27[.]xyz<\/p>\n

                umlp27[.]xyz<\/p>\n

                kdvi28[.]xyz<\/p>\n

                xuuv28[.]xyz<\/p>\n

                lefx29[.]xyz<\/p>\n

                atsk30[.]xyz<\/p>\n

                vflu31[.]xyz<\/p>\n

                zhnv32[.]xyz<\/p>\n

                xdhh33[.]xyz<\/p>\n

                refp34[.]xyz<\/p>\n

                rczt35[.]xyz<\/p>\n

                gxkk36[.]xyz<\/p>\n

                gmec37[.]xyz<\/p>\n

                ahur38[.]xyz<\/p>\n

                asqb39[.]xyz<\/p>\n

                bjas40[.]xyz<\/p>\n

                jnmj41[.]xyz<\/p>\n

                mfis42[.]xyz<\/p>\n

                tyer43[.]xyz<\/p>\n

                spmu44[.]xyz<\/p>\n

                bxqi45[.]xyz<\/p>\n

                islf46[.]xyz<\/p>\n

                gjdl47[.]xyz<\/p>\n

                ztib48[.]xyz<\/p>\n

                ytqk49[.]xyz<\/p>\n

                cepf50[.]xyz<\/p>\n

                kcap51[.]xyz<\/p>\n

                dfeo52[.]xyz<\/p>\n

                lcrn53[.]xyz<\/p>\n

                tgav54[.]xyz<\/p>\n

                sctn56[.]xyz<\/p>\n

                cfzb57[.]xyz<\/p>\n

                lpdl60[.]xyz<\/p>\n

                bikm61[.]xyz<\/p>\n

                doif62[.]xyz<\/p>\n

                ovel63[.]xyz<\/p>\n

                bkhr64[.]xyz<\/p>\n

                vhjp65[.]xyz<\/p>\n

                guxv66[.]xyz<\/p>\n

                qgud67[.]xyz<\/p>\n

                ngkl68[.]xyz<\/p>\n

                wfug69[.]xyz<\/p>\n

                rhlw70[.]xyz<\/td>\n

                		8 March 2022<\/td>\n89 domains<\/strong><\/p>\n

                \u00a0<\/strong><\/p>\n

                Registrar<\/strong>: Hosting Concepts<\/p>\n

                \u00a0<\/strong><\/p>\n

                NS<\/strong>: *.ns.cloudflare.com<\/p>\n

                \u00a0<\/strong><\/p>\n

                Pattern<\/strong>: ^[a-z]{4}[0-9]{1,2}.xyz<\/p>\n

                 <\/p>\n

                Numeric part<\/strong>: Sequence of numbers from 1 through 70, with a few gaps. Some numbers from 1 through 28 were reused twice.<\/td>\n

                		Front-end domains from SMS<\/p>\n

                 <\/p>\n

                Observed in the 1TV campaign on 2022-03-26<\/td>\n<\/tr>\n

                eaiys1[.]xyz<\/p>\n

                upxut2[.]xyz<\/p>\n

                obkom3[.]xyz<\/p>\n

                bsqnt4[.]xyz<\/p>\n

                rninf5[.]xyz<\/p>\n

                lrcoq6[.]xyz<\/p>\n

                hacpg7[.]xyz<\/p>\n

                dfooh8[.]xyz<\/p>\n

                slsvv9[.]xyz<\/p>\n

                eiwku10[.]xyz<\/p>\n

                tuafv11[.]xyz<\/p>\n

                pvtcb12[.]xyz<\/p>\n

                aekse13[.]xyz<\/p>\n

                sbbwr14[.]xyz<\/p>\n

                iiddf15[.]xyz<\/p>\n

                nqldt16[.]xyz<\/p>\n

                ceewi17[.]xyz<\/p>\n

                uzzau18[.]xyz<\/p>\n

                vnaeg19[.]xyz<\/p>\n

                bpdmk20[.]xyz<\/p>\n

                dyzhu21[.]xyz<\/p>\n

                yhqxk22[.]xyz<\/p>\n

                ebtxe23[.]xyz<\/p>\n

                lutod24[.]xyz<\/p>\n

                fxzzc25[.]xyz<\/p>\n

                rjebg26[.]xyz<\/p>\n

                ibjme27[.]xyz<\/p>\n

                svjem28[.]xyz<\/p>\n

                jbbsg29[.]xyz<\/p>\n

                qodmu30[.]xyz<\/p>\n

                yyaad31[.]xyz<\/p>\n

                plzjc32[.]xyz<\/p>\n

                velfu33[.]xyz*<\/p>\n

                kxyps34[.]xyz<\/p>\n

                cnwfz35[.]xyz<\/p>\n

                zhgsb36[.]xyz<\/p>\n

                bypmz37[.]xyz<\/p>\n

                xnqno38[.]xyz<\/p>\n

                ccpxd39[.]xyz<\/p>\n

                qsbhi40[.]xyz<\/p>\n

                qhacw41[.]xyz<\/p>\n

                iwbxe42[.]xyz<\/p>\n

                snqwr43[.]xyz<\/p>\n

                gxrgf44[.]xyz<\/p>\n

                jfbku45[.]xyz<\/p>\n

                einsj46[.]xyz*<\/p>\n

                sirdt47[.]xyz<\/p>\n

                gcfed48[.]xyz*<\/p>\n

                hnxxd49[.]xyz<\/p>\n

                jpjhz50[.]xyz<\/td>\n

                		8 March 2022<\/td>\n50 domains<\/strong><\/p>\n

                \u00a0<\/strong><\/p>\n

                Registrar<\/strong>: Hosting Concepts<\/p>\n

                 <\/p>\n

                NS<\/strong>: *.ns.cloudflare.com<\/p>\n

                \u00a0<\/strong><\/p>\n

                Pattern<\/strong>: ^[a-z]{5}[0-9]{1,2}.xyz<\/p>\n

                 <\/p>\n

                Numeric part<\/strong>: Sequence of numbers from 1 through 50<\/td>\n

                		Front-end domain from SMS<\/p>\n

                 <\/p>\n

                Observed in the 1TV campaign on 26 March<\/td>\n<\/tr>\n

                pycrm2[.]xyz<\/td>\n10 March 2022<\/td>\nSingle domain matching common pattern<\/p>\n

                Registrar: Hosting Concepts<\/p>\n

                NS: *.ns.cloudflare.com<\/p>\n

                Pattern: ^[a-z]{5}[0-9]{1,2}.xyz<\/p>\n

                Numeric pattern: only number 2<\/td>\n

                		Front-end domain from SMS<\/td>\n<\/tr>\n
                easyechoes[.]com<\/p>\n

                 <\/p>\n

                 <\/td>\n

                		18 February 2022<\/p>\n

                 <\/td>\n

                		Registrar:Hosting Concepts<\/p>\n

                NS: ns1.openprovider.nl<\/p>\n

                NS: ns2.openprovider.be<\/p>\n

                NS: ns3.openprovider.eu<\/td>\n

                		Middle-layer domain (campaign-broker \/ redirector)<\/td>\n<\/tr>\n
                flagshipsteak[.]com<\/td>\n5 March 2022<\/td>\nRegistrar:Hosting Concepts<\/p>\n

                NS: ns1.openprovider.nl<\/p>\n

                NS: ns2.openprovider.be<\/p>\n

                NS: ns3.openprovider.eu<\/td>\n

                		Middle-layer domain (campaign-broker \/ redirector)<\/td>\n<\/tr>\n
                glittersisgold[.]com<\/p>\n

                 <\/p>\n

                 <\/p>\n

                 <\/td>\n

                		26 March 2022<\/p>\n

                 <\/p>\n

                 <\/td>\n

                		Registrar:Hosting Concepts<\/p>\n

                NS: ns1.openprovider.nl<\/p>\n

                NS: ns2.openprovider.be<\/p>\n

                NS: ns3.openprovider.eu<\/td>\n

                		Middle-layer domain (campaign-broker \/ redirector)<\/td>\n<\/tr>\n
                goodasgold[.]shop<\/td>\n29 January 2022<\/td>\nRegistrar: NAMECHEAP INC<\/p>\n

                NS: dns1.registrar-servers.com<\/p>\n

                NS: dns2.registrar-servers.com<\/td>\n

                		Middle-layer domain (campaign-broker \/ redirector)<\/td>\n<\/tr>\n
                takeoneforlove[.]com<\/td>\n11 March 2022<\/td>\nRegistrar: Hosting Concepts<\/p>\n

                NS: pam.ns.cloudflare.com<\/p>\n

                NS: patrick.ns.cloudflare.com<\/td>\n

                		Middle-layer domain (campaign-broker \/ redirector)<\/td>\n<\/tr>\n
                u30487[.]xyz<\/td>\n28 February 2022<\/td>\nRegistrar: Hosting Concepts<\/p>\n

                NS: linda.ns.cloudflare.com<\/p>\n

                NS: rocky.ns.cloudflare.com<\/td>\n

                		Landing domain (clickbait page)<\/td>\n<\/tr>\n
                eshatl[.]xyz<\/p>\n

                 <\/td>\n

                		28 February 2022<\/td>\nRegistrar: Hosting Concepts<\/p>\n

                NS: linda.ns.cloudflare.com<\/p>\n

                NS: rocky.ns.cloudflare.com<\/td>\n

                		Final landing domain<\/td>\n<\/tr>\n
                smartfashiondaily[.]com<\/td>\n17 September 2021<\/td>\nRegistrar: NAMECHEAP INC<\/p>\n

                NS: arnold.ns.cloudflare.com<\/p>\n

                NS: maeve.ns.cloudflare.com<\/td>\n

                		Final landing domain<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

                * domains observed in malicious SMS<\/p>\n","protected":false},"excerpt":{"rendered":"

                Author: Nick Sundvall and Vadym Tymchenko   1. Executive summary A new technique for bypassing mobile spam filters and distributing malicious content was recently observed in text messages received by a number of users. Where mobile phishing often includes a fake sender phone number, these malicious messages appear to come from the victims themselves. The […]<\/p>\n","protected":false},"author":397,"featured_media":6722,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[554],"tags":[658,657,360],"class_list":{"0":"post-7661","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-cyber-threat-advisory","8":"tag-cyber-threat-advisory","9":"tag-cyber-threat-intelligence","10":"tag-dns-security","11":"entry"},"acf":[],"yoast_head":"\nSmishing Attacks From Spoofed Senders | Infoblox<\/title>\n<meta name=\"description\" content=\"This report analyzes the new smishing technique and the multiple redirect layers involved in the attack.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/the-smish-is-coming-from-inside-the-house\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The Smish is Coming from Inside the House\" \/>\n<meta property=\"og:description\" content=\"This report analyzes the new smishing technique and the multiple redirect layers involved in the attack.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/the-smish-is-coming-from-inside-the-house\/\" \/>\n<meta property=\"og:site_name\" content=\"Infoblox Blog\" \/>\n<meta property=\"article:published_time\" content=\"2022-04-08T20:14:26+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-04-26T20:20:05+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/ciu-image-33.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"612\" \/>\n\t<meta property=\"og:image:height\" content=\"408\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Infoblox Threat Intel\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Infoblox Threat Intel\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/threat-intelligence\\\/cyber-threat-advisory\\\/the-smish-is-coming-from-inside-the-house\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/threat-intelligence\\\/cyber-threat-advisory\\\/the-smish-is-coming-from-inside-the-house\\\/\"},\"author\":{\"name\":\"Infoblox Threat Intel\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/person\\\/b6aed8965e3298a0817c16d32c0a67ae\"},\"headline\":\"The Smish is Coming from Inside the House\",\"datePublished\":\"2022-04-08T20:14:26+00:00\",\"dateModified\":\"2024-04-26T20:20:05+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/threat-intelligence\\\/cyber-threat-advisory\\\/the-smish-is-coming-from-inside-the-house\\\/\"},\"wordCount\":2782,\"publisher\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/threat-intelligence\\\/cyber-threat-advisory\\\/the-smish-is-coming-from-inside-the-house\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/ciu-image-33.jpg\",\"keywords\":[\"Cyber Threat Advisory\",\"Cyber Threat Intelligence\",\"DNS Security\"],\"articleSection\":[\"Cyber Threat Advisory\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/threat-intelligence\\\/cyber-threat-advisory\\\/the-smish-is-coming-from-inside-the-house\\\/\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/threat-intelligence\\\/cyber-threat-advisory\\\/the-smish-is-coming-from-inside-the-house\\\/\",\"name\":\"Smishing Attacks From Spoofed Senders | Infoblox\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/threat-intelligence\\\/cyber-threat-advisory\\\/the-smish-is-coming-from-inside-the-house\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/threat-intelligence\\\/cyber-threat-advisory\\\/the-smish-is-coming-from-inside-the-house\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/ciu-image-33.jpg\",\"datePublished\":\"2022-04-08T20:14:26+00:00\",\"dateModified\":\"2024-04-26T20:20:05+00:00\",\"description\":\"This report analyzes the new smishing technique and the multiple redirect layers involved in the attack.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/threat-intelligence\\\/cyber-threat-advisory\\\/the-smish-is-coming-from-inside-the-house\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/threat-intelligence\\\/cyber-threat-advisory\\\/the-smish-is-coming-from-inside-the-house\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/threat-intelligence\\\/cyber-threat-advisory\\\/the-smish-is-coming-from-inside-the-house\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/ciu-image-33.jpg\",\"contentUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/ciu-image-33.jpg\",\"width\":612,\"height\":408,\"caption\":\"Big data and hacking concept. Back view of hacker at desktop using creative digital numbers mesh on blurry bokeh background. Multiexposure\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/threat-intelligence\\\/cyber-threat-advisory\\\/the-smish-is-coming-from-inside-the-house\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Infoblox Threat Intel\",\"item\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/category\\\/threat-intelligence\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Cyber Threat Advisory\",\"item\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/category\\\/threat-intelligence\\\/cyber-threat-advisory\\\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"The Smish is Coming from Inside the House\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\",\"name\":\"infoblox.com\\\/blog\\\/\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\",\"name\":\"Infoblox\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/infoblox-logo-2.svg\",\"contentUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/infoblox-logo-2.svg\",\"width\":137,\"height\":30,\"caption\":\"Infoblox\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/person\\\/b6aed8965e3298a0817c16d32c0a67ae\",\"name\":\"Infoblox Threat Intel\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/blogs.infoblox.com\\\/wp-content\\\/uploads\\\/avatar_user_397_1714162589-96x96.png\",\"url\":\"https:\\\/\\\/blogs.infoblox.com\\\/wp-content\\\/uploads\\\/avatar_user_397_1714162589-96x96.png\",\"contentUrl\":\"https:\\\/\\\/blogs.infoblox.com\\\/wp-content\\\/uploads\\\/avatar_user_397_1714162589-96x96.png\",\"caption\":\"Infoblox Threat Intel\"},\"description\":\"Infoblox Threat Intel is the leading creator of original DNS threat intelligence, distinguishing itself in a sea of aggregators. What sets us apart? Two things: mad DNS skills and unparalleled visibility. DNS is notoriously tricky to interpret and hunt from, but our deep understanding and unique access to the internet's inner workings allow us to track down threat actors that others can't see. We're proactive, not just defensive, using our insights to disrupt cybercrime where it begins. We also believe in sharing knowledge to support the broader security community by publishing detailed research and releasing indicators on GitHub. In addition, our intel is seamlessly integrated into our Infoblox Protective DNS solutions, so customers automatically get its benefits, along with ridiculously low false positive rates.\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/author\\\/infoblox-threat-intel\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Smishing Attacks From Spoofed Senders | Infoblox","description":"This report analyzes the new smishing technique and the multiple redirect layers involved in the attack.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/the-smish-is-coming-from-inside-the-house\/","og_locale":"en_US","og_type":"article","og_title":"The Smish is Coming from Inside the House","og_description":"This report analyzes the new smishing technique and the multiple redirect layers involved in the attack.","og_url":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/the-smish-is-coming-from-inside-the-house\/","og_site_name":"Infoblox Blog","article_published_time":"2022-04-08T20:14:26+00:00","article_modified_time":"2024-04-26T20:20:05+00:00","og_image":[{"width":612,"height":408,"url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/ciu-image-33.jpg","type":"image\/jpeg"}],"author":"Infoblox Threat Intel","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Infoblox Threat Intel","Est. reading time":"13 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/the-smish-is-coming-from-inside-the-house\/#article","isPartOf":{"@id":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/the-smish-is-coming-from-inside-the-house\/"},"author":{"name":"Infoblox Threat Intel","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/person\/b6aed8965e3298a0817c16d32c0a67ae"},"headline":"The Smish is Coming from Inside the House","datePublished":"2022-04-08T20:14:26+00:00","dateModified":"2024-04-26T20:20:05+00:00","mainEntityOfPage":{"@id":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/the-smish-is-coming-from-inside-the-house\/"},"wordCount":2782,"publisher":{"@id":"https:\/\/www.infoblox.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/the-smish-is-coming-from-inside-the-house\/#primaryimage"},"thumbnailUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/ciu-image-33.jpg","keywords":["Cyber Threat Advisory","Cyber Threat Intelligence","DNS Security"],"articleSection":["Cyber Threat Advisory"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/the-smish-is-coming-from-inside-the-house\/","url":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/the-smish-is-coming-from-inside-the-house\/","name":"Smishing Attacks From Spoofed Senders | Infoblox","isPartOf":{"@id":"https:\/\/www.infoblox.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/the-smish-is-coming-from-inside-the-house\/#primaryimage"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/the-smish-is-coming-from-inside-the-house\/#primaryimage"},"thumbnailUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/ciu-image-33.jpg","datePublished":"2022-04-08T20:14:26+00:00","dateModified":"2024-04-26T20:20:05+00:00","description":"This report analyzes the new smishing technique and the multiple redirect layers involved in the attack.","breadcrumb":{"@id":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/the-smish-is-coming-from-inside-the-house\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/the-smish-is-coming-from-inside-the-house\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/the-smish-is-coming-from-inside-the-house\/#primaryimage","url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/ciu-image-33.jpg","contentUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/ciu-image-33.jpg","width":612,"height":408,"caption":"Big data and hacking concept. Back view of hacker at desktop using creative digital numbers mesh on blurry bokeh background. Multiexposure"},{"@type":"BreadcrumbList","@id":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/the-smish-is-coming-from-inside-the-house\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.infoblox.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Infoblox Threat Intel","item":"https:\/\/www.infoblox.com\/blog\/category\/threat-intelligence\/"},{"@type":"ListItem","position":3,"name":"Cyber Threat Advisory","item":"https:\/\/www.infoblox.com\/blog\/category\/threat-intelligence\/cyber-threat-advisory\/"},{"@type":"ListItem","position":4,"name":"The Smish is Coming from Inside the House"}]},{"@type":"WebSite","@id":"https:\/\/www.infoblox.com\/blog\/#website","url":"https:\/\/www.infoblox.com\/blog\/","name":"infoblox.com\/blog\/","description":"","publisher":{"@id":"https:\/\/www.infoblox.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.infoblox.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.infoblox.com\/blog\/#organization","name":"Infoblox","url":"https:\/\/www.infoblox.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/infoblox-logo-2.svg","contentUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/infoblox-logo-2.svg","width":137,"height":30,"caption":"Infoblox"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/person\/b6aed8965e3298a0817c16d32c0a67ae","name":"Infoblox Threat Intel","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/avatar_user_397_1714162589-96x96.png","url":"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/avatar_user_397_1714162589-96x96.png","contentUrl":"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/avatar_user_397_1714162589-96x96.png","caption":"Infoblox Threat Intel"},"description":"Infoblox Threat Intel is the leading creator of original DNS threat intelligence, distinguishing itself in a sea of aggregators. What sets us apart? Two things: mad DNS skills and unparalleled visibility. DNS is notoriously tricky to interpret and hunt from, but our deep understanding and unique access to the internet's inner workings allow us to track down threat actors that others can't see. We're proactive, not just defensive, using our insights to disrupt cybercrime where it begins. We also believe in sharing knowledge to support the broader security community by publishing detailed research and releasing indicators on GitHub. In addition, our intel is seamlessly integrated into our Infoblox Protective DNS solutions, so customers automatically get its benefits, along with ridiculously low false positive rates.","url":"https:\/\/www.infoblox.com\/blog\/author\/infoblox-threat-intel\/"}]}},"_links":{"self":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/7661","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/users\/397"}],"replies":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/comments?post=7661"}],"version-history":[{"count":4,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/7661\/revisions"}],"predecessor-version":[{"id":7673,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/7661\/revisions\/7673"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/media\/6722"}],"wp:attachment":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/media?parent=7661"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/categories?post=7661"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/tags?post=7661"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}