Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
Kyle Ehmke Profile picture
Kyle Ehmke
@kyleehmke
Threat intel researcher focused on infrastructure hunting. Views are my own and not my employer's. Others: @kyleehmke@infosec.exchange @kyleehmke.bsky.social
May 31, 2020 • 8 tweets • 5 min read
Heads up on some probable Sandworm domains that had resolving subdomains in May 2020:

userarea[.]click (46.4.10[.]58)
userarea[.]eu (185.226.67[.]190)

In @ThreatConnect: app.threatconnect.com/auth/incident/… That infrastructure is part of a larger network identified by investigating the domains fbapp[.]top, fbapp[.]info, and fbapp[.]link, which were registered through Njalla the same day (12/24/18) as the hostapp[.]be domain in @NSACyber's report last week.

ImageImage
Jan 14, 2020 • 9 tweets • 3 min read
So just to be explicit about our research @ThreatConnect, we initially came across the cubenergy-my-sharepoint[.]com by exploiting some consistencies that we've seen in previous Fancy Bear infrastructure. To be specific, the use of a PositiveSSL certificate in conjunction with a Sharepoint-related string, has been used several times previously by Fancy Bear and not widely seen elsewhere.
Dec 16, 2019 • 6 tweets • 3 min read
Heads up on some suspicious domains spoofing UKR organizations registered in the last year:
cubenergy-my-sharepoint[.]com
dpkshodnya-mysharepoint[.]com
kub-gas[.]com
kvatral95[.]com
my-ukr[.]net

More context in @ThreatConnect: app.threatconnect.com/auth/campaign/… (1/6) Relevant hosting IPs:
91.132.139[.]155
184.164.139[.]238
94.158.245[.]28
185.174.174[.]34

Also mail server mail.kvatral95[.]com is hosted on a probable dedicated server at 45.89.175[.]235. (2/6)
Jun 26, 2019 • 16 tweets • 4 min read
On the info ops front, the Facebook page for The Right News seemingly serves as an echo chamber for The Daily Wire. Based on that page and WHOIS history for therightnews[.]net, The Right News probably is actively working on behalf of The Daily Wire without openly stating so. 1/15 In terms of background, The Right News' Facebook page was created on 11/22/13, has over 193k followers, and claims to be a Media/News company. The page posts political commentary, conservative articles, and memes. 2/15