ge0lev (@ge0lev) profile picture

ge0lev

@ge0lev

Threat Hunting | Malware Analysis

 Attiki, Greece
Joined July 2018
  • Tweets46
  • Following407
  • Followers389
7Media
Photo by ge0lev (@ge0lev)Photo by ge0lev (@ge0lev)Photo by ge0lev (@ge0lev)Photo by ge0lev (@ge0lev)Photo by ge0lev (@ge0lev)Photo by ge0lev (@ge0lev)Photo by ge0lev (@ge0lev)
#Lumma #Malware 👾8 New Lumma Domains with Low Hits👾 🚨pastebin.com/T4dBPXDF🚨 CC: @banthisguy9349 @NDA0E @BlinkzSec @kddx0178318 @raghav127001 @DaveLikesMalwre @g0njxa @ViriBack @500mk500 @ge0lev @marsomx_ @JAMESWT_MHT @DonPasci
Image from WatchingRac (@RacWatchin8872)
2
7
22
2,241
#Lumma #Malware 👾12 New Lumma Domains with Low Hits👾 🚨pastebin.com/dFbqvkTb🚨 CC: @banthisguy9349 @NDA0E @BlinkzSec @kddx0178318 @raghav127001 @DaveLikesMalwre @g0njxa @ViriBack @500mk500 @ge0lev @marsomx_ @JAMESWT_MHT @DonPasci
Image from WatchingRac (@RacWatchin8872)
9
36
4,778
#Stealc #Malware 🚨58 IP's with Low Hits on VT related to Stealc🚨 pastebin.com/eRk5vEyK CC: @banthisguy9349 @NDA0E @BlinkzSec @kddx0178318 @raghav127001 @DaveLikesMalwre @g0njxa @ViriBack @500mk500 @ge0lev @marsomx_ @JAMESWT_MHT @DonPasci
Image from WatchingRac (@RacWatchin8872)
Image from WatchingRac (@RacWatchin8872)
5
14
3,193
#Stealc #Malware 🚨40 IP's with Low Hits on VT related to Stealc🚨 pastebin.com/u7SVaBGv CC: @banthisguy9349 @NDA0E @BlinkzSec @kddx0178318 @raghav127001 @DaveLikesMalwre @g0njxa @ViriBack @500mk500 @ge0lev @marsomx_ @JAMESWT_MHT @DonPasci
Image from WatchingRac (@RacWatchin8872)
Image from WatchingRac (@RacWatchin8872)
1
3
18
3,334
#Tycoon2FA #Phishing - Using new TLD ([.]co[.]za) - New Anti-Bot System (never saw something like that) CC: @banthisguy9349 @NDA0E @BlinkzSec @kddx0178318 @raghav127001 @DaveLikesMalwre @g0njxa @ViriBack @500mk500 @ge0lev @marsomx_ @JAMESWT_MHT @DonPasci
Image from WatchingRac (@RacWatchin8872)
Image from WatchingRac (@RacWatchin8872)
NoPhishInHere (@NoMorePhis) profile pictureNoPhishInHere@NoMorePhis20 Sep 2025
#Tycoon2FA #Phishing 🐟135 Domains related to Tycoon2FA Phishing with Low Hits on vt: pastebin.com/6Qus2Qxf Full List: github.com/NoMorePhish/Tycoo… Tool used: @ValidinLLC CC: @RacWatchin8872 @g0njxa @500mk500

ogndpb.esslrp-htlsafe-mailapbjkaxvx.comjonpqtia.comflonvultian.combb - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

pastebin.com
2
6
1
23
3,511
#Clickfix more I'll add later
Image from Raaz (@solostalking)
9
32
2,785
#Lumma #Malware 👾 37 domains related to Lumma: pastebin.com/39PPLg4L CC: @banthisguy9349 @NDA0E @BlinkzSec @kddx0178318 @raghav127001 @DaveLikesMalwre @g0njxa @ViriBack @500mk500 @ge0lev @marsomx_ @JAMESWT_MHT @DonPasci
Image from WatchingRac (@RacWatchin8872)
Image from WatchingRac (@RacWatchin8872)
2
8
22
1,721
#Lumma #Malware 👾 32 domains related to Lumma: pastebin.com/0RhLL7Uf CC: @banthisguy9349 @NDA0E @BlinkzSec @kddx0178318 @raghav127001 @DaveLikesMalwre @g0njxa @ViriBack @500mk500 @ge0lev @marsomx_ @JAMESWT_MHT @DonPasci
Image from WatchingRac (@RacWatchin8872)
8
25
2,026
🚨After a long time, I finally created a GitHub repo containing the domains discovered by the bot: github.com/NoMorePhish/Tycoo… CC: @banthisguy9349 @NDA0E @BlinkzSec @kddx0178318 @raghav127001 @DaveLikesMalwre @g0njxa @ViriBack @500mk500 @ge0lev @marsomx_ @JAMESWT_MHT @DonPasci
Image from WatchingRac (@RacWatchin8872)
NoPhishInHere (@NoMorePhis) profile pictureNoPhishInHere@NoMorePhis2 Jun 2025
#Tycoon2FA #Phishing 🐟30 Domains related to Tycoon2FA Phishing with Low Hits on vt: pastebin.com/z3PSJjZ5 Tool used: @ValidinLLC CC: @RacWatchin8872 @g0njxa @500mk500

vithgevsvbpx.esnpacvwsyvwf.esmbdxdpg.essgerzgk.esjsfqxqk.esborouseburb - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

pastebin.com
11
1
33
5,497
#Phishing My first bot will focus on phishing domains! CC: @banthisguy9349 @NDA0E @BlinkzSec @kddx0178318 @raghav127001 @DaveLikesMalwre @g0njxa @ViriBack @500mk500 @ge0lev @marsomx_ @JAMESWT_MHT @DonPasci
NoPhishInHere (@NoMorePhis) profile pictureNoPhishInHere@NoMorePhis30 Apr 2025
#Tycoon #Phishing 🐟158 Domains related to Tycoon2FA Phishing with Low Hits on vt🐟: pastebin.com/wQzLkRpa Tool used: @ValidinLLC CC: @RacWatchin8872 @g0njxa @500mk500
1
6
15
2,025
#Tycoon Updates: -> New Captcha (IconCaptcha) -> Currently Using .es, .ru, .com, .info, .org TLD's New Domains: pastebin.com/mW4tZnf7 CC: @banthisguy9349 @NDA0E @BlinkzSec @kddx0178318 @raghav127001 @DaveLikesMalwre @g0njxa @ViriBack @500mk500 @ge0lev @marsomx_ @JAMESWT_MHT
Image from WatchingRac (@RacWatchin8872)
Image from WatchingRac (@RacWatchin8872)
Image from WatchingRac (@RacWatchin8872)
1
8
41
3,296
#FakeCaptcha 87 Domains hosting FakeCaptcha: pastebin.pl/view/17961bda AnyRun: app.any.run/tasks/a08761bd-f… app.any.run/tasks/7bbd518a-1… CC: @banthisguy9349 @NDA0E @BlinkzSec @kddx0178318 @raghav127001 @DaveLikesMalwre @g0njxa @ViriBack @500mk500 @ge0lev @marsomx_ @JAMESWT_MHT @DonPasci
Image from WatchingRac (@RacWatchin8872)
Image from WatchingRac (@RacWatchin8872)
Image from WatchingRac (@RacWatchin8872)
4
13
1
48
6,305
#Github #Malware #Lumma 💣Campaign Using SolaraExecutor-V3 to infect victims with Lumma Stealer: Github -> Exe with Powershell Code -> Pastebin -> Github -> Lumma Stealer pastebin.com/1KvNgjk3
Image from WatchingRac (@RacWatchin8872)
Image from WatchingRac (@RacWatchin8872)
Image from WatchingRac (@RacWatchin8872)
Image from WatchingRac (@RacWatchin8872)
2
23
1
62
7,063
#Tycoon2FA #Phishing 24 new domains and urls related to Tycoon with low hits on VT: pastebin.com/8CyYQHLT CC: @banthisguy9349 @NDA0E @BlinkzSec @kddx0178318 @raghav127001 @DaveLikesMalwre @g0njxa @ViriBack @500mk500 @ge0lev @marsomx_ @JAMESWT_MHT @DonPasci

https://z6in.rocggyghq.ru/X72Iripz/https://PM.ogcjwwtjfwz.ru/zwO2Gj9a/https: - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

pastebin.com
6
12
1,414
8af777d0f92cef2d9040a634527c3753669235589c23129f09855ad0ebe10c6f GoogleUpdateSetup.exe Guys. 'googleupdatesetup.exe' has been spread by a actor that uses Snakekeylogger. I suspect this certificate to be abused. Tag Cert Abuse Specialist into this post please.
Image from Fox_threatintel (@banthisguy9349)
5
16
66
7,092
#Tycoon2FA #Phishing 126 new domains and urls related to Tycoon: pastebin.com/sCzWTCLw CC: @banthisguy9349 @NDA0E @BlinkzSec @kddx0178318 @raghav127001 @DaveLikesMalwre @g0njxa @ViriBack @500mk500 @ge0lev @marsomx_ @JAMESWT_MHT @DonPasci
Image from WatchingRac (@RacWatchin8872)
Image from WatchingRac (@RacWatchin8872)
Image from WatchingRac (@RacWatchin8872)
1
10
25
2,437
#Tycoon #Phishing Got more domains with the help of @g0njxa 571 domains linked to Tycoon. Here’s a list of domains+subdomains+full path, hosting Outlook/Gmail phishing pages: pastebin.com/jp0uTrK4 A few of them are waiting for API renew (TA's didn't pay the bill 😂)

https://klH0.abeanethw.ru/f8lIL/https://zG.achronistic.ru/ExpcdgVdj1NcVnizSy6l - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

pastebin.com
3
11
35
5,500
#Tycoon2FA 31 new domains related to the infrastructure pastebin.com/3KQ6bUig CC: @banthisguy9349 @NDA0E @BlinkzSec @kddx0178318 @raghav127001 @DaveLikesMalwre @g0njxa @500mk500 @ge0lev @marsomx_ @JAMESWT_MHT @DonPasci
Image from WatchingRac (@RacWatchin8872)
Image from WatchingRac (@RacWatchin8872)
Image from WatchingRac (@RacWatchin8872)
WatchingRac (@RacWatchin8872) profile pictureWatchingRac@RacWatchin88722 Jan 2025
#Tycoon2FA +287 new domains related to the infrastrucute pastebin.com/GR9fgB39 CC: @banthisguy9349 @NDA0E @BlinkzSec @kddx0178318 @raghav127001 @DaveLikesMalwre @g0njxa @ViriBack @500mk500 @ge0lev @marsomx_ @JAMESWT_MHT @DonPasci
Image from WatchingRac (@RacWatchin8872)
Image from WatchingRac (@RacWatchin8872)
Image from WatchingRac (@RacWatchin8872)
2
2
22
4,941
#Tycoon2FA +287 new domains related to the infrastrucute pastebin.com/GR9fgB39 CC: @banthisguy9349 @NDA0E @BlinkzSec @kddx0178318 @raghav127001 @DaveLikesMalwre @g0njxa @ViriBack @500mk500 @ge0lev @marsomx_ @JAMESWT_MHT @DonPasci
Image from WatchingRac (@RacWatchin8872)
Image from WatchingRac (@RacWatchin8872)
Image from WatchingRac (@RacWatchin8872)
Validin (@ValidinLLC) profile pictureValidin
@ValidinLLC30 Dec 2024
🚨 New Blog: "Analyzing #Tycoon2FA Infra with Validin" Discover how @RacWatchin8872 expanded a phishing analysis into ~2k confirmed Storm-1747 domains using Validin's powerful threat-hunting tools. A must-read for analysts hunting advanced phishing kits! validin.com/blog/tycoon_2fa_…
Tycoon 2FA: Analyzing and Hunting Phishing-as-a-Service Domains | Validin

Tycoon 2FA: Analyzing and Hunting Phishing-as-a-Service Domains | Validin

Learn how to analyze Tycoon 2FA phishing campaigns and uncover thousands of related domains effortlessly using Validin’s powerful threat-hunting capabilities.

validin.com
3
10
1
37
6,895
🚨 New Blog: "Analyzing #Tycoon2FA Infra with Validin" Discover how @RacWatchin8872 expanded a phishing analysis into ~2k confirmed Storm-1747 domains using Validin's powerful threat-hunting tools. A must-read for analysts hunting advanced phishing kits! validin.com/blog/tycoon_2fa_…
Tycoon 2FA: Analyzing and Hunting Phishing-as-a-Service Domains | Validin

Tycoon 2FA: Analyzing and Hunting Phishing-as-a-Service Domains | Validin

Learn how to analyze Tycoon 2FA phishing campaigns and uncover thousands of related domains effortlessly using Validin’s powerful threat-hunting capabilities.

validin.com
1
32
2
82
15,515
Load more