Anshu 🕸️ (@thebitdoodler) header
Anshu 🕸️ (@thebitdoodler) profile picture

Threat Research @ Internet #Research

Loading...
Joined July 2019
Photo by Anshu 🕸️ (@thebitdoodler)Photo by Anshu 🕸️ (@thebitdoodler)Photo by Anshu 🕸️ (@thebitdoodler)Photo by Anshu 🕸️ (@thebitdoodler)Photo by Anshu 🕸️ (@thebitdoodler)Photo by Anshu 🕸️ (@thebitdoodler)Photo by Anshu 🕸️ (@thebitdoodler)Photo by Anshu 🕸️ (@thebitdoodler)Photo by Anshu 🕸️ (@thebitdoodler)Photo by Anshu 🕸️ (@thebitdoodler)
More Panels 🤔 - nocheats[.]co 8080 - nocheat[.]lat 8080 - scan[.]lat 8080 IPs: - 64\.188\.66\.51 - 72.56\.241\.175
HTTP + RAT = ❓→ C2: httprat[.]xyz 🔥 Found some interesting #RAT -like network activity using #websocket: → /ws/victim?id=... → /ws/screen?id=... sandbox: tria.ge/261009-ppbh8awvct/ 6d031d51ffc5e78171153a4af78ba6d327a9ae332ee432c0243ebc6e23e3188a
2
221
Anshu 🕸️ retweeted
Pocket.ai by LiveShortly 💥
1
1
3
981
Anshu 🕸️ retweeted
Threat intel without context has always annoyed me. Everybody thinks their feed is high-confidence until you ask them for more context about the infrastructure they're pushing through. They have no idea what infra they're tracking. I see this far too often... 🤦 You get an IP, domain, or hash marked as malicious, maybe with a threat actor tag attached, but very little explaining how anyone reached that conclusion. A lot of feeds aggregate scanning results, third-party datasets, shared intelligence, and other feeds. After enough aggregation, the original evidence gets lost. That becomes a problem when you start seeing scanned infra, honeypots, red team systems, or other noise mixed into feeds that are still being marketed as “verified” or “high confidence.” I wanted to take a different approach with the intel we publish through Threat Hunting Labs. Every IOC we publish is tied back to the intrusion where we actually observed it and goes through two stages of curation. If an IP was contacted by malware, we keep the surrounding execution context: - Which process made the connection - The command line - Process lineage - Context of the malicious process (i.e., process injection, LoTL, etc.) - Whether it was tied to persistence and more... That context is the important bit. You should be able to see why an IOC was classified as malicious instead of blindly trusting a label. Because when you have a hit, you can get context on how we have seen it used in the past so you can hunt through your logs. From there, consuming the feed is still simple. API key, plug it into the platform you already use, and go. If you want to dig deeper, all of the supporting context is available through the UI and API. This is pretty much the threat intel feed I always wanted to use myself. Very proud of what we have built here.
We’ve made huge progress on the intelligence platform that sits behind Threat Hunting Labs. The real intrusions we respond to eventually become investigations inside the platform, but along the way they also generate valuable intelligence around attacker infrastructure, malware, indicators, and TTPs. We’ve spent the last few months improving how that intelligence is processed and delivered, based heavily on feedback from enterprise customers. The result is a much stronger threat intel platform with: • Fresh adversary infrastructure • Enriched indicators and context • Intelligence grounded in real intrusion activity • API access designed to plug into the platform you already use Threat intelligence feeds should not cost an arm and a leg. Threat Hunting Labs Enterprise customers get access to our intelligence platform at no additional cost. Hands-on training and threat intelligence under one platform. Viti: intel.threathuntinglabs.com/ Contact us: threathuntinglabs.com/contac…
7
18
3
139
18,409
Anshu 🕸️ retweeted
COLDCARD explained simply !!
1
2
855
Anshu 🕸️ retweeted
The latest FRAGNESIA LPE Cheers Enjoy.
1
5
835
Anshu 🕸️ retweeted
Joining the CXO Speaker Lineup at VULNCON 2026 - Dhawal Shrivastava, Senior Security Assurance Engineering Lead @Microsoft With nearly 16 years of experience across product security, cloud and AI trust, incident response, compliance, and security leadership, Dhawal Shrivastava brings a rare blend of strategic vision and hands-on expertise to the VULNCON 2026 stage. Join us at VULNCON 2026 to gain insights from a cybersecurity leader who has spent his career turning complex security challenges into impactful business outcomes. 📍 NIMHANS Convention Centre, Bengaluru 📅 12th & 13th June, 2026 Final Chance: Last Minute Sale ends on 9th June vulncon.in/register #VULNCON2026 #Vulncon #CyberSecurity #RiskManagement #Governance #InfoSec #CyberResilience
2
3
79
Anshu 🕸️ retweeted
Meet Scoot — the official mascot of VULNCON 2026 🐾 Curious, sharp, and always one step ahead, Scoot represents the spirit of cybersecurity research; questioning systems, exploring vulnerabilities, and pushing innovation forward. Welcome the face of VULNCON 2026. The journey just got smarter. And we are just starting!! Meet him at VULNCON 2026 📍NIMHANS Convention Centre, Bengaluru 📅 12th & 13th June, 2026 Registrations are now open — secure your seat today! vulncon.in/register Stay Tuned. Scoot is about to make an entrance. 🐾✨ #Vulncon #VULNCON2026 #Scoot #Cybersecurity #Cybersecuritycommunity #Infosec #SecurityResearch
3
8
202
Anshu 🕸️ retweeted
zohomailapp[.]com nffjf[.]info payment-uae[.]com sftp[.]sagargolf[.]com job-diva[.]xyz ceprode-ayllu[.]top gamarjoba-ushguli[.]top stein-uk[.]top wsparcie-kobiet[.]xyz pieniadze-dla-kobiet[.]xyz dla-polek[.]xyz loanprocessing-usa[.]top nutritionhealthfitness[.]online facio-uk[.]top smarttechcomputer[.]online e-uliker[.]top stdalfour-us[.]top plcdigi-al[.]xyz safecom-us[.]top fachanwalt-bonn[.]online seventh-dayremnantchurch[.]xyz grg-brevard[.]online losangeles-breastaugmentations[.]online ghana-carnivalclub-berlin[.]online ad-distributorsstore[.]top 62[.]60[.]226[.]73 AS214351 Femo It Solutions Limited 🇩🇪 smb[.]sagargolf[.]com google[.]herionhelpline[.]com ultrafastcore[.]pro sync[.]sagargolf[.]com 85[.]209[.]156[.]5 AS41111 Fast Geo Hosting S.r.l. 🇳🇱 sftp[.]sagargolf[.]com info365-postova[.]com monsuivi-mrelay[.]com obnovitinetfilx[.]com obnovinalog[.]com azuriranjenetfilx[.]com netfilxmx-renewal[.]com netfilxobnoviti[.]com ananeono-netfilx[.]com neak-megujitani[.]com netfilxrs-renewai[.]com zse-platba[.]com vubanka-idp[.]com netfilxcr-renewai[.]com bancodechile-secure[.]com mooneyit-info[.]com renewnetfilx[.]com bancochile-info[.]com netfiixpt-renewai[.]com postova365-info[.]com intesasp-info[.]com suivicolis-2025[.]com aissaleptit[.]com renewaipi[.]com usernet-fiokot[.]info maltapostrack[.]com 365bank-obnovy[.]com renew365postova[.]com moncolis-relai[.]com 365renew[.]com forny-sundhedskort[.]com upsinfo-paquete[.]com renewpostova365[.]com zse-obnovit[.]com idalpha-bnk[.]com umprogrammierung-paket[.]com mbh-renewal[.]com usernet-renovar[.]com obnovypostova365[.]com myhermes-packet[.]com obnovy365banka[.]com usrntsg[.]com usernet-fornya[.]com renewai-sub[.]com accessfiix-pak[.]com zse-obnovy[.]com userpost-kaz[.]com pakfines-gov[.]com renewflix-pak[.]com paktracking[.]com usernet-pak[.]com idhblpak[.]com payment-pkfines[.]com bank365postova[.]com postova365info[.]com pakpostrack[.]info 365postovaobnovit[.]info deliverypk-info[.]com pkpost-fast[.]com isporuka-info[.]com megujitani-szamla[.]com szallitas-informacio[.]com rendorsegportai-fizetes[.]com usernet-frissites[.]com obnovypoistenca[.]com netfilx-megujitani[.]com 213-209-150-229[.]plesk[.]page clever-brahmagupta[.]213-209-150-229[.]plesk[.]page 213[.]209[.]150[.]229 AS2856 British Telecommunications PLC 🇩🇪 #CastleBot #GuLoader @abuse_ch
1
3
289
#APT36 #SideCopy #Phishing #APT [1/3] 20250731-Deferment-of-implementation-of-Rule-9-of-LPS-Rule_434_785.zip 99b2235101a9a1eb922527b1a31e9b51 737cbe4cef2f2a178b9f91d2104f7dd3 be263bee537ab60901fa1436c91ce32e ZipModifyDate 2025:09:25 #CurlBackRAT #C2 microsoft.windowsdns[.]com
#APT36 #SideCopy #TransparentTribe ZIP > LNK > MSI > #CurlBackRAT (Most likely) hxxps://vetpharmaconsultant.in/js/doccs/20250731-Deferment-of-implementation-of-Rule-9-of-LPS-Rule_434_785/wins #Phishing #APT
1
16
2
34
12,569
Anshu 🕸️ retweeted
Some threat actors are still using VBA macros:
1
1
5
860
Anshu 🕸️ retweeted
Super Excited to announce the release of 𝗦𝗵𝗶𝗽𝗦𝗲𝗰 𝗦𝘁𝘂𝗱𝗶𝗼 🚀 🚀 Go ahead and try at : studio.shipsec.ai 👩‍💻 Opensource : github.com/shipsecai/studio Enjoyed the project? Drop a ⭐ on the repo! 𝗪𝗵𝗮𝘁 𝗶𝘀 𝗦𝗵𝗶𝗽𝗦𝗲𝗰 𝗦𝘁𝘂𝗱𝗶𝗼 ? An OpenSource, No Code Security Automation Platform. 𝗪𝗵𝘆 𝗦𝗵𝗶𝗽𝗦𝗲𝗰 𝗦𝘁𝘂𝗱𝗶𝗼? 🎨 Visual Workflow Builder : Design security automations with drag-and-drop, no coding required ⚡ Real-Time Execution : Watch & debug workflows run live with streaming logs and progress indicators 🧩 Pre-Built Security Components : Subfinder, DNSX, HTTPx, Nuclei, and more ready to use 🔒 Enterprise Reliability: Built on Temporal for durable, resumable workflow executions 🛡️ Secure by Default : Encrypted secrets, role-based access, and audit trails 💻 Run Anywhere : Cloud hosted or self-hosted on your own infrastructure 📅 Scheduled Workflows : Schedule your scans to run at specific times or intervals 🔗 Codify Your Workflows : Trigger workflows via a simple POST request, through cURL, python etc.
4
13
2
48
3,344
Another example: activecarnpaigns[.]com IP: 193.143.1[.]220 (AS: Proton66) Targeting @ActiveCampaign Registered w/ @tucows @malwrhunterteam
2
297
Anshu 🕸️ retweeted
Fake Malware TOAD via Malvertizing "SYSTEM THINK, INC" was serving ads that redirect to a Fake Malware TOAD URL. carinteriors[.]site cozyworkspace[.]site fitnessgadgets[.]site fitnessgearhub[.]site gymora[.]site handmadecandles[.]site handmadejewels[.]site naturalskincare[.]site safetravelgear[.]site skincarekits[.]site smartkitchenware[.]site womenshandbags[.]site gjkabnguienbgjkw.blob.core[.]windows[.]net hxxps://gjkabnguienbgjkw.blob.core.windows[.]net/$web/Wi0nHelpDigiErr0t030/index.html
1
6
1
11
1,315
Anshu 🕸️ retweeted
13
53
4,801
Anshu 🕸️ retweeted
👹 Social Engineering: threat actors post fake job offers (now impersonating the company ChainFlip) on websites such as Indeed and Glassdoor (it could be any company and any job portal, as we can see in this example: nitter.cf/1ZRR4H/status/18154622…). 🚩 "We are using Microsoft Teams Enterprise with AI Detect Bot. If you are currently using the basic Teams app, Teams Enterprise will be downloaded automatically when you join the meeting" 😏 After receiving a new application, they contact the person from the fraudulent domain chainflip[.]works, arrange an interview, and send a meeting request via Calendly, which, in addition to reaching the inbox, also allows them to include a malicious link in the body of the email. ⚠️ The malicious site requires a temporary access code, a technique used to filter victims and evade automated analysis. * These people are not from North Korea.
🚩 Fake job offers used in this campaign 🇰🇵 and published on multiple web portals: 1⃣.- [LinkedIn]: "Senior blockchain developer needed" → https://www.linkedin[.]com/jobs/view/senior-blockchain-developer-needed-at-hirog-3974975235/. 2⃣.- [WellFound]: "Ecommerce Developer with Web3 Integration (3+ years exp)" → https://wellfound[.]com/jobs/3055218-ecommerce-developer-with-web3-integration. 3⃣.- [PeoplePerHour]: "I need senior blockchain developer for our online store" → https://www.peopleperhour[.]com/freelance-jobs/technology-programming/e-commerce-cms-development/i-need-senior-blockchain-developer-for-our-online-store-4235812. 4⃣.- [ZipRecruiter]: "Blockchain developer needed" → https://www.ziprecruiter[.]com/c/HiroG/Job/Blockchain-developer-needed/-in-Califon,NJ?jid=6bf13a7b9c0139d4. 5⃣.- [WayUp]: "Blockchain developer needed" → https://www.wayup[.]com/i-j-HiroG-313478541129579/. 6⃣.- [Recruiter]: Link is no longer avaible. #DPRK
1
44
2
129
35,000