In this blog, we will identify 36 Latrodectus phishing domains through passive DNS analysis of a domain reported on Twitter/X.
The initial reported domain leverages 302 redirects to send users to a malicious or benign file. The URL in the 302 redirect is re-used across numerous domains; we can leverage this information to identify additional infrastructure.
In summary, we will use the following indicators to identify the additional servers
- The same resolved IP address
193.106.174[.]218 - The same usage of 302 redirects to the same URL on
documentcloud[.]org - Previous usage of 302 redirects to
harvardlawreview[.]org
The primary tooling we will be leveraging is Validin.
Initial Intelligence
The initial intelligence in this blog is from a tweet posted by @Unit42_intel.
The tweet details a Latrodectus infection leveraging phishing links to redirect victims to a javascript file, which ultimately loads LummaStealer Malware.
https://platform.twitter.com/embed/Tweet.html?creatorScreenName=embee_research&dnt=false&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOltdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2ZvbGxvd2VyX2NvdW50X3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9iYWNrZW5kIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19yZWZzcmNfc2Vzc2lvbiI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfZm9zbnJfc29mdF9pbnRlcnZlbnRpb25zX2VuYWJsZWQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X21peGVkX21lZGlhXzE1ODk3Ijp7ImJ1Y2tldCI6InRyZWF0bWVudCIsInZlcnNpb24iOm51bGx9LCJ0ZndfZXhwZXJpbWVudHNfY29va2llX2V4cGlyYXRpb24iOnsiYnVja2V0IjoxMjA5NjAwLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3Nob3dfYmlyZHdhdGNoX3Bpdm90c19lbmFibGVkIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdXNlX3Byb2ZpbGVfaW1hZ2Vfc2hhcGVfZW5hYmxlZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfbGVnYWN5X3RpbWVsaW5lX3N1bnNldCI6eyJidWNrZXQiOnRydWUsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1766242077585596520&lang=en&origin=https%3A%2F%2Fwww.embeeresearch.io%2Fphishing-domain-analysis-with-passive-dns-latrodectus%2F&sessionId=c2cef51c08b0a3428d53b29643c87d2a10117db1&siteScreenName=embee_research&theme=light&widgetsVersion=2615f7e52b7e0%3A1702314776716&width=550px
Within the original tweet, there is a screenshot of a phishing link contained in an email. This link contains the domain lufyfeo[.]org, which will form the basis and starting point of our analysis today.
Our goal is to analyse this domain to identify patterns or indicators that can identify additional domains and IOCs.
Initial Notes
Based on information contained in the initial post, the lufyfeo[.]org domain is likely leveraging redirects to send a victim to alternate “fake” pages.
This information will form an important step in our next analysis, as we will leverage patterns in the 302 redirects to identify additional domains.
Initial Analysis With Passive DNS
Our initial analysis can begin by searching the lufyfeo[.]org domain using a passive DNS tool such as Validin.
This will reveal detailed history about resolved IP addresses have been in use by the domain.
In the below screenshot, we can see that the most recent IP resolution was 193.106.174[.]218
This IP address will form our first pivot point.
After determining the most recent IP address, we can also review the most recent host responses for the lufyfeo[.]org domain.
This reveals the presence of multiple 302 redirects, which are likely redirecting the user to the next malicious page.
By viewing additional information about the 302 redirect, we can see that the redirect location is a PDF file hosted on documentcloud[.]org
By researching the documentcloud[.]org domain, this appears to be a legitimate site used for hosting pdf files.
Investigating this exact PDF link on urlscanAfter investigating this exact PDF link on urlscan, I found that it appears to be a relatively benign PDF file.
I did not confirm 100%, but I believe that this is a non-malicious PDF returned if the user has not requested the exact URL provided in the initial email.
Leveraging Redirects as Pivot Points
At this point, we have now identified the most recent IP address used by lufyfeo[.]org, and we have identified that the domain is leveraging 302 redirects to send the user to the next location.
Recall that the lufyfeo[.]org domain contains host responses with 302 redirects.
By expanding our search to the most recent resolved IP address for lufyfeo[.]org, we can expand this search to other domains hosted on the same server.
We can check this by searching for the most recent resolved IP 192.106.174[.]218 and checking the Host Responses tab for 302 redirects.
Reviewing the redirect details for interiourbydennis[.]com, we can see that the 302 redirects to the same location.
A very similar response can be observed for deqytuu9[.]org and web3rse[.]org
Of extremely interesting note is that the deqytuu9[.] domain resolves to a pdf file hosted on harvardlawreview[.]org
To my knowledge, this is a legitimate domain and legitimate file, but it is interesting to note that other sites hosting PDFs are being leveraged.
This will become more important later when we do additional pivoting.
Identifying All Current Domains
At this stage, we have identified an IP address 193.106.174[.]218 that is hosting both the original malicious domain lufyfeo[.]org as well as numerous other domains showing similar behaviour.
In total, there are 1256 host responses for the 193.106.174[.]218 address. Our next goal will be to enumerate all of these for indications of 302 redirects to URLs containing pdf references on harvardlawreview[.]org or documentcloud[.]org
Since the number of responses was so large, I utilised the JSON export feature of Validin to obtain the complete results of the search.
This allowed me to focus on information like the 302 redirect location.
We can start this by exporting all entries in the current response.
After exporting the entries, CyberChef can be leveraged to beautify the JSON output and determine which fields are of interest.
In this case, we want only the host and location fields within the JSON.
Enumerating JSON Output With Python
Since we only need to check the location and host fields, we can use a small Python script to enumerate all results in the JSON output for references to URLs with PDF references.
Running this script produces many results for redirects to the same location as the known malicious domain.
After deduplicating the results, we are left with 36 domains hosted on the same IP address and redirecting to the same documentcloud[.]org file, or the additional harvardlawreview[.]org file.
The complete list of these domains can be found below.
mayanui[.]com
quwezui[.]org
durete[.]org
hofaty[.]org
qeqady[.]org
fuwer[.]org
defifya[.]org
gotuqoa[.]org
suzabyu[.]org
web3rse[.]com
interiourbydennis[.]com
sytukoe8[.]org
lufyfeo[.]org
boldenslawncare[.]com
qyjifia[.]org
vajosoo[.]org
sabehey[.]org
nevujo[.]org
lyzupoy[.]org
mypusau[.]org
zuwagie6[.]org
marypopkinz[.]com
simanay[.]org
cabobao3[.]org
ticava[.]org
zefos[.]org
fazadoe[.]org
luhuhu[.]org
cuxu[.]org
pubonao[.]org
xacygo[.]org
deqytuu9[.]org
gejyg[.]org
pucak[.]org
intellipowerinc[.]com
gejyg[.]org