DOWNEX

Overview 19 indicators

No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.

Principal sources 16 reports

Ranked by how many of this actor's indicators each report brought in.

• 9x.com/lontze7/status/1878800751532896679
• 9blog.sekoia.io/double-tap-campaign-russia-nexus-apt-po…
• 9search.censys.io/hosts/38.180.206.61
• 9search.censys.io/hosts/38.180.207.137
• 9app.validin.com/detail?find=dd9aef0ce3d64a9dd4009357637…
• 6bitdefender.com/blog/businessinsights/deep-dive-into-do…
• 6cert.gov.ua/article/4697016 (Ukrainian)
• 6virustotal.com/gui/ip-address/172.104.62.59/relations

Timeline 19 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2025-01-13 5 domain, 1 ipv4, 2 url1 yr ago

   x.com/lontze7/status/1878800751532896679 · blog.sekoia.io/double-tap-campaign-russia-nexus-apt-po… · search.censys.io/hosts/38.180.206.61 · search.censys.io/hosts/38.180.207.137 · app.validin.com/detail?find=dd9aef0ce3d64a9dd4009357637…

   domain	background-services.net
   domain	download-resourses.info
   domain	energieecoinnov.info
   domain	energieecotech.info
   domain	lookup.ink
   ipv4	38.180.207.137:45323
   url	http://38.180.206.61
   url	http://38.180.207.137

   copy batch

2. 2024-07-23 2 domain, 2 url2 yrs ago

   cert.gov.ua/article/6280129 · virustotal.com/gui/ip-address/185.158.248.198/relations · virustotal.com/gui/ip-address/194.31.55.131/relations

   domain	enrollmentdm.com
   domain	trust-certificate.net
   url	http://45.136.198.184
   url	http://5.45.70.178

   copy batch

3. 2023-05-22 3 domain, 3 url3 yrs ago

   bitdefender.com/blog/businessinsights/deep-dive-into-do… · cert.gov.ua/article/4697016 (Ukrainian) · virustotal.com/gui/ip-address/172.104.62.59/relations · virustotal.com/gui/ip-address/185.203.117.6/relations · virustotal.com/gui/ip-address/79.124.60.180/relations · virustotal.com/gui/file/cb9405390b4eb81beebb91ee596f77… · virustotal.com/gui/file/70d8e503fd199de816815b88e82fe7… · virustotal.com/gui/file/75395359af2d61b2434d68fbee12eb…

   domain	diagnostic-resolver.com
   domain	ms-webdav-miniredir.com
   domain	net-certificate.services
   url	http://139.99.126.38
   url	http://206.166.251.216
   url	http://84.32.188.123

   copy batch

4. 2023-05-22 1 url_path3 yrs ago

   x.com/lontze7/status/1878800751532896679 · blog.sekoia.io/double-tap-campaign-russia-nexus-apt-po… · search.censys.io/hosts/38.180.206.61 · search.censys.io/hosts/38.180.207.137 · app.validin.com/detail?find=dd9aef0ce3d64a9dd4009357637…

   /hftqlbgtg.php

   copy batch

Further reading 16

• virustotal.com/gui/ip-address/185.158.248.198/relations
• virustotal.com/gui/ip-address/185.203.117.6/relations
• cert.gov.ua/article/6280129
• x.com/lontze7/status/1878800751532896679
• search.censys.io/hosts/38.180.207.137
• blog.sekoia.io/double-tap-campaign-russia-nexus-apt-po…
• app.validin.com/detail?find=dd9aef0ce3d64a9dd4009357637…
• bitdefender.com/blog/businessinsights/deep-dive-into-do…
• virustotal.com/gui/file/70d8e503fd199de816815b88e82fe7…
• virustotal.com/gui/ip-address/194.31.55.131/relations
• virustotal.com/gui/file/cb9405390b4eb81beebb91ee596f77…
• virustotal.com/gui/file/75395359af2d61b2434d68fbee12eb…
• cert.gov.ua/article/4697016 (Ukrainian)
• virustotal.com/gui/ip-address/172.104.62.59/relations
• search.censys.io/hosts/38.180.206.61
• virustotal.com/gui/ip-address/79.124.60.180/relations