← All actors Recent activity

GAZA

GAZA · ta402

Indicators
264
Source reports
37
Activity span
not dated
Newest indicator
unknown
Upstream change
2026-01-02
20152023

Overview 264 indicators

No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.

domain257GAZA-domain.txt
url4GAZA.json
ipv42GAZA.json
url_path1GAZA.json

Principal sources 37 reports

Ranked by how many of this actor's indicators each report brought in.

What the sources have in common — not a claim that these are the same actor. See the whole graph.

Timeline 264 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

  1. 1 domain3 yrs ago

    sentinelone.com/labs/gaza-cybergang-unified-front-targe… · otx.alienvault.com/pulse/657b6fc5f21adc5b57300979 · app.any.run/tasks/3e9d412a-49c9-48db-8b1f-f6fe55414…

    nicoledotso.icu

  2. 5 domain3 yrs ago

    sentinelone.com/labs/gaza-cybergang-unified-front-targe…

    aracaravan.com
    beatricewarner.com
    claire-conway.com
    jane-chapman.com
    wayne-lashley.com

  3. 3 domain3 yrs ago

    proofpoint.com/us/blog/threat-insight/ta402-uses-compl…

    healthcaption.com
    inclusive-economy.com
    theconomics.net

  4. 5 domain3 yrs ago

    securelist.com/gaza-cybergang-updated-2017-activity/82…

    data-server.cloudns.club
    newshelpyou.com
    topsite.life
    update.newshelpyou.com
    updatesforme.club

  5. 1 domain, 1 ipv44 yrs ago

    virustotal.com/gui/file/46e09a0d320f63deb6b13ce6986188…

    domainmythrow.ddns.net
    ipv4149.28.137.224:10101

  6. 2 domain4 yrs ago

    proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale… · otx.alienvault.com/pulse/6202a3f984b0c0b13f2c88f8

    easyuploadservice.com
    uggboots4sale.com

  7. 2 domain, 2 url4 yrs ago

    twitter.com/h2jazi/status/1486094915872473096 · zscaler.com/blogs/security-research/new-espionage-a… · virustotal.com/gui/file/2a9857f5b247488166e25d42f81945… · virustotal.com/gui/file/b2260d530f51b2289e2c64579eb53c…

    domainbundanesia.com
    domainmsupdata.com
    urlhttp://23.94.218.221
    urlhttp://45.63.49.202

  8. 1 domain, 1 url4 yrs ago

    virustotal.com/gui/file/973b2140bdba4f08306ab39a2245d6…

    domainsognostudio.com
    urlhttp://185.244.39.165

  9. 1 url5 yrs ago

    proofpoint.com/us/blog/threat-insight/new-ta402-molera… · otx.alienvault.com/pulse/60cb37bf5fe8246bb2556969

    http://192.210.151.43

  10. 1 domain, 1 url_path6 yrs ago

    malpedia.caad.fkie.fraunhofer.de/details/win.molerat_loader · virustotal.com/gui/file/df3cf22649e723b82bab789e12055f…

    domainh908926f.beget.tech
    url_path/rat/startup.rat

  11. 1 domain6 yrs ago

    welivesecurity.com/2020/07/14/welcome-chat-secure-messagin… · otx.alienvault.com/pulse/5f0dcfcaedaed628a054183d

    emobileservices.club

  12. 1 domain6 yrs ago

    twitter.com/JAMESWT_MHT/status/1268471328320913410 · app.any.run/tasks/648c8a6d-6586-433f-ab65-5f4dd4b92…

    vinnysvinyl.com

  13. 13 domain6 yrs ago

    unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor · twitter.com/jeFF0Falltrades/status/1173300902242988… · otx.alienvault.com/pulse/5d7f50c9b115a641c04aacd6

    adsmartweb9.com
    cloudserviceapi.online
    goldenlines.site
    itresolver.online
    laptower.com
    masterservices.online
    minesaxess.net
    msexchange13.com
    msexchanges16.com
    nextdata.site
    officemanage.site
    servicebios.com
    zmartco.com

  14. 4 domain6 yrs ago

    cybereason.com/blog/new-cyber-espionage-campaigns-targ… · otx.alienvault.com/pulse/5e46d6556e222319f332ec9a · unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor · twitter.com/jeFF0Falltrades/status/1173300902242988… · otx.alienvault.com/pulse/5d7f50c9b115a641c04aacd6

    laceibagrafica.com
    motoqu.com
    nysura.com
    webtutorialz.com

  15. 1 domain6 yrs ago

    sentinelone.com/labs/gaza-cybergang-unified-front-targe… · otx.alienvault.com/pulse/657b6fc5f21adc5b57300979 · app.any.run/tasks/3e9d412a-49c9-48db-8b1f-f6fe55414…

    nicoledotson.icu

  16. 1 domain7 yrs ago

    clearskysec.com/wp-content/uploads/2016/01/Operation%20…

    dorcertg.otzo.com

  17. 1 ipv47 yrs ago

    twitter.com/Timele9527/status/1200235223595618304

    79.124.60.40:80

  18. 102 domain7 yrs ago

    clearskysec.com/wp-content/uploads/2016/01/Operation%20…

    0arfx4grailorhvlicbj.servehumour.com
    0n4tblbdfncaauxioxto.ddns.net
    3tshhm1nfphiqqrxbi8c.servehumour.com
    aaas.mefound.com
    acc.buybit.us
    accounts-helper.ml
    adfdafsggdfgdfgsagaer.blogsyte.com
    aqs.filezellasd.co.vu
    baz.downloadcor.xyz
    bulk-smtp.xyz
    buy.israel-shipment.xyz
    cl170915.otzo.com
    cyaxsnieccunozn0erih.mefound.com
    d.nabzerd.co.vu
    debka.ga
    dfwsd.co.vu
    direct-marketing.ml
    directl.otzo.com
    dontrplay.tk
    down.downloadcor.xyz
    down.supportcom.xyz
    ed3qy5yioryitoturysuiu.otzo.com
    email-market.ml
    email-test.ml
    emailotest.co.vu
    facetoo.co.vu
    filezellla.otzo.com
    gabro.xxuz.com
    gamail.goaglesmtp.co.vu
    games.buybit.us
    gfhbgfzfgfgfgdg.otzo.com
    goodwebmail.tk
    googledomain.otzo.com
    hdgshfdgh.co.vu
    helthnews.ga
    hostgatr.mrface.com
    hr.goaglesmtp.co.vu
    idf.idfcom.co.vu
    imazing.ga
    info.intarspace.co.vu
    infoblusa.tk
    iphonenewsd.co.vu
    jake.support-sales.tk
    jenneaypreff.linkpc.net
    krowd.downloadcor.xyz
    lkvz7bsfuiaidsyynu7bd2owpe.dns05.com
    mailweb.otzo.com
    marki.mefound.com
    markit.mefound.com
    markting-fac.tk
    markting.mefound.com
    marktingvb.ml
    mossad.mefound.com
    ms.suppoit.xyz
    new.newlan.co.vu
    newdowr.otzo.com
    news.bulk-smtp.xyz
    news.buybit.us
    news.net-freaks.com
    news015.otzo.com
    news20158.co.vu
    ns.suppoit.xyz
    ra.goaglesmtp.co.vu
    sales-spy.ml
    sales.blogsyte.com
    sales.intarspace.co.vu
    sales.suppoit.xyz
    salesmarkting.co.vu
    ser.esmtp.biz
    singin.loginto.me
    sip.supportcom.xyz
    sky.otzo.com
    skynews1.blogsyte.com
    smtp.email-test.ml
    smtp.gq
    smtpa.dynamic-dns.net
    socks.israel-shipment.xyz
    spynews.otzo.com
    star.mefound.com
    star.yaneom.space
    sub.submitfda.co.vu
    submit.mrface.com
    sup.mefound.com
    supo.mefound.com
    support-sales.tk
    support.bkyane.xyz
    support.markting-fac.tk
    support.mypsx.net
    suppot-sales.mefound.com
    transkf.tk
    us-update.com
    us.suppoit.xyz
    v6.support-sales.tk
    vbdodo.mefound.com
    version.downloadcor.xyz
    wallnet.zyns.com
    wembail.supportmai.cf
    word.2waky.com
    xr.downloadcor.xyz
    yaneom.ml
    yaneom.space.co
    zapt.zapto.org

  19. 1 domain7 yrs ago

    unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor · twitter.com/jeFF0Falltrades/status/1173300902242988… · otx.alienvault.com/pulse/5d7f50c9b115a641c04aacd6

    dapoerwedding.com

  20. 1 domain7 yrs ago

    twitter.com/James_inthe_box/status/1171510993857347… · app.any.run/tasks/cb96df9e-25f4-4d24-b4f8-c176938e2…

    freshchrysanthemum.com

  21. 7 domain7 yrs ago

    otx.alienvault.com/pulse/5cae20f3a01b640c6da1441e

    dji-msi.2waky.com
    mmh.ns02.us
    ramliktest.mynetav.org
    saso10.myftp.biz
    testhoward.mysecondarydns.com
    testmace.compress.to
    time-loss.dns05.com

  22. 1 domain7 yrs ago

    otx.alienvault.com/pulse/5cae20f3a01b640c6da1441e · clearskysec.com/wp-content/uploads/2016/01/Operation%20…

    supports.mefound.com

  23. 10 domain7 yrs ago

    securelist.com/gaza-cybergang-updated-2017-activity/82…

    alasra-paper.duckdns.org
    download.data-server.cloudns.club
    hamas-wathaq.duckdns.org
    hnoor.newphoneapp.com
    lol.mynetav.org
    manual.newphoneapp.com
    moreoffer.life
    ping.topsite.life
    signup.updatesforme.club
    upgrade.newshelpyou.com

  24. 4 domain7 yrs ago

    twitter.com/silv0123/status/1075047190819717122 · otx.alienvault.com/pulse/5cae20f3a01b640c6da1441e

    checktest.www1.biz
    fulltest.yourtrap.com
    microsoft10.compress.to
    wiknet.wikaba.com

  25. 1 domain7 yrs ago

    ti.360.net/blog/articles/suspected-molerats-new-at… · twitter.com/Timele9527/status/1200235223595618304 · unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor · twitter.com/jeFF0Falltrades/status/1173300902242988… · otx.alienvault.com/pulse/5d7f50c9b115a641c04aacd6

    smartweb9.com

  26. 3 domain8 yrs ago

    securelist.com/blog/research/72283/gaza-cybergang-wher…

    natco2.no-ip.net
    natco4.no-ip.net
    uae.kim

  27. 68 domain9 yrs ago

    securelist.com/blog/research/72283/gaza-cybergang-wher…

    ajaxo.zapto.org
    backjadwer.bounceme.net
    backop.mooo.com
    bandao.publicvm.com
    bypasstesting.servehalflife.com
    cbbnews.tk
    cccam.serveblog.net
    chromeupdt.tk
    cyber-peace.org
    cyber18.no-ip.net
    deapka.sytes.net
    depka.sytes.net
    download.likescandy.com
    downloadskype.cf
    duntat.zapto.org
    fastbingcom.sytes.net
    fatihah.zapto.org
    gaonsmom.redirectme.net
    goodday.zapto.org
    google.com.r3irv2ykn0qnd7vr7sqv7kg2qho3ab5tngl5avxi5iimz1jxw9pa9.uae.kim
    googlecombq6xx.ddns.net
    gov.uae.kim
    gq4bp1baxfiblzqk.mrbasic.com
    haartezenglish.redirectme.net
    haartezenglish.strangled.net
    httpo.sytes.net
    internetdownloadr.publicvm.com
    justded.justdied.com
    kaliob.selfip.org
    kaswer12.strangled.net
    lastmoon.mooo.com
    lilian.redirectme.net
    live.isasecret.com
    mailchat.zapto.org
    mp4.servemp3.com
    natco1.no-ip.net
    natco3.no-ip.net
    natco5.no-ip.net
    nazer.zapto.org
    nrehcnthrtfmyi.strangled.net
    ns2.negociosdesucesso.info
    offeline.webhop.net
    orango.redirectme.net
    redirectlnk.redirectme.net
    removalmalware.servecounterstrike.com
    rgoyfuadvkebxhjm.ddns.net
    rotter2.sytes.net
    safar.selfip.com
    safari.linkpc.net
    spreng.vizvaz.com
    store-legal.biz
    su.noip.us
    tango.zapto.org
    test.cable-modem.org
    test.ns01.info
    testcom.strangled.net
    thenewupdate.chickenkiller.com
    thenewupdatee.redirectme.net
    tvnew.otzo.com
    up.uae.kim
    updatee.hopto.org
    updatee.serveblog.net
    updato.ns01.info
    uptime.uae.kim
    use.mooo.com
    wcf6f0nqvjtup4un.mooo.com
    ynet.ignorelist.com
    ynet.sytes.net

  28. 4 domain9 yrs ago

    securelist.com/blog/research/72283/gaza-cybergang-wher… · clearskysec.com/wp-content/uploads/2016/01/Operation%20…

    cnaci8gyolttkgmguzog.ignorelist.com
    dnsfor.dnsfor.me
    ksm5sksm5sksm5s.zzux.com
    update.ciscofreak.com

  29. 10 domain9 yrs ago

    securelist.com/blog/research/72283/gaza-cybergang-wher…

    downloadlog.linkpc.net
    downloadmyhost.zapto.org
    help2014.linkpc.net
    kolabdown.sytes.net
    noredirecto.redirectme.net
    rotter2.publicvm.com
    safara.sytes.net
    wallanews.publicvm.com
    wallanews.sytes.net
    webfile.myq-see.com

  30. 1 domain9 yrs ago

    securelist.com/gaza-cybergang-updated-2017-activity/82…

    newphoneapp.com

  31. 1 domain11 yrs ago

    clearskysec.com/wp-content/uploads/2016/01/Operation%20…

    drivres-update.info

  32. 1 domain11 yrs ago

    twitter.com/BaoshengbinCumt/status/1352845385891373… · virustotal.com/gui/file/d48fe4b28ef4e5fb666d4f03247b31… · virustotal.com/gui/file/fa02e02e3db4076fd03fb54cd38bd6…

    javaupdate.no-ip.info

Further reading 37