#balada #inject #wordpress
Domains related to balada injection:
bind.bestresulttostart[.]com
js.cdntoswitchspirit[.]com
jquery.restartyourchoices[.]com
done.restartyourchoices[.]com
#TA569
More domains:
friscomusicgroup[.]com
greenpapers[.]org
quaryget[.]org
getquery[.]org
#TA569
assistpayout[.]org
backendjs[.]org
devcodejs[.]org
devqeury[.]org
jqscr[.]com
jqueryh[.]org
jqueryns[.]com
jsqur[.]com
jsviewdev[.]org
l9j2sm5mxz.jqscr[.]com
Ref: virustotal.com/gui/ip-addres…
#ViperSoftX is back, doesn't look like much has changed.
c2 arrowlchat[.]com
Still fetching powershell txt records from privatproxy-schnellvpn[.]xyz
