Skip to content

Instantly share code, notes, and snippets.

View ANeilan's full-sized avatar

Alan Neilan ANeilan

27 followers · 10 following
View GitHub Profile
@ANeilan
ANeilan / stuff-i-found-2020-04-18.md
Created April 18, 2020 19:38
stuff i found while going through certstream data overnight
URL IP Address Threat Actor Email(s)
http://784119.cf/att.zip.zip 31.220.17.248 [email protected]
http://apkagain.xyz/OFFICE.zip 91.234.99.200 [email protected]
http://cm-vfxira.ddns.net/sharepoint.zip 111.90.149.203 [email protected]
http://elpatroni.ddns.net/yahoo/ATtt.zip `15.223.68.22
@ANeilan
ANeilan / stuff-i-found-today-2020-04-17.md
Created April 17, 2020 18:26
stuff i found today while i was on break, combing through certstream data
URL IP Address Threat Actor Emails
http://africads12.xyz/popup%20(2).zip 162.241.27.152 No Email: +4932221097517
http://amigocanino.club/acessar.zip 104.24.112.110,104.24.113.110 No Email: 216.172.161.27
http://gidlellc.xyz/txt/txt.zip 46.17.96.124 [email protected]
http://instatop.cf/Box/Box.zip 192.185.112.213 [email protected]
http://lqanchodien.anffgaming.tk/accgame123kcom.rar 103.27.62.57 [email protected]
`http://microsecurities.tk/pdf2020.
@ANeilan
ANeilan / stuff-i-found-yesterday (2020-04-16).md
Created April 17, 2020 13:58
stuff i found combing through certstream data (2020-04-16)
@ANeilan
ANeilan / phishing_sites_on_178.159.36.41.md
Last active February 26, 2025 11:27
phishing sites i found from certificate data for sites that resolve to 178.159.36.41

IP: 178.159.36.41
Netblock (using Whois info): 178.159.36.0-178.159.36.255
ASN: 35196 IHOR-AS, RU
Whois Email for IP: [email protected]
Whois Email / SOA for domains: [email protected]

URL Type
hxxp://icloud.com-findmyphone.in/admin/login.php iPanel Pro
hxxp://www.apps.care/apple/admin/login.php Sign In - iPanel
@ANeilan
ANeilan / 16shop_details.txt
Created April 11, 2019 20:06
# registration details from sending post request to 16shop.club/api/setting/get_setting.php "domain=<blah>"
login.appleid.apples.idmsa.account.locked.sumarry-intl-cloud.com
IP: 162.144.72.165
HTTP/1.1 200 OK
Connection: keep-alive
Content-Encoding: gzip
Content-Type: application/json
@ANeilan
ANeilan / paypalaccount-servicereviwe.com_signin-deobfuscated.html
Created January 1, 2019 15:11
decrypted/deobfuscated html source code from a paypal phishing site
<!DOCTYPE html>
<html>
<head>
<title>Connect your Google account, check out faster on your devices</title>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=yes">
<meta name="robots" content="noindex, nofollow, noarchive, nosnippet, noodp, noydir">
<link rel="shortcut icon" href="assets/img/favicon.ico">
<link rel="apple-touch-icon" href="assets/img/apple-touch-icon.png">
<link rel="stylesheet" href="assets/css/signin_style.css">
@ANeilan
ANeilan / appieid.mantecadospamifiesta.com_Login.php_decrypted_deobfuscated_source_code.html
Created January 1, 2019 05:13
<!DOCTYPE html>
<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<meta content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no" name="viewport">
<title>Sign In</title>
<link href="assets/img/favicon.ico" rel="shortcut icon" type="image/x-icon">
<link href="assets/css/First.css" media="all" rel="stylesheet" type="text/css">
<link href="assets/css/Second.css" rel="stylesheet" type="text/css">
<link href="assets/css/Fonts.css" rel="stylesheet" type="text/css">
@ANeilan
ANeilan / keybase.md
Created October 28, 2018 14:56

Keybase proof

I hereby claim:

  • I am aneilan on github.
  • I am w00dsman (https://keybase.io/w00dsman) on keybase.
  • I have a public key ASC4oqlnqsBSi7qrJ2i-2zXQpCk1Z2Xeo3-ieyrs7TEbSgo

To claim this, I am signing this object:

@ANeilan
ANeilan / debug_make.log
Created June 27, 2017 12:47
debug version of make.log from 'rvm install ruby-2.3.0 --debug'
+__rvm_make:0> make -j4
CC = gcc
LD = ld
LDSHARED = gcc -shared
CFLAGS = -O3 -fno-fast-math -ggdb3 -Wall -Wextra -Wno-unused-parameter -Wno-parentheses -Wno-long-long -Wno-missing-field-initializers -Wunused-variable -Wpointer-arith -Wwrite-strings -Wdeclaration-after-statement -Wimplicit-function-declaration -Wdeprecated-declarations -Wno-packed-bitfield-compat -std=iso9899:1999 -fPIC
XCFLAGS = -D_FORTIFY_SOURCE=2 -fstack-protector -fno-strict-overflow -fvisibility=hidden -DRUBY_EXPORT
CPPFLAGS = -I. -I.ext/include/x86_64-linux -I./include -I.
DLDFLAGS = -Wl,-soname,libruby.so.2.3 -fstack-protector
SOLIBS = -lpthread -ldl -lcrypt -lm
Using built-in specs.
@ANeilan
ANeilan / config.log
Created June 27, 2017 12:46
rvm config.log from debug install of ruby-2.3.0
This file has been truncated, but you can view the full file.
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
It was created by configure, which was
generated by GNU Autoconf 2.69. Invocation command line was
$ ./configure --prefix=/home/aneilan/.rvm/rubies/ruby-2.3.0 --disable-install-doc --enable-shared
## --------- ##
## Platform. ##