sysgoblin

sysgoblin

sysgoblin

sysgoblin

sysgoblin

Kit	Domain	Threat Actor Emails
16Shop	account-security.ideeprince.com	[email protected], [email protected]
16Shop	amaz0n.develop01managing-6540982nc.com	[email protected], [email protected]
16Shop	amaz0n.openaccesslogin.com	[email protected], [email protected]
16Shop	amazon-s.xyz	[email protected], [email protected]
16Shop	appaypal-accountloginverification.gleeze.com	[email protected], [email protected]
16Shop	appaypal-accountloginverificationreq.gleeze.com	[email protected], [email protected]
16Shop	appaypal-accountloginverify.gleeze.com	[email protected], [email protected]
16Shop	appaypal-accountverificationreq.gleeze.com

sysgoblin

[16Shop]		    104.248.55.11		web.verify-acc.amz2020.app-lockedaccesverifed000.com		[email protected], [email protected]
[16Shop]		    104.31.64.248		appleupdates-verificationrequired.com		[email protected], [email protected]
[16Shop]		    134.122.1.92		web.amazon.aws.services-auth-follow.loginsupport.org		[email protected], [email protected]
[16Shop]		    157.230.126.157		billingsecure.amazon.com.dsabekogia.com		[email protected], [email protected]
[16Shop]		    161.117.250.188		auth-verify.paypal.idwebscr.webapps23687618.tempekjaran1.com		[email protected], [email protected]
[16Shop]		    162.144.98.230		manage-secure.information-paypal.gaspolinaja.com		[email protected], [email protected]
[16Shop]		    162.144.98.230		secure-paypal.bangetdivorce.com		[email protected], [email protected]
[16Shop]		    162.214.49.197		authorized2-signin-amazon.camdvr.org		
[16Shop]		    162.214.50.13		signin-webrecovery-br8eapple.serveuser.com		[email protected], resultmrsukarelap

sysgoblin

# 16Shop
account-securityid-accesslmted.cafieajf.com                 [email protected], admin.16shop.co
amazon.co.jp.1ad6332e10f94e94ca940de69248.info              [email protected], [email protected]
amazonalert.ddns.net
amazonsecurityaccount.mailservactiongolf2.com               [email protected], [email protected]
amznupdates-verificationrequired.com	                      [email protected], [email protected]
app.sign.in.amazon.jp.langf-jp.3ov.b.cusnevama.com          [email protected], [email protected]
appaypal-accountverification.gleeze.com	                    [email protected], [email protected]
apple-accountsignin-verification.com	                      [email protected], [email protected]
appledetailsinformation.attachementmeappconfirm.com

sysgoblin

# for PoSh v7+
# requires appropriate privileges and network access
# change "1..250" and "10.0.0." to scan the range you want

1..250 | ForEach-Object -Parallel {
    try {
        $h = (Resolve-DnsName "10.0.0.$_" -ErrorAction Break).NameHost
        $os = Get-CimInstance -computername $h -Query "Select CSName, BuildNumber from Win32_OperatingSystem" -ErrorAction Break 
        if ([int]$os.BuildNumber -ge 18362) { # 18362 = 1903, 18363 = 1909
            dir "\\$($h)\c$" | out-null # open smb connection to remote host

sysgoblin

Keybase proof

I hereby claim:

• I am sysgoblin on github.
• I am sysg0blin (https://keybase.io/sysg0blin) on keybase.
• I have a public key ASD0Jhe7R2wvFlYnh2DdVeCKo38UaLEnjQYYVmIhnv3ZpAo

To claim this, I am signing this object: