Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

CIRCL OSINT Feed

ThreatFox MISP Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Over a five-month period, multiple malicious campaigns operated through a single bulletproof hosting provider, AS202412 (OMEGATECH LTD, Seychelles). These campaigns used disposable domains, fake CAPTCHA pages to trick victims into executing commands, and varied infrastructure including compromised websites, cloud storage, blockchain-based C2 addresses, and trojanized installers. Despite differing payloads and methods, all campaigns initiated contact via the same hosting provider. Successful infections deployed stealers and remote access tools with persistence across reboots. Most browser visits ended at the lure page without execution.

Four distinct malicious chains operated over five months through the bulletproof hosting provider AS202412 registered to OMEGATECH LTD in Seychelles. Each campaign began with fake CAPTCHA pages employing the ClickFix technique, instructing victims to paste commands into Windows Run dialogs. The campaigns used disposable domains with similar naming conventions, compromised legitimate websites, and diverse infrastructure including cloud storage, blockchain-resolved command and control addresses, and trojanized installers. Although payloads and staging varied, all chains initiated contact through AS202412, which expanded its IP allocations during the observation period. While most browser contacts did not lead to execution, successful compromises deployed information stealers and remote access tools with persistence mechanisms that survive system reboots.

Detailed information about Disposable Domains, Durable Hosting. Get real-time updates, technical details, and mitigation strategies.

Disposable Domains, Durable Hosting - Live Threat Intelligence - Threat Radar | OffSeq.com

Disposable Domains, Durable Hosting

Threats Tagged 'as202412'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'as202412'

Lead Pen Test Professional