Export from MISP Threat Report Nile Phish - attacks again Egyptian civil society Threat Report Nile Phish - attacks again Egyptian civil society 89 2017-01-16T00:00:00+00:00 2017-01-31T13:49:48+00:00 Open Network activity Network activity: account-google.serveftp.com (MISP Attribute #15651) Malware Artifacts Domain Watchlist Network activity: account-google.serveftp.com (MISP Attribute #15651) account-google.serveftp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: aramex-shipping.servehttp.com (MISP Attribute #15652) Malware Artifacts Domain Watchlist Network activity: aramex-shipping.servehttp.com (MISP Attribute #15652) aramex-shipping.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: device-activation.servehttp.com (MISP Attribute #15653) Malware Artifacts Domain Watchlist Network activity: device-activation.servehttp.com (MISP Attribute #15653) device-activation.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: dropbox-service.serveftp.com (MISP Attribute #15654) Malware Artifacts Domain Watchlist Network activity: dropbox-service.serveftp.com (MISP Attribute #15654) dropbox-service.serveftp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: dropbox-sign.servehttp.com (MISP Attribute #15655) Malware Artifacts Domain Watchlist Network activity: dropbox-sign.servehttp.com (MISP Attribute #15655) dropbox-sign.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: dropboxsupport.servehttp.com (MISP Attribute #15656) Malware Artifacts Domain Watchlist Network activity: dropboxsupport.servehttp.com (MISP Attribute #15656) dropboxsupport.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: fedex-mail.servehttp.com (MISP Attribute #15657) Malware Artifacts Domain Watchlist Network activity: fedex-mail.servehttp.com (MISP Attribute #15657) fedex-mail.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: fedex-shipping.servehttp.com (MISP Attribute #15658) Malware Artifacts Domain Watchlist Network activity: fedex-shipping.servehttp.com (MISP Attribute #15658) fedex-shipping.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: fedex-sign.servehttp.com (MISP Attribute #15659) Malware Artifacts Domain Watchlist Network activity: fedex-sign.servehttp.com (MISP Attribute #15659) fedex-sign.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: googledriver-sign.ddns.net (MISP Attribute #15660) Malware Artifacts Domain Watchlist Network activity: googledriver-sign.ddns.net (MISP Attribute #15660) googledriver-sign.ddns.net High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: googledrive-sign.servehttp.com (MISP Attribute #15661) Malware Artifacts Domain Watchlist Network activity: googledrive-sign.servehttp.com (MISP Attribute #15661) googledrive-sign.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: google-maps.servehttp.com (MISP Attribute #15662) Malware Artifacts Domain Watchlist Network activity: google-maps.servehttp.com (MISP Attribute #15662) google-maps.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: googlesecure-serv.servehttp.com (MISP Attribute #15663) Malware Artifacts Domain Watchlist Network activity: googlesecure-serv.servehttp.com (MISP Attribute #15663) googlesecure-serv.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: googlesignin.servehttp.com (MISP Attribute #15664) Malware Artifacts Domain Watchlist Network activity: googlesignin.servehttp.com (MISP Attribute #15664) googlesignin.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: googleverify-signin.servehttp.com (MISP Attribute #15665) Malware Artifacts Domain Watchlist Network activity: googleverify-signin.servehttp.com (MISP Attribute #15665) googleverify-signin.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: mailgooglesign.servehttp.com (MISP Attribute #15666) Malware Artifacts Domain Watchlist Network activity: mailgooglesign.servehttp.com (MISP Attribute #15666) mailgooglesign.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: myaccount.servehttp.com (MISP Attribute #15667) Malware Artifacts Domain Watchlist Network activity: myaccount.servehttp.com (MISP Attribute #15667) myaccount.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: secure-team.servehttp.com (MISP Attribute #15668) Malware Artifacts Domain Watchlist Network activity: secure-team.servehttp.com (MISP Attribute #15668) secure-team.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: security-myaccount.servehttp.com (MISP Attribute #15669) Malware Artifacts Domain Watchlist Network activity: security-myaccount.servehttp.com (MISP Attribute #15669) security-myaccount.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: verification-acc.servehttp.com (MISP Attribute #15670) Malware Artifacts Domain Watchlist Network activity: verification-acc.servehttp.com (MISP Attribute #15670) verification-acc.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: dropbox-verfy.servehttp.com (MISP Attribute #15671) Malware Artifacts Domain Watchlist Network activity: dropbox-verfy.servehttp.com (MISP Attribute #15671) dropbox-verfy.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: fedex-s.servehttp.com (MISP Attribute #15672) Malware Artifacts Domain Watchlist Network activity: fedex-s.servehttp.com (MISP Attribute #15672) fedex-s.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: watchyoutube.servehttp.com (MISP Attribute #15673) Malware Artifacts Domain Watchlist Network activity: watchyoutube.servehttp.com (MISP Attribute #15673) watchyoutube.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: verification-team.servehttp.com (MISP Attribute #15674) Malware Artifacts Domain Watchlist Network activity: verification-team.servehttp.com (MISP Attribute #15674) verification-team.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: securityteam-notify.servehttp.com (MISP Attribute #15675) Malware Artifacts Domain Watchlist Network activity: securityteam-notify.servehttp.com (MISP Attribute #15675) securityteam-notify.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: secure-alert.servehttp.com (MISP Attribute #15676) Malware Artifacts Domain Watchlist Network activity: secure-alert.servehttp.com (MISP Attribute #15676) secure-alert.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: quota-notification.servehttp.com (MISP Attribute #15677) Malware Artifacts Domain Watchlist Network activity: quota-notification.servehttp.com (MISP Attribute #15677) quota-notification.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: notification-team.servehttp.com (MISP Attribute #15678) Malware Artifacts Domain Watchlist Network activity: notification-team.servehttp.com (MISP Attribute #15678) notification-team.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: fedex-notification.servehttp.com (MISP Attribute #15679) Malware Artifacts Domain Watchlist Network activity: fedex-notification.servehttp.com (MISP Attribute #15679) fedex-notification.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: docs-mails.servehttp.com (MISP Attribute #15680) Malware Artifacts Domain Watchlist Network activity: docs-mails.servehttp.com (MISP Attribute #15680) docs-mails.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: restricted-videos.servehttp.com (MISP Attribute #15681) Malware Artifacts Domain Watchlist Network activity: restricted-videos.servehttp.com (MISP Attribute #15681) restricted-videos.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: dropboxnotification.servehttp.com (MISP Attribute #15682) Malware Artifacts Domain Watchlist Network activity: dropboxnotification.servehttp.com (MISP Attribute #15682) dropboxnotification.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: moi-gov.serveftp.com (MISP Attribute #15683) Malware Artifacts Domain Watchlist Network activity: moi-gov.serveftp.com (MISP Attribute #15683) moi-gov.serveftp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: activate-google.servehttp.com (MISP Attribute #15685) Malware Artifacts Domain Watchlist Network activity: activate-google.servehttp.com (MISP Attribute #15685) activate-google.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: googlemaps.servehttp.com (MISP Attribute #15686) Malware Artifacts Domain Watchlist Network activity: googlemaps.servehttp.com (MISP Attribute #15686) googlemaps.servehttp.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 108.61.176.96 (MISP Attribute #15399) Malware Artifacts IP Watchlist Network activity: 108.61.176.96 (MISP Attribute #15399) 108.61.176.96 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 104.238.191.204 (MISP Attribute #15400) Malware Artifacts IP Watchlist Network activity: 104.238.191.204 (MISP Attribute #15400) 104.238.191.204 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: 176.123.26.42 (MISP Attribute #15358) Malware Artifacts IP Watchlist Network activity: 176.123.26.42 (MISP Attribute #15358) 176.123.26.42 High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: secure.policy.check@gmail.com (MISP Attribute #15374) Malware Artifacts Malicious E-mail Payload delivery: secure.policy.check@gmail.com (MISP Attribute #15374) secure.policy.check@gmail.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: aramex.shipment@gmail.com (MISP Attribute #15375) Malware Artifacts Malicious E-mail Payload delivery: aramex.shipment@gmail.com (MISP Attribute #15375) aramex.shipment@gmail.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: fedex_tracking@outlook.sa (MISP Attribute #15376) Malware Artifacts Malicious E-mail Payload delivery: fedex_tracking@outlook.sa (MISP Attribute #15376) fedex_tracking@outlook.sa None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: mails.acc.noreply@gmail.com (MISP Attribute #15377) Malware Artifacts Malicious E-mail Payload delivery: mails.acc.noreply@gmail.com (MISP Attribute #15377) mails.acc.noreply@gmail.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: fedex.noreply@gmail.com (MISP Attribute #15378) Malware Artifacts Malicious E-mail Payload delivery: fedex.noreply@gmail.com (MISP Attribute #15378) fedex.noreply@gmail.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: customerserviceonlineteam@gmail.com (MISP Attribute #15379) Malware Artifacts Malicious E-mail Payload delivery: customerserviceonlineteam@gmail.com (MISP Attribute #15379) customerserviceonlineteam@gmail.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: fedexcustomers.service@gmail.com (MISP Attribute #15380) Malware Artifacts Malicious E-mail Payload delivery: fedexcustomers.service@gmail.com (MISP Attribute #15380) fedexcustomers.service@gmail.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: elnadeem.org@gmail.com (MISP Attribute #15381) Malware Artifacts Malicious E-mail Payload delivery: elnadeem.org@gmail.com (MISP Attribute #15381) elnadeem.org@gmail.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: dropbox.noreplay@gmail.com (MISP Attribute #15382) Malware Artifacts Malicious E-mail Payload delivery: dropbox.noreplay@gmail.com (MISP Attribute #15382) dropbox.noreplay@gmail.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: mails.noreply.verify@gmail.com (MISP Attribute #15383) Malware Artifacts Malicious E-mail Payload delivery: mails.noreply.verify@gmail.com (MISP Attribute #15383) mails.noreply.verify@gmail.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: fedex.mails.shipping@gmail.com (MISP Attribute #15384) Malware Artifacts Malicious E-mail Payload delivery: fedex.mails.shipping@gmail.com (MISP Attribute #15384) fedex.mails.shipping@gmail.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: dropbox.notifications.mails@gmail.com (MISP Attribute #15385) Malware Artifacts Malicious E-mail Payload delivery: dropbox.notifications.mails@gmail.com (MISP Attribute #15385) dropbox.notifications.mails@gmail.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: dropbox.notfication@gmail.com (MISP Attribute #15649) Malware Artifacts Malicious E-mail Payload delivery: dropbox.notfication@gmail.com (MISP Attribute #15649) dropbox.notfication@gmail.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Payload delivery Payload delivery: drive.noreply.mail@gmail.com (MISP Attribute #15650) Malware Artifacts Malicious E-mail Payload delivery: drive.noreply.mail@gmail.com (MISP Attribute #15650) drive.noreply.mail@gmail.com None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none citizenlab ../../../descendant-or-self::node()