Dancho Danchev

Dear blog readers, An image is worth a thousand words. I’ve recently started working on a new project which I executed and achieved with success. It’s basically a malware C&C domains offensive network reconnaissance project where I’m once again feeding back the results into a local MySQL database. Here’s a link to my similar project.

Dear blog readers, The following is a recently data mined compilation of cybercrime-friendly XMPP/Jabber account IDs which I’m sharing with the idea to assist everyone on their cyber threat actor attribution efforts and to assist U.S Law Enforcement on its way to properly track down monitor and prosecute the individuals behind these campaigns. Sample cybercrime-friendlyRead More

Dear blog readers, This is Dancho. How to use this manual testimony? – Reference me Dancho Danchev – My web site (https://malvertising.net) – My research portfolio as PoC (Proof of Concept) (https://archive.org/details/@ddanchev) – My email address (dancho.danchev@hush.com; disruptive.individuals@gmail.com) My key points: – I have never received anyone’s acknowledgment for my achievements or a reward –Read More

Dear blog readers, In this post I’ll post some recent actionable intelligence on the Koobface botnet’s master Leded (Ded Mazai) and Anton Nikolaevich Korotchenko (Антон Николаевич Коротченко) Koobface Botnet Master KrotReal. Leded primary email address account: mrpinkesq@yahoo.com Primary domain: hxxp://moblave.com; hxxp://mobpaty.com Related domain registrations: hxxp://xmob-erotic.comhxxp://xerotic-mob.comhxxp://kinozal3d.comhxxp://mob-vids.comhxxp://mob-dating.nethxxp://mob-dating.comhxxp://mob-dating.orghxxp://mobcelebrity.nethxxp://mobcelebrity.orghxxp://tube4mob.comhxxp://mob-ka-next.comhxxp://mljsprivate.bizhxxp://xmusic-mp3.comhxxp://z-erovideo.comhxxp://z-kinozal3d.comhxxp://eromfpre.comhxxp://x-onlinekino.comhxxp://mp3prosto.comhxxp://prostofiles.comhxxp://online-kinoteatr.bizhxxp://mobile-vista.orghxxp://perfect-erotic.orghxxp://cool-erotic.orghxxp://super-erotic.orghxxp://amazing-erotic.orghxxp://good-erotic.orghxxp://nice-erotic.orghxxp://getgdz.nethxxp://v2mlcelery.comhxxp://mob-ka.comhxxp://salosbros.comhxxp://horomob.comhxxp://horomob.nethxxp://horomob.orghxxp://erotic-mobile.comhxxp://android-igru.bizhxxp://rusx.mobihxxp://horomob.bizhxxp://mtswapservice.com hxxp://eromfpre.comhxxp://v2mlcelery.com Sample photos of Leded: hxxp://v2mlemerald.comhxxp://v2mllavender.comhxxp://v2mlmint.comhxxp://mobcelebrity.comhxxp://tube4mob.comhxxp://mob-dating.comhxxp://mobpaty.comhxxp://mob-vids.comhxxp://mobcelebrity.orghxxp://mob-tube.comhxxp://mob-dating.orghxxp://mob-ka.orghxxp://top-ero.orghxxp://top-files.orghxxp://top-films.orghxxp://top-girls.orghxxp://top-musics.orghxxp://moblave.comhxxp://mob-dating.nethxxp://mobcelebrity.nethxxp://mob-ka-next.comhxxp://v2mlaqua.comhxxp://v2mlamber.comhxxp://v2mlamethyst.comhxxp://x-onlinekino.comhxxp://v2mlpurple.comhxxp://z-kinozal3d.comhxxp://z-erovideo.com hxxp://xmusic-mp3.comhxxp://v2mlorange.comhxxp://v2mlgrey.comhxxp://mobile-vista.orghxxp://perfectgirlsmobile.orghxxp://v2mljs.orghxxp://v2mlviolet.comhxxp://v2mlmagenta.comhxxp://badabooom.comhxxp://horomob.comhxxp://mob-ka.comhxxp://horomob.nethxxp://horomob.orghxxp://mob-ka.nethxxp://getgdz.nethxxp://peretrax-js.comhxxp://xmob-erotic.comhxxp://xerotic-mob.comhxxp://mobpaty.orghxxp://v2mlblack.bizhxxp://v2mlbrown.comhxxp://v2mlyellow.comhxxp://v2mlpink.orghxxp://v2mltraffer.orghxxp://v2mlgreen.orghxxp://v2mljsbs.orghxxp://eroticvideo.bizhxxp://v2mlblue.orghxxp://no-day.comhxxp://mp3prosto.comhxxp://v2mlred.comhxxp://prostofiles.comhxxp://ero-film.comhxxp://peretrax.comhxxp://fustmove.comhxxp://mtswapservice.comhxxp://kinozal3d.comhxxp://pillowerotic.comhxxp://erotic-mobile.comhxxp://android-igru.bizhxxp://online-kinoteatr.bizhxxp://ml404js.bizhxxp://android-mobile.bizhxxp://cool-erotic.orghxxp://good-erotic.orghxxp://super-erotic.orghxxp://beautiful-erotic.org hxxp://your-tree.orghxxp://beautifulerotic.nethxxp://sweet-erotic.orghxxp://amazing-erotic.orghxxp://nice-erotic.orghxxp://ml18js.orghxxp://ml-15-js.orghxxp://ml19js.orghxxp://mlvjs19.orghxxp://m-dating.orghxxp://perfect-erotic.orghxxp://adultvideoxxx.orghxxp://apk-ml.orghxxp://mega-erotic.orghxxp://russiangirlsvideo.orghxxp://erovideoclip.comhxxp://salosbros.comhxxp://gdz2014.orghxxp://horomob.bizhxxp://ml13js.bizhxxp://ml12js.bizhxxp://mljsprivate.bizhxxp://mljs14.bizhxxp://mob-xxx.bizhxxp://ero-video.bizhxxp://mljs16.bizhxxp://ml17js.bizhxxp://rusx.mobi Sample screenshotsRead More

Here we go. It appears that the individuals behind the successful compromise of the Cyberheaven VPN Chrome extensions are currently busy or at least have several other upcoming and in the works campaigns targeting several other vendors of Chrome VPN extensions. The first example is hxxp://censortracker.pro which apparently aims to target the legitimate (hxxp://censortracker.org). RelateRead More

An image is worth a thousand words. Related.

Dear blog readers, I’ve decided to continue my elaboration and provide further actionable intelligence on a well known member of the Darkode cybercrime-friendly forum community Nassef. Nassef is using xavi-linuxer@live.com as his personal email address account and is known to have registered the following domains using it – hxxp://tonymontana.cards – hxxp://tonymontana.cash – hxxp://tonymontana.biz. He’s alsoRead More

If an image is worth a thousand words so is real time OSINT methodology. More on Bulgaria’s Circles here and here. Stay tuned.

Link.  

Link.