AMERISAVE.COM
AMERISAVE.COM
Group: clop
Discovered by ransomware.live: 2023-07-26
Estimated attack date: 2023-07-26
Description:
Low Mortgage Rates & Quick Approvals - AmeriSave
🕵️ Infostealer activity detected by HudsonRock
Compromised Employees: 0
Compromised Users: 366
Third Party Employee Credentials: 2
External Attack Surface: 31
DNS Records:
The following DNS records were found for the victim's domain.
WHOIS Emails
- domain.operations web.com
MX Records
- amerisave-com.mail.protection.outlook.com.
TXT Records
- v=spf1 mx ip4:168.245.0.0/17 ip4:149.72.0.0/16 ip4:10.1.20.25/32 ip4:20.85.29.106/32 include:spf.protection.outlook.com include:_spf.psm.knowbe4.com include:spf.emailsignatures365.com include:spf-us.emailsignatures365.com include:spfa.cpmails.com include:" "_spf.salesforce.com include:relay.bswi" "ft.com include:relay.mailchannels.net -all
- docusign=f3003cef-3130-440f-81ae-708b4c72deb3
- google-site-verification=SqpXcZRCw5kRLQ4JW7n39OgDFd0SaffxTFSpSGNB140
- apple-domain-verification=DhOwFK2wGyedOKUB
- adobe-idp-site-verification=a7e15e4e66c5c36d7b797aebd7a4a30bcdb4b035d3a1abff231bfb596dc2167a
- atlassian-domain-verification=OFeWzCNfGgS6nOGrDaIYLCiZ27TSoL8AcWdGgamZHmNkK1wC4NeLWXglO5Dpieqc
- dfef5e37-e473-4e43-ba8d-7536aad9fa4c
- MS=ms23496257
- google-site-verification=C4rsk0VKKfb1kYPFXxUmPyDxUIT0gu1ZCuZDMmo5EYk
- IeIVDHgiMc/PQW/aR1HqKSosWkL/UNCTXoVrsNgfEPfPaw0RTMbA1JtUzyuAusW00vQbe70SEylsjMpqmuhJOw==
- smartsheet-site-validation=G_TTCY7iPJJTP2OY9knM0z0lsHDb7smE
- facebook-domain-verification=zs4yifhmnc1axm4wjt7muxe4toojan
- mgverify=7466b37bb002eefe69bc4139119397b5e6e82a5f47acc589b2bbc9cc4952ef37
- google-site-verification=b_LH-ENCysFOI4iccACJXW5dU7_OlJNVgNMXEpFtbCs
Cloud / SaaS Services Detected
Adobe
Apple
Atlassian
Microsoft 365
KnowBe4
DocuSign
Leak Screenshot:
