Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business

Logo PHOENIX.EDU

Group: Clop

Discovered by ransomware.live: 2025-11-21

Estimated attack date: 2025-11-21

Country: US

Description:

[AI generated] Phoenix.edu is the online portal for the University of Phoenix, a for-profit institution that is geared towards adult learners. The university offers degree programs at the associate's, bachelor's, master's and doctoral levels across a range of disciplines, including business, education, nursing, technology and more. It is recognized for its flexible course schedules, online classes, and professional development opportunities.


🕵️ Infostealer activity detected by HudsonRock

Compromised Employees: 79

Compromised Users: 5632

Third Party Employee Credentials: 296


External Attack Surface: 118


Infostealer Distribution


DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • hostmaster apollo.edu
MX Records
  • mxa-002dbe01.gslb.pphosted.com.
  • mxb-002dbe01.gslb.pphosted.com.
TXT Records
  • y5bNThgLCfXxka3EUFAxkTx7oFXog5PtLs5aMSqjKXSNb0emzlK5cDyFtu9B2o7/dd3SMm5PCmibb8i5F8VTLA==
  • ZOOM_verify_j-E40QuCQMuvOoa1g04Ytg
  • google-site-verification=v4ggzgEPtNCbynYNg8o-ojkDo5440x8dXzmj3pQXPDs
  • Foxit-domain-verification=ea909df0d5fcb6b40f3851bed8ea59a3
  • docusign=bb751c67-da8a-46cb-a2af-dc21c69e85ec
  • atlassian-domain-verification=eAcBeNBTVMFhz2q1WeTy8KlpuYarzPTyLQtLlUVNKrkDnmjZXUL9i1Zd4SDGU3Xa
  • amazonses:E8WANdRZwaBn3022iS9y5RFwS8nMZa6I6LY1HLxxGNY=
  • segment-site-verification=iLtsFZdJbwU0AS3hnwm90Pod6PARw7DR
  • v=spf1 ip4:74.120.231.6 ip4:3.221.97.1 ip4:54.174.254.153 ip4:18.233.30.245 ip4:3.232.53.234 ip4:54.198.41.149 ip4:52.203.192.133 ip4:74.120.224.204 ip4:74.120.224.205 ip4:148.163.155.228 ip4:192.48.98.254 ip4:67.20.178.231 ip4:148.163.147.29 include:spf-" "00809302.pphosted.com include:spf.clearslide.com include:spf.protection.outlook.com include:mktomail.com include:_spf.salesforce.com include:all.spf.avature.net ~all
  • google-site-verification=7c_CInAZx3LoBoe_-VS6QHUmyZKtrKBXE2ECaPB2T_8
  • onetrust-domain-verification=1275e074ffdb4f589e45d60558ce208e
  • sending_domain1056643=8ab068d872beb23cfdb06fc473668ae1f35677f7f3568409460e24c0b2ee157b
  • pardot1056643=a9863900a67c35e1e71f7f106dbb679b14c7dcc2e835d2c145c56944f0cd8390
  • apple-domain-verification=TxWFXcPym4CGflV8
  • google-site-verification=o5DRfgkxs8cHrZsTy-c3n2D9dydYXFxxGrQPc6C85KE
  • adobe-sign-verification=e6b0022a9ecdbdda4bda7b124965beb7
  • MS=ms47423577
  • teamviewer-sso-verification=befda1f9702d4b5cbe3747865d91cb42
  • docusign=9cfe7b17-7559-440b-971c-18d0ea81df94
  • openai-domain-verification=dv-3qV2buW8AE4xO9gtsj17195l
  • slack-domain-verification=f9bkx9fVkL6ccMxjehLeyW9lomo7DoKJkGD41duX
Cloud / SaaS Services Detected
Apple Atlassian Amazon SES/WorkMail Microsoft 365 Salesforce Slack Marketo Segment Teamviewer OneTrust DocuSign Proofpoint Zoom

Leak Screenshot:

Leak Screenshot