Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

baycrestpartners.com

baycrestpartners.com

Discovered 2023-05-02 21:49 UTC
Est. attack date 2023-05-02

Description:

#NationalHazardAgencyWe stole 18 gigabytes of data and documents, including SQL databases and mail backups. You have two choices: pay us or leak 18 gigabytes of documentation.Contact us

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • ba79de789a4e6113401401c707a9a54b3048841b25818c33bc6df8a47a374d82baycrestpartners.com.whoisproxy.org
  • trustandsafetysupport.aws.com
  • ba79de789a4e6113401401c707a9a54bd58290bccf58f0125db22a243b94c6ecbaycrestpartners.com.whoisproxy.org
  • ba79de789a4e6113401401c707a9a54bec1d4f35ace9411779d7f41c3ed7a913baycrestpartners.com.whoisproxy.org
  • ba79de789a4e6113401401c707a9a54b2cd72be702bc4dfb6631a4edd207672abaycrestpartners.com.whoisproxy.org
MX Records
  • d350416a.ess.barracudanetworks.com. Barracuda
  • d350416b.ess.barracudanetworks.com. Barracuda
TXT Records
  • v=spf1 include:spf.ess.barracudanetworks.com a:dispatch-us.ppe-hosted.com include:spf.protection.outlook.com include:_spf.streetcontxt.com" " ip4:38.125.86.216 ip4:208.81.212.0/22 ip4:64.235.150.181 ip4:64.235.150.252 ip4:64.235.154.105 ip4:64.235.154.109 ip4:38.125.86.213 ~ALL
  • D009D774F8
  • MS=ms63137743
  • google-site-verification:gK5hx_RL7giXHrsmYwy7YBoMI7zIEXxto3Cj2Nab0P8
  • ppe-93c513638a55f71f06e12500e037bbaa955bcc4d
  • seatsurfing-verification=957f09d3-51e2-42f1-89ad-66cfee7ef36f
Cloud / SaaS Services Detected
Microsoft 365 Proofpoint Essentials

Leak Screenshot:

Leak Screenshot