itt.com
itt.com
Group: dispossessor
Discovered by ransomware.live: 2024-04-19
Estimated attack date: 2022-10-23
Description:
itt.com
🕵️ Infostealer activity detected by HudsonRock
Compromised Employees: 9
Compromised Users: 13
Third Party Employee Credentials: 14
External Attack Surface: 13
DNS Records:
The following DNS records were found for the victim's domain.
WHOIS Emails
- domainabuse cscglobal.com
MX Records
- mx2.hc2313-10.iphmx.com.
- mx1.hc2313-10.iphmx.com.
TXT Records
- docusign=0b8301ee-e6e7-4ffe-91d5-09a17c038284
- atlassian-domain-verification=d8tAjOZaIN088mIROSrQYrnedO6nGPf7lm4KbMjdkuZeH8D0fbNKup7Huyh11NFJ
- ciscocidomainverification=722f6e004aff4ad1941d108b8647a80510033906eb225ac48ef5843284dcc089
- v=spf1 exists:%{i}.spf.hc2313-10.iphmx.com mx a:email.itt.com ip4:199.253.126.5 include:spf.protection.outlook.com include:spf.braintreegateway.com -all
- docusign=a848c6de-9589-4d62-9349-03afa087cd77
- 9CpzIHJTQBHshVgsePik5lhFzsKEloyLMHTDzlbSbrytfYnpneBV2s7cGcyaJ3CmhzCFz3VZtkI/qhM6PSaEIw==
- duo_sso_verification=yOqUeEgoL0bTGqcv9wPUV7VU4pNxWV9mk83fYxDAdNaxLSF2O55LcavDYCUedg7z
- zvbt75z.ng.impervadns.net
Cloud / SaaS Services Detected
Atlassian
Cisco Duo
DocuSign
Leak Screenshot:
