rixos.com
rixos.com
Group: embargo
Discovered by ransomware.live: 2025-03-14
Estimated attack date: 2025-03-12
Country:
Data exfiltrated: 1.8 TB
Description:
Founded in 2000 and headquartered in Dubai, United Arab Emirates, Rixos Hotels is a Turkish luxury hotel chain. The company operates hotels and resorts across Europe and the Middle East, including properties in Azerbaijan, Egypt, Kazakhstan, Russia, Switzerland, Turkey, Ukraine and the UAE. - We will disclose 1.8 TB of data
🕵️ Infostealer activity detected by HudsonRock
Compromised Employees: 64
Compromised Users: 50
Third Party Employee Credentials: 35
External Attack Surface: 26
Infostealer Distribution
DNS Records:
The following DNS records were found for the victim's domain.
WHOIS Emails
- abuse key-systems.net
- abusereport key-systems.net
- info domain-contact.org
MX Records
- mail1.rixos.com.
TXT Records
- _globalsign-domain-verification=vS9JzRweblBCSOlQ-x1G07h1Jx6Z4wLjjev2nb_ZJr
- _nimge8hbh6ae2ovc1ywa3xlhvooq5gv
- facebook-domain-verification=9noim5rugspp70udtvhp5v14invsnz
- facebook-domain-verification=arz9ibior8wswpr4wc7rn2wn3nwfdq
- facebook-domain-verification=bbwbl8r6raqltgwfqwnvjz8s1k8y0u
- google-site-verification=g4YfzRzjfVjDnktjL1vCO92mMVeVI5XvCbcrToAgBHs
- tmes=8a3cdc346562bd1a02542980c8dfe45d
- v=spf1 ip4:91.199.111.113/32 ip4:91.199.111.112/32 ip4:91.199.111.111/32 ip4:85.115.56.190/32 ip4:91.199.111.210/32 ip4:91.199.111.2/32 include:spf.tmes.trendmicro.eu ip4:103.19.95.100/30 include:ivvy.net include:oracle.accor.com ip4:62.192.13.116 includ" "e:amazonses.com include:aspmx.pardot.com " "include:spf-004da001.pphosted.com include:_spf.mail.hostinger.com -all
- MS=ms56374328
- Ptok1vVtLX46kn8801hD6SF+wsNxhnTYxlKyDvi1zMnIClnEqyyc48r1dKGyubv2xia50E6iQq/JA+6UJ5B+uQ==
- _fi6f77u7n0gl277w4pbn8d2eek06mkf
Cloud / SaaS Services Detected
Amazon SES/WorkMail
Microsoft 365
Proofpoint
Leak Screenshot:
