A new tool launched in recent days has made it possible to quickly detect an attack based on various .best domains.
Matrix had reported these domains on urlscan.io several hours ago.
From the evidence gathered in recent minutes, it appears that the attack targeted customers of the US bank America First Credit Union.
Below is the list of domains involved.
- ab5[.]best
- ab8[.]best
- ah4[.]best
- aj0[.]best
- aj2[.]best
- ak0[.]best
- al6[.]best
- al7[.]best
- an6[.]best
- ao7[.]best
- ar0[.]best
- ay5[.]best
- aw5[.]best
- az4[.]best
- bb3[.]best
- bc0[.]best
- bd5[.]best
- be7[.]best
- bf8[.]best
- br5[.]best
- bs6[.]best
- bv3[.]best
- bv6[.]best
- bw5[.]best
- bx3[.]best
- eo0[.]best
- ed4[.]best
- ed5[.]best
- ei2[.]best
- ei5[.]best
- ei8[.]best
- ej5[.]best
- el0[.]best
- em3[.]best
- en8[.]best
- eo0[.]best
- er0[.]best
- er5[.]best
- eu5[.]best
- eu9[.]best
- ev2[.]best
- ex9[.]best
- fa5[.]best
- fa7[.]best
- fa9[.]best
- fb3[.]best
- fg0[.]best
- fj7[.]best
Emiliano Carlesi's blog 