Unmasking Phishing: Strategies for identifying 0ktapus domains and beyond

80.78.28.234

80.78.24.166

80.78.25.254

80.78.22.244

67.217.228.42

64.95.13.215

216.245.184.53

193.149.176.19

162.33.179.76

80.78.24.176

www.validin.com

www.silentpush.com

www.cyberresilience.com

https://www.cyberresilience.com/threatonomics/resilience-threat-researchers-identify-new-campaigns-from-scattered-spider/

https://www.validin.com/blog/coralling-scattered-spider-with-dns-history/

https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud

https://blog.sekoia.io/scattered-spider-laying-new-eggs/

https://blog.eclecticiq.com/ransomware-in-the-cloud-scattered-spider-targeting-insurance-and-financial-industries

www.authenticate-bt.com

www.dashsso.com

https://www.silentpush.com/blog/scattered-spider/

ns3.my-ndns.com

att-mfa.com

mailgun-okta.com

tickets.zapto.org

sso.ibexgiobal.com

rbx.okta.bio

ping.taskus-sso.com

okta.cellularsaies.com

louisvuitton.okta-lv.com

login.unumhr.com

login.transamerica-hr.com

login.thrivent-hr.com

login.unum-hr.com

login.synchronyfinanciai.com

login.servicenow-help.com

login.securian-hr.com

login.realogy-hr.com

login.rbx-hr.com

login.nfp-hr.com

login.klaviyo-hr.com

login.hr-intercom.com

login.grubhub-support.com

login.doordash-support.com

login.corporate-pnc.com

login.corporate-ally.com

login.block-hr.com

login.ally-hr.com

account.securian-hr.com

account.klaviyo-hr.com

account.kemper-support.com

ziffdavis-okta.com

zendesk-servicedesk.com

xapo-okta.com

verify-tmobile.com

verify-mailgun.com

uscc-hr.com

unchainedprod-okta.com

ultainternal.com

ultahub.com

typeform-okta.com

twillio-sendgrid.com

twitter-okta.com

telint-helpdesk.com

teleperformance-incident.com

t-mobile-okta.com

t-mobiie.net

sync-apple.com

sunrise-crypto.com

storewatch-tmobile.com

stargatesso.com

stargatesso-gemini.com

stargate-okta.com

sso-klaviyo.com

sso-falconx.com

squarespacehr.com

squarespace-okta.com

snapchat-okta.com

settings-okta.com

sessions-sendgrid.com

servicenowprod.com

sendgrid-overview.com

sendgrid-account.com

robinhood-servicedesk.com

ripple-okta.com

review-mailgun.com

resolveservicedesk.com

rejectauth-sendgrid.com

rbx-servicedesk.com

rbx-corp.com

rbx-hr.com

prntsrc.net

pfchangs-support.com

paxos-okta.com

ouryahoo-okta.net

ouryahoo-okta.org

ouryahoo-okta.com

okta-verify.com

onsolve-okta.com

okta-twilio.com

okta-ouryahoo.com

okta-ripple.com

okta-onsolve.com

okta-nydig.com

okta-intercom.com

okta-gamestop.com

okta-campaignmonitor.com

okta-cbhq.net

okta-blockdaemon.com

nike-support.com

mixpanel-okta.com

mgmresorts-okta.com

mcointernal-okta.com

markel-hr.com

manageactivity-sendgrid.com

luno-okta.com

louisvuitton-okta.com

klaviyo-vpn.com

klav-workday.com

jacksonhewitt-service.com

itbit-okta.com

intercom-okta.com

intercom-hr.com

hr-gnc.com

grubhub-support.com

grid-review.com

gofundme-okta.com

grayscale-okta.com

gd-okta.com

galaxy-okta.com

five9-hr.com

fico-servicenow.com

expediagroup-servicenow.com

epic-servicedesk.com

docusignhq.net

docusign-okta.com

dashboard-mailgun.com

corp-foundever.net

corescientific-okta.com

contact-sendgrid.com

consensys-okta.com

condenast-hub-okta-emea.com

concentrix-servicedesk.com

commonspiritcorp-okta.com

calendar-dd.com

block-hr.com

binance-us-okta.com

binance-sso.com

auth-alchemy.com

apple-vpn.com

alchemy-okta.com

adasupport-okta.com

activecampainhr.com

acwa-internal.com

acwa-apple.com

account-sendgrid.com

login.five9-hr.com

login.uscc-hr.com

revolut-ticket.com

forward-icloud.com

blog.sekoia.io

login.suniife.com

vzapps-vzn.com

uscellular-sso.com

unumhr.com

transamerica-hr.com

thrivent-hr.com

telesignhr.com

supporthub-iqor.com

stargate-sso.com

squarespace-hr.com

sharing-folders.com

roblox-hrs.com

rbxhr.net

podium-hr.com

nfp-hr.com

newyorklifehr.com

mercury-hr.com

mutualofomaha-hr.com

klaviyo-hr.com

ibexgiobal.com

hanover-hr.com

grubhubsso.com

gemini-sso.com

foundever-sso.com

corporate-huntington.com

corporate-ally.com

corp-foundever.com

corp-cox.com

connect-asurion.net

clicksend-staging.com

cinfin-hr.com

cellularsaies.com

block-sso.com

amica-hr.com

ally-hr.com

activecampaignhr.com

activecampaign-hr.com

klaviyocorp.net

intercomsso.net

cashsso.com

T1591

T1606

T1585

T1589

T1586

T1608

T1583

T1584

T1566

T1078