← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Thousands of Sites with Popup Builder Compromised by Balada Injector
WHITE feisty-swim1410 2024-01-25 Modified: 2024-02-14
44
IOCs
MEDIUM VOLUME
popup builderwordpresscloudflaredecemberbalada injectornnnnjanuarybaladajavascriptwpscanbalada javascriptsitecheck
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Balada JavaScript Popup Builder SiteCheck
Indicators of Compromise (44)
All URL domain hostname
TYPEINDICATORDESCRIPTIONCREATED
URL http://get.specialcraftbox.com/loc/gr.txt — 2024-01-25
URL https://get.specialcraftbox.com/loc/r.php?zd= — 2024-01-25
URL https://rest.greenfastline.com/vkRJGzsp — 2024-01-25
URL https://soft.specialcraftbox.com/JZFYbC — 2024-01-25
URL https://soft.specialcraftbox.com/KQGrXb?c= — 2024-01-25
domain bestdarkbars.com — 2024-01-25
domain bestlightbars.com — 2024-01-25
domain blacklinetosplit.com — 2024-01-25
domain blueperfectballon.com — 2024-01-25
domain bluesmallbutterfly.com — 2024-01-25
domain clearblueline.com — 2024-01-25
domain cleargreenline.com — 2024-01-25
domain clearlinesprice.com — 2024-01-25
domain creativemanagercircle.com — 2024-01-25
domain creativemanagerline.com — 2024-01-25
domain darkspecialbars.com — 2024-01-25
domain daynitroglass.com — 2024-01-25
domain goldflowerservice.com — 2024-01-25
domain greenfastline.com — 2024-01-25
domain greensmallbutterfly.com — 2024-01-25
domain lightgreenstep.com — 2024-01-25
domain lightredstep.com — 2024-01-25
domain lightspecialbars.com — 2024-01-25
domain nightnitroglass.com — 2024-01-25
domain openspecificdark.com — 2024-01-25
domain openspecificwhite.com — 2024-01-25
domain redperfectballon.com — 2024-01-25
domain solohostering.com — 2024-01-25
domain somenewforyou.com — 2024-01-25
domain specialcraftbox.com — 2024-01-25
domain stoneblacksort.com — 2024-01-25
domain stonewhitesort.com — 2024-01-25
domain sunshineblackcolor.com — 2024-01-25
domain sunshinewhitecolor.com — 2024-01-25
domain topgiftsforusers.com — 2024-01-25
domain trackspecialdomain.com — 2024-01-25
domain whitelinetosplit.com — 2024-01-25
domain workandbestservice.com — 2024-01-25
domain workandgoodservice.com — 2024-01-25
hostname fine.greenfastline.com — 2024-01-25
hostname get.specialcraftbox.com — 2024-01-25
hostname rest.greenfastline.com — 2024-01-25
hostname service.specialcraftbox.com — 2024-01-25
hostname soft.specialcraftbox.com — 2024-01-25
References (1)
↗ https://blog.sucuri.net/2024/01/thousands-of-sites-with-popup-builder-compromised-by-balada-injector.html