← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Pattern 48: AEZA PTR Spoof Farm - Russian Credential Harvesting (github.com, telegram.org, VK, Yandex)
Russian state-adjacent credential harvesting infrastructure using fake PTR records to impersonate major services. AEZA International LTD (UK shell company, 311 Shoreham Street Sheffield) controls 89.169.53.0/24 via REG.RU (Russian registrar) and AS31514 OOO Trivon Networks. Discovered via ThreatFox Stealc C2 correlation. Targets: developers (GitHub), Russian citizens (VK/Yandex/Telegram/RuTube), supply chain (Yandex repos).
| TYPE | INDICATOR | DESCRIPTION | CREATED | |
|---|---|---|---|---|
| domain | ptr.network | PTR spoofing domain - controls fake reverse DNS for entire operation | 2025-12-05 | |
| domain | cookiesvps.com | VPS reseller frontend - registered via REG.RU Feb 2025 | 2025-12-05 | |
| domain | aeza.net | AEZA International LTD - bulletproof hosting provider | 2025-12-05 |