PHISH been taken down? Re: https://urlquery.net/report/8ac2c83e-5452-4b34-b241-ffa61fecad5d
See: https://aw-snap.info/file-viewer/?protocol=not-secure&ref_sel=GSP2&ua_sel=ff&chk-cache=&fs=1&tgt=dmcjfHxzdl4uXl1t~enc
What’s further on that Berlin Strato IP: https://www.scumware.org/report/81.169.145.164
What about a general IP block for this address?
Still launching malware on from that IP: JS/Kryptik.BP trojan a.k.a. Virtool.JS.obfuscator → https://aw-snap.info/file-viewer/?protocol=not-secure&ref_sel=GSP2&ua_sel=ff&chk-cache=&fs=1&tgt=c15odWx7LmZ1e31me2wjLiN7YGJnc2A%3D~enc
Avast detects this as JS:Iframe-AGZ [Trj].
polonus