Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • World
  • Users
  • Groups
Skins
  • Light
  • Brite
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (Cyborg)
  • No Skin
Collapse
Brand Logo

CIRCLE WITH A DOT

  1. Home
  2. Uncategorized
  3. The best time to block api

The best time to block api

Scheduled Pinned Locked Moved Uncategorized
threatintelthreatintelligeifin
3 Posts 2 Posters 0 Views
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • ifin@infosec.exchangeI This user is from outside of this forum
    ifin@infosec.exchangeI This user is from outside of this forum
    ifin@infosec.exchange
    wrote last edited by
    #1

    The best time to block api.telegram[.]org was like, I dunno, five years ago? The second best time to do it is now.

    Seriously. Cross that one off the easy wins list today.

    #ThreatIntel #ThreatIntelligence #IFIN

    julie@merida.hairJ 1 Reply Last reply
    3
    0
    • R relay@relay.infosec.exchange shared this topic
      mttaggart@infosec.exchangeM mttaggart@infosec.exchange shared this topic
    • ifin@infosec.exchangeI ifin@infosec.exchange

      The best time to block api.telegram[.]org was like, I dunno, five years ago? The second best time to do it is now.

      Seriously. Cross that one off the easy wins list today.

      #ThreatIntel #ThreatIntelligence #IFIN

      julie@merida.hairJ This user is from outside of this forum
      julie@merida.hairJ This user is from outside of this forum
      julie@merida.hair
      wrote last edited by
      #2

      @ifin@infosec.exchange Y'all seeing some new stuff or is this just general advice?

      ifin@infosec.exchangeI 1 Reply Last reply
      0
      • julie@merida.hairJ julie@merida.hair

        @ifin@infosec.exchange Y'all seeing some new stuff or is this just general advice?

        ifin@infosec.exchangeI This user is from outside of this forum
        ifin@infosec.exchangeI This user is from outside of this forum
        ifin@infosec.exchange
        wrote last edited by
        #3

        @julie New-ish. We had a report of some ClickFix activity that used it, and was related to a recent Elastic report.

        Link Preview Image
        PhantomPulse RAT (MacOS) using ClickFix

        Hi, EDIT: moved to news. We stumbled upon this when a user was “clickfixed” on a Mac. Command+space==>Terminal, Enter The page is hosted in pages.dev (mandatory f..k Cloudflare). I can share the domain if you think…

        favicon

        IFIN (discourse.ifin.network)

        1 Reply Last reply
        0
        • R relay@relay.mycrowd.ca shared this topic
        Reply
        • Reply as topic
        Log in to reply
        • Oldest to Newest
        • Newest to Oldest
        • Most Votes


        • Login

        • Login or register to search.
        • First post
          Last post
        0
        • Categories
        • Recent
        • Tags
        • Popular
        • World
        • Users
        • Groups