GDPR: harmless after all?

GDPR: harmless after all?

#hancitor

Domain: genesisofdenver.com
IP: 47.254.198.10

Registrant email: 8FC0
DomainRegistrar

carvanacharlotte.com
carvanachicago.com
carmaxoflouisville.com
louisvillecarmax.com
louisvillerides.com
louisvilleride.com
carmaxlouisville.com
ridesharelouisville.com
kccmanufacturing.com
oxmoorsucks.com
oxmoorbuyscars.com…
oxmoorcars.com
kyshieldinsurance.com…

GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy• 58 domains total• on 28 different IPs• many on massive vhosting• many used by hancitor• All of them maybe?

Registrant email: 8FC0
DomainRegistrar

carvanacharlotte.com
carvanachicago.com
carmaxoflouisville.com
louisvillecarmax.com
louisvillerides.com
louisvilleride.com
carmaxlouisville.com
ridesharelouisville.com
kccmanufacturing.com
oxmoorsucks.com
oxmoorbuyscars.com…
oxmoorcars.com
kyshieldinsurance.com…

GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy• new hancitor campaign• domains from the same list• DBL marks ’em all as
malware domains…

Registrant email: 8FC0
DomainRegistrar

carvanacharlotte.com
carvanachicago.com
carmaxoflouisville.com
louisvillecarmax.com
louisvillerides.com
louisvilleride.com
carmaxlouisville.com
ridesharelouisville.com
kccmanufacturing.com
oxmoorsucks.com
oxmoorbuyscars.com…
oxmoorcars.com
kyshieldinsurance.com…

GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy• new campaign picks domainfrom the same list• probably campaign goes
nowhere…

#hancitor…so they move to a different
batch of domains…

Domain: dcbadfoodlawyer.com
DomainRegistrar

Registrant email

dcbadfoodlawyer.com

GoDaddy

D1D7

Registrant email: D1D7
DomainRegistrar

Registrant email

dcbadfoodlawyer.com
laleyenespanol.net
laleyenespanol.info
havanacounsel.com
pitchmiami.com
pitchthevalley.com
pitchchicago.com
pitchaustin.com
milliondollarlawsuit.co
visithavana.co
puertoricanlawblog.com
floridafinancialfraudlawyer.com
redteamlawyers.com
sarelsonlawfirm.com…

GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy

D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7

Registrant email: D1D7
DomainRegistrar

Registrant email

dcbadfoodlawyer.com
laleyenespanol.net
laleyenespanol.info
havanacounsel.com
pitchmiami.com
pitchthevalley.com
pitchchicago.com
pitchaustin.com
milliondollarlawsuit.co
visithavana.co
puertoricanlawblog.com
floridafinancialfraudlawyer.com
redteamlawyers.com
sarelsonlawfirm.com…

GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy

D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7

Registrant email: D1D7
DomainRegistrar

Registrant email

dcbadfoodlawyer.com
laleyenespanol.net
laleyenespanol.info
havanacounsel.com
pitchmiami.com
pitchthevalley.compitchchicago.com
pitchaustin.com
milliondollarlawsuit.co
visithavana.co
puertoricanlawblog.com
floridafinancialfraudlawyer.com
redteamlawyers.com
sarelsonlawfirm.com…

GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy

D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7

Registrant email: D1D7Domain

Registrar

Registrant email

dcbadfoodlawyer.com
laleyenespanol.net
laleyenespanol.info
havanacounsel.com
pitchmiami.com
pitchthevalley.com
pitchchicago.com
pitchaustin.com
milliondollarlawsuit.co
visithavana.co
puertoricanlawblog.com
floridafinancialfraudlawyer.com
redteamlawyers.com
sarelsonlawfirm.com…

GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy
GoDaddy

D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7
D1D7

Rinse & Repeat

Operational steps forwardInvestigation doesn’t need cleartext
Correlation -not identification- is step 1➡ 8FC0: XXXXX@msn.com➡ D1D7: YYYYY@yahoo.com
Without correlating first, identification is
worthless (in most cases)