Contact us Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

The University of Oklahoma (ou.edu)

ou.edu

Group Fog
Discovered 2025-01-14
Est. attack date 2025-01-14
Country US

Description:

91 MB

Infostealer activity detected by HudsonRock

Compromised Employees: 65

Compromised Users: 1124

Third Party Employee Credentials: 233


External Attack Surface: 162


DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • No emails found.
MX Records
  • mxa-00272701.gslb.pphosted.com.
  • mxb-00272701.gslb.pphosted.com.
TXT Records
  • 4ebp5mps69vnmnnm00pq3ak046
  • MS=ms47553681
  • google-site-verification=B1XtiPZn3KBonENNqC3PRDjD5AlcbiA3syfJY2R1RlA
  • pardot_139971_*=262d8f2660b45fe1196819eb9ca51f259fa772e1c40148014eda80bfb1a37c21
  • dell-technologies-domain-verification=ou.edu_f4eb63d7-ca68-4b9c-8886-aed9c0d2a464_1778443049
  • v=spf1 include:spf.protection.outlook.com include:_tuf-spf.touchnet.com include:_spf.qualtrics.com include:aspmx.pardot.com include:servers.mcsv.net include:mail.zendesk.com ip4:67.231.145.144 include:sendgrid.net ip4:168.245.25.116" " ip4:148.59.100.16/28 ip4:129.15.42.13 ip4:52.86.188.131 ip4:54.236.128.150 ip4:54.236.109.30 ip4:64.72.147.142 ip4:208.86.201.61 ip4:216.37.17.227 ip4:64.72.147.23 ip4:35.80.141.6 ip4:44.229.121.55 ip4:148.59.100.16/28 ~all
  • MS=ms95193120
  • beam-verification=tO9eASrtnwOX0k5Pt87mwtRwTJPncRbHQznFi2MbavFkVccZ
  • 19b2wwr3n8zyh5ppcyqgc2n9pwszbvch
  • 208.75.123.0/24
  • ZOOM_verify_6gDEToiHTCmY38NbmZzkzA
  • +zWEfgkvA2j9fHHBKPVE4qyt9uyD85oFlNynjfase5hvZlAnYbCXGlpU3uw/YWjw29sso+Ld9IUjDBQhveBwYA==
  • amazonses:6a65aisx1XSyBKQ17qrGnQGvL0ZCs9I5Rq9LME9rqWY=
  • autodesk-domain-verification=N4NfpymhDwdHr4XMV8FB
  • AppID=0000000048019867
  • google-site-verification=Ta7bq2QHLFrKjjFUjdm4DXkV8K3wN56S5mdMEY5CwO8
  • docusign=8de025f0-7002-4f33-81c9-b99876e9dd6f
  • LCTr/F0hImTjsnYw6pt9Jg6TWBOcfqK+3qeJYgsQ+bpkyiTfaix8+0YKXRV/VTHUIt2BZtBnra+Eza6GVKPohg==
  • google-site-verification=EMTIg5uKXGXbCBa5000kcqYhYMkZbHKDuyyCAZZqX38
  • docusign=05e90101-723f-479f-af27-de27e85d8f98
  • apple-domain-verification=K0MYiQ2cpU5b71eM
  • cisco-ci-domain-verification=2e8593a1e97e6ee3e9e53c4192da8d2fc3c38fff45292480c92fed85bb98f451
  • onetrust-domain-verification=ed5aafe61b1a42deb87c19be18cfd4c2
  • adobe-idp-site-verification=6ba3e6ad-d322-435f-b2ea-efa73549fd04
  • knowbe4-site-verification=c5d493be36393b1b48e67e6d904010e2
  • infoblox-domain-mastery=67f7995c22bb4be1835f541279da44c14afc894a3485c4132ad3b48b3826ada41b
Cloud / SaaS Services Detected
Adobe Apple Amazon SES/WorkMail Mailchimp Microsoft 365 Zendesk Autodesk KnowBe4 Cisco SendGrid OneTrust DocuSign Proofpoint Zoom

Leak Screenshot:

Leak Screenshot