ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain rbcroyalbank-homesc.info.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1786799
IOC: rbcroyalbank-homesc.info
IOC Type :domain
Threat Type :payload_delivery
Malware: Unknown Webinject
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS132203 TENCENT-NET-AP-CN
Country:- CN
First seen:2026-04-14 10:39:34 UTC
Last seen:never
UUID:c69f7205-37e7-11f1-8759-42010aa4000a
Reporter HuntTeam
Reward 5 credits from ThreatFox
Tags:banking HK-operator Jwr phishing-as-a-service tianka
Reference: https://urlhaus.abuse.ch/browse/?search=anzrewardse-homes.info

Avatar
HuntTeam
Sibling of Jwr phishing-as-a-service backend at 43.160.241.151 (Tencent SG/ACEVILLE PTE.LTD). 39 brand-impersonation domains targeting AU/NZ/UK/CA banks. 100 confirmed paid victims observed in operator backend. Operator suspected in Tung Chung HK (AS55361 Lucky Tone). Same kit md5 03234bcd44856a84a3f719c093f34e08 main.js across all vhosts.