ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://drive.google.com/file/d/15gqa1eu6JZb4SGgKWE7Wdu3lUbzv-Y0_/view?usp=sharing.

Database Entry


IOC ID:1832949
IOC: https://drive.google.com/file/d/15gqa1eu6JZb4SGgKWE7Wdu3lUbzv-Y0_/view?usp=sharing
IOC Type :url
Threat Type :payload_delivery
Malware: Unknown malware
Confidence Level : Confidence level is elevated (75%)
Is compromised? : True
ASN:AS15169 GOOGLE
Country:- US
First seen:2026-06-17 05:45:15 UTC
Last seen:never
UUID:132cfa28-69c9-11f1-9258-42010aa4000a
Reporter DENNISAROSS
Reward 5 credits from ThreatFox
Tags:dentons-impersonation google-drive-abuse homoglyph phishing
Reference: https://urlscan.io/result/019ed22e-347e-7229-af80-c237e0f20fc9/

Avatar
DENNISAROSS
Google Drive hosted PDF used in phishing campaign impersonating Dentons law firm via Unicode/Cyrillic homoglyph spoofing. File shared via legitimate Google Drive notification email (DKIM/SPF/DMARC pass) from khajobacle2002@community.instantpublicalertnetwork.com (domain age 7 days). File titled with homoglyphed chars: (Оur Sеcurity Tеаm) — [Sеrvicе Suspеnsiоn Will Оccur]. Mass campaign targeting 22+ recipients. Observed 2026-06-16.