🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://sites.google.com/view/facturacion2026mx.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1901515
IOC: https://sites.google.com/view/facturacion2026mx
IOC Type :url
Threat Type :payload_delivery
Malware: Unknown malware
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS15169 GOOGLE
Country:- US
First seen:2026-09-06 06:20:08 UTC
Last seen:2026-09-05 20:29:22 UTC
UUID:cb4bdd78-a961-11f1-b569-42010aa4000a
Reporter LinkusBlame
Reward 5 credits from ThreatFox
Tags:cybercartel Google-Sites invoice-lure link-annotation mexico open-redirect pdf-lib sat
Reference: https://otx.alienvault.com/pulse/6a861fca606614e9cad9fd2f

Avatar
LinkusBlame
Landing stage of a SAT-impersonation campaign against Mexican businesses, live as of 2026-09-04. Reached from a weaponised PDF whose only malicious element is a full-page /Link annotation, laundered through an abused third-party open redirect. IMPORTANT: block THIS URL only - never sites.google.com. The operator moved here after the two previous landing domains were sinkholed by Shadowserver (2026-07-06, 2026-07-30). Reported to Google Safe Browsing 2026-09-05. Zero urlscan scans when found.