Ransomfeed

CARD INFO

Dominio: kengen.co.ke
Registrar: Safaricom Limited
Motori AV recap
- Malevolo: 0
- Sospetto: 0
- Non rilevato: 29
- Innocuo: 65
Analisi Antivirus:

- Acronis: [harmless] clean
- 0xSI_f33d: [undetected] unrated
- Abusix: [harmless] clean
- ADMINUSLabs: [harmless] clean
- Axur: [undetected] unrated
- Criminal IP: [harmless] clean
- AILabs (MONITORAPP): [harmless] clean
- AlienVault: [harmless] clean
- alphaMountain.ai: [harmless] clean
- AlphaSOC: [undetected] unrated
- Antiy-AVL: [harmless] clean
- ArcSight Threat Intelligence: [undetected] unrated
- AutoShun: [undetected] unrated
- benkow.cc: [harmless] clean
- Bfore.Ai PreCrime: [undetected] unrated
- BitDefender: [harmless] clean
- Bkav: [undetected] unrated
- Blueliv: [harmless] clean
- Certego: [harmless] clean
- Chong Lua Dao: [harmless] clean
- CINS Army: [harmless] clean
- Cluster25: [undetected] unrated
- CRDF: [harmless] clean
- CSIS Security Group: [undetected] unrated
- Snort IP sample list: [harmless] clean
- CMC Threat Intelligence: [harmless] clean
- Cyan: [undetected] unrated
- Cyble: [harmless] clean
- CyRadar: [harmless] clean
- DNS8: [harmless] clean
- Dr.Web: [harmless] clean
- Ermes: [undetected] unrated
- ESET: [harmless] clean
- ESTsecurity: [harmless] clean
- EmergingThreats: [harmless] clean
- Emsisoft: [harmless] clean
- Forcepoint ThreatSeeker: [harmless] clean
- Fortinet: [harmless] clean
- G-Data: [harmless] clean
- GCP Abuse Intelligence: [undetected] unrated
- Google Safebrowsing: [harmless] clean
- GreenSnow: [harmless] clean
- Gridinsoft: [undetected] unrated
- Heimdal Security: [harmless] clean
- Hunt.io Intelligence: [undetected] unrated
- IPsum: [harmless] clean
- Juniper Networks: [harmless] clean
- Kaspersky: [harmless] clean
- Lionic: [harmless] clean
- Lumu: [undetected] unrated
- MalwarePatrol: [harmless] clean
- MalwareURL: [undetected] unrated
- Malwared: [harmless] clean
- Mimecast: [undetected] unrated
- Netcraft: [undetected] unrated
- OpenPhish: [harmless] clean
- Phishing Database: [harmless] clean
- PhishFort: [undetected] unrated
- PhishLabs: [undetected] unrated
- Phishtank: [harmless] clean
- PREBYTES: [harmless] clean
- PrecisionSec: [undetected] unrated
- Quick Heal: [harmless] clean
- Quttera: [harmless] clean
- SafeToOpen: [undetected] unrated
- Sansec eComscan: [undetected] unrated
- Scantitan: [harmless] clean
- SCUMWARE.org: [harmless] clean
- Seclookup: [harmless] clean
- SecureBrain: [undetected] unrated
- SOCRadar: [harmless] clean
- Sophos: [harmless] clean
- Spam404: [harmless] clean
- StopForumSpam: [harmless] clean
- Sucuri SiteCheck: [harmless] clean
- ThreatHive: [harmless] clean
- Threatsourcing: [harmless] clean
- Trustwave: [harmless] clean
- Underworld: [undetected] unrated
- URLhaus: [harmless] clean
- URLQuery: [undetected] unrated
- Viettel Threat Intelligence: [harmless] clean
- VIPRE: [undetected] unrated
- VX Vault: [harmless] clean
- ViriBack: [harmless] clean
- Webroot: [harmless] clean
- Yandex Safebrowsing: [harmless] clean
- ZeroCERT: [harmless] clean
- desenmascara.me: [harmless] clean
- malwares.com URL checker: [harmless] clean
- securolytics: [harmless] clean
- Xcitium Verdict Cloud: [harmless] clean
- zvelo: [undetected] unrated
- ZeroFox: [undetected] unrated

Motori che NON classificano il dominio come harmless:

- 0xSI_f33d: undetected (unrated)
- Axur: undetected (unrated)
- AlphaSOC: undetected (unrated)
- ArcSight Threat Intelligence: undetected (unrated)
- AutoShun: undetected (unrated)
- Bfore.Ai PreCrime: undetected (unrated)
- Bkav: undetected (unrated)
- Cluster25: undetected (unrated)
- CSIS Security Group: undetected (unrated)
- Cyan: undetected (unrated)
- Ermes: undetected (unrated)
- GCP Abuse Intelligence: undetected (unrated)
- Gridinsoft: undetected (unrated)
- Hunt.io Intelligence: undetected (unrated)
- Lumu: undetected (unrated)
- MalwareURL: undetected (unrated)
- Mimecast: undetected (unrated)
- Netcraft: undetected (unrated)
- PhishFort: undetected (unrated)
- PhishLabs: undetected (unrated)
- PrecisionSec: undetected (unrated)
- SafeToOpen: undetected (unrated)
- Sansec eComscan: undetected (unrated)
- SecureBrain: undetected (unrated)
- Underworld: undetected (unrated)
- URLQuery: undetected (unrated)
- VIPRE: undetected (unrated)
- zvelo: undetected (unrated)
- ZeroFox: undetected (unrated)

Analisi DNS

- Tipo: TXT, Valore: atmosphere-verification=BlWQfuIliG1sgLgQb1K0hkCIUspDbd46g0xK5Nv0eMRDZ7YwLmt8ra1gw1t8C4WkGaYRY97oiksK5p72XZRVSTkM6EExFBckORgG
- Tipo: SOA, Valore: ns1.safaricombusiness.co.ke
- Tipo: MX, Valore: kengen-co-ke-2.fortimailcloud.com
- Tipo: NS, Valore: ns1.safaricombusiness.co.ke
- Tipo: NS, Valore: ns3.safaricombusiness.co.ke
- Tipo: TXT, Valore: v=DKIM1;k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmZbZxjewP32DM3Y3tPWMqIXCUwCGFLJwsmOKMMe0+HTMqAuuNq15hWRcJ0abAt9RhMTqkLdauPEiXSz3bsea /W50JTMYRnxLJ+uXLZzU1seBNy7KNqKS4GG1OnfR1MkopUh7qpGgiTTcWe4rwbdYIYO1dEd+Em6MojhJX8Nj+Pn /xk87WtVVD5sclZmeoAoD
- Tipo: NS, Valore: ns2.safaricombusiness.co.ke
- Tipo: TXT, Valore: v=spf1 +a +mx include:spf.protection.outlook.com include:_spf.fortimailcloud.com ip4:197.248.124.64/27 ip4:197.248.120.246/32 ip4:41.203.208.0/20 ip4:41.203.216.0/21 ip4:41.203.216.0/24 ip4:197.248.0.0/16 ip4:196.201.208.0/20 ip4:196.201.212.0/22 ip4:1
- Tipo: TXT, Valore: duo_sso_verification=UoLkPpv4Et7XXPdAJLrVdXSnrQnh2Kq5yAruswB5GAhsaI6XoSxTpT1wpxJiCuCm
- Tipo: NS, Valore: ns4.safaricombusiness.co.ke
- Tipo: TXT, Valore: google-site-verification=5FhguJUDaR5vCDoLf7ZI4Pqg0mey-av3x8ngBZwzqXo
- Tipo: MX, Valore: kengen-co-ke-1.fortimailcloud.com
- Tipo: TXT, Valore: google-site-verification=oCkHdGuhI-_guKZIbV7LEf4OFVOwlDLMqzSia9N9acQ
- Tipo: TXT, Valore: 14Dwelfe0NoXbm7Eawuie9pVl/Ozr5dQBUgw82j7xuwe+43TpSgNeOJ6r3/I1CBVQ05kQdIe+Wfa90hXyoh8Tg==
- Tipo: TXT, Valore: MS=ms37738914
- Tipo: A, Valore: 102.216.119.22

Certificato HTTPS

- Emesso da: GeoTrust TLS RSA CA G1
- Intestato a: *.kengen.co.ke
- Valido dal: 2025-05-12 00:00:00
- Valido fino al: 2026-05-12 23:59:59
- Algoritmo firma: RSA
- Versione: V3
- Serial number: 8adc164a63da4cc948166fb511cebd2

LEAKS NOTI e MALWARE Raw data by HudsonRock
Summary
🧠 Dispositivi infetti: 3128
🌐 Utenti compromessi: 3053
🧑‍💼 Utenti aziendali compromessi: 75
🔑 Password aziendali esposte: 27
🔑 Password users esposte: 303
🧬 Stealer family e conteggio

RedLine: 1115
Lumma: 891
Generic Stealer: 574
Raccoon: 223
StealC: 208
Vidar: 68
UNKNOWN: 22
Azorult: 6
Mystic: 6
Ficker: 2
Atomic: 1
KPOT: 1
Taurus: 1
CRYPTBOT: 1

🏢 Utenze aziendali compromesse (link/conteggio)

https://mail.kengen.co.ke: 34
https://mail.kengen.co.ke/owa/auth/logon.aspx: 31
https://mail.kengen.co.ke/: 11
https://intranet.kengen.co.ke/index.php: 7
https://intranet.kengen.co.ke/: 5
https://••••••••••.kengen.co.ke: 4
http://••••••••.kengen.co.ke: 3
https://••••.kengen.co.ke/•••/••••.•••: 3
http://••••••.kengen.co.ke: 2
https://••••.kengen.co.ke/•••••••••••••••••••••••••••••••••••••••••/••••••••••/••••••••••••/•••/•••••.•••: 2
https://••••••••.kengen.co.ke: 2
https://••••••••••.kengen.co.ke/•••••••/•••••••••••••: 1
https://••••••••.kengen.co.ke: 1
https://••••.kengen.co.ke/•••/••••/•••••••••••••••.••••: 1
https://••••.kengen.co.ke/•••••••••••••••••••••••••••••••••••••••••/••••••••••/••••••••••••/••••••••.•••: 1
https://••••••••••.kengen.co.ke/•••••••/•••••••••••••: 1
https://•••.kengen.co.ke: 1

🔐 Utenze users compromesse

🛡️ Antivirus rilevati

Windows Defender: 5
Not Found: 3