25-Year-Old Domain Shares Name Servers With Fresh Emotet Asset
A domain registered in 2000 and one registered in 2025 delegate to the identical four Porkbun name servers, tying them to an Emotet-linked infrastructure set. All three domains carry Let's Encrypt certificates with subject CNs unrelated to their own hostnames, while a fully-instrumented IBAN-themed document loader confirms the classic macro-to-PowerShell-to-dropped-EXE chain.
Two domains registered nearly a quarter-century apart are pointed at an identical set of authoritative name servers — a provisioning fingerprint that says more about this campaign's operators than any single payload does. quasi-monkey.com, registered through Porkbun LLC on 2000-09-11 and sitting on the internet for more than 9,400 days, and andysresume.info, registered on 2025-02-03, both delegate to the same four Porkbun infrastructure hosts: curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com,…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read