Contact us Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

The University of Oklahoma (ou.edu)

ou.edu

Group Fog
Discovered 2025-01-14 12:31 UTC
Est. attack date 2025-01-14
Country US

Description:

91 MB

Infostealer activity detected by HudsonRock

Compromised Employees: 65

Compromised Users: 1124

Third Party Employee Credentials: 233


External Attack Surface: 162


DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • No emails found.
MX Records
  • mxa-00272701.gslb.pphosted.com. Proofpoint
  • mxb-00272701.gslb.pphosted.com. Proofpoint
TXT Records
  • google-site-verification=B1XtiPZn3KBonENNqC3PRDjD5AlcbiA3syfJY2R1RlA
  • MS=ms95193120
  • adobe-idp-site-verification=6ba3e6ad-d322-435f-b2ea-efa73549fd04
  • 4ebp5mps69vnmnnm00pq3ak046
  • AppID=0000000048019867
  • google-site-verification=EMTIg5uKXGXbCBa5000kcqYhYMkZbHKDuyyCAZZqX38
  • 19b2wwr3n8zyh5ppcyqgc2n9pwszbvch
  • dell-technologies-domain-verification=ou.edu_f4eb63d7-ca68-4b9c-8886-aed9c0d2a464_1778443049
  • autodesk-domain-verification=N4NfpymhDwdHr4XMV8FB
  • docusign=8de025f0-7002-4f33-81c9-b99876e9dd6f
  • amazonses:6a65aisx1XSyBKQ17qrGnQGvL0ZCs9I5Rq9LME9rqWY=
  • docusign=05e90101-723f-479f-af27-de27e85d8f98
  • ZOOM_verify_6gDEToiHTCmY38NbmZzkzA
  • v=spf1 include:spf.protection.outlook.com include:_tuf-spf.touchnet.com include:_spf.qualtrics.com include:aspmx.pardot.com include:servers.mcsv.net include:mail.zendesk.com ip4:67.231.145.144 include:sendgrid.net ip4:168.245.25.116" " ip4:148.59.100.16/28 ip4:129.15.42.13 ip4:52.86.188.131 ip4:54.236.128.150 ip4:54.236.109.30 ip4:64.72.147.142 ip4:208.86.201.61 ip4:216.37.17.227 ip4:64.72.147.23 ip4:35.80.141.6 ip4:44.229.121.55 ip4:148.59.100.16/28 ~all
  • apple-domain-verification=K0MYiQ2cpU5b71eM
  • LCTr/F0hImTjsnYw6pt9Jg6TWBOcfqK+3qeJYgsQ+bpkyiTfaix8+0YKXRV/VTHUIt2BZtBnra+Eza6GVKPohg==
  • infoblox-domain-mastery=67f7995c22bb4be1835f541279da44c14afc894a3485c4132ad3b48b3826ada41b
  • beam-verification=tO9eASrtnwOX0k5Pt87mwtRwTJPncRbHQznFi2MbavFkVccZ
  • google-site-verification=Ta7bq2QHLFrKjjFUjdm4DXkV8K3wN56S5mdMEY5CwO8
  • onetrust-domain-verification=ed5aafe61b1a42deb87c19be18cfd4c2
  • pardot_139971_*=262d8f2660b45fe1196819eb9ca51f259fa772e1c40148014eda80bfb1a37c21
  • +zWEfgkvA2j9fHHBKPVE4qyt9uyD85oFlNynjfase5hvZlAnYbCXGlpU3uw/YWjw29sso+Ld9IUjDBQhveBwYA==
  • MS=ms47553681
  • cisco-ci-domain-verification=2e8593a1e97e6ee3e9e53c4192da8d2fc3c38fff45292480c92fed85bb98f451
  • 208.75.123.0/24
  • knowbe4-site-verification=c5d493be36393b1b48e67e6d904010e2
Cloud / SaaS Services Detected
Adobe Apple Amazon SES/WorkMail Mailchimp Microsoft 365 Autodesk KnowBe4 Zendesk Cisco SendGrid OneTrust DocuSign Proofpoint Zoom

Leak Screenshot:

Leak Screenshot