Phishing justid.io

[HUGOK 0]

The firewall reports in the threat filter the URL Phishing justid.io to two target addresses 3.225.57.215 3.229.62.193 computer scanned the latest Eset Endoint Security did not detect anything, only WireShark actually shows connection attempts to these addresses. How to solve the problem.

[Marcos 5,267]

Please provide logs collected with ESET Log Collector.

[HUGOK 0]

ees_logs.zip

[itman 1,746]

3 hours ago, HUGOK said:

two target addresses 3.225.57.215 3.229.62.193

Those IP addresses are associated with Proxy-registered route object for Amazon Data Services NoVa (ADSN-1).

As far as justid.io goes, VirusTotal only shows IP address, 136.243.70.185, associated with it. Also, this domain when entered into Firefox won't resolve at all. Accessing the domain via Google search result yields;