By: Dancho Danchev
The actual malicious software binary location URL: hxxp://shighil.com/dl2.exe MD5: c2055b7fbaa041d9f68b9d5df9b45edd
Email Contact Available in Preston Platform.
Bulgaria (National)


Not enough data
Dancho Danchev's coverage is focused on cybersecurity, hacking, and hacker groups. His articles include a significant amount of expert commentary and announcements related to privacy & cybersecurity. Given his focus on exposing cyber threats and identifying malicious actors, he would likely be interested in pitches from experts who can provide insights into emerging cybersecurity threats, new hacking techniques or trends in hacker groups.
Given the nature of his articles which often expose cybercriminal activities or highlight industry-specific issues, he may be receptive to sources with direct knowledge of these topics or those who can provide unique perspectives based on their experience in the field.
He does not appear to have a specific geographic focus but rather covers global cyber threats and security issues.
This information evolves through artificial intelligence and human feedback. Improve this profile .
By: Dancho Danchev
The actual malicious software binary location URL: hxxp://shighil.com/dl2.exe MD5: c2055b7fbaa041d9f68b9d5df9b45edd
By: Dancho Danchev
Dear blog readers, In this post I'll provide actionable intelligence on all the BitCoin wallet addresses from the RAMP (Russian Anonymous
By: Dancho Danchev
Dear blog readers, In this post I'll provide actionable intelligence based on the research and analysis which I posted in my previous “ Dissecting
By: Dancho Danchev
The actual malicious software binary location URL: hxxp://www.delwarren.com/backup/nowin.exe MD5: 320dd151aed6a181d84e63f78cf801f0
By: Dancho Danchev
In my most recent analysis I decided to take a deeper look inside some of the domains which belong to members of the XSS forum are known to have been used as
By: Dancho Danchev
The post Is Aquila (Dmitry) from WASM Forum Community the Author of the Carberp Banking Malware? appeared first on Dancho Danchev's Blog – Mind Streams of Information Security Knowledge
By: Dancho Danchev
The post BitCoin Wallet Addresses From the Breached Forums Cybercrime-Friendly Forum Community – A Compilation appeared first on Dancho Danchev's Blog – Mind Streams of Information Security Knowledge
By: Dancho Danchev
Dear blog readers,I recently intercepted a relatively interesting phishing attempt impersonating the Bulgarian parcel shipping company Speedy that also includes propagation using SMS messages targeting Bulgarian users prompting them to click on bogus and phishing links and I decided to dig a little bit deeper into the infrastructure behind the phishing campaign.With the company acknowledging the existence of the campaign and prompting users to stay vigilant and avoid interacting with the SMS messages and don't click on the phishing domain links in this post I'll provide actionable intelligence on the infrastructure behind the phishing campaign.It's worth emphasizing on the fact that based on publicly accessible information and based on my own personal analysis methodology I was able to find out that this specific phishing campaign was originally active since 2023 which makes it a persistent phishing attack campaign that targets Bulgarian parcel shipping services which also includes Bulgarian Post Service and DHL Bulgaria.Sample domains known to have been involved in the campaign include:hxxp://bg-pacihxxp://bg-sofhxxp://bg-imyhxxp://bg-mykhxxp://bg-myckhxxp://bg-tckhxxp://bg-tmyhxxp://bg-ilhxxp://bg-tzchxxp://bg-tiackhxxp://bg-mybhxxp://bg-tackResponding IPs:165.154.239.211165.154.212.18Sample URLs known to have been used in the campaign include:hxxp://speedy.bg-myb/en/speedy.htmlhxxp://speedy.bg-tiack/en/speedy.htmlhxxp://speedy.bg-tiack/en/speedy.htmlhxxp://speedybg.cfd/en/speedy.htmlhxxp://speedy-i/bg/speedy.htmlhxxp://speedy-blg/bg/speedy.htmlhxxp://speedy.bg-na.qpon/my/speedy.htmlhxxp://speedy.bg-ip.qpon/my/speedy.htmlhxxp://speedy.bg-ic.qpon/my/speedy.htmlhxxp://speedy.bg-it.qpon/my/speedy.htmlhxxp://speedy.bg-ip.qpon/my/speedy.htmlhxxp://speedy.bg-ia.qpon/my/speedy.htmlhxxp://speedy.bg-gl.qpon/my/speedy.htmlhxxp://speedy.bu-bd.qpon/my/speedy.htmlhxxp://speedy.bu-bd.qpon/my/speedy.htmlhxxp://speedy.bg-pv.cfd/my/speedy.htmlhxxp://speedy.bg-bz.qpon/my/speedy.htmlhxxp://speedy.bg-z.qpon/my/speedy.htmlhxxp://speedy.bg-pot.qpon/bg/speedy.htmlhxxp://speedy.bg-pot.qpon/bg/speedy.htmlhxxp://speedy.bg-packl.cfd/bg/speedy.htmlhxxp://speedy.bg-pack.cfd/bg/speedy.htmlhxxp://speedy.bg-packg.cfd/bg/speedy.htmlhxxp://speedy.bg-packg.cfd/bg/speedy.htmlhxxp://speedy.bg-packg.cfd/bg/speedy.htmlhxxp://speedy.bg-packi.cfd/bg/speedy.htmlhxxp://speedyi.cfd/bg/speedy.htmlhxxp://speedyi.cfd/bg/speedy.html
The post Email Address Accounts and IP Addresses of Bhf.io appeared first on Dancho Danchev's Blog – Mind Streams of Information Security Knowledge
By: Dancho Danchev
Dear blog readers,The following is a BitCoin blockchain analysis of the BitCoin wallet addresses from the Verified Cash cybercrime forum.BitCoin Wallet addresses from Verified Cash:12MfXCZriSUzs6hqv8v38pXtsMxpS88heq1fcJnW8F1cr3km1JReJ39JNDwCzNHg8zN16KbuitzAhV46AkwGf3fzjDA9v3Gt9jZbA12MbMbZxAWwr7DkqsUM1jokvNZ62qTCwUp1J739iSUmcGYcYgA6RrropQ7SZqTmG9k281Xo7jit9T1tBjyifkjnDXvMqRYak3DpKV16khSQGYEJ7CyVj1QefrmTH7Bcr9ZNmpwU12QaCcmezomjWSXAQUUZq4q47CaPw4Qtff15ejT2uAAfQ4LoNvAHwNP6kMt7fkjKKHj71G2vFbBBgr29qjyQzvEU1E6DyPep4F9VAu13Y3aWEzoAgyXqkeD6X2oBepvktjZSLmqe1KhTeezUbD3Q84dUPcomh9XyBMXXp3gYS414XrcrUucwB3KyCoqRKUuaKKwJaa15zE6o19HUjgvSRDntGwNFbQBprKZ3bWJnwfjJAC1CoSX2ry4rJnYw9PDdduhxwhJ6z2q3vetC13JPChr4b4Uw6nsMQVEgpqYWQNvHsTa9V21Cvz88PCu9nKtWX92QiphcFeV5BoBhsE3o1PbZZSyWY6WncTWy2eTBGSxCik9ievDwWT1HgWVLKLsfqi4LFzewQwi83vSWfNC6mhhr1HspbjRMrXqch7xdwgqADwfuhhFSELBgsM1F4CiQuVQfgyq1t1exmNVGJaVjDDpeaAua1HzcvqFmV2cXEdUdGA3zErjWZzMM2A3Wqx1NA14tsBgsjGN5JXBSLsmWf5WF2N4aobsf1ATYMGrWacGYAnp8fnQVLzFUzPp243Hysw1MUHs4GEHBYN7KngaffBjXvgFxzAAomX1N1EFoVFkdtCNGvPwd8HZ9Qd7VC2RJH4zszX39eEENWZs44UPh8rh6S6pee2dFpFUxHGxy1NfVtUNLXr8BA6JQJAWQEn7AjC6hGrJoG51FUpUBNSfY9ipoE44PHZbqaviDDHNCdb8z1Ex9PozMF3pCZXc1DoxS62ejcaHT8pqURi14Wmsja5BVH6srbW7YtQRLni8xH97b7iwx1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX1JxBiTbVnng1264Zn29LgUFDZPaydcHMCHbc1q76awjp3nmklgnf0yyu0qncsekktf4e3qj248t43Cbq7aT1tY8kMxWLbitaG7yT6bPbKChq643HU5sj7kB6wT9zRwpbhCRrR28vKWjfkMKf1QgTYzMYqStzZBQx8gguYaJQMjFRbagbh1DsB8CHc7fa87GUm6qs6YGoCRgQpBo2TJZHere's the analysis:Generated at: 2026-05-09 17:05:59 UTCAPI source: https://blockstream.info/apiBTC/USD price source: cryptocompare (https://min-api.cryptocompare) -> coingecko (https://api.coingecko/api/v3)BTC/USD price method: historical daily BTC/USD rate in UTCAddresses submitted: 38Addresses processed successfully: 38Addresses with errors: 0Total transactions across processed addresses: 2181BTC/USD price coverage: 1043 of 1043 confirmed transaction date(s)Combined final summaryTotal received by all processed addresses: 131580.79716657 BTCTotal received by all processed addresses in USD: $1,532,587,625.43Total sent/spent by all processed addresses: 131580.31997084 BTCTotal sent/spent by all processed addresses in USD: $1,067,981,597.66Combined balance from fetched histories: 0.47719573 BTCCombined net decrease across outgoing transactions: 131569.72502628 BTCCombined net decrease across outgoing transactions in USD: $1,067,899,090.21Per-address summaryAddress