The data predates changes on whois (before GDPR took effect) and allows us to identify registrant data that is connected to Dridex phishing campaigns and the Carbanak group. Magecart Group 5 has a different modus operandi; it targets the supply chain used by e-commerce merchants to load various libraries, analytics, or security seals. The threat actors registered the domain informaer under eight different top-level domains (TLDs) using privacy protection services (see IOCs for full list) Using these services, they may have forgotten to apply the same to informaer.com.”]