Group:
Clop
Discovered by ransomware.live: 2025-11-21
Estimated attack date:
2025-11-21
Country:
Description:
[AI generated] Phoenix.edu is the online portal for the University of Phoenix, a for-profit institution that is geared towards adult learners. The university offers degree programs at the associate's, bachelor's, master's and doctoral levels across a range of disciplines, including business, education, nursing, technology and more. It is recognized for its flexible course schedules, online classes, and professional development opportunities.
Infostealer activity detected by HudsonRock
Compromised Employees: 79
Compromised Users: 5632
Third Party Employee Credentials: 296
External Attack Surface:
118
DNS Records:
The following DNS records were found for the victim's domain.
- mxa-002dbe01.gslb.pphosted.com.
- mxb-002dbe01.gslb.pphosted.com.
- google-site-verification=7c_CInAZx3LoBoe_-VS6QHUmyZKtrKBXE2ECaPB2T_8
- y5bNThgLCfXxka3EUFAxkTx7oFXog5PtLs5aMSqjKXSNb0emzlK5cDyFtu9B2o7/dd3SMm5PCmibb8i5F8VTLA==
- v=spf1 ip4:74.120.231.6 ip4:3.221.97.1 ip4:54.174.254.153 ip4:18.233.30.245 ip4:3.232.53.234 ip4:54.198.41.149 ip4:52.203.192.133 ip4:74.120.224.204 ip4:74.120.224.205 ip4:148.163.155.228 ip4:192.48.98.254 ip4:67.20.178.231 ip4:148.163.147.29 include:spf-" "00809302.pphosted.com include:spf.protection.outlook.com include:mktomail.com include:_spf.salesforce.com include:all.spf.avature.net ~all
- docusign=9cfe7b17-7559-440b-971c-18d0ea81df94
- openai-domain-verification=dv-3qV2buW8AE4xO9gtsj17195l
- MS=ms47423577
- google-site-verification=o5DRfgkxs8cHrZsTy-c3n2D9dydYXFxxGrQPc6C85KE
- docusign=bb751c67-da8a-46cb-a2af-dc21c69e85ec
- google-gws-recovery-domain-verification=66895504
- apple-domain-verification=TxWFXcPym4CGflV8
- amazonses:E8WANdRZwaBn3022iS9y5RFwS8nMZa6I6LY1HLxxGNY=
- google-site-verification=v4ggzgEPtNCbynYNg8o-ojkDo5440x8dXzmj3pQXPDs
- adobe-sign-verification=e6b0022a9ecdbdda4bda7b124965beb7
- onetrust-domain-verification=1275e074ffdb4f589e45d60558ce208e
- slack-domain-verification=f9bkx9fVkL6ccMxjehLeyW9lomo7DoKJkGD41duX
- pardot1056643=a9863900a67c35e1e71f7f106dbb679b14c7dcc2e835d2c145c56944f0cd8390
- ZOOM_verify_j-E40QuCQMuvOoa1g04Ytg
- google-site-verification=HQ4PS14f_E8UiGejNl7OoUzyZd3K0YcJjZnZU1Jp_sY
- segment-site-verification=iLtsFZdJbwU0AS3hnwm90Pod6PARw7DR
- Foxit-domain-verification=ea909df0d5fcb6b40f3851bed8ea59a3
- teamviewer-sso-verification=befda1f9702d4b5cbe3747865d91cb42
- atlassian-domain-verification=eAcBeNBTVMFhz2q1WeTy8KlpuYarzPTyLQtLlUVNKrkDnmjZXUL9i1Zd4SDGU3Xa
- sending_domain1056643=8ab068d872beb23cfdb06fc473668ae1f35677f7f3568409460e24c0b2ee157b
Cloud / SaaS Services Detected
Apple
Atlassian
Amazon SES/WorkMail
Microsoft 365
Salesforce
Slack
Marketo
Segment
Teamviewer
OneTrust
DocuSign
Proofpoint
Zoom
Leak Screenshot:
Legal Disclaimer:
Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession,
hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data.
This platform indexes only publicly visible information posted by ransomware operators and
open web sources without accessing or obtaining the underlying stolen content.
The service is provided to support public awareness, legitimate research, and cyber-resilience.
No stolen personal or confidential data is collected or distributed via this site.