Assets · Discovered · watched all the time

What turned up that nobody has looked at yet

4 to review · 1 critical, 3 high · across tessellatepay.com and tessellate.ng · certificate logs checked at 10:00

vpn.tessellatepay.com · certificate logs · found Mon 12 Oct, 02:01

A VPN appeared on Mon 12 Oct, and it's on CISA's exploited list

Runs FortiOS 7.0.12, which attackers are exploiting now (CVE-2024-21762). Nobody has said whose it is, so its findings go to no one. And on the dark web, access to a VPN that matches it is for sale. We’d give it to Platform: they run the office network, and FortiGate is network kit. Three more finds are waiting below.

Decide on it Open the finding

Waiting

Whose is it?

Worst first · our suggestion is filled in, and nothing changes until you confirm

New host · tessellatepay.com · found Mon 12 Oct, 02:01
vpn.tessellatepay.com
A FortiGate SSL VPN, in Lagos
Critical Runs FortiOS 7.0.12, which attackers are exploiting now (CVE-2024-21762)
How we found it
1. Certificate logsA Sectigo certificate for vpn.tessellatepay.com, issued Fri 2 Oct
2. DNSResolves to 102.89.34.118, MainOne in Lagos
3. On the webAnswers on 443 and 10443: FortiGate SSL VPN
4. FingerprintFortiOS 7.0.12, on CISA's exploited list
5. The dark webAccess to a VPN matching it went on sale on Thu 15 Oct
What is it to you?
Who looks after it
Suggested: Platform. They run the office network, and FortiGate is network kit.
What it's for
How much it matters
A · Crown jewels: money moves or customer data lives here
Everything we know about it
A name like yours · found Fri 16 Oct, 06:12
tessellatepay-ng.com
A lookalike domain with a copy of your sign-in page
High Set up for phishing your merchants: it can send mail and collects passwords
How we found it
1. Names like yoursRegistered Fri 16 Oct through Namecheap, owner hidden
2. DNSHas mail records, so it can send and receive email
3. On the weblogin.tessellatepay-ng.com shows a copy of your sign-in page
What is it to you?
Ask for it to be taken downWe send Namecheap and the host the copied page, the mail records and your trademark, as evidence.Warn us if it starts sending mailA message in #security-alerts the first time its mail records change.
Why, for whoever looks next
Not ours. Someone set it up to phish our merchants.
New host · tessellatepay.com · found Mon 5 Oct, 02:03
old.tessellatepay.com
An old name pointing at a Heroku app that's gone
High Anyone can claim the Heroku app and serve pages on your domain
How we found it
1. DNSA CNAME to tessellate-legacy.herokuapp.com
2. HerokuThat app no longer exists: Heroku answers "No such app"
What is it to you?
Who looks after it
Suggested: Platform. They manage your DNS.
What it's for
How much it matters
C · Internal and brand: tools and pages that would hurt if they fell
Everything we know about it
An address answering as you · tessellatepay.com · found Thu 1 Oct, 02:46
18.133.42.7
The server behind app.tessellatepay.com, reachable without Cloudflare
High Requests sent here skip the firewall and rate limits
How we found it
1. Certificate logsA certificate for app.tessellatepay.com also lists this address's reverse name
2. Direct request18.133.42.7 answers on 443 with app.tessellatepay.com's certificate
3. On the webServes "Sign in · Tessellate Pay" with no Cloudflare in front
What is it to you?
Who looks after it
Suggested: Payments. It's the origin of app.tessellatepay.com, which they own.
What it's for
How much it matters
A · Crown jewels: money moves or customer data lives here
Tracking it isn’t fixing it. The fix is to accept traffic only from Cloudflare at the origin, so this address stops answering anyone else.

Waiting

vpn.tessellatepay.com

tessellatepay-ng.com

old.tessellatepay.com

18.133.42.7