Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE32 IOCs
Dropcatch Scavengers: Expired Malicious Domains Become Cash Cows
Threat Actors
Malware Families
Diamond Model
Adversary(1)
Infrastructure(6)
Capability(3)
Victim
Indicators of Compromise
Indicators of Compromise32
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | tofuturepubs.com affiliate fraudasiabad reputation | High | 69 | Aug 13, 26 |
| Domain | cdnjslibraries.com affiliate fraudasiabad reputation | High | 80 | Aug 13, 26 |
| Domain | simplejscdn.com affiliate fraudasiabad reputation | High | 69 | Aug 13, 26 |
| Domain | slurpslimes.org active scanaptbotnet | High | 82 | Jul 13, 23 |
| Domain | webpixel.app active scanningapplication service scanningasia | Medium | 63 | Jul 17, 25 |
| Domain | windowlight.org access controlaptblacklisted urls | Medium | 71 | Jun 28, 23 |
| Domain | advanceslibrary.com botnetintel-blogloader | High | 86 | Jun 28, 26 |
| Domain | wesq.me affiliate fraudasiabad reputation | High | 80 | Aug 13, 26 |
| Domain | memtkh.com affiliate fraudasiabad reputation | High | 83 | Jan 11, 25 |
| Domain | draggedline.org access controlaffiliate fraudapt | Medium | 70 | Sep 6, 23 |
| Domain | propush.me exfiltrationintel-blogmalware | High | 58 | Oct 9, 26 |
| Domain | getshopstar.com indicatorintel-blogmalware | Low | 31 | Aug 13, 26 |
| Domain | lzdatheme.com indicatorintel-blogmalware | Low | 31 | Aug 13, 26 |
| Domain | weatherplllatform.com exploitindicatorintel-blog | Low | 32 | Nov 19, 22 |
| Domain | magesource.su active scanaffiliate fraudasia | High | 82 | Feb 26, 21 |
| Domain | blacksaltys.com abuseactive scanadsi | High | 83 | Jul 30, 24 |
| Domain | blocksovetnik.ru exploitindicatorintel-blog | Low | 31 | Aug 13, 26 |
| Domain | jqueryapihelpers.com affiliate fraudasiabad reputation | High | 77 | Jun 12, 25 |
| Domain | renteres.ru affiliate fraudasiabad reputation | High | 69 | Aug 13, 26 |
| Domain | brodirect3s.site affiliate fraudasiabad reputation | High | 78 | Aug 13, 26 |
| SHA256 | 230aec2350a0eb778d51d277eb7bd95cf4c0246c32fbcbc0658a2e464ca45706 file-hashintel-blogloader | Medium | 53 | Oct 9, 26 |
| Domain | pausewatchings.com indicatorintel-blogmalware | Medium | 68 | Aug 13, 26 |
| Domain | bluegaslamp.org access controlaffiliate fraudapt | Medium | 70 | Aug 10, 23 |
| Domain | hpmdnetwork.ru exploitindicatorintel-blog | Low | 31 | Aug 13, 26 |
| Domain | gsstats.ru indicatorintel-blogmalware | High | 78 | Aug 13, 26 |
| Domain | blackshelter.org abuseaccess attemptaccount brute force | High | 88 | Dec 4, 24 |
| Domain | imhd.io indicatorintel-blogmalware | Low | 30 | Aug 30, 25 |
| Domain | pills-europe.com affiliate fraudasiabad reputation | High | 69 | Aug 13, 26 |
| Domain | checkoutbump.com affiliate fraudasiabad reputation | High | 80 | Aug 13, 26 |
| Domain | ads-analytic.com intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| Domain | sport2news.com intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| Domain | renpaste.top intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
IOC Relationship Graph
IOC Relationship Graph32 total IOCs
DomainSHA256