IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE5 IOCs

Ghostwriter Phishing Infrastructure Targets Gmail and Ukrainian Email Portal Users

CP
Cyber Press
Published June 29, 2026Original Report

Threat Actors

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYUNC1151INFRASTRUCTUREaccounts-verification…mail.service-support.…45.197.133.104CAPABILITYunknownVICTIMunknown
Adversary(1)
Infrastructure(3)
Capability
Victim

Indicators of Compromise

5 indicators

TypeIndicatorConfidenceScoreFirst Seen
SHA2562434e1a88cf2effa13fc4eb335560e3cf49790ddd4bd0df7e100de9867a19748MediumScore 53/100First seen
Domainaccounts-verification.cc.cdHighScore 58/100First seen
Domainmail.service-support.digitalHighScore 58/100First seen
SHA2566542f8fa3e1f00a3c0e9994c34d8b49d2c3d2684cf73c23a0b1030daaaaa4786MediumScore 53/100First seen
IP45.197.133.104HighScore 58/100First seen

IOC Relationship Graph

5 total IOCs
SHA256DomainIP
SHA2562Domain2IP1Actors1Ghostwriter Phishing Infrastructure Targets Gmail and Ukrainian Email Portal UsersREPORT2434e1a88cf2effa13fc…6542f8fa3e1f00a3c0e9…accounts-verificatio…mail.service-support…45.197.133.104UNC1151
scroll to zoom · drag to pan · click IOC to open