IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE30 IOCs

Hold the Phone! International Revenue Share Fraud Driven by Fake CAPTCHAs

IN
Infoblox
Published April 23, 2026Original Report

Threat Actors

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYPlayINFRASTRUCTUREhttps://d.ruelomamuy.…d.panzozerrot.comd.vistertransit.comCAPABILITYPlayVICTIMunknown
Adversary(1)
Infrastructure(6)
Capability(1)
Victim

Indicators of Compromise

Indicators of Compromise30

TypeIndicatorConfidenceScoreFirst Seen
URLhttps://d.ruelomamuy.com/makeTrackerDownload.php?a=WEBSMS&s=5002320649344849&c=US&groupds=138&caf=5002320649344849&origSms=I%20want%20to%20continue%205002320649344849&step=9
aptespionageintel-blog
High
58
Oct 9, 26
Domaind.panzozerrot.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domaind.vistertransit.com
aptespionageintel-blog
High
58
Oct 9, 26
SHA1aa3e8d3009d94b9c89ac744b2be0687643493b0c
file-hashintel-blogmalware
Medium
53
Oct 9, 26
Domainzawsterris.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainchat.matchnewtoday.com
aptespionageintel-blog
High
58
Oct 9, 26
Domainzerrotmamil.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domaincarrolvassin.top
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainvids.chatorizon.com
aptespionageintel-blog
High
58
Oct 9, 26
Domainbuffalosolpe.top
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domain4lifetips.com
aptespionageintel-blog
High
58
Oct 9, 26
Domainhotnow.sweeffg.online
intel-blogmalwarenetwork
High
58
Oct 9, 26
URLhttp://megaplaylive.com/?enc=eyJwaG9uZU51bWJlcnMiOlsiKzIwMTAwNTc5NzQ1MiIsIisyMDEwMDQ5MzkxNzgiLCIrMjAxMDA1Nzk2Mzg5IiwiKzIwMTAwNDk1MTYyNiIsIisyMDEwMDU4MDMzNzkiLCIrMjAxMDA2MzQ4ODc5IiwiKzIwMTAwNDkzOTE0NSIsIisyMDEwMDUyMDk2NzYiLCIrMjAxMDA2MzQzOTk3IiwiKzIwMTAwNjM1MzY5MyIsIisyMDEwMDk0MDg1ODQiLCIrMjAxMDA1Nzk2Mzk5IiwiKzM4MDkyNzg4NTQ2MiIsIiszODA5MjI0MTg0MDQiLCIrNDQ3NDkwOTIwODEwIiwiKzQ2NzY2NzQ2NDUxIiwiKzQzNjcwMzA2ODEwNyIsIis3NzkwNTAwMDIyNSIsIiszMjQ2NzQ0MDQyNyIsIis0NDc4NDg1MDk0NDgiXSwiYWYiOiI1MDAyMzIwNjQ5MzQ0ODQ5IiwiZGV2IjpudWxsLCJ0eXBlIjoiZ2FtZXMiLCJsYW5nIjoiZW4iLCJsb2FkZXIiOmZhbHNlLCJjaWQiOm51bGwsInBpZCI6bnVsbH0=
aptespionageintel-blog
High
58
Oct 9, 26
Domainr.carrolvassin.top
aptespionageintel-blog
High
58
Oct 9, 26
Domaind.zerrotmamil.com
aptespionageintel-blog
High
58
Oct 9, 26
Domainclaimandwins.com
aptespionageintel-blog
High
58
Oct 9, 26
Domaintransitcaxip.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainvistertransit.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domaind.fufecarrol.top
intel-blogmalwarenetwork
High
58
Oct 9, 26
URLhttps://verifysuper.com/cl/i/wopmej?aff_sub4=5002320649344849&aff_sub5=US
aptespionageexploit
High
58
Oct 9, 26
Domaind.santafebuno.top
aptespionageexploit
High
58
Oct 9, 26
Domainr.transitcaxip.com
aptespionageintel-blog
High
58
Oct 9, 26
Domaind.remotesbuffalo.top
aptespionageintel-blog
High
58
Oct 9, 26
Domainfufecarrol.top
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainpanzozerrot.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domaincolnsdital.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domaind.marraheltin.com
aptespionageintel-blog
High
58
Oct 9, 26
Domaind.herbosfinx.com
aptespionageintel-blog
High
58
Oct 9, 26
Domainr.buffalosolpe.top
aptespionageintel-blog
High
58
Oct 9, 26
Domainremotesbuffalo.top
intel-blogmalwarenetwork
High
58
Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph30 total IOCs
URLDomainSHA1
Domain26URL3SHA11Actors1Malware1REPORTHold the Phone! InternatioPlayPlay
scroll to zoom · drag to pan · click IOC to open