Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE29 IOCs
Inside Help TDS: Hotejka, Cloudflare Pages, and Predictive Detection
Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Indicators of Compromise29
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | arrow-berry-gem.pages.dev indicatorintel-blognetwork | High | 58 | Oct 15, 26 |
| Domain | pastebin.com intel-blogmalwarenetwork | High | 61 | Jun 2, 26 |
| Domain | pages.dev intel-blogmalwarenetwork | High | 78 | Jun 18, 26 |
| Domain | solar-cloud-branch.pages.dev indicatorintel-blognetwork | High | 58 | Oct 15, 26 |
| IP | 162.244.35.33 indicatorintel-blognetwork | High | 58 | Oct 15, 26 |
| Domain | ultraviewer.net indicatorintel-blognetwork | High | 58 | Oct 15, 26 |
| IP | 62.113.117.248 intel-blognetworkproxy | High | 58 | Oct 15, 26 |
| Domain | usa.on1xvpn.com intel-blogmalwarenetwork | High | 58 | Oct 15, 26 |
| Domain | linen-thorn-wild.pages.dev intel-blogmalwarenetwork | High | 58 | Oct 15, 26 |
| IP | 91.196.33.144 intel-blogmalwarenetwork | High | 58 | Oct 15, 26 |
| Domain | roi-traffic.icu indicatorintel-blognetwork | High | 58 | Oct 15, 26 |
| Domain | pinkfels.shop intel-blogmalwarenetwork | High | 58 | Oct 15, 26 |
| Domain | fosetya.shop indicatorintel-blognetwork | High | 58 | Oct 15, 26 |
| Domain | lib1.biz indicatorintel-blognetwork | High | 58 | Oct 15, 26 |
| Domain | zenno.club intel-blogmalwarenetwork | High | 58 | Oct 15, 26 |
| Domain | hotns.rest intel-blognetworkproxy | High | 58 | Oct 15, 26 |
| Domain | hotejka.com indicatorintel-blognetwork | High | 58 | Oct 15, 26 |
| Domain | roi777.online intel-blognetworkphishing | High | 58 | Oct 15, 26 |
| Domain | usa.on1xvpn.ru intel-blogmalwarenetwork | High | 58 | Oct 15, 26 |
| Domain | trixsolvesxa.shop intel-blognetworkproxy | High | 58 | Oct 15, 26 |
| Domain | hotcname.help indicatorintel-blognetwork | High | 58 | Oct 15, 26 |
| Domain | goalods.lol intel-blognetworkproxy | High | 58 | Oct 15, 26 |
| Domain | ashen-drift-stone.pages.dev indicatorintel-blognetwork | High | 58 | Oct 15, 26 |
| Domain | zylvantrexor.lol intel-blognetworkproxy | High | 58 | Oct 15, 26 |
| Domain | hotejka.ink intel-blognetworkproxy | High | 58 | Oct 15, 26 |
| Domain | sun-sky-calm.pages.dev intel-blogmalwarenetwork | High | 58 | Oct 15, 26 |
| Domain | roi777.com intel-blogmalwarenetwork | High | 58 | Oct 15, 26 |
| Domain | serv.host intel-blogmalwarenetwork | High | 58 | Oct 15, 26 |
| Domain | varbani.com indicatorintel-blognetwork | High | 58 | Oct 15, 26 |
IOC Relationship Graph
IOC Relationship Graph29 total IOCs
DomainIP