Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
IP190.115.16.13HighIP186.2.175.183HighIP138.226.236.52HighIP45.227.254.154MediumDomainaskforupdate.orgMediumIP138.226.236.193HighIP138.226.237.250HighIP138.226.236.101HighIP138.226.236.13HighIP138.226.236.51MediumDomainriverscounselling.comMediumIP31.220.3.165MediumIP138.226.237.225HighDomainpixelrz.comHighDomainddns-ip.netMediumDomainkeytool.ccHigh