Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
IP87.120.104.79MediumIP45.148.18.38HighDomainprofile-verification.comHighDomainmicrosoft-utility.comMediumIP87.120.104.213HighIP87.120.104.147HighIP45.148.18.44HighIP91.217.206.28MediumIP213.179.32.9HighIP87.120.104.144HighIP193.90.12.122MediumIP194.242.11.186MediumIP84.247.135.235MediumIP4.235.114.15HighIP20.100.168.21HighDomaindrives-google.comMediumIP185.12.59.117MediumSHA256c3fb454d59adc1d794fd04af1252c9f8755d2a286c8e1e804f1e86ef08037045HighIP185.12.59.118MediumIP84.215.61.54HighIP62.97.160.112HighIP46.246.122.185HighIP87.248.1.199MediumDomainaccount-user-permission-account.comHighDomainaol-mail-account.comHighDomaindocuments-supportsharing.clubMediumDomaindropebox.coHighDomaingle-mail.comHighDomaingoogle-setting.comHighDomainprofiles-facebook.comHighDomainsadashboard.comHighDomainwebmail-tidhar-co-il.mlHighDomainyahoo-proflles.comHighDomainxn--googe-q2e.mlMediumDomainyoutubbe.mlMediumDomainftp.officialswebsites.infoMediumDomainftp.com-service.netMediumDomainftp.microsoft-upgrade.mobiMediumDomainhangout.messageservice.clubMediumDomainlogin-mails.account-support-user.comMediumDomainlogins-mails.account-servicerecovery.comMediumDomainlogins-mails.accounts-service.supportMediumDomainmail-login.account-servicerecovery.comMediumDomainmail-login.verify-account.servicesMediumDomainmailgate.youtube-com.watchMediumDomainmailgoogle.com-recoveryservice.bidMediumDomainsmtp.group-google.comMediumDomainvideo-yahoo.com.accountservice.supportMediumDomainww62.group-google.comMediumDomainmywindows24.inMedium