Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Domainplasticbells.comMediumSHA2560a6da70548f14834acb8960689a589b48ff422f8385ae445a281aab77045fe22MediumIP179.27.99.9MediumIP201.221.36.202HighIP179.27.158.254MediumDomainfighiting1013.orgMediumSHA256018494565257ef2b6a4e68f1c3e7573b87fc53bd5828c9c5127f31d37ea964f8Low