Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
9 IOCs
Borrowed Reputation: Domain Shadowing and Gambling SEO
Excerpt
Borrowed Reputation How domain shadowing placed illegal gambling pages beneath school and government domains Executive Summary We identified two unrelated operations that used domain shadowing to place illegal gambling content beneath legitimate school and government domains. In both cases, an unauthorized party appears to have gained access to DNS administration and created records that the original domain owners may not have noticed. Because the resulting hostnames sat…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →9 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | link-omacuan-amc-edu-et-raahs-edu-bd.pages.dev | High | Score 58/100 | First seen |
| Domain | free-bonus-no-deposit-betting-sites.dpboss.maharashtra.gov.in | High | Score 58/100 | First seen |
| Domain | imghaxor.io | High | Score 58/100 | First seen |
| Domain | imgmahasuhu.io | High | Score 58/100 | First seen |
| Domain | imgstore.io | High | Score 58/100 | First seen |
| Domain | mikale.me | High | Score 58/100 | First seen |
| Domain | hinkale.me | High | Score 58/100 | First seen |
| Domain | link.omacuan.amc.edu.et.raahs.edu.bd | High | Score 58/100 | First seen |
| IP | 168.144.156.92 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…