Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Threat Actors
Malware Families
Excerpt
Fake WatchGuard VPN Site Steals Credentials | Huntress Deception is moving at machine speed. Learn to keep pace. Portal Login Support Blog Contact Search Search Products Products Platform Overview Huntress Platform One managed platform across endpoint integrity, identity resilience, and operational readiness. Huntress Platform One managed platform across endpoint integrity, identity resilience, and operational readiness. Athena Engine The agentic AI that investigates every…
Read the original report →Diamond Model
Adversary(3)
Infrastructure(6)
Capability(4)
Victim
Indicators of Compromise
Open the mindmap →7 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | watchguard-ssl.online | High | Score 58/100 | First seen |
| IP | 158.94.209.19 | High | Score 58/100 | First seen |
| CVE | CVE-2025-11371 | Medium | Score 51/100 | First seen |
| URL | https://www.watchguard-vpn.net/ | High | Score 58/100 | First seen |
| IP | 74.208.236.39 | High | Score 58/100 | First seen |
| Domain | watchguard-vpn.com | High | Score 58/100 | First seen |
| IP | 80.249.132.140 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…