Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
29 IOCs
Inside Help TDS: Hotejka, Cloudflare Pages, and Predictive Detection
Excerpt
Threat research is always a bit of a cat-and-mouse game, and it’s often made more so when an actor survives years in the face of scrutiny. The actors behind the so-called Help Traffic Distribution System (TDS) are one such case. They’ve been active since at least April 2017 and have been largely unaffected by the cybersecurity world around them. Help TDS delivers tech support scams (TSSs) that direct users to call centers, where social engineering is used to convince them to…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →29 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | arrow-berry-gem.pages.dev | High | Score 58/100 | First seen |
| Domain | pastebin.com | High | Score 61/100 | First seen |
| Domain | pages.dev | High | Score 80/100 | First seen |
| Domain | solar-cloud-branch.pages.dev | High | Score 58/100 | First seen |
| IP | 162.244.35.33 | High | Score 58/100 | First seen |
| Domain | ultraviewer.net | High | Score 58/100 | First seen |
| IP | 62.113.117.248 | High | Score 58/100 | First seen |
| Domain | usa.on1xvpn.com | High | Score 58/100 | First seen |
| Domain | linen-thorn-wild.pages.dev | High | Score 58/100 | First seen |
| IP | 91.196.33.144 | High | Score 58/100 | First seen |
| Domain | roi-traffic.icu | High | Score 58/100 | First seen |
| Domain | pinkfels.shop | High | Score 58/100 | First seen |
| Domain | fosetya.shop | High | Score 58/100 | First seen |
| Domain | lib1.biz | High | Score 58/100 | First seen |
| Domain | zenno.club | High | Score 58/100 | First seen |
| Domain | hotns.rest | High | Score 58/100 | First seen |
| Domain | hotejka.com | High | Score 58/100 | First seen |
| Domain | roi777.online | High | Score 58/100 | First seen |
| Domain | usa.on1xvpn.ru | High | Score 58/100 | First seen |
| Domain | trixsolvesxa.shop | High | Score 58/100 | First seen |
| Domain | hotcname.help | High | Score 58/100 | First seen |
| Domain | goalods.lol | High | Score 58/100 | First seen |
| Domain | ashen-drift-stone.pages.dev | High | Score 58/100 | First seen |
| Domain | zylvantrexor.lol | High | Score 58/100 | First seen |
| Domain | hotejka.ink | High | Score 58/100 | First seen |
| Domain | sun-sky-calm.pages.dev | High | Score 58/100 | First seen |
| Domain | roi777.com | High | Score 58/100 | First seen |
| Domain | serv.host | High | Score 58/100 | First seen |
| Domain | varbani.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…