Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
55 IOCs
Moqhao Part 1: Identifying Phishing Infrastructure
Threat Actors
Excerpt
https://team-cymru.com/blog/2021/01/20/moqhao-part-1-identifying-phishing-infrastructure/ MoqHao Part 1: Identifying Phishing Infrastructure By S2 Research Team Published: 2021-01-10 · Archived: 2026-10-25 02:07:54 UTC Cyber Reconnaissance with Team Cymru's Pure Signal‚Ñ¢ Platform In mid-January, Twitter users @NaomiSuzuki_ and @KesaGataMe0 identified nearly 20 malicious phishing domains spoofing AEON Bank in Japan. The domains were tied to MoqHao, a malware family targeting…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →55 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 103.75.189.31 | High | Score 67/100 | First seen |
| IP | 172.67.215.77 | High | Score 67/100 | First seen |
| Domain | aeoob.com | High | Score 67/100 | First seen |
| IP | 45.114.130.4 | High | Score 67/100 | First seen |
| Domain | t.auznw.com | High | Score 67/100 | First seen |
| IP | 20.48.114.7 | High | Score 67/100 | First seen |
| Domain | t.aeomq.com | High | Score 67/100 | First seen |
| IP | 27.100.36.35 | High | Score 67/100 | First seen |
| Domain | t.aeomt.com | High | Score 67/100 | First seen |
| SHA1 | c2029fa68bfa34fefc4ac48360434989122f1348 | High | Score 67/100 | First seen |
| IP | 104.27.181.251 | High | Score 67/100 | First seen |
| Domain | aeenm.com | High | Score 67/100 | First seen |
| Domain | t.aeogu.com | High | Score 67/100 | First seen |
| Domain | t.aeomc.com | High | Score 67/100 | First seen |
| Domain | t.aeomz.com | High | Score 67/100 | First seen |
| IP | 45.121.147.50 | High | Score 67/100 | First seen |
| Domain | t.aeoin.com | High | Score 67/100 | First seen |
| IP | 104.27.180.251 | High | Score 67/100 | First seen |
| Domain | t.aeoxi.com | High | Score 67/100 | First seen |
| Domain | t.aeomk.com | High | Score 67/100 | First seen |
| Domain | 77bbnk.com | High | Score 67/100 | First seen |
| Domain | t.aeoob.com | High | Score 67/100 | First seen |
| IP | 45.121.147.242 | High | Score 67/100 | First seen |
| Domain | t.aeokc.com | High | Score 67/100 | First seen |
| Domain | t.aeoyhl.com | High | Score 67/100 | First seen |
| IP | 216.189.159.35 | High | Score 67/100 | First seen |
| Domain | t.aeodr.com | High | Score 67/100 | First seen |
| Domain | t.aeomp.com | High | Score 67/100 | First seen |
| IP | 104.27.180.110 | High | Score 67/100 | First seen |
| IP | 104.27.188.38 | High | Score 67/100 | First seen |
| Domain | t.aeomg.com | High | Score 67/100 | First seen |
| IP | 45.121.147.170 | High | Score 67/100 | First seen |
| IP | 40.74.72.100 | High | Score 67/100 | First seen |
| IP | 45.58.52.60 | High | Score 67/100 | First seen |
| Domain | 77bac.com | High | Score 67/100 | First seen |
| URL | https://team-cymru.com/blog/2021/01/20/moqhao-part-1-identifying-phishing-infrastructure/ | High | Score 67/100 | First seen |
| Domain | 77ebnk.com | High | Score 67/100 | First seen |
| Domain | aenvv.com | High | Score 67/100 | First seen |
| Domain | t.aeomnv.com | High | Score 67/100 | First seen |
| IP | 178.132.7.109 | High | Score 67/100 | First seen |
| IP | 51.83.247.167 | High | Score 67/100 | First seen |
| Domain | t.aeovn.com | High | Score 67/100 | First seen |
| IP | 213.183.48.212 | High | Score 67/100 | First seen |
| Domain | bnk.com | High | Score 67/100 | First seen |
| IP | 172.67.158.54 | High | Score 67/100 | First seen |
| IP | 172.67.199.42 | High | Score 67/100 | First seen |
| Domain | 77cbnk.com | High | Score 67/100 | First seen |
| IP | 210.140.10.24 | High | Score 67/100 | First seen |
| Domain | t.aeomu.com | High | Score 67/100 | First seen |
| Domain | t.aeoxq.com | High | Score 67/100 | First seen |
| Domain | t.aeomh.com | High | Score 67/100 | First seen |
| IP | 188.213.49.231 | High | Score 67/100 | First seen |
| Domain | 77obnk.com | High | Score 67/100 | First seen |
| Domain | aetvk.com | High | Score 67/100 | First seen |
| Domain | aenbv.com | High | Score 67/100 | First seen |
IOC Relationship Graph
Building graph…