{ "generated": "2026-06-04T23:16:33.932Z", "tlp": "clear", "source": "https://interceptcell.com", "feed_url": "https://ciphercortex.com/research/feeds/indicators-all.json", "total": 428, "dispatch_count": 284, "hooked_scams_count": 144, "indicators": [ { "type": "Telegram Bot Token", "value": "8663112401:AAH8iT2OITdNX5h4qWWQcFiU6wh3t-jToJI", "context": "Phantom Stealer exfil bot (@Patty_1312Bot / \"L.G. Escorte Service\"), operator: Stonertje420", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "Telegram Chat ID", "value": "6044905994", "context": "Stonertje420 (@stonertje) \\u2014 phantom-stealer operator receiving exfiltrated data", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "Discord Webhook ID", "value": "1476012056774967446", "context": "Phantom Stealer primary exfil webhook (\"Captain Hook\"), guild 1476011897424973937", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "Discord Channel ID", "value": "1476011898565693464", "context": "Phantom Stealer exfil channel on Stonertje420 Discord server", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "Mutex", "value": "phantom_mtx_7f3a9b2c", "context": "Phantom Stealer runtime mutex \\u2014 indicates active infection", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "Build ID", "value": "phantom-v1.0", "context": "Phantom Stealer build identifier for victim tracking", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "Telegram Bot Token", "value": "5894962737:AAHAFZnz2AkLAyHC0G-7S2je9JMWWLJHGsU", "context": "Enigma Stealer bot (@EnigmaTestMessage_001_bot) with active C2 webhook", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "C2 Domain", "value": "mfjyb716[.]qermznc[.]sbs", "context": "Enigma Stealer C2 subdomain, webhook endpoint at /100385/bot.php", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "C2 Domain", "value": "qermznc[.]sbs", "context": "Enigma Stealer parent domain \\u2014 DGA-style .sbs domain with 7+ subdomains", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "C2 Domain", "value": "jgudc567[.]qermznc[.]sbs", "context": "Enigma Stealer campaign subdomain (cert issued 2025-07-17)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "C2 Domain", "value": "kjbpp508[.]qermznc[.]sbs", "context": "Enigma Stealer campaign subdomain (cert issued 2025-07-17)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "C2 Domain", "value": "twszv363[.]qermznc[.]sbs", "context": "Enigma Stealer campaign subdomain (cert issued 2025-07-17)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "C2 Domain", "value": "nhftt822[.]qermznc[.]sbs", "context": "Enigma Stealer campaign subdomain (cert issued 2025-07-17)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "C2 Domain", "value": "bskoh933[.]qermznc[.]sbs", "context": "Enigma Stealer campaign subdomain (cert issued 2025-07-17)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "C2 Domain", "value": "chxpf777[.]qermznc[.]sbs", "context": "Enigma Stealer campaign subdomain (cert issued 2025-07-17)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "C2 Domain", "value": "jkwan723[.]qermznc[.]sbs", "context": "Enigma Stealer campaign subdomain (cert issued 2025-07-17)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "IP Address", "value": "104.21.22.138", "context": "Enigma Stealer C2 webhook IP (Cloudflare)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "Malware Repository", "value": "github[.]com/mategol/PySilon-malware", "context": "Discord-controlled Python RAT \\u2014 1,177 stars, 193 forks, active development", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "Malware Repository", "value": "github[.]com/1rhino2/phantom-stealer", "context": "Go-based Windows infostealer \\u2014 parent project forked by Stonertje420", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "Malware Repository", "value": "github[.]com/Blank-c/Blank-Grabber", "context": "Python stealer with GUI builder \\u2014 994 stars, 275 forks", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "Cryptocurrency Wallet", "value": "0x4c305D9d4CdF740FF4f2166ecF65c1DF73e93472", "context": "ETH wallet hardcoded in SkilledDC/token-grabber and 14+ forks", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "forked-and-burned-hunting-live-stealer-operators-through-github", "dispatch_title": "Forked and Burned" }, { "type": "Domain", "value": "inditechlab[.]com", "context": "DOJ-seized DPRK IT worker front company domain (Independent Lab LLC), cloned Kitrum website", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "Domain", "value": "tonywangtech[.]com", "context": "DOJ-seized DPRK IT worker front company domain (Shenyang Tonywang Technology)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "Domain", "value": "wkjllc[.]com", "context": "DOJ-seized DPRK IT worker front company domain (Tony WKJ LLC)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "Domain", "value": "hopanatech[.]com", "context": "DOJ-seized DPRK IT worker front company domain (HopanaTech)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "Domain", "value": "huguotechltd[.]com", "context": "DPRK IT worker front company domain (Shenyang Huguo Technology)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "IP Address", "value": "174.138.181.198", "context": "InterServer IP hosting 3 DPRK front company websites (inditechlab, tonywangtech, wkjllc)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "IP Address", "value": "180.235.135.177", "context": "Asia Web Services IP hosting HopanaTech front company", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "IP Address", "value": "103.15.29.44", "context": "Asia Web Services IP hosting Shenyang Huguo Technology front company", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "C2 Server", "value": "185.235.241.208", "context": "BeaverTail/InvisibleFerret C2 server, Contagious Interview campaign, port 1224", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "C2 Server", "value": "95.164.17.24", "context": "BeaverTail/InvisibleFerret C2 server, Contagious Interview campaign, port 1224", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "SHA256", "value": "9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c", "context": "BeaverTail macOS DMG \\u2014 fake MiroTalk installer", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "SHA256", "value": "000b4a77b1905cabdb59d2b576f6da1b2ef55a0258004e4a9e290e9f41fb6923", "context": "BeaverTail macOS DMG \\u2014 fake video call app", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "SHA256", "value": "d801ad1beeab3500c65434da51326d7648a3c54923d794b2411b7b6a2960f31e", "context": "BeaverTail macOS Mach-O binary", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "SHA256", "value": "fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0", "context": "BeaverTail Windows MSI installer", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "SHA256", "value": "de6f9e9e2ce58a604fe22a9d42144191cfc90b4e0048dffcc69d696826ff7170", "context": "BeaverTail Windows MSI installer", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "SHA256", "value": "d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6", "context": "BeaverTail Windows EXE", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "SHA256", "value": "f08e88c7397443e35697e145887af2683a83d2415ccd0c7536cea09e35da9ef7", "context": "InvisibleFerret Python backdoor component", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "SHA256", "value": "e0568196f1494137a5bbee897a37bc4fe15f87175b57a30403450a88486190c4", "context": "InvisibleFerret Python backdoor component", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "SHA256", "value": "b9be6b0ac414ac2a033c17c3ac649417e97e5d0580db796a8ff55169299de50e", "context": "InvisibleFerret Python backdoor component", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "SHA256", "value": "8563eecbc85a0c43b689b9d9f31fe5977e630c276dee0d7dbfe1a47ab1ab4550", "context": "InvisibleFerret Python backdoor component", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "Browser Extension ID", "value": "nkbihfbeogaeaoehlefnkodbefgpgknn", "context": "MetaMask (Chrome) \\u2014 targeted by BeaverTail for credential theft", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "Browser Extension ID", "value": "ejbalbakoplchlghecdalmeeeajnimhm", "context": "MetaMask (Edge) \\u2014 targeted by BeaverTail for credential theft", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "Browser Extension ID", "value": "fhbohimaelbohpjbbldcngcnapndodjp", "context": "BNB Chain / Binance \\u2014 targeted by BeaverTail for credential theft", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "Browser Extension ID", "value": "ibnejdfjmmkpcnlpebklmnkoeoihofec", "context": "TronLink \\u2014 targeted by BeaverTail for credential theft", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "Browser Extension ID", "value": "bfnaelmomeimhlpmgjnjophhpkkoljpa", "context": "Phantom \\u2014 targeted by BeaverTail for credential theft", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "Fake Persona", "value": "Onder Kayabasi", "context": "LinkedIn/X recruiter persona used in Contagious Interview campaign through August 2024", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "Email", "value": "tongyuze@jswc[.]com[.]cn", "context": "Tong Yuze \\u2014 registrant of 25+ Chinese companies including HopanaTech parent entity", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-workers-who-arent-there-mapping-dprk-it-fraud-infrastructure", "dispatch_title": "DPRK IT Worker Infrastructure" }, { "type": "Vulnerable Host", "value": "109.201.11.102", "context": "MFA diplomatic mail server (mail.mfa.gov.ir / cp.mfa.gov.ir), Exim 4.98, 3 HIGH CVEs, self-signed cert", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "diplomatic-mail-and-open-databases-iranian-government-infrastructure-exposed", "dispatch_title": "Diplomatic Mail and Open Databases" }, { "type": "Vulnerable Host", "value": "185.37.55.244", "context": "SMBGhost (CVE-2020-0796, CVSS 10.0) \\u2014 SMB port 445 exposed, Windows IIS 10.0, wormable RCE", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "diplomatic-mail-and-open-databases-iranian-government-infrastructure-exposed", "dispatch_title": "Diplomatic Mail and Open Databases" }, { "type": "Vulnerable Host", "value": "185.37.55.104", "context": "MS15-034 (CVE-2015-1635) \\u2014 10-year-old HTTP.sys RCE, Windows IIS 8.5", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "diplomatic-mail-and-open-databases-iranian-government-infrastructure-exposed", "dispatch_title": "Diplomatic Mail and Open Databases" }, { "type": "Exposed Database", "value": "185.37.55.1", "context": "MariaDB 10.0.38 on port 3306, 7 years past EOL, admin.news.mrud.ir (Ministry of Roads)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "diplomatic-mail-and-open-databases-iranian-government-infrastructure-exposed", "dispatch_title": "Diplomatic Mail and Open Databases" }, { "type": "Vulnerable Host", "value": "185.37.55.206", "context": "VMware ESXi 6.0.0 hypervisor, EOL, ransomware target", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "diplomatic-mail-and-open-databases-iranian-government-infrastructure-exposed", "dispatch_title": "Diplomatic Mail and Open Databases" }, { "type": "Exposed Database", "value": "185.37.55.162", "context": "MySQL 5.7.11 with FTP (21) and RDP (3389) exposed, Windows IIS, EOL", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "diplomatic-mail-and-open-databases-iranian-government-infrastructure-exposed", "dispatch_title": "Diplomatic Mail and Open Databases" }, { "type": "Vulnerable Host", "value": "185.37.55.85", "context": "IIS 8.0 with RDP (3389) exposed, EOL Windows Server, self-signed cert", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "diplomatic-mail-and-open-databases-iranian-government-infrastructure-exposed", "dispatch_title": "Diplomatic Mail and Open Databases" }, { "type": "Shared Hosting", "value": "185.143.233.235", "context": "president.ir, mfa.ir, nioc.ir, irna.ir, mehrnews.com \\u2014 shared cPanel hosting, 12 ports exposed", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "diplomatic-mail-and-open-databases-iranian-government-infrastructure-exposed", "dispatch_title": "Diplomatic Mail and Open Databases" }, { "type": "Shared Hosting", "value": "185.143.234.235", "context": "president.ir, mfa.ir, nioc.ir \\u2014 second shared hosting IP, 9 ports exposed including cPanel/WHM", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "diplomatic-mail-and-open-databases-iranian-government-infrastructure-exposed", "dispatch_title": "Diplomatic Mail and Open Databases" }, { "type": "Shared Hosting", "value": "185.143.233.41", "context": "cert.ir (Iran CERT) on shared hosting with cPanel, co-tenant ketabsal.ir", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "diplomatic-mail-and-open-databases-iranian-government-infrastructure-exposed", "dispatch_title": "Diplomatic Mail and Open Databases" }, { "type": "Shared Hosting", "value": "185.143.235.201", "context": "dolat.ir, moi.ir \\u2014 sinaweb.net shared hosting, 10 ports including cPanel", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "diplomatic-mail-and-open-databases-iranian-government-infrastructure-exposed", "dispatch_title": "Diplomatic Mail and Open Databases" }, { "type": "Shared Hosting", "value": "185.143.232.201", "context": "dolat.ir, moi.ir \\u2014 eqra.net shared hosting, 8 ports including cPanel", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "diplomatic-mail-and-open-databases-iranian-government-infrastructure-exposed", "dispatch_title": "Diplomatic Mail and Open Databases" }, { "type": "Compromised IP", "value": "94.31.47.252", "context": "Schroders Long Room, UK (ZAYO AS6461), open directory, RDP tools, MySQL log", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "Compromised IP", "value": "94.31.47.253", "context": "Schroders Gym, UK (ZAYO AS6461), proxy implant, KL4 music system", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "Compromised IP", "value": "5.148.149.198", "context": "The Beaumont Hotel Gym, UK (Exponential-E AS5607), proxy implant", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "Compromised IP", "value": "118.140.110.132", "context": "Cathay Pacific Haven Rest, HK (HGC AS9304), root MySQL, ransomed, malware depot", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "Compromised IP", "value": "118.140.110.134", "context": "Cathay Pacific Teahouse / HK Pier, HK (HGC AS9304), webshell, MySQL logs", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "Compromised IP", "value": "88.99.51.113", "context": "ArkSurvival.cz gaming, DE (Hetzner AS24940), proxy implant, FTP, ARK server", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "SHA-256", "value": "cb5e1686e66c42b1929f8da26d6260f8202cb9d68a95b322a0d5e3e9df159571", "context": "rs03.exe / rss.exe, Go reverse SOCKS5 proxy (muxado + ChaCha20-Poly1305), deployed across all 6 nodes", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "SHA-256", "value": "78c76393b576c2e9e630e792a4af06f797565380a530f6d711f1f2c2ee1c5a7d", "context": "rdp.bat, RDP enablement and RDPWrap installer", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "SHA-256", "value": "832bc26f058b2cefe84b4c8e65df82d57c3481a2f77778974c1584c906632b8f", "context": "show3389.bat, RDP diagnostics with Chinese translation artifacts", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "Webshell", "value": "330ddac7b989d5a0e69cf3a7a4192b72.php", "context": "MD5-named PHP beacon on Cathay Pacific Teahouse server (.134)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "Recon IP", "value": "106.75.186.101", "context": "UCLOUD Shenzhen, hostname mail[.]ymmmeui[.]cn, SHOW DATABASES scan", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "Ransom IP", "value": "45.149.241.135", "context": "Central Technology Ltd, UK, Wave 1, DBCODE 2X4Q2", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "Ransom IP", "value": "194.48.251.149", "context": "IP-Projects/AMEE TECH, NL, Wave 2, DBCODE 2RIRI", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "Ransom IP", "value": "194.48.251.49", "context": "IP-Projects/AMEE TECH, NL, Wave 3, DBCODE 2A0KU", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "BTC Wallet", "value": "bc1qunqtf8zqxwkwyp4xrx5jpvuxmmeyxc2jd97zlx", "context": "Ransom collection address, 0.00195 BTC received", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "BTC Wallet", "value": "bc1qwfl5x7qwgttnqkrhxjauma4gpwjjt57clu7me4", "context": "First-hop cash-out, funds moved within 2 hours", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "BTC Wallet", "value": "bc1q2rr03kc7p04hk0rxdkwmpsm3pdezcd0l960qy2", "context": "15-victim aggregation wallet, 0.35 BTC consolidated", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "BTC Wallet", "value": "bc1qa6eur8flph9dr44j4tggxn0mcjtm8dzcdaqzvh", "context": "Final destination, emptied to operator consolidation wallet", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "BTC Wallet", "value": "3Pc8g6LJcfT3nEZNj4PPP6GHZYEBT3xUNA", "context": "Operator consolidation wallet, 4.24 BTC across 8 addresses from multiple ransom batches", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "BTC Wallet", "value": "bc1qq904ynep5mvwpjxdlyecgeupg22dm8am6cfvgq", "context": "Collection address with 3 confirmed deposits to Kraken.com (Sept 2025)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "Exchange", "value": "Kraken.com", "context": "Cash-out exchange, confirmed via WalletExplorer wallet cluster 00001012b1848923 (2.1M deposit addresses)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "Email Pattern", "value": "dzen+@onionmail.org", "context": "Per-victim ransom contact, DBCODE suffix tracks each target", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "Domain", "value": "2info[.]win", "context": "Ransom instructions (EGIHosting Romania AS215659), redirects to paste.sh", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "URL", "value": "https://is[.]gd/yotuqu", "context": "Shortened redirect to ransom payment page", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "Hostname", "value": "mail[.]ymmmeui[.]cn", "context": "Reverse DNS for recon scanner 106.75.186.101 (UCLOUD Shenzhen)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-server-that-attacked-itself", "dispatch_title": "The Server That Attacked Itself" }, { "type": "Phishing Server", "value": "51.81.155.58", "context": "OVH US, 19 ports, Mailcow clone, CRM, mail infra", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "you-changed-the-password-gophish-panels-exposed", "dispatch_title": "You Changed the Password" }, { "type": "Phishing Domain", "value": "mail[.]selki-relay[.]com", "context": "Mailcow webmail clone credential harvesting", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "you-changed-the-password-gophish-panels-exposed", "dispatch_title": "You Changed the Password" }, { "type": "Phishing Server", "value": "83.173.113.66", "context": "French school, Proxmox, RDP, MySQL, FTP exposed", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "you-changed-the-password-gophish-panels-exposed", "dispatch_title": "You Changed the Password" }, { "type": "Phishing Server", "value": "185.67.144.27", "context": "French school, RDP, MySQL, Odoo exposed", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "you-changed-the-password-gophish-panels-exposed", "dispatch_title": "You Changed the Password" }, { "type": "Phishing Server", "value": "103.169.3.162", "context": "Indonesian ISP, BMKG domain, Portainer exposed", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "you-changed-the-password-gophish-panels-exposed", "dispatch_title": "You Changed the Password" }, { "type": "Phishing Domain", "value": "admin[.]bmkg[.]site", "context": "Indonesian government agency targeting", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "you-changed-the-password-gophish-panels-exposed", "dispatch_title": "You Changed the Password" }, { "type": "Phishing Server", "value": "34.159.98.118", "context": "Google Cloud, German company training", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "you-changed-the-password-gophish-panels-exposed", "dispatch_title": "You Changed the Password" }, { "type": "Phishing Domain", "value": "training[.]deutscher-bauservice[.]de", "context": "Phishing awareness training domain", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "you-changed-the-password-gophish-panels-exposed", "dispatch_title": "You Changed the Password" }, { "type": "Phishing Server", "value": "47.238.237.1", "context": "Alibaba Cloud, IT support lure", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "you-changed-the-password-gophish-panels-exposed", "dispatch_title": "You Changed the Password" }, { "type": "Phishing Domain", "value": "itassist[.]cienet-security[.]xyz", "context": "IT support impersonation", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "you-changed-the-password-gophish-panels-exposed", "dispatch_title": "You Changed the Password" }, { "type": "C2 IP", "value": "38.49.57.15", "context": "KURUN CLOUD (AS8796), US, fake Google cert", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "C2 IP", "value": "172.245.242.117", "context": "RackNerd (AS36352), US, same operator as Google Spider", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "C2 Domain", "value": "him[.]10s[.]is", "context": "Resolves to 172.245.242.117", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "SSL SHA-256", "value": "a82bd2ecad1cfee66b6f6d568a29a646cec50842e7bd709fad5e3bbe65529083", "context": "Fake Google Spider certificate fingerprint", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "JARM", "value": "2ad2ad16d2ad2ad00042d42d00042ddb04deffa1705e2edc44cae1ed24a4da", "context": "38.49.57.15 TLS fingerprint", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "CS Public Key MD5", "value": "1331821cc1c6d6873c56d1b90ccc20fa", "context": "Google Spider server 1", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "CS Public Key MD5", "value": "3bd0d90fbf36f5e7743db93c55d18906", "context": "Google Spider server 2", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "CS Inject Stub", "value": "e781a4479f7c5a03b2dcfe4bd436366f", "context": "Shared across Google Spider servers", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "C2 IP", "value": "72.146.31.117", "context": "Azure Italy North (AS8075), MSI deployer", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "C2 Hostname", "value": "lcowpowerlite[.]italynorth[.]cloudapp[.]azure[.]com", "context": "Azure cloud hostname for MSI deployer", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "CS Public Key MD5", "value": "711a55f8a7b07a59dc36d386179da161", "context": "Azure Italy operator", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "CS Inject Stub", "value": "c0f5928c29401663a7e585dabdabd1c0", "context": "Azure Italy operator", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "Detection", "value": "TranslateUS.msi", "context": "MSI payload deployed via CS post-exploitation", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "C2 IP", "value": "8.138.167.123", "context": "Alibaba Cloud, Baidu CDN fronting", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "C2 Domain", "value": "dakk5rnsax46s[.]cfc-execute[.]su[.]baidubce[.]com", "context": "Baidu CDN domain fronting", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "C2 IP", "value": "107.150.105.91", "context": "UCLOUD, US, Cloudflare NS abuse", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "C2 IP", "value": "8.219.76.168", "context": "Alibaba Cloud, Singapore, baidu.com host header", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "C2 Domain", "value": "missmovie[.]lol", "context": "Cluster A domain (watermark 666666666)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "C2 Domain", "value": "www[.]quick-shares[.]com", "context": "Cluster C domain (watermark 100000)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "CS Public Key MD5", "value": "ca1c5ee4c6f4451759972387cacad5ac", "context": "Cluster A: 107.150.105.91, 8.159.146.72, 8.138.222.215, 39.104.78.25", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "CS Public Key MD5", "value": "f37b63e281f4d8f9ba757771bf73090b", "context": "Cluster B: 143.92.43.153, .246, .231 (CTG HK farm)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "CS Public Key MD5", "value": "f09fbfdb3631dbb827cfaa7485f01b42", "context": "Cluster C: 101.132.173.62 → 38.182.168.169", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "C2 IP", "value": "143.92.43.153", "context": "CTG Server Ltd, HK, farm node", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "C2 IP", "value": "143.92.43.246", "context": "CTG Server Ltd, HK, farm node", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "C2 IP", "value": "143.92.43.231", "context": "CTG Server Ltd, HK, farm node", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "140-beacons-exposed-cobalt-strike-infrastructure", "dispatch_title": "140 Beacons" }, { "type": "C2 IP", "value": "147.124.202.208:3000", "context": "Express.js, LIVE", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "C2 IP", "value": "163.245.194.216:3000", "context": "Express.js, LIVE", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "C2 IP", "value": "87.236.177.9:3000", "context": "DOWN", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "C2 IP", "value": "66.235.168.136:3000", "context": "DOWN", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "Domain", "value": "api-web3-auth[.]vercel[.]app", "context": "Serves cleartext Stage 1 loader", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "Domain", "value": "oracle-v1-beta[.]vercel[.]app", "context": "Serves obfuscated Stage 1 loader", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "Domain", "value": "monobyte-code[.]vercel[.]app", "context": "Fake code editor landing page", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "Domain", "value": "ip-check-notification-rkb[.]vercel[.]app", "context": "IP/VPN profiling", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "Domain", "value": "ip-check-notification-firebase[.]vercel[.]app", "context": "IP/VPN profiling", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "Domain", "value": "price-oracle-v2[.]vercel[.]app", "context": "Staging, taken down", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "Domain", "value": "coredeal2[.]vercel[.]app", "context": "Staging, taken down", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "Domain", "value": "vscodesettingtask[.]vercel[.]app", "context": "Staging, taken down", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "Domain", "value": "ip-checking-notification-kgm[.]vercel[.]app", "context": "Recon, status unknown", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "Domain", "value": "ip-check-notification-03[.]vercel[.]app", "context": "Recon, status unknown", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "Domain", "value": "ip-check-wh[.]vercel[.]app", "context": "Recon, status unknown", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "Domain", "value": "ip-checking-notification-firebase111[.]vercel[.]app", "context": "Recon, status unknown", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "Domain", "value": "ip-check-notification-firebase03[.]vercel[.]app", "context": "Recon, status unknown", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "SHA-256", "value": "c15111d9246e845b7d8dcffc6b9c351beb12aaebcf70c1ad980dcf8b1f1965b7", "context": "Stage 1 loader (cleartext, acquired live)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "SHA-256", "value": "ae87e37db08525a46be1024068e44521c8a233a23c8069e349f0c2bcfacf634c", "context": "Stage 1 loader (obfuscated, acquired live)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "SHA-256", "value": "49bc956bd495526b1009172221d15dda75a860d523dbc1a91ebd194e2ddec96a", "context": "Stage 2 tasking client (obfuscated, captured live)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "SHA-256", "value": "2b3a5abf9aebe5cc5082fef65548c6670f9228b4cd1b682b966a223457ce2b49", "context": "Stage 2 tasking client (deobfuscated)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "SHA-256", "value": "ddd43e493cb333c1cc5d7cd50a6a5a61ecd89cfa5f4076f62c2adf96748b87f8", "context": "Malicious repo artifact", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "SHA-256", "value": "449e2bf57ab4790427a3a7de3d98b6c540e76190a3d844de2f0e7b66be842b19", "context": "Malicious repo artifact", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "SHA-256", "value": "07ad8525844ce61471e08e8c515b76bf063bac482394152bad814026cd577f69", "context": "Malicious repo artifact", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "SHA-256", "value": "e4d71aa95be0725c351e9d1d273d35ccdb0a8bdb31a57927c8738431b89788f5", "context": "Malicious repo artifact", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "SHA-256", "value": "13152dcb3be425e1ce0f085cd733121a4665cf9935cf8867738e3d510a80308a", "context": "Malicious repo artifact", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "SHA-256", "value": "6d59740d0710da370d5c38ddf88d6912487a1799e4ad09b72d764a3d27ed16b3", "context": "Malicious repo artifact", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "Network", "value": "GET /api/errorMessage", "context": "Stage 1 C2 beacon endpoint", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "Network", "value": "POST /api/handleErrors", "context": "Stage 2 tasking endpoint (captured live)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "Network", "value": "POST /api/reportErrors", "context": "Stage 2 error telemetry endpoint", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "Domain", "value": "chaosbyte.us9.list-manage.com", "context": "Mailchimp email harvesting", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "Detection", "value": "exceptionId=env101383", "context": "Campaign/target identifier", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "Detection", "value": "deps-theard", "context": "Stage 2 error category (attribution fingerprint)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "new-function-new-threat-dprk-next-js", "dispatch_title": "new Function(), New Threat" }, { "type": "C2 IP", "value": "144.172.115.189:8080", "context": "Primary C2 (confirmed live)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "C2 IP", "value": "23.227.203.99:8080", "context": "Backup C2 (dormant, in source comments)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "Domain", "value": "camdriver[.]pro", "context": "Payload hosting and phishing exfil", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "Domain", "value": "ripplecareer[.]com", "context": "Phishing lure site (95.169.180.146)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "URL", "value": "hxxps://camdriver[.]pro/realtekwin.update", "context": "Stage 2 payload download", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "URL", "value": "hxxps://camdriver[.]pro/letsgoassessment", "context": "Phishing data exfil endpoint", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "SHA-256", "value": "63797c555d995fac8d167c184d016534a1da0f338521a8af244ad4e78ae79946", "context": "driver.zip (payload archive)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "SHA-256", "value": "204337c13fe22c6b1c22c91b87f8bb5e3be1316d96405549a92a4f0daab6d4d1", "context": "updatedriver.py (RAT entry point)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "SHA-256", "value": "7d733fcee66f0d93f5d38e773c5f8ce1747b8a4244e031a45050708e5cf446a2", "context": "core.py (C2 command loop)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "SHA-256", "value": "d89a4e1880f762aacfd63467072dcc53c45d82a8fdbfdb9878f3897d215d72cb", "context": "transport.py (encrypted transport)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "SHA-256", "value": "678042861a29ade86989c7952371ba4bb9b083f78e8f42cae0c5c438261e20d4", "context": "constants.py (config/wallets/extensions)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "SHA-256", "value": "1c6b8ed92d08ff2eacf441e5d9bac079bd01588f719374675a978610b0bd743a", "context": "auto.py (Chrome credential theft)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "SHA-256", "value": "b2776c9383d45bec871e426304c47681628d82bb9d29a4fc543cf58a042d5935", "context": "auto_gather.py (Telegram/Discord/Steam)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "SHA-256", "value": "f7f69ae26afd0d3011a583f9994fae1382d746f5f97115a48adc98029f10b63b", "context": "evasion.py (ETW/AMSI/NTDLL bypass)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "SHA-256", "value": "ffb76093fa92e1a6731582707023da6d1fdbcd806d00974a95c008504bfe96be", "context": "dec.py (Chrome DPAPI decryption)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "SHA-256", "value": "fd5c46d73d29ba21b04c844bbaf9096066136526911230645a2a040d23fb612b", "context": "svchost.exe (renamed pythonw.exe)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "Registry", "value": "HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\svchost", "context": "Persistence Run key", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "Scheduled Task", "value": "svchost (ONLOGON, HIGHEST)", "context": "Persistence scheduled task", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "Scheduled Task", "value": "OneDrive Update Task-S-16-5-25-262930093-1106209884-352468633-100", "context": "SYSTEM-level persistence task", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "File Path", "value": "%TEMP%\\\\OneDriveUpdate.exe", "context": "Persistence binary", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "File Path", "value": "%APPDATA%\\\\.system_id\\\\.host", "context": "Machine fingerprint storage", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "File Path", "value": "%TEMP%\\\\.store", "context": "Temporary data store", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "File Path", "value": "%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\svchost.lnk", "context": "Startup folder persistence", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "Crypto", "value": "f7Jk9vB2xQpL6zT1wR8sY3uN0eH5cD4a", "context": "AES-CBC Key", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "Crypto", "value": "pL9vB2xQpL6zT1wR", "context": "AES-CBC IV", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "Detection", "value": "StarMainLoop", "context": "C2 command loop function name", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "Detection", "value": "REPLACEMENT_ADDRESSES", "context": "Clipper wallet configuration variable", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "Detection", "value": "OneDriveUpdate.exe", "context": "Persistence binary in %TEMP%", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "Detection", "value": "realtekwin.update", "context": "Payload URL path component", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "Detection", "value": "camdriver.pro", "context": "Payload and phishing domain", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "anatomy-of-a-trojanized-toolkit", "dispatch_title": "Anatomy of a Trojanized Toolkit" }, { "type": "IPv4", "value": "179.43.176.30", "context": "PoisonX Stealer panel, PRIVATE LAYER bulletproof hosting (AS51852), Lugano, Switzerland", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "IPv4", "value": "49.12.124.231", "context": "Whack RAT operator dashboard, Hetzner (AS24940), 2 active victims", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "Domain", "value": "whack.cy", "context": "Whack RAT C2 domain (Cyprus TLD)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "Domain", "value": "stream.whack.cy", "context": "Whack RAT WebSocket C2 server (wss://stream.whack.cy/operator)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "IPv4", "value": "31.57.77.35", "context": "CNG/Cingenler RAT panel, Keyubu (AS210538), Istanbul, Turkey", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "Domain", "value": "server.keyubu.com", "context": "CNG RAT server hostname", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "IPv4", "value": "89.185.82.181", "context": "Stealer Server dashboard, GLOBAL CONNECTIVITY SOLUTIONS (AS215540), Skopje", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "IPv4", "value": "89.185.81.203", "context": "Stealer Server dashboard, GLOBAL CONNECTIVITY SOLUTIONS (AS215540), Oslo", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "Domain", "value": "online-tenderconfirmation.com", "context": "Phishing domain on stealer server infrastructure", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "IPv4", "value": "34.134.154.94", "context": "Steam Stealer C2, Google Cloud (AS396982), Brazilian Portuguese operator", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "IPv4", "value": "146.19.213.175", "context": "Enhanced Stealer Server, ALEXHOST SRL bulletproof hosting, Moldova", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "IPv4", "value": "170.205.31.153", "context": "RAT Control Panel with open API (/api/bots, /api/stats), Advin Services (AS206216)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "IPv4", "value": "116.124.133.191", "context": "Korean payment card stealer with OTP auth, SK Broadband (AS9318)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "IPv4", "value": "5.9.148.210", "context": "Redline Script panel + Squid proxy + Streamer, Hetzner (AS24940)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "Hostname", "value": "WIN-8OA3CCQAE4D", "context": "PoisonX server hostname from RDP certificate", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "URL", "value": "wss://stream.whack.cy/operator", "context": "Whack RAT C2 WebSocket endpoint", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "URL", "value": "https://whack.cy/dashboard/auth/login", "context": "Whack RAT operator login URL", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "Detection", "value": "Cingenler Rat Control Panel - v2.0", "context": "CNG RAT version string", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "Detection", "value": "Stealler", "context": "Misspelling in GLOBAL CONNECTIVITY stealer server dashboard", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "ASN", "value": "AS51852", "context": "PRIVATE LAYER INC, bulletproof hosting for PoisonX", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "ASN", "value": "AS215540", "context": "GLOBAL CONNECTIVITY SOLUTIONS LLP, stealer twins and phishing", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "ASN", "value": "AS210538", "context": "Keyubu, CNG RAT hosting in Turkey", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "ASN", "value": "AS206216", "context": "Advin Services LLC, RAT Control Panel hosting", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-panels-left-open", "dispatch_title": "The Panels Left Open" }, { "type": "Domain", "value": "handala-hack.to", "context": "Handala primary clearnet leak site and RedWanted bounty board; DDoS-Guard (185.178.208.137) protected; active geoblocking", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "Domain", "value": "handala.to", "context": "Handala redirect/profiling domain; Trellian parking; FingerprintJS visitor fingerprinting loop; TLS cert renewed 2026-03-09", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "IPv4", "value": "185.178.208.137", "context": "DDoS-Guard edge node (Rostov-na-Donu, Russia) protecting handala-hack.to", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "Tor Onion", "value": "vmjfieomxhnfjba57sd6jjws2ogvowjgxhhfglsikqvvrnrajbmpxqqd.onion", "context": "Handala Tor hidden service; active NGINX", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "Domain", "value": "gramatikservicesapi.top", "context": "Void Manticore n8n automation server; 64.176.169.27 Vultr AS20473; active since 2024-09-09 (19 days post-X-ban); Asia/Jerusalem timezone", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "IPv4", "value": "64.176.169.27", "context": "gramatikservicesapi.top — Vultr AS20473; n8n v1.61.0 workflow automation; Docker + PostgreSQL", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "IPv4", "value": "64.176.169.22", "context": "Void Manticore C2 node; Vultr AS20473; SSH only (443 closed); isolated/bastion role", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "IPv4", "value": "64.176.172.235", "context": "Void Manticore C2 node; Vultr AS20473; HTTPS active (serving Check Point ZTA cert — possibly recycled)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "IPv4", "value": "64.176.172.165", "context": "Void Manticore C2 node; Vultr AS20473", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "IPv4", "value": "64.176.173.77", "context": "Void Manticore C2 node; Vultr AS20473", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "IPv4", "value": "64.176.172.101", "context": "Void Manticore C2 node; Vultr AS20473; HTTPS+SSH active", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "CIDR", "value": "64.176.168.0/21", "context": "Vultr block containing all documented Void Manticore C2 nodes and automation infrastructure", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "IPv4", "value": "31.192.237.207", "context": "Operation HamsaUpdate C2; ilyarolevik1.pserver.space; Chelyabinsk-Signal LLC, Russia; SSH alive, port 2515 closed (dormant)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "Domain", "value": "ilyarolevik1.pserver.space", "context": "Reverse DNS hostname for 31.192.237.207; pserver.space is Russian VPS provider Chelyabinsk-Signal LLC", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "ASN", "value": "AS20473", "context": "Vultr AS — hosts all documented Void Manticore C2 infrastructure in 64.176.168.0/21", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "AWS S3 Bucket", "value": "handala-bucket", "context": "Handala exfiltration staging bucket; identified in senvarservice-DC.exe by OP Innovate", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "URL", "value": "link[.]storjshare[.]io/s/jwyite7mez2ilyvm2esxw2jq3apq/crowdstrikeisrael/update.zip", "context": "Storj staging URL for CrowdStrike-lure campaign payload (Trellix)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "URL", "value": "link[.]storjshare[.]io/s/jvktcsf5ypoak5aucs6fn6noqgga/crowdstrikesupport/update.zip", "context": "Storj staging URL for CrowdStrike-lure campaign payload (variant)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "URL", "value": "sjc1.vultrobjects[.]com/f5update/update[.]sh", "context": "Vultr Object Storage — Operation HamsaUpdate Linux payload", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "Telegram Bot Token", "value": "7277950797:AAF99Nw5rAT1BHnMmwY_tQNYJFU3dYJ5RHc", "context": "Handala wiper C2 bot token (burned); Trellix-analyzed campaign; confirmed rotated 2026-03-11", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "Telegram Channel ID", "value": "7436061126", "context": "Handala wiper C2 channel; Trellix campaign; victim IP/hostname/progress reporting", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "Telegram Bot Token", "value": "6428401585:AAGE6SbwtVJxOpLjdMcrL45gb18H9UV7tQA", "context": "Handala wiper C2 bot token (burned); Operation HamsaUpdate; confirmed rotated 2026-03-11", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "Telegram Channel ID", "value": "6932028002", "context": "Handala wiper C2 channel; HamsaUpdate campaign", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "SHA256", "value": "e28085e8d64bb737721b1a1d494f177e571c47aab7c9507dba38253f6183af35", "context": "Hatef Windows wiper — checks hostname for HANDALA before executing", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "SHA256", "value": "454e6d3782f23455875a5db64e1a8cd8eb743400d8c6dadb1cd8fd2ffc2f9567", "context": "Handala Delphi loader — second-stage, injects RC4 shellcode via dllhost.exe", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "SHA256", "value": "fe07dca68f288a4f6d7cbd34d79bb70bc309635876298d4fde33c25277e30bd2", "context": "F5UPDATER.exe loader — Operation HamsaUpdate first stage", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "SHA256", "value": "96dec6e07229201a02f538310815c695cf6147c548ff1c6a0def2fe38f3dcbc8", "context": "update.zip — CrowdStrike-lure campaign NSIS payload archive", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "SHA256", "value": "D0C03D40772CD468325BBC522402F7B737F18B8F37A89BACC5C8A00C2B87BFC6", "context": "Void Manticore Windows wiper (Check Point Research)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "SHA256", "value": "DEEAF85B2725289D5F262B4F60DDA0C68AE42D8D46D0DC19B9253B451AEA25A", "context": "Void Manticore Windows wiper variant (Check Point Research)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "MD5", "value": "2a5dd680c05b43d72365e8beb7e40088", "context": "Handala wiper — Trellix campaign", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "MD5", "value": "fca0910949d92dc3dd3dfcf0fb3d0408", "context": "AutoIT script — Trellix campaign (RC4 shellcode injector)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "MD5", "value": "755c0350038daefb29b888b6f8739e81", "context": "CrowdStrike.exe NSIS installer — CrowdStrike-lure campaign", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "MD5", "value": "da663d3ea0c818a60292e5239ef23dae", "context": "ListOpenedFileDrv_32.sys — BYOVD unsigned driver for privilege escalation", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "Hostname Check", "value": "HANDALA", "context": "Hatef wiper will NOT execute on machines named exactly HANDALA — deploy as honeypot canary", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "Hostname Check", "value": "Gaza hackers Team Handala Machine", "context": "CrowdStrike-lure wiper execution guard — checks machine name contains this string", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "File Extension", "value": ".BiBi", "context": "BiBi wiper corruption marker — files overwritten with random data", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "File Extension", "value": ".bb", "context": "BiBi wiper corruption marker variant (.bb[random] suffix)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "File Path", "value": "C:\\aaa_TouchMeNot_.txt", "context": "Sandbox check — wiper aborts if Windows Defender Emulator marker present", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "MySQL Table", "value": "RECOVER_YOUR_DATA", "context": "Database artifact — shared pattern in Iranian actor ransom operations", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "Instance ID", "value": "3d8869443494a76e14cc3d430f43310d203b30947a0ce06f004c438441e349a1", "context": "n8n instance fingerprint for gramatikservicesapi.top automation server", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "URL Parameter", "value": "fp=", "context": "handala.to FingerprintJS visitor fingerprint parameter — appended to all redirect URLs", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "URL Parameter", "value": "tr_uuid=", "context": "handala.to redirect tracking UUID (timestamp-based) — visitor tracking parameter", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "Cookie", "value": "__ddg9_", "context": "DDoS-Guard tracking cookie on handala-hack.to — logs visitor IP for operator visibility", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "National ID", "value": "1362398276", "context": "Ali Bermoudeh — Handala Telegram channel admin; Tabriz, Iran; DOB ~1998; FATA background", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "National ID", "value": "1680072404", "context": "Morteza Aftabifar — MOIS handler for Bermoudeh; Tabriz, Iran", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "Password Pattern", "value": "1377629", "context": "Ali Bermoudeh password — Iranian calendar birthdate (year 1377 + date digits) reused across accounts", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "X/Twitter Handle", "value": "@HPRNEW", "context": "HPR INTELLIGENCE — Handala announcement/amplification account; continuation of banned @Handala_Hack (banned 2024-08-21)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "IPv4", "value": "185.208.156.82", "context": "handala-hack.to origin server — www. subdomain misconfiguration bypasses DDoS-Guard; AS42624 Global-Data System IT Corporation, Zurich CH; WordPress 6.9.1 + LiteSpeed", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "behind-the-firewall-handala-infrastructure-exposed", "dispatch_title": "Behind the Firewall" }, { "type": "ASN", "value": "AS42624", "context": "Global-Data System IT Corporation, Zurich — hosts handala-hack.to origin server at 185.208.156.82", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "behind-the-firewall-handala-infrastructure-exposed", "dispatch_title": "Behind the Firewall" }, { "type": "WordPress Username", "value": "vie6c", "context": "handala-hack.to WordPress author ID 1; profile URL https://handala.cx — links to predecessor domain", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "behind-the-firewall-handala-infrastructure-exposed", "dispatch_title": "Behind the Firewall" }, { "type": "Domain", "value": "handala.cx", "context": "Original Handala leak site (Christmas Island TLD); first cert 2023-12-11 via Google Trust Services; 7 months before handala-hack.to; now offline", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "behind-the-firewall-handala-infrastructure-exposed", "dispatch_title": "Behind the Firewall" }, { "type": "Domain", "value": "handala-redwanted.to", "context": "Dedicated RedWanted bounty platform; 192.142.53.75; Ultahost Amsterdam NL AS214036; IIS/10.0 Windows Server; HTTP only; no TLS", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "behind-the-firewall-handala-infrastructure-exposed", "dispatch_title": "Behind the Firewall" }, { "type": "IPv4", "value": "192.142.53.75", "context": "handala-redwanted.to; Ultahost Inc., Amsterdam NL (AS214036); Microsoft IIS/10.0; HTTP port 80 only", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "behind-the-firewall-handala-infrastructure-exposed", "dispatch_title": "Behind the Firewall" }, { "type": "ASN", "value": "AS214036", "context": "Ultahost Inc., Amsterdam — hosts handala-redwanted.to at 192.142.53.75", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "behind-the-firewall-handala-infrastructure-exposed", "dispatch_title": "Behind the Firewall" }, { "type": "Telegram Display Name", "value": "Akhira", "context": "@HPRNEW operator persona on Telegram; Arabic for the Hereafter/Afterlife; personal contact account", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "behind-the-firewall-handala-infrastructure-exposed", "dispatch_title": "Behind the Firewall" }, { "type": "Telegram Channel", "value": "t.me/Handala_hack", "context": "Original Handala announcement channel (December 2023 launch); username preserved but banned", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "behind-the-firewall-handala-infrastructure-exposed", "dispatch_title": "Behind the Firewall" }, { "type": "Telegram Channel", "value": "t.me/Handala_Leak", "context": "Original Handala leak data channel (December 2023 launch)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "behind-the-firewall-handala-infrastructure-exposed", "dispatch_title": "Behind the Firewall" }, { "type": "Telegram Channel", "value": "t.me/Handala_backup", "context": "Original Handala backup channel (December 2023 launch)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "behind-the-firewall-handala-infrastructure-exposed", "dispatch_title": "Behind the Firewall" }, { "type": "SHA256", "value": "aae017e7a36e016655c91bd01b4f3c46309bbe540733f82cce29392e72e9bd1f", "context": "Rhadamanthys infostealer — Void Manticore INCD/F5-update lure phishing campaign; commercial darknet tool; Check Point Research 2026", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "the-boy-with-his-back-turned-handala-void-manticore-exposed", "dispatch_title": "Handala / Void Manticore Exposed" }, { "type": "IPv4", "value": "193.164.5.223", "context": "RustDesk botnet C2 panel (Turkey), port 8080, API key \"1234\" hardcoded in JavaScript", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "turkish-rustdesk-botnet-355-victims", "dispatch_title": "Turkish RustDesk Botnet" }, { "type": "Hostname", "value": "rustdesk-bot-manager.local", "context": "RustDesk C2 panel hostname, 355 total victims (159 online at interception)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "turkish-rustdesk-botnet-355-victims", "dispatch_title": "Turkish RustDesk Botnet" }, { "type": "API Key", "value": "1234", "context": "Hardcoded API key for RustDesk botnet panel, exposed in client-side JavaScript", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "turkish-rustdesk-botnet-355-victims", "dispatch_title": "Turkish RustDesk Botnet" }, { "type": "ASN", "value": "AS49453", "context": "Global Layer B.V., Netherlands — hosts RustDesk C2 at 193.164.5.223", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "turkish-rustdesk-botnet-355-victims", "dispatch_title": "Turkish RustDesk Botnet" }, { "type": "IPv4", "value": "34.70.205.211", "context": "Primary C2 for Chinese cryptomining botnet (Google Cloud), serves XMRig miner and worm scripts", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "mass-redis-exploitation-chinese-cryptomining-botnet", "dispatch_title": "Chinese Cryptomining Botnet" }, { "type": "IPv4", "value": "38.150.0.118", "context": "Secondary C2 for cryptomining botnet (offline at interception)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "mass-redis-exploitation-chinese-cryptomining-botnet", "dispatch_title": "Chinese Cryptomining Botnet" }, { "type": "IPv4", "value": "194.110.247.97", "context": "Secondary C2 for cryptomining botnet (offline at interception)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "mass-redis-exploitation-chinese-cryptomining-botnet", "dispatch_title": "Chinese Cryptomining Botnet" }, { "type": "IPv4", "value": "103.79.77.16", "context": "Secondary C2 for cryptomining botnet (offline at interception)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "mass-redis-exploitation-chinese-cryptomining-botnet", "dispatch_title": "Chinese Cryptomining Botnet" }, { "type": "URL", "value": "http://34.70.205.211/plugins-dist/safehtml/lang/font/kworker", "context": "Cryptominer worm dropper script, injected via Redis cron jobs", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "mass-redis-exploitation-chinese-cryptomining-botnet", "dispatch_title": "Chinese Cryptomining Botnet" }, { "type": "URL", "value": "http://34.70.205.211/plugins-dist/safehtml/lang/font/javae", "context": "XMRig Monero miner binary (5.6MB), deployed to /tmp/.ice-unix/", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "mass-redis-exploitation-chinese-cryptomining-botnet", "dispatch_title": "Chinese Cryptomining Botnet" }, { "type": "Mining Pool", "value": "pool.supportxmr.com:8080", "context": "Monero mining pool targeted by botnet, wallet 42s7H81w...", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "mass-redis-exploitation-chinese-cryptomining-botnet", "dispatch_title": "Chinese Cryptomining Botnet" }, { "type": "Cryptocurrency Wallet", "value": "42s7H81wKKbggZsnd5geEeC7ANWUDhkqf7xhdSgaBd9ZE61qwwh7ch1gBQkE5FbvabAdNTeNV18nBNTpioUqmgHj4h4kks2", "context": "Monero (XMR) wallet for cryptomining botnet operation", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "mass-redis-exploitation-chinese-cryptomining-botnet", "dispatch_title": "Chinese Cryptomining Botnet" }, { "type": "MD5", "value": "fbd9e4ad199e879b3b4e60d3d0bd2941", "context": "kworker worm script (36KB shell script)", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "mass-redis-exploitation-chinese-cryptomining-botnet", "dispatch_title": "Chinese Cryptomining Botnet" }, { "type": "SHA1", "value": "5eb5d1bc4b90d6dfae8a36f6a4563d2e618fa887", "context": "javae XMRig miner binary BuildID", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "mass-redis-exploitation-chinese-cryptomining-botnet", "dispatch_title": "Chinese Cryptomining Botnet" }, { "type": "File Path", "value": "/tmp/.ice-unix/.../javae", "context": "XMRig miner installation path with random directory name", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "mass-redis-exploitation-chinese-cryptomining-botnet", "dispatch_title": "Chinese Cryptomining Botnet" }, { "type": "File Path", "value": "/usr/bin/cd1", "context": "Malicious wrapper for standard cd command, maintained by cron", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "mass-redis-exploitation-chinese-cryptomining-botnet", "dispatch_title": "Chinese Cryptomining Botnet" }, { "type": "File Path", "value": "/usr/bin/wd1", "context": "Malicious wrapper for standard pwd command, maintained by cron", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "mass-redis-exploitation-chinese-cryptomining-botnet", "dispatch_title": "Chinese Cryptomining Botnet" }, { "type": "Redis Key", "value": "backup1", "context": "Cron payload key injected into Redis for persistence", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "mass-redis-exploitation-chinese-cryptomining-botnet", "dispatch_title": "Chinese Cryptomining Botnet" }, { "type": "Redis Key", "value": "backup2", "context": "Cron payload key injected into Redis for persistence", "tlp": "clear", "source_type": "dispatch", "dispatch_slug": "mass-redis-exploitation-chinese-cryptomining-botnet", "dispatch_title": "Chinese Cryptomining Botnet" }, { "type": "domain", "value": "bizzyearners.net", "context": "front, probrokerapis2", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "live", "notes": null }, { "type": "domain", "value": "capitaltechpip.net", "context": "front, probrokerapis3", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "live", "notes": null }, { "type": "domain", "value": "coin-front.io", "context": "front, probrokerapis3, DDoS-Guard fronted, BACloud Lithuania", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "live", "notes": "DDoS-Guard fronted, BACloud Lithuania" }, { "type": "domain", "value": "crestmarkets.org", "context": "front, probrokerapis2, single BTC wallet took $426K in 30 days", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "live", "notes": "single BTC wallet took $426K in 30 days" }, { "type": "domain", "value": "cryptopalmsmarket.com", "context": "front, probrokerapis3", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "live", "notes": null }, { "type": "domain", "value": "deluxepluswealth.com", "context": "front, probrokerapis3", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "live", "notes": null }, { "type": "domain", "value": "fidexexpert.com", "context": "front, probrokerapis3", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "live", "notes": null }, { "type": "domain", "value": "fortunelivex.com", "context": "front, probrokerapis2", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "live", "notes": null }, { "type": "domain", "value": "parsonexmarket.com", "context": "front, probrokerapis3, /api/graph open without auth", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "live", "notes": "/api/graph open without auth" }, { "type": "domain", "value": "quorixtrading.com", "context": "front, probrokerapis3", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "live", "notes": null }, { "type": "domain", "value": "rocketstake.net", "context": "front, probrokerapis3", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "live", "notes": null }, { "type": "domain", "value": "signalsurge.net", "context": "front, probrokerapis2", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "live", "notes": null }, { "type": "domain", "value": "solvexcapitallimited.io", "context": "front, probrokerapis2", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "live", "notes": null }, { "type": "domain", "value": "synergytrades.live", "context": "front, probrokerapis3", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "live", "notes": null }, { "type": "domain", "value": "tillidfx.net", "context": "front, self-hosted, own backend, same kit", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "live", "notes": "own backend, same kit" }, { "type": "domain", "value": "tradesphere.pro", "context": "front, self-hosted, own backend, same kit", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "live", "notes": "own backend, same kit" }, { "type": "domain", "value": "veltrixcapitalpro.com", "context": "front, probrokerapis3", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "live", "notes": null }, { "type": "domain", "value": "bb.prowebsitesamples.com", "context": "vendor, default admin login info@prowebsitesamples.com / samplepassword", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "default admin login info@prowebsitesamples.com / samplepassword" }, { "type": "domain", "value": "pms.prowebsitesamples.com", "context": "vendor", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "prowebsitesamples.com", "context": "vendor, sells templates BB / PMS / WWW", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "sells templates BB / PMS / WWW" }, { "type": "domain", "value": "federalsecurenet.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "cryptometaedge.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "toptracepointco.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "smartearncapital.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "vtmarketpro.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "fxcapitalnexus.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "fleetpathlogistics.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "topchoicedelivery.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "corepathdelivery.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "logistavaexpress.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "urbandeliverygroup.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "citylinedelivery.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "crestgateinvestment.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "hashtradehub.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "pipsparadise.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "prop-pulsecapitals.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "prop-pulsecapital.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "humilisinvest.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "profitpulsepeak.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "parsonexbase.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "parsonexclimax.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "parsonexmarkets.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "arbitragebrokerage.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "corebulltrade.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "finestmarkets.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "eversteadoptions.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "pipsgainhub.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "crestdynamo.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "bullishpeak.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "aitradeteam.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "pipstradelab.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "pipsoptionstrade.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "livingtrades.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "fortunelivemarkets.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "oakvestpro.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "aceofbulls.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "bullishace.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "bullvestpro.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "strativuscapital.com", "context": "catalog, banking-categorized", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "banking-categorized" }, { "type": "domain", "value": "zyoracapital.com", "context": "catalog, banking-categorized", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "banking-categorized" }, { "type": "domain", "value": "metawealthwatch.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "betamarketwatch.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "bullishclimax.com", "context": "catalog", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "hannahlewismarkets.com", "context": "catalog, appears in vendor catalog dump 2026-04-30; deployed but kit-confirmation not verified by this researcher", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "appears in vendor catalog dump 2026-04-30; deployed but kit-confirmation not verified by this researcher" }, { "type": "domain", "value": "mail.coin-front.io", "context": "operator outbound mail", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "operator outbound mail" }, { "type": "domain", "value": "mail.parsonexmarket.com", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "mail.veltrixcapitalpro.com", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "domain", "value": "probrokerapis2.com", "context": "5 fronts share this backend", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "5 fronts share this backend" }, { "type": "domain", "value": "probrokerapis3.com", "context": "9 fronts share this backend", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "9 fronts share this backend" }, { "type": "domain", "value": "probrokerapis6.com", "context": "configured but gated", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "configured but gated" }, { "type": "domain", "value": "probrokersockets-com-god8.onrender.com", "context": "kit-shared signal feed", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "kit-shared signal feed" }, { "type": "ip", "value": "98.97.77.181", "context": "Cory Bates persona, captured via Grabify canary 2026-04-30 21:37:49 UTC, AS14593 SpaceX Starlink, Lagos Nigeria, hostname customer.lgosnga1.isp.starlink.com, geo 6.4541, 3.3947", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "Cory Bates persona, captured via Grabify canary 2026-04-30 21:37:49 UTC, AS14593 SpaceX Starlink, Lagos Nigeria, hostname customer.lgosnga1.isp.starlink.com, geo 6.4541, 3.3947" }, { "type": "email", "value": "noreply@coin-front.io", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "email", "value": "noreply@parsonexmarket.com", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "phone", "value": "+12133976550", "context": "US +1 (213) 397-6550, Cory Bates persona, RCS-capable; LA area code but operator IP geolocates to Lagos NG, so this is a US VoIP relay (TextNow/Bandwidth-class)", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "US +1 (213) 397-6550, Cory Bates persona, RCS-capable; LA area code but operator IP geolocates to Lagos NG, so this is a US VoIP relay (TextNow/Bandwidth-class)" }, { "type": "username", "value": "@cory_bates1895", "context": "aged 2011, 405 followers / 3,221 following, jiu-jitsu + bitcoin bio, dropped coin-front.io", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "aged 2011, 405 followers / 3,221 following, jiu-jitsu + bitcoin bio, dropped coin-front.io" }, { "type": "wallet", "value": "bc1q6tayfjwdt44tmsruryc2ferry62fu5l8yayrpc", "context": "$128K single deposit, swept to 1HV2BNfCeaeQ9c1RsUnnZLLVE6uyQSZWXb", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "swept", "notes": "$128K single deposit, swept to 1HV2BNfCeaeQ9c1RsUnnZLLVE6uyQSZWXb" }, { "type": "wallet", "value": "bc1qzgsxlhq65l3m8lc5yzkrmevtp0qh90vqvkrfju", "context": "single 0.297 BTC shot 2025-07-04", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "dormant", "notes": "single 0.297 BTC shot 2025-07-04" }, { "type": "wallet", "value": "TUNqd7gyhx6noMetAZLu4ZtrhqBke7ndoB", "context": "USDT-TRC20 receiver", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "active", "notes": "USDT-TRC20 receiver" }, { "type": "wallet", "value": "bitcoincash:qzqdykddz7kyd7eql4s2t3df0f2hsllhsyuqlwm7sw", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "active", "notes": null }, { "type": "wallet", "value": "0xE9e02797772381527Fe35776a3871ec4FEE29d43", "context": "ETH-native receiver", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "active", "notes": "ETH-native receiver" }, { "type": "wallet", "value": "TYJPhHqtnFv94gWqdWqwoFC9NxH9SqBHNV", "context": "USDT-TRC20", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "active", "notes": "USDT-TRC20" }, { "type": "wallet", "value": "TCJAJ6wVhABtxZfJmFFaCGSzxHA8CpfAJh", "context": "TRX rotation wallet", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "swept", "notes": "TRX rotation wallet" }, { "type": "wallet", "value": "1P9wocCxnF1QGX71Xa5eWohuba4dr58jYD", "context": "271-day span, $86 median", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "active", "notes": "271-day span, $86 median" }, { "type": "wallet", "value": "0xFF8513cDdaE9BD91ed0c11F3c49866A1b38B2C3A", "context": "USDT-ERC20", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "USDT-ERC20" }, { "type": "wallet", "value": "TXvBrSpVby3gKqoMkcr8GJqjXTECm4ZE6M", "context": "USDT-TRC20", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "USDT-TRC20" }, { "type": "wallet", "value": "bc1qn228waxytzugvm322unp0dyz97t9kzkkx5eg9l", "context": "471-day span, looks like demo flows", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "active", "notes": "471-day span, looks like demo flows" }, { "type": "wallet", "value": "0x5dC045569a5114F59D997613756a4d551c58FBA1", "context": "ETH-native", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "ETH-native" }, { "type": "wallet", "value": "bc1qxg7dap9wmhh8twzgthwkd3chnx7x46mfdga2mz", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "dormant", "notes": null }, { "type": "wallet", "value": "bc1ql8hlfymt889wnxgxvf75rexehktc4fakv34kfg", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": "active", "notes": null }, { "type": "wallet", "value": "bc1q775qtkejh5fnxadx2mey8k3g25zsvwahl6dqgl", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "TXaPDV2T37XJbmpkc3PwbFijhZCSPPXyAr", "context": "USDT-TRC20", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "USDT-TRC20" }, { "type": "wallet", "value": "bc1qcxfmz7zs8suzenkw9zng20l4kvknr9h4k7ftea", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "17jmaT1PpjeJfdGg5Q2746MeVnvWQLwWVm", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "1FcFEH3Kx85JL6wTDVDr4RDBBKYbvguyNT", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "bc1q9nyvdjr2jyxxhx0ea9tf69y6j20ea4l83fd269", "context": "primary BTC, swept", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "primary BTC, swept" }, { "type": "wallet", "value": "TDpqPGesMxGL9oxcWhPChdawPw5rASyWSd", "context": "USDT-TRC20", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "USDT-TRC20" }, { "type": "wallet", "value": "0xF172c996598fdd558BB21D5312B2da99c6844120", "context": "rotation, ETH-native", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "rotation, ETH-native" }, { "type": "wallet", "value": "0x0a5659BAf2cF27DC19ea87ddAAbEb651ad3E117e", "context": "advertised hot wallet, barely funded", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "advertised hot wallet, barely funded" }, { "type": "wallet", "value": "TYcGojypFj6BwtqYGV7PWmZX8KiH4xakvA", "context": "advertised primary, swept", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "advertised primary, swept" }, { "type": "wallet", "value": "Azy4rkMjEtipK2mDFiBCdYq8cXM4dvw8bLPZ1qm6vYAS", "context": "snapshot zero", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "snapshot zero" }, { "type": "wallet", "value": "r4uHqWeEFHKKqiqQaGNYKr37UiijUWA4ez", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "DMdqGNV4qKFsgshRdX75tPCFsWp9Y5hhXJ", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "bc1qaacjkf7qtufw0922qpkzdupc7fz7pnzj9lmqxe", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "0xbbe67CD6D4A613435842Da6D3b0E27E6A0c23856", "context": "ETH ERC20", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "ETH ERC20" }, { "type": "wallet", "value": "rGbvKPcTd52XJYpbBxQ2MWXzpM6RbyY8TT", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "0x1A82AFB40690ed0bb3bFC122D79811E4FA23Fc3F", "context": "ETH/USDT ERC20", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "ETH/USDT ERC20" }, { "type": "wallet", "value": "TSWmZQXM9S4ZupeMSBJH6yAX5N3bBMLR7z", "context": "USDT-TRC20", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "USDT-TRC20" }, { "type": "wallet", "value": "rntmJoNjyuxTurLMtuLsevofV6vZFTtXv3", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "AK2JqnCTfebKiUsDBeDrLEUFA6TnFYsxh5T5HVQsb6wP", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "r3YhwVdoYMS8aheu7MXmaSkkq2nfYLXdtY", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "8XJFAons9pKaTBiiZZv7HHcGutMDibDYjpDQzK788DxQ", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "0x7218Bf3498511f26085eddBd16609eA524dbCfE6", "context": "ETH-native", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "ETH-native" }, { "type": "wallet", "value": "0xff41c057b016b6760c4c95ed5ddb997e4bb885b3", "context": "USDC ERC20", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "USDC ERC20" }, { "type": "wallet", "value": "16awnCpQgnyWYswXPyNftAVi85aQkq2hfg", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "0x37Fa6BaB7e02b9ea42E9719bDe5954A65E3d0305", "context": "ETH ERC20", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "ETH ERC20" }, { "type": "wallet", "value": "0xC25B38EAF27455663D484b6B9E38CA6168795673", "context": "ETH/USDT ERC20", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "ETH/USDT ERC20" }, { "type": "wallet", "value": "FHiUph6qKwrdubsMHGMVZym2Qt6SCYfLAi2JTfJGDQ9K", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "bc1qs33nn3kfze2zcm242xqyh7a64h3mr5hxahd7x8", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "0x75140DE3e7097ffB4239419371e4AfF01D319EC2", "context": "ETH/BNB", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "ETH/BNB" }, { "type": "wallet", "value": "r5L5FDiXxdmUoUimsvDaSTmrnUH9CbKki", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "2Zf9ZmCriZX9ou1MG8JEEKoQcsP1uvpKrr1CCzqwtWaT", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "0xFf3c512b6D17746040dff4f6146B74E67E7089C0", "context": "ETH/USDT cross-chain", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "ETH/USDT cross-chain" }, { "type": "wallet", "value": "rnqeuL1CSmCagZX2jSsXazbazQjyQ1z8uC", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "qrv5mcnhr09ga3h69p349mqvr9h8s80gwqu302jwes", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "addr1q8dvghts7kcmc5jqzra50z5urwhge7486n6rjdtyelhjj4jsxhz05ds5sfe0fkzw4r7g2jaw9gp6rw9n70e2tqzsapms4amsgj", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "DEv8mnLYcRFnpAcPLaG8Dn4TJKK7dC2SYx", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "0x6Bc0Cd974e0CE5dcE198AD016d54a99e19549ab1", "context": "ETH/BNB", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "ETH/BNB" }, { "type": "wallet", "value": "0xaAC43EB4E17ee938f0Af3374f0285811485925b2", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "LfHCzkJx6sEg83dNnUBtbaWfBPfHu6wzgH", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "1KWpKpBqcL7GXXDYfBtpwyXxjQwYJk2KJe", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "0x21c865300ddc573fed1f922670429d9b2df95d2d", "context": "USDC/USDT BSC", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "USDC/USDT BSC" }, { "type": "wallet", "value": "rJn2zAPdFA193sixJwuFixRkYDUtx3apQh", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "G3b3SW9DStUwCB1Pd4XnFzGYLwHkbYcWkkN2fxaqha3v", "context": "USDT-Solana", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "USDT-Solana" }, { "type": "wallet", "value": "LgEJ6bQFaMB7wZAbE8TL4RLMiwEVtsJYyv", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "wallet", "value": "1HV2BNfCeaeQ9c1RsUnnZLLVE6uyQSZWXb", "context": "next-hop sweep target from crestmarkets BTC wallet", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "next-hop sweep target from crestmarkets BTC wallet" }, { "type": "hash", "value": "6beb02b513f811da0ad2a837f203feffbc6900a552ad23f024e019da3c2526b3", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "hash", "value": "8abbbfe54ff466d05dff7d5ec2ae215c", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "hash", "value": "-1032583768", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "hash", "value": "3f76ad861342405b5f0a5059de35bfb2fc880e9748975929083f5cfe2d5a385a", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "hash", "value": "427b0c476fa99fa037d026c4549fb124", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "hash", "value": "d952ca796a5c973e632bc7cdf841343a3d845c54061b14639097f0eb836e475d", "context": "", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": null }, { "type": "key", "value": "4aeb1fdb9a261fa98524e37134fd905a4ef8e7ce", "context": "live-chat widget account ID", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "live-chat widget account ID" }, { "type": "key", "value": "BKt9tSMCKnDEjraPoYp-MpP_th8ivocl9AwuM8-xB550Zl9DPi9au9uFwLQvOSGU8yBkRADsCSboGwBEj-iZkfU", "context": "browser-push subscriber key, kit-shared", "tlp": "clear", "source_type": "hooked_scams", "case_slug": "coin-front-io", "case_title": "coin-front.io", "confidence": "observed", "status": null, "notes": "browser-push subscriber key, kit-shared" } ] }