{
  "aliases": [
    "whiteelephant"
  ],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 73,
    "ipv4": 16,
    "url": 7
  },
  "first_seen": {
    "domain": {
      "abdupdates.com": "2024-09-12",
      "alr3ady.net": "2024-09-12",
      "antivirusreviewratings.com": "2024-09-12",
      "authorisedsecurehost.com": "2024-09-12",
      "bksrv3r001.com": "2024-09-12",
      "bluecreams.com": "2024-09-12",
      "bookshopmarket.com": "2024-09-12",
      "brandsons.net": "2024-09-12",
      "braninfall.net": "2024-09-12",
      "c00lh0sting.com": "2024-09-12",
      "c0ttenc0unty.com": "2024-09-12",
      "cr3ator01.net": "2024-09-12",
      "crowcatcher.com": "2024-09-12",
      "crvhostia.net": "2024-09-12",
      "currentnewsstore.com": "2024-09-12",
      "customauthentication.com": "2024-09-12",
      "devinmartin.net": "2024-09-12",
      "directsupp0rt.com": "2024-09-12",
      "divinepower.info": "2024-09-12",
      "draganheart.com": "2024-09-12",
      "easyhost-ing.com": "2024-09-12",
      "easyslidesharing.net": "2024-09-12",
      "f00dlover.info": "2024-09-12",
      "filetrusty.net": "2024-09-12",
      "follow-ship.com": "2024-09-12",
      "forest-fire.net": "2024-09-12",
      "foxypredators.com": "2024-09-12",
      "freensecurehost.com": "2024-09-12",
      "freesecurehostings.com": "2024-09-12",
      "freewebdomainhost.com": "2024-09-12",
      "freewebuserhost.com": "2024-09-12",
      "gauzpie.com": "2024-09-12",
      "gmail-loginchk.freehostia.com": "2024-09-12",
      "h3helnsupp0ort.com": "2024-09-12",
      "hatemewhy.com": "2024-09-12",
      "hostingserveronline.net": "2024-09-12",
      "hotmasalanewssite.com": "2024-09-12",
      "islam-jindabad.blogspot.com": "2024-09-12",
      "jasminjorden.com": "2024-09-12",
      "karzontheway.com": "2024-09-12",
      "kungfu-panda.info": "2024-09-12",
      "matrixnotloaded.com": "2024-09-12",
      "msfileshare.net": "2024-09-12",
      "msoftweb.com": "2024-09-12",
      "myt3mple.com": "2024-09-12",
      "newamazingfacts.com": "2024-09-12",
      "nitr0rac3.com": "2024-09-12",
      "pc-technsupport.com": "2024-09-12",
      "piegauz.net": "2024-09-12",
      "r3gistration.net": "2024-09-12",
      "reliablensecurehost.net": "2024-09-12",
      "s0pp0rtdesk.com": "2024-09-12",
      "s3rv1c3s.net": "2024-09-12",
      "secuina.net": "2024-09-12",
      "securenhost.com": "2024-09-12",
      "server003.com": "2024-09-12",
      "server006.com": "2024-09-12",
      "serverrr.com": "2024-09-12",
      "serviceaccountloginservicemail.info": "2024-09-12",
      "servicesaccount.com": "2024-09-12",
      "sliderocket.com": "2024-09-12",
      "speedaccelator.com": "2024-09-12",
      "spidercom.info": "2024-09-12",
      "t3rmin3.com": "2024-09-12",
      "taraanasongs.com": "2024-09-12",
      "thedailynewsheadline.com": "2016-02-24",
      "tow3r.info": "2024-09-12",
      "updatemypc.net": "2024-09-12",
      "updatesl1nk.com": "2024-09-12",
      "vall3y.com": "2024-09-12",
      "wearwellgarments.eu": "2024-09-12",
      "webjavaupdate.com": "2024-09-12",
      "webmicrosoftupdate.net": "2024-09-12"
    },
    "ipv4": {
      "212.72.189.74:21": "2024-09-13",
      "212.72.189.74:443": "2024-09-13",
      "64.186.132.165:3780": "2024-09-13",
      "65.75.243.251:1700": "2024-09-13",
      "65.75.243.251:81": "2024-09-13",
      "65.75.250.66:21": "2024-09-13",
      "65.75.250.66:443": "2024-09-13",
      "69.197.147.146:21": "2024-09-13",
      "69.197.147.146:443": "2024-09-13",
      "75.127.111.165:21": "2024-09-13",
      "75.127.111.165:443": "2024-09-13",
      "75.127.78.100:21": "2024-09-13",
      "75.127.78.100:443": "2024-09-13",
      "75.127.91.16:81": "2024-09-13",
      "84.243.201.254:21": "2024-09-13",
      "84.243.201.254:443": "2024-09-13"
    },
    "url": {
      "http://143.95.251.26": "2024-09-13",
      "http://212.72.189.74": "2024-09-13",
      "http://65.75.250.66": "2024-09-13",
      "http://69.197.147.146": "2024-09-13",
      "http://75.127.111.165": "2024-09-13",
      "http://75.127.78.100": "2024-09-13",
      "http://84.243.201.254": "2024-09-13"
    }
  },
  "first_seen_precision": {
    "domain": {},
    "ipv4": {},
    "url": {}
  },
  "first_seen_range": {
    "earliest": "2016-02-24",
    "latest": "2024-09-13"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "abdupdates.com",
      "alr3ady.net",
      "antivirusreviewratings.com",
      "authorisedsecurehost.com",
      "bksrv3r001.com",
      "bluecreams.com",
      "bookshopmarket.com",
      "brandsons.net",
      "braninfall.net",
      "c00lh0sting.com",
      "c0ttenc0unty.com",
      "cr3ator01.net",
      "crowcatcher.com",
      "crvhostia.net",
      "currentnewsstore.com",
      "customauthentication.com",
      "devinmartin.net",
      "directsupp0rt.com",
      "divinepower.info",
      "draganheart.com",
      "easyhost-ing.com",
      "easyslidesharing.net",
      "f00dlover.info",
      "filetrusty.net",
      "follow-ship.com",
      "forest-fire.net",
      "foxypredators.com",
      "freensecurehost.com",
      "freesecurehostings.com",
      "freewebdomainhost.com",
      "freewebuserhost.com",
      "gauzpie.com",
      "gmail-loginchk.freehostia.com",
      "h3helnsupp0ort.com",
      "hatemewhy.com",
      "hostingserveronline.net",
      "hotmasalanewssite.com",
      "islam-jindabad.blogspot.com",
      "jasminjorden.com",
      "karzontheway.com",
      "kungfu-panda.info",
      "matrixnotloaded.com",
      "msfileshare.net",
      "msoftweb.com",
      "myt3mple.com",
      "newamazingfacts.com",
      "nitr0rac3.com",
      "pc-technsupport.com",
      "piegauz.net",
      "r3gistration.net",
      "reliablensecurehost.net",
      "s0pp0rtdesk.com",
      "s3rv1c3s.net",
      "secuina.net",
      "securenhost.com",
      "server003.com",
      "server006.com",
      "serverrr.com",
      "serviceaccountloginservicemail.info",
      "servicesaccount.com",
      "sliderocket.com",
      "speedaccelator.com",
      "spidercom.info",
      "t3rmin3.com",
      "taraanasongs.com",
      "thedailynewsheadline.com",
      "tow3r.info",
      "updatemypc.net",
      "updatesl1nk.com",
      "vall3y.com",
      "wearwellgarments.eu",
      "webjavaupdate.com",
      "webmicrosoftupdate.net"
    ],
    "ipv4": [
      "212.72.189.74:21",
      "212.72.189.74:443",
      "64.186.132.165:3780",
      "65.75.243.251:1700",
      "65.75.243.251:81",
      "65.75.250.66:21",
      "65.75.250.66:443",
      "69.197.147.146:21",
      "69.197.147.146:443",
      "75.127.111.165:21",
      "75.127.111.165:443",
      "75.127.78.100:21",
      "75.127.78.100:443",
      "75.127.91.16:81",
      "84.243.201.254:21",
      "84.243.201.254:443"
    ],
    "url": [
      "http://143.95.251.26",
      "http://212.72.189.74",
      "http://65.75.250.66",
      "http://69.197.147.146",
      "http://75.127.111.165",
      "http://75.127.78.100",
      "http://84.243.201.254"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "APPIN"
  ],
  "references": [
    "https://www.sentinelone.com/labs/elephant-hunting-inside-an-indian-hack-for-hire-group/",
    "https://www.virustotal.com/gui/file/088038c03cc1ed4a045f54c7e2bc051bc4f334a10db7f17e66db72d3e412c365/detection",
    "https://www.virustotal.com/gui/file/66a58da1d568fbca46462acbbce75c21b2d8f4735da5c34824feae6f8b525411/detection",
    "https://www.virustotal.com/gui/file/cd661a71d7f7e7076bd90af46ca5b3202b5a4af1067ac9ddff8dfcb8e6987426/detection",
    "https://www.virustotal.com/gui/file/d70de8d8263f54cf9dea72638e664556a6684b5f518bfb66f45271898653ad5c/detection",
    "https://www.virustotal.com/gui/file/f7460d0ead6b5923faa24bda2d1301fd3718893115ae5926780353a0279505a6/detection"
  ],
  "related": [],
  "slug": "APPIN",
  "timeline": [
    {
      "counts": {
        "ipv4": 16,
        "url": 7
      },
      "first_seen": "2024-09-13",
      "indicators": {
        "ipv4": [
          "212.72.189.74:21",
          "212.72.189.74:443",
          "64.186.132.165:3780",
          "65.75.243.251:1700",
          "65.75.243.251:81",
          "65.75.250.66:21",
          "65.75.250.66:443",
          "69.197.147.146:21",
          "69.197.147.146:443",
          "75.127.111.165:21",
          "75.127.111.165:443",
          "75.127.78.100:21",
          "75.127.78.100:443",
          "75.127.91.16:81",
          "84.243.201.254:21",
          "84.243.201.254:443"
        ],
        "url": [
          "http://143.95.251.26",
          "http://212.72.189.74",
          "http://65.75.250.66",
          "http://69.197.147.146",
          "http://75.127.111.165",
          "http://75.127.78.100",
          "http://84.243.201.254"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.sentinelone.com/labs/elephant-hunting-inside-an-indian-hack-for-hire-group/",
        "https://www.virustotal.com/gui/file/cd661a71d7f7e7076bd90af46ca5b3202b5a4af1067ac9ddff8dfcb8e6987426/detection",
        "https://www.virustotal.com/gui/file/d70de8d8263f54cf9dea72638e664556a6684b5f518bfb66f45271898653ad5c/detection",
        "https://www.virustotal.com/gui/file/f7460d0ead6b5923faa24bda2d1301fd3718893115ae5926780353a0279505a6/detection",
        "https://www.virustotal.com/gui/file/088038c03cc1ed4a045f54c7e2bc051bc4f334a10db7f17e66db72d3e412c365/detection",
        "https://www.virustotal.com/gui/file/66a58da1d568fbca46462acbbce75c21b2d8f4735da5c34824feae6f8b525411/detection"
      ],
      "total": 23
    },
    {
      "counts": {
        "domain": 72
      },
      "first_seen": "2024-09-12",
      "indicators": {
        "domain": [
          "abdupdates.com",
          "alr3ady.net",
          "antivirusreviewratings.com",
          "authorisedsecurehost.com",
          "bksrv3r001.com",
          "bluecreams.com",
          "bookshopmarket.com",
          "brandsons.net",
          "braninfall.net",
          "c00lh0sting.com",
          "c0ttenc0unty.com",
          "cr3ator01.net",
          "crowcatcher.com",
          "crvhostia.net",
          "currentnewsstore.com",
          "customauthentication.com",
          "devinmartin.net",
          "directsupp0rt.com",
          "divinepower.info",
          "draganheart.com",
          "easyhost-ing.com",
          "easyslidesharing.net",
          "f00dlover.info",
          "filetrusty.net",
          "follow-ship.com",
          "forest-fire.net",
          "foxypredators.com",
          "freensecurehost.com",
          "freesecurehostings.com",
          "freewebdomainhost.com",
          "freewebuserhost.com",
          "gauzpie.com",
          "gmail-loginchk.freehostia.com",
          "h3helnsupp0ort.com",
          "hatemewhy.com",
          "hostingserveronline.net",
          "hotmasalanewssite.com",
          "islam-jindabad.blogspot.com",
          "jasminjorden.com",
          "karzontheway.com",
          "kungfu-panda.info",
          "matrixnotloaded.com",
          "msfileshare.net",
          "msoftweb.com",
          "myt3mple.com",
          "newamazingfacts.com",
          "nitr0rac3.com",
          "pc-technsupport.com",
          "piegauz.net",
          "r3gistration.net",
          "reliablensecurehost.net",
          "s0pp0rtdesk.com",
          "s3rv1c3s.net",
          "secuina.net",
          "securenhost.com",
          "server003.com",
          "server006.com",
          "serverrr.com",
          "serviceaccountloginservicemail.info",
          "servicesaccount.com",
          "sliderocket.com",
          "speedaccelator.com",
          "spidercom.info",
          "t3rmin3.com",
          "taraanasongs.com",
          "tow3r.info",
          "updatemypc.net",
          "updatesl1nk.com",
          "vall3y.com",
          "wearwellgarments.eu",
          "webjavaupdate.com",
          "webmicrosoftupdate.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.sentinelone.com/labs/elephant-hunting-inside-an-indian-hack-for-hire-group/",
        "https://www.virustotal.com/gui/file/cd661a71d7f7e7076bd90af46ca5b3202b5a4af1067ac9ddff8dfcb8e6987426/detection",
        "https://www.virustotal.com/gui/file/d70de8d8263f54cf9dea72638e664556a6684b5f518bfb66f45271898653ad5c/detection",
        "https://www.virustotal.com/gui/file/f7460d0ead6b5923faa24bda2d1301fd3718893115ae5926780353a0279505a6/detection",
        "https://www.virustotal.com/gui/file/088038c03cc1ed4a045f54c7e2bc051bc4f334a10db7f17e66db72d3e412c365/detection",
        "https://www.virustotal.com/gui/file/66a58da1d568fbca46462acbbce75c21b2d8f4735da5c34824feae6f8b525411/detection"
      ],
      "total": 72
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2016-02-24",
      "indicators": {
        "domain": [
          "thedailynewsheadline.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.sentinelone.com/labs/elephant-hunting-inside-an-indian-hack-for-hire-group/",
        "https://www.virustotal.com/gui/file/cd661a71d7f7e7076bd90af46ca5b3202b5a4af1067ac9ddff8dfcb8e6987426/detection",
        "https://www.virustotal.com/gui/file/d70de8d8263f54cf9dea72638e664556a6684b5f518bfb66f45271898653ad5c/detection",
        "https://www.virustotal.com/gui/file/f7460d0ead6b5923faa24bda2d1301fd3718893115ae5926780353a0279505a6/detection",
        "https://www.virustotal.com/gui/file/088038c03cc1ed4a045f54c7e2bc051bc4f334a10db7f17e66db72d3e412c365/detection",
        "https://www.virustotal.com/gui/file/66a58da1d568fbca46462acbbce75c21b2d8f4735da5c34824feae6f8b525411/detection"
      ],
      "total": 1
    }
  ]
}