{
  "aliases": [],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 95,
    "ipv4": 1
  },
  "first_seen": {
    "domain": {
      "212nj0b42w.web.telegram-account.host": "2024-12-11",
      "658pvbhj2k7veemmv4.web.telegram-account.host": "2024-12-11",
      "accept-action.site": "2024-12-11",
      "account-guard.site": "2024-12-11",
      "account-saver.com": "2024-12-11",
      "account-viewer.com": "2024-12-11",
      "add-group.site": "2026-01-02",
      "cancel-action.site": "2024-12-11",
      "cancel-auth.site": "2024-12-11",
      "check-active.site": "2024-12-11",
      "check.sign-cert.com": "2024-12-11",
      "cloud.account-viewer.com": "2024-12-11",
      "cloud.god-le.net": "2024-12-11",
      "clouddrive.world": "2024-12-11",
      "confirm-signal.site": "2024-12-11",
      "confirm.account-viewer.com": "2024-12-11",
      "confirmphone.site": "2024-12-11",
      "defender-bot.site": "2024-12-11",
      "delta.milgov.site": "2024-12-11",
      "derzhposluhy.com": "2024-12-11",
      "device.redirecl.com": "2024-12-11",
      "dhl.redirecl.com": "2024-12-11",
      "drive-share.site": "2024-12-11",
      "drive.redirecl.com": "2024-12-11",
      "emtserviceca.info": "2024-12-11",
      "get.god-le.com": "2024-12-11",
      "get.in-touc.com": "2024-12-11",
      "get.mail-gov.com": "2024-12-11",
      "get.sign-cert.com": "2024-12-11",
      "god-le.com": "2024-12-11",
      "god-le.net": "2024-12-11",
      "google.drive-share.site": "2024-12-11",
      "google.share-drive.site": "2024-12-11",
      "group-invitation.site": "2024-12-11",
      "group-teneta.online": "2024-12-11",
      "group.kropyva.site": "2024-12-11",
      "group.teneta.site": "2024-12-11",
      "helperanalytics.ru": "2026-01-02",
      "homeskart.shop": "2024-12-11",
      "homeway.xyz": "2024-12-11",
      "i-ua.account-guard.site": "2024-12-11",
      "in-touc.com": "2024-12-11",
      "ivanti.account-viewer.com": "2024-12-11",
      "join-group.online": "2026-01-02",
      "kropyva.group": "2024-12-11",
      "kropyva.site": "2024-12-11",
      "live.outloolc.com": "2024-12-11",
      "mail-gov.com": "2024-12-11",
      "mail-gov.net": "2024-12-11",
      "mail.outloolc.com": "2024-12-11",
      "mails.support": "2024-12-11",
      "milgov.host": "2024-12-11",
      "milgov.site": "2024-12-11",
      "mirotrent.com": "2024-12-11",
      "my.mail-gov.net": "2024-12-11",
      "odwebp.com": "2024-12-11",
      "outloolc.com": "2024-12-11",
      "palantir.ink": "2024-12-11",
      "passport-ukr-net.site": "2024-12-11",
      "plntr.account-viewer.com": "2024-12-11",
      "plntr.mirotrent.com": "2024-12-11",
      "protect-password.site": "2024-12-11",
      "qsrgh.site": "2024-12-11",
      "qweasdzx.site": "2024-12-11",
      "redirecl.com": "2024-12-11",
      "share-drive.site": "2024-12-11",
      "sign-cert.com": "2024-12-11",
      "signal-confirm.site": "2024-12-11",
      "signal-protect.host": "2026-01-02",
      "spam.web-telegram.host": "2024-12-11",
      "stellar.account-viewer.com": "2024-12-11",
      "svc.odwebp.com": "2024-12-11",
      "teiegram.host": "2024-12-11",
      "telegram-account.host": "2024-12-11",
      "telegram-auth.website": "2024-12-11",
      "telegram-confirm.site": "2024-12-11",
      "telegram.check-active.site": "2024-12-11",
      "telegram.defender-bot.site": "2024-12-11",
      "telegram.qweasdzx.site": "2024-12-11",
      "telegram.token-defender.cloud": "2024-12-11",
      "telegramm-account.site": "2024-12-11",
      "teneta.add-group.site": "2026-01-02",
      "teneta.group": "2024-12-11",
      "teneta.join-group.online": "2026-01-02",
      "teneta.site": "2024-12-11",
      "token-defender.cloud": "2024-12-11",
      "uspp.derzhposluhy.com": "2024-12-11",
      "web-telegram.host": "2024-12-11",
      "web.teiegram.host": "2024-12-11",
      "web.telegram-account.host": "2024-12-11",
      "web.telegramm-account.site": "2024-12-11",
      "web.web.telegram-account.host": "2024-12-11",
      "whatsapp-confirm.site": "2024-12-11",
      "whatsapp.group-invitation.site": "2024-12-11",
      "whatsapp.protect-password.site": "2024-12-11"
    },
    "ipv4": {
      "185.225.35.75:30555": "2024-12-11"
    }
  },
  "first_seen_precision": {
    "domain": {
      "add-group.site": "at-or-before",
      "helperanalytics.ru": "at-or-before",
      "join-group.online": "at-or-before",
      "signal-protect.host": "at-or-before",
      "teneta.add-group.site": "at-or-before",
      "teneta.join-group.online": "at-or-before"
    },
    "ipv4": {}
  },
  "first_seen_range": {
    "earliest": "2024-12-11",
    "latest": "2026-01-02"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "212nj0b42w.web.telegram-account.host",
      "658pvbhj2k7veemmv4.web.telegram-account.host",
      "accept-action.site",
      "account-guard.site",
      "account-saver.com",
      "account-viewer.com",
      "add-group.site",
      "cancel-action.site",
      "cancel-auth.site",
      "check-active.site",
      "check.sign-cert.com",
      "cloud.account-viewer.com",
      "cloud.god-le.net",
      "clouddrive.world",
      "confirm-signal.site",
      "confirm.account-viewer.com",
      "confirmphone.site",
      "defender-bot.site",
      "delta.milgov.site",
      "derzhposluhy.com",
      "device.redirecl.com",
      "dhl.redirecl.com",
      "drive-share.site",
      "drive.redirecl.com",
      "emtserviceca.info",
      "get.god-le.com",
      "get.in-touc.com",
      "get.mail-gov.com",
      "get.sign-cert.com",
      "god-le.com",
      "god-le.net",
      "google.drive-share.site",
      "google.share-drive.site",
      "group-invitation.site",
      "group-teneta.online",
      "group.kropyva.site",
      "group.teneta.site",
      "helperanalytics.ru",
      "homeskart.shop",
      "homeway.xyz",
      "i-ua.account-guard.site",
      "in-touc.com",
      "ivanti.account-viewer.com",
      "join-group.online",
      "kropyva.group",
      "kropyva.site",
      "live.outloolc.com",
      "mail-gov.com",
      "mail-gov.net",
      "mail.outloolc.com",
      "mails.support",
      "milgov.host",
      "milgov.site",
      "mirotrent.com",
      "my.mail-gov.net",
      "odwebp.com",
      "outloolc.com",
      "palantir.ink",
      "passport-ukr-net.site",
      "plntr.account-viewer.com",
      "plntr.mirotrent.com",
      "protect-password.site",
      "qsrgh.site",
      "qweasdzx.site",
      "redirecl.com",
      "share-drive.site",
      "sign-cert.com",
      "signal-confirm.site",
      "signal-protect.host",
      "spam.web-telegram.host",
      "stellar.account-viewer.com",
      "svc.odwebp.com",
      "teiegram.host",
      "telegram-account.host",
      "telegram-auth.website",
      "telegram-confirm.site",
      "telegram.check-active.site",
      "telegram.defender-bot.site",
      "telegram.qweasdzx.site",
      "telegram.token-defender.cloud",
      "telegramm-account.site",
      "teneta.add-group.site",
      "teneta.group",
      "teneta.join-group.online",
      "teneta.site",
      "token-defender.cloud",
      "uspp.derzhposluhy.com",
      "web-telegram.host",
      "web.teiegram.host",
      "web.telegram-account.host",
      "web.telegramm-account.site",
      "web.web.telegram-account.host",
      "whatsapp-confirm.site",
      "whatsapp.group-invitation.site",
      "whatsapp.protect-password.site"
    ],
    "ipv4": [
      "185.225.35.75:30555"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "UNC4221"
  ],
  "references": [
    "https://cert.gov.ua/article/6281632 (# UAC-0185)",
    "https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger",
    "https://www.virustotal.com/gui/file/9f29d27cdad37a6451f3ccd2f3c054afa408ef83422b4999eff5915834cd00be/detection",
    "https://x.com/TLP_R3D/status/1892221224094445666"
  ],
  "related": [
    {
      "evidence": [
        {
          "detail": "2 reports cite both",
          "kind": "reporting",
          "weight": 2.0
        }
      ],
      "slug": "G0034"
    },
    {
      "evidence": [
        {
          "detail": "2 reports cite both",
          "kind": "reporting",
          "weight": 2.0
        }
      ],
      "slug": "UNC5792"
    }
  ],
  "slug": "UNC4221",
  "timeline": [
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "add-group.site",
          "helperanalytics.ru",
          "join-group.online",
          "signal-protect.host",
          "teneta.add-group.site",
          "teneta.join-group.online"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/TLP_R3D/status/1892221224094445666",
        "https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 88,
        "ipv4": 1
      },
      "first_seen": "2024-12-11",
      "indicators": {
        "domain": [
          "212nj0b42w.web.telegram-account.host",
          "658pvbhj2k7veemmv4.web.telegram-account.host",
          "accept-action.site",
          "account-guard.site",
          "account-saver.com",
          "account-viewer.com",
          "cancel-action.site",
          "cancel-auth.site",
          "check-active.site",
          "check.sign-cert.com",
          "cloud.account-viewer.com",
          "cloud.god-le.net",
          "clouddrive.world",
          "confirm-signal.site",
          "confirm.account-viewer.com",
          "confirmphone.site",
          "defender-bot.site",
          "delta.milgov.site",
          "derzhposluhy.com",
          "device.redirecl.com",
          "dhl.redirecl.com",
          "drive-share.site",
          "drive.redirecl.com",
          "emtserviceca.info",
          "get.god-le.com",
          "get.in-touc.com",
          "get.mail-gov.com",
          "get.sign-cert.com",
          "god-le.com",
          "god-le.net",
          "google.drive-share.site",
          "google.share-drive.site",
          "group-invitation.site",
          "group-teneta.online",
          "group.kropyva.site",
          "group.teneta.site",
          "homeskart.shop",
          "homeway.xyz",
          "i-ua.account-guard.site",
          "in-touc.com",
          "ivanti.account-viewer.com",
          "kropyva.group",
          "kropyva.site",
          "live.outloolc.com",
          "mail-gov.com",
          "mail-gov.net",
          "mail.outloolc.com",
          "mails.support",
          "milgov.host",
          "milgov.site",
          "mirotrent.com",
          "my.mail-gov.net",
          "odwebp.com",
          "outloolc.com",
          "palantir.ink",
          "passport-ukr-net.site",
          "plntr.account-viewer.com",
          "plntr.mirotrent.com",
          "protect-password.site",
          "qsrgh.site",
          "qweasdzx.site",
          "redirecl.com",
          "share-drive.site",
          "sign-cert.com",
          "spam.web-telegram.host",
          "stellar.account-viewer.com",
          "svc.odwebp.com",
          "teiegram.host",
          "telegram-account.host",
          "telegram-auth.website",
          "telegram-confirm.site",
          "telegram.check-active.site",
          "telegram.defender-bot.site",
          "telegram.qweasdzx.site",
          "telegram.token-defender.cloud",
          "telegramm-account.site",
          "teneta.group",
          "teneta.site",
          "token-defender.cloud",
          "uspp.derzhposluhy.com",
          "web-telegram.host",
          "web.teiegram.host",
          "web.telegram-account.host",
          "web.telegramm-account.site",
          "web.web.telegram-account.host",
          "whatsapp-confirm.site",
          "whatsapp.group-invitation.site",
          "whatsapp.protect-password.site"
        ],
        "ipv4": [
          "185.225.35.75:30555"
        ]
      },
      "precision": "exact",
      "references": [
        "https://cert.gov.ua/article/6281632 (# UAC-0185)",
        "https://www.virustotal.com/gui/file/9f29d27cdad37a6451f3ccd2f3c054afa408ef83422b4999eff5915834cd00be/detection"
      ],
      "total": 89
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-12-11",
      "indicators": {
        "domain": [
          "signal-confirm.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://cert.gov.ua/article/6281632 (# UAC-0185)",
        "https://www.virustotal.com/gui/file/9f29d27cdad37a6451f3ccd2f3c054afa408ef83422b4999eff5915834cd00be/detection",
        "https://x.com/TLP_R3D/status/1892221224094445666",
        "https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger"
      ],
      "total": 1
    }
  ]
}