{
  "aliases": [],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 141
  },
  "first_seen": {
    "domain": {
      "12support.top": "2025-01-08",
      "6559464.com": "2025-01-08",
      "accesspoint.cc": "2025-01-08",
      "admin.flywidus.co": "2025-01-08",
      "atgajroker.icu": "2025-01-08",
      "atmolatori.cyou": "2025-01-08",
      "atmolatori.icu": "2025-01-08",
      "awedinetwork.com": "2025-01-08",
      "beri1.com": "2025-01-08",
      "clmhelp.top": "2025-01-08",
      "cloud.vshell.io": "2025-01-08",
      "cogajroker.icu": "2025-01-08",
      "cqhelp.top": "2025-01-08",
      "csupport.ch": "2025-01-08",
      "dealr.help": "2025-01-08",
      "do68iyckuy.emerge.co.zw": "2025-01-08",
      "dshelp.top": "2025-01-08",
      "edg-rt1.top": "2025-01-08",
      "elioua5.top": "2025-01-08",
      "exnpanel1.top": "2025-01-08",
      "fposhelp.com": "2025-01-08",
      "gajrokerist.icu": "2025-01-08",
      "gajrokerring.icu": "2025-01-08",
      "gajrokerware.icu": "2025-01-08",
      "glueconnect.com": "2025-01-08",
      "gomolatori.cyou": "2025-01-08",
      "gomolatori.icu": "2025-01-08",
      "gthelp.top": "2025-01-08",
      "gxclp2.top": "2025-01-08",
      "help26.ca": "2025-01-08",
      "helpmysupport.top": "2025-01-08",
      "icrm-tr3.top": "2025-01-08",
      "itmanagers.io": "2025-01-08",
      "jjghelp.top": "2025-01-08",
      "jxhelp.top": "2025-01-08",
      "kaptohelp.top": "2025-01-08",
      "kryzuxyzhosting.com": "2025-01-08",
      "lamolatori.cyou": "2025-01-08",
      "lamolatori.icu": "2025-01-08",
      "lowcarbsupport.nl": "2025-01-08",
      "lwhelp.top": "2025-01-08",
      "medion-001-site1.ctempurl.com": "2025-01-08",
      "mgbhelp.top": "2025-01-08",
      "mghelp.top": "2025-01-08",
      "mkpanel.connectagent.online": "2025-01-08",
      "mohamedsisyxyz.com": "2025-01-08",
      "molatoriby.cyou": "2025-01-08",
      "molatoriby.icu": "2025-01-08",
      "molatorier.cyou": "2025-01-08",
      "molatorier.icu": "2025-01-08",
      "molatoriism.cyou": "2025-01-08",
      "molatoriism.icu": "2025-01-08",
      "molatoriist.cyou": "2025-01-08",
      "molatoriist.icu": "2025-01-08",
      "molatoriit.cyou": "2025-01-08",
      "molatoriit.icu": "2025-01-08",
      "molatorila.cyou": "2025-01-08",
      "molatorila.icu": "2025-01-08",
      "molatoriline.cyou": "2025-01-08",
      "molatoriline.icu": "2025-01-08",
      "molatorimax.cyou": "2025-01-08",
      "molatorimax.icu": "2025-01-08",
      "molatoriora.cyou": "2025-01-08",
      "molatoriora.icu": "2025-01-08",
      "molatoripro.cyou": "2025-01-08",
      "molatoripro.icu": "2025-01-08",
      "molatorister.cyou": "2025-01-08",
      "molatorister.icu": "2025-01-08",
      "molatorisy.cyou": "2025-01-08",
      "molatorisy.icu": "2025-01-08",
      "molatoriup.cyou": "2025-01-08",
      "molatoriup.icu": "2025-01-08",
      "moqadiski.com": "2025-01-08",
      "mr26panel.top": "2025-01-08",
      "nonopanel.top": "2025-01-08",
      "nphelp.top": "2025-01-08",
      "numolatori.cyou": "2025-01-08",
      "numolatori.icu": "2025-01-08",
      "nwpihelp.top": "2025-01-08",
      "omvtr-ud.top": "2025-01-08",
      "onmolatori.cyou": "2025-01-08",
      "onmolatori.icu": "2025-01-08",
      "orhelp.top": "2025-01-08",
      "plphelp.top": "2025-01-08",
      "pnbf-gv.top": "2025-01-08",
      "promolatori.cyou": "2025-01-08",
      "promolatori.icu": "2025-01-08",
      "ptbhelp.top": "2025-01-08",
      "pzhelp.top": "2025-01-08",
      "qc3699.jadonparod.cyou": "2025-01-08",
      "qc3699.kafinora.cyou": "2025-01-08",
      "qdhy5-pr.top": "2025-01-08",
      "regajroker.icu": "2025-01-08",
      "remoteconnection.com": "2025-01-08",
      "rgbxyzhosting.com": "2025-01-08",
      "ricpnew1.top": "2025-01-08",
      "rjpanelplus.top": "2025-01-08",
      "rtkhelp.top": "2025-01-08",
      "samolatori.cyou": "2025-01-08",
      "samolatori.icu": "2025-01-08",
      "screen.support": "2025-01-08",
      "secret.wathnan.qa": "2025-01-08",
      "skahelp.top": "2025-01-08",
      "snhelp.top": "2025-01-08",
      "srceconnect.com": "2025-01-08",
      "sreencont.com": "2025-01-08",
      "support.accuratetechnologies.com": "2025-01-08",
      "support.americanroads.com": "2025-01-08",
      "support.dyson.com.au": "2025-01-08",
      "support.gyldendal.dk": "2025-01-08",
      "support.trustedsitepartner.com": "2025-01-08",
      "support.vitamail.dk": "2025-01-08",
      "support.vitamail.fi": "2025-01-08",
      "support.vitamail.se": "2025-01-08",
      "support.websecurityplatform.com": "2025-01-08",
      "supportusnow.top": "2025-01-08",
      "sxzer-rt.top": "2025-01-08",
      "t7m.top": "2025-01-08",
      "tetoxyzhosting.com": "2025-01-08",
      "tgvhelp.top": "2025-01-08",
      "trustedsitepartner.com": "2025-01-08",
      "ttlhelp.top": "2025-01-08",
      "u9b.top": "2025-01-08",
      "uwhelp.top": "2025-01-08",
      "voicemail-twisters.top": "2025-01-08",
      "vrehelp.top": "2025-01-08",
      "wesupportdevice.top": "2025-01-08",
      "wjhelp.top": "2025-01-08",
      "wnhelp.top": "2025-01-08",
      "wothelp.top": "2025-01-08",
      "wplhelp.top": "2025-01-08",
      "xkhelp.top": "2025-01-08",
      "xohelp.top": "2025-01-08",
      "xshelp.top": "2025-01-08",
      "yell64u.top": "2025-01-08",
      "yhbvt-pw.top": "2025-01-08",
      "ytfpyehpyt.me": "2025-01-08",
      "zghelp.top": "2025-01-08",
      "ziadversionthree.com": "2025-01-08",
      "zkang-ws.top": "2025-01-08",
      "zx4qtc.me": "2025-01-08"
    }
  },
  "first_seen_precision": {
    "domain": {}
  },
  "first_seen_range": {
    "earliest": "2025-01-08",
    "latest": "2025-01-08"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "12support.top",
      "6559464.com",
      "accesspoint.cc",
      "admin.flywidus.co",
      "atgajroker.icu",
      "atmolatori.cyou",
      "atmolatori.icu",
      "awedinetwork.com",
      "beri1.com",
      "clmhelp.top",
      "cloud.vshell.io",
      "cogajroker.icu",
      "cqhelp.top",
      "csupport.ch",
      "dealr.help",
      "do68iyckuy.emerge.co.zw",
      "dshelp.top",
      "edg-rt1.top",
      "elioua5.top",
      "exnpanel1.top",
      "fposhelp.com",
      "gajrokerist.icu",
      "gajrokerring.icu",
      "gajrokerware.icu",
      "glueconnect.com",
      "gomolatori.cyou",
      "gomolatori.icu",
      "gthelp.top",
      "gxclp2.top",
      "help26.ca",
      "helpmysupport.top",
      "icrm-tr3.top",
      "itmanagers.io",
      "jjghelp.top",
      "jxhelp.top",
      "kaptohelp.top",
      "kryzuxyzhosting.com",
      "lamolatori.cyou",
      "lamolatori.icu",
      "lowcarbsupport.nl",
      "lwhelp.top",
      "medion-001-site1.ctempurl.com",
      "mgbhelp.top",
      "mghelp.top",
      "mkpanel.connectagent.online",
      "mohamedsisyxyz.com",
      "molatoriby.cyou",
      "molatoriby.icu",
      "molatorier.cyou",
      "molatorier.icu",
      "molatoriism.cyou",
      "molatoriism.icu",
      "molatoriist.cyou",
      "molatoriist.icu",
      "molatoriit.cyou",
      "molatoriit.icu",
      "molatorila.cyou",
      "molatorila.icu",
      "molatoriline.cyou",
      "molatoriline.icu",
      "molatorimax.cyou",
      "molatorimax.icu",
      "molatoriora.cyou",
      "molatoriora.icu",
      "molatoripro.cyou",
      "molatoripro.icu",
      "molatorister.cyou",
      "molatorister.icu",
      "molatorisy.cyou",
      "molatorisy.icu",
      "molatoriup.cyou",
      "molatoriup.icu",
      "moqadiski.com",
      "mr26panel.top",
      "nonopanel.top",
      "nphelp.top",
      "numolatori.cyou",
      "numolatori.icu",
      "nwpihelp.top",
      "omvtr-ud.top",
      "onmolatori.cyou",
      "onmolatori.icu",
      "orhelp.top",
      "plphelp.top",
      "pnbf-gv.top",
      "promolatori.cyou",
      "promolatori.icu",
      "ptbhelp.top",
      "pzhelp.top",
      "qc3699.jadonparod.cyou",
      "qc3699.kafinora.cyou",
      "qdhy5-pr.top",
      "regajroker.icu",
      "remoteconnection.com",
      "rgbxyzhosting.com",
      "ricpnew1.top",
      "rjpanelplus.top",
      "rtkhelp.top",
      "samolatori.cyou",
      "samolatori.icu",
      "screen.support",
      "secret.wathnan.qa",
      "skahelp.top",
      "snhelp.top",
      "srceconnect.com",
      "sreencont.com",
      "support.accuratetechnologies.com",
      "support.americanroads.com",
      "support.dyson.com.au",
      "support.gyldendal.dk",
      "support.trustedsitepartner.com",
      "support.vitamail.dk",
      "support.vitamail.fi",
      "support.vitamail.se",
      "support.websecurityplatform.com",
      "supportusnow.top",
      "sxzer-rt.top",
      "t7m.top",
      "tetoxyzhosting.com",
      "tgvhelp.top",
      "trustedsitepartner.com",
      "ttlhelp.top",
      "u9b.top",
      "uwhelp.top",
      "voicemail-twisters.top",
      "vrehelp.top",
      "wesupportdevice.top",
      "wjhelp.top",
      "wnhelp.top",
      "wothelp.top",
      "wplhelp.top",
      "xkhelp.top",
      "xohelp.top",
      "xshelp.top",
      "yell64u.top",
      "yhbvt-pw.top",
      "ytfpyehpyt.me",
      "zghelp.top",
      "ziadversionthree.com",
      "zkang-ws.top",
      "zx4qtc.me"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "UNC5952"
  ],
  "references": [
    "https://x.com/pancak3lullz/status/1877080477510549779"
  ],
  "related": [],
  "slug": "UNC5952",
  "timeline": [
    {
      "counts": {
        "domain": 141
      },
      "first_seen": "2025-01-08",
      "indicators": {
        "domain": [
          "12support.top",
          "6559464.com",
          "accesspoint.cc",
          "admin.flywidus.co",
          "atgajroker.icu",
          "atmolatori.cyou",
          "atmolatori.icu",
          "awedinetwork.com",
          "beri1.com",
          "clmhelp.top",
          "cloud.vshell.io",
          "cogajroker.icu",
          "cqhelp.top",
          "csupport.ch",
          "dealr.help",
          "do68iyckuy.emerge.co.zw",
          "dshelp.top",
          "edg-rt1.top",
          "elioua5.top",
          "exnpanel1.top",
          "fposhelp.com",
          "gajrokerist.icu",
          "gajrokerring.icu",
          "gajrokerware.icu",
          "glueconnect.com",
          "gomolatori.cyou",
          "gomolatori.icu",
          "gthelp.top",
          "gxclp2.top",
          "help26.ca",
          "helpmysupport.top",
          "icrm-tr3.top",
          "itmanagers.io",
          "jjghelp.top",
          "jxhelp.top",
          "kaptohelp.top",
          "kryzuxyzhosting.com",
          "lamolatori.cyou",
          "lamolatori.icu",
          "lowcarbsupport.nl",
          "lwhelp.top",
          "medion-001-site1.ctempurl.com",
          "mgbhelp.top",
          "mghelp.top",
          "mkpanel.connectagent.online",
          "mohamedsisyxyz.com",
          "molatoriby.cyou",
          "molatoriby.icu",
          "molatorier.cyou",
          "molatorier.icu",
          "molatoriism.cyou",
          "molatoriism.icu",
          "molatoriist.cyou",
          "molatoriist.icu",
          "molatoriit.cyou",
          "molatoriit.icu",
          "molatorila.cyou",
          "molatorila.icu",
          "molatoriline.cyou",
          "molatoriline.icu",
          "molatorimax.cyou",
          "molatorimax.icu",
          "molatoriora.cyou",
          "molatoriora.icu",
          "molatoripro.cyou",
          "molatoripro.icu",
          "molatorister.cyou",
          "molatorister.icu",
          "molatorisy.cyou",
          "molatorisy.icu",
          "molatoriup.cyou",
          "molatoriup.icu",
          "moqadiski.com",
          "mr26panel.top",
          "nonopanel.top",
          "nphelp.top",
          "numolatori.cyou",
          "numolatori.icu",
          "nwpihelp.top",
          "omvtr-ud.top",
          "onmolatori.cyou",
          "onmolatori.icu",
          "orhelp.top",
          "plphelp.top",
          "pnbf-gv.top",
          "promolatori.cyou",
          "promolatori.icu",
          "ptbhelp.top",
          "pzhelp.top",
          "qc3699.jadonparod.cyou",
          "qc3699.kafinora.cyou",
          "qdhy5-pr.top",
          "regajroker.icu",
          "remoteconnection.com",
          "rgbxyzhosting.com",
          "ricpnew1.top",
          "rjpanelplus.top",
          "rtkhelp.top",
          "samolatori.cyou",
          "samolatori.icu",
          "screen.support",
          "secret.wathnan.qa",
          "skahelp.top",
          "snhelp.top",
          "srceconnect.com",
          "sreencont.com",
          "support.accuratetechnologies.com",
          "support.americanroads.com",
          "support.dyson.com.au",
          "support.gyldendal.dk",
          "support.trustedsitepartner.com",
          "support.vitamail.dk",
          "support.vitamail.fi",
          "support.vitamail.se",
          "support.websecurityplatform.com",
          "supportusnow.top",
          "sxzer-rt.top",
          "t7m.top",
          "tetoxyzhosting.com",
          "tgvhelp.top",
          "trustedsitepartner.com",
          "ttlhelp.top",
          "u9b.top",
          "uwhelp.top",
          "voicemail-twisters.top",
          "vrehelp.top",
          "wesupportdevice.top",
          "wjhelp.top",
          "wnhelp.top",
          "wothelp.top",
          "wplhelp.top",
          "xkhelp.top",
          "xohelp.top",
          "xshelp.top",
          "yell64u.top",
          "yhbvt-pw.top",
          "ytfpyehpyt.me",
          "zghelp.top",
          "ziadversionthree.com",
          "zkang-ws.top",
          "zx4qtc.me"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/pancak3lullz/status/1877080477510549779"
      ],
      "total": 141
    }
  ]
}