Indicators of Compromise

emailsectionelecheck.querySelector

emailinputcheck.value

victim@email.corp

window.callPhantom

navigator.webdriver

http://kzagniw.es/LI6vGlx7@1wPztdy

http://immutable.nathacha.digital/T@uWhi6jqZQH7/#?EMAIL_ADDRESS

http://astro.thorousha.ru/vojd4e50fw4o!g/$ENCODED

http://branch.cricomai.sa.com/b@GrBOPttIrJA/*EMAIL_ADDRESS

http://mysql.vecedoo.online/JB5ow79@fKst02/#EMAIL_ADDRESS

http://backend.vmfuiojitnlb.es/CGyP9!CbhSU22YT2/

http://mock.zuyistoo.today/pry1r75TisN5S@8yDDQI/$EMAIL_ADDRESS

com.de

http://qonnfp.wnrathttb.ru/Fe2yiyoKvg3YTfV!/$EMAIL_ADDRESS

http://piwf.ariitdc.es/kv2gVMHLZ@dNeXt/$EMAIL_ADDRESS

http://q9y3.efwzxgd.es/MEaap8nZG5A@c8T/*EMAIL_ADDRESS

api.ipapi.is

in.net

sa.com

token.authorize