testfirebase-b24a8.appspot[.]comDomain
Reported by 1 independent source · first reported by Zscaler ThreatLabz · last reported
Last reported 8 months ago
What the reports say
1 report, newest first · the exact sentence from each-
APT Attacks Target Indian Government Using SHEETCREEP, FIREPOWER, and MAILCREEP | Part 2“…ault-rtdb.firebaseio.com/(12336)005056C0000186/details.jsonSHEETCREEP backup configuration URLhxxps://storage.googleapis.com/testfirebase-b24a8.appspot[.]com/config1.txtDownload URL and SHEETCREEP payloadhxxps://hciaccounts.in/Documents.zipC2 URLhxxps://docs.google.com/spreadsheets…”
Indicators reported together
named in the same reports- hxxps://hcidoc[.]in/in 1 report
- hcidoc[.]inin 1 report
- domaincoadelhi[.]inin 1 report
- domainshciaccounts[.]inin 1 report
- hxxps://hciaccounts[.]in/Documents.zipin 1 report
- hciaccounts[.]inin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.