104.194.159[.]150IP address
Reported by 2 independent sources · first reported by Zscaler ThreatLabz · last reported
Last reported 2 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia“…hat attacker email was previously used to register an earlier domain masquerading as Microsoft, ms365-live.com which resolved to IP 104.194.159[.]150.”
-
CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials“104.194.159[.]150”
Indicators reported together
named in the same reports- ms365-device[.]comin 2 reports
- ms365-live[.]comin 2 reports
- m365-owa[.]comin 2 reports
- owa-ms365[.]comin 2 reports
- 31.57.243[.]154in 2 reports
- 38.146.28[.]75in 2 reports
- be99857449d2856d…6b4970d8d42cin 2 reports
- 38.146.28[.]132in 1 report
- 107.189.26[.]194in 1 report
- 213.145.86[.]112in 1 report
- 918fa52ae45ed60b…4513be11c593in 1 report
- fewfwfwfwfwf[.]infoin 1 report
- 196.251.107[.]171in 1 report
- foreignrelations[.]usin 1 report
- 5b8d50c2e8cc3038…191ae67f8ffcin 1 report
- 1d9299799a7b8da6…3f6cbc843e3cin 1 report
- 107.189.18[.]7in 1 report
- c5826032207d623a…54f3e4420265in 1 report
- my-invite[.]orgin 1 report
- statistic-ms[.]livein 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.