hxxps://hciaccounts[.]in/Documents.zipURL

Reported by 1 independent source · first reported 27 Jan 2026 by Zscaler ThreatLabz · last reported 27 Jan 2026

Last reported 8 months ago

What the reports say

1 report, newest first · the exact sentence from each

“… payload by uploading a ZIP archive (Documents.zip) containing the SHEETCREEP backdoor to a threat actor-controlled site (hxxps://hciaccounts[.]in/Documents.zip).T1566.002Initial Access, Phishing: Spearphishing LinkThe threat actor used phishing PDFs which contained a ‘Download Doc…”

Zscaler ThreatLabzVendor27 Jan 2026
APT Attacks Target Indian Government Using SHEETCREEP, FIREPOWER, and MAILCREEP | Part 2

named in the same reports

Copy these 6 indicators · defanged

6 indicators, defanged, one per line

hxxps://hcidoc[.]in/
hcidoc[.]in
testfirebase-b24a8.appspot[.]com
domaincoadelhi[.]in
domainshciaccounts[.]in
hciaccounts[.]in

Thanks — we review every report.

Report a wrong value