indicatordomain
is-01-ast[.]ols-img-12[.]workers[.]dev
- First seen
- 2026-07-23
- Last seen
- 2026-07-23
- Sightings
- 1
Posts referencing this indicator
- Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel
Cloudflare Workers endpoint used for WebRTC signaling (SDP Offer/Answer exchange) to establish C2 connection; traffic falls within Cloudflare CDN ranges and is difficult to block
