# ============================================================
# INDICATORS OF COMPROMISE (IOCs)
# Incident: SEO Poisoning Attack on Japanese Medical Websites
# Date: 2026-08-12 to 2026-08-13
# Victim: Medi-Face Co., Ltd. (medi-face.co.jp) + 20 other JP medical sites
# ============================================================

# ATTACKER IPs
103.20.83.86        # Primary — Biznet Networks, Indonesia (AS17451)
114.10.65.118       # Telkom Indonesia (AS7713)
103.236.188.241     # Indonesia
182.10.98.57        # Indonesia
31.56.30.60         # Iran

# MALICIOUS DOMAINS — Cloudflare Pages (brand impersonation)
medi-face.pages.dev
fraise-clinic.pages.dev
jutsu-seribu-bayangan.pages.dev
wewillrockyou.pages.dev

# GAMBLING DESTINATION DOMAINS
bringmetolife.store
terreagoodboy.store

# AFFILIATE IDs (attacker revenue codes)
cSyJDyLy
MKPA2AD00002

# GSC VERIFICATION TOKEN (stolen / unauthorized)
2Z_wOjQcGzVd53eRds3fVWKSAaDsyNsUl7AsNymx4tc

# WEBSHELL FILENAME
fgh.php

# GAMBLING KEYWORDS INJECTED
SULEBET
SANJITOTO
AIRBET88
HIJAUWIN
SBOBET

# ATTACKER ASN
AS17451    # Biznet Networks, Indonesia
AS7713     # Telkom Indonesia

# VICTIM SERVER
REDACTED    # CORESERVER (KDDI Web Communications, Japan)

# C2 CHANNEL
api.telegram.org    # Telegram Bot API used for command & control

# ATTACK DATE
2026-08-12
2026-08-13

# ============================================================
# CLOUDFLARE ABUSE REPORT IDs (for reference/correlation)
# ============================================================
# e2894d9df790acd8  jutsu-seribu-bayangan.pages.dev  [RESTRICTED]
# 93a81a13bdea96a7  wewillrockyou.pages.dev          [RESTRICTED]
# 1d39484ffb8f0eb4  medi-face.pages.dev              [under review]
# b88b484ceeb1828c  fraise-clinic.pages.dev          [under review]

# ============================================================
# NETCRAFT PHISHING REPORT UUIDs
# ============================================================
# dPORnP7rYNAeVqvZgbexk6difZ5ukR7N
# URyTgd5sZ8tjF0ogh2EspK7SdyRz816J
# T8LYWY0a4mDJufjV8OXSYtXwt1uRULbq
# g9paCpR9Ax4g2illbvGPE59qCICGU959

# ============================================================
# LICENSE: CC0 (Public Domain) — Share freely
# ============================================================