# Bulwark Black - extracted indicators
# LIVE indicators

## IPv4 (6)
104.194.159.150
107.189.26.194
213.145.86.112
31.57.243.154
38.146.28.132
38.146.28.75

## Domains (14)
cloudflarecp.com
cloudflareok.com
cloudflareportal.com
connectivity.cloudflareclient.com
detectportal.brave-http-only.com
detectportal.firefox.com
m365-owa.com
ms365-device.com
ms365-live.com
msftconnecttest.com
msftncsi.com
nmcheck.gnome.org
owa-ms365.com
www.volexity.com

## URLs (8)
https://213.145.86.112/cdn/chunks/polyfill-7e2b.min.js
https://213.145.86.112/t/event
https://213.145.86.112/t/pixel.gif
https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication
m365-owa.com
ms365-device.com
ms365-live.com
owa-ms365.com

## sha256 (2)
918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593
be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c