highPhishing

Malware Intelligence Report

PublishedMarch 12, 2026

Threat Actors:Infrastructure-attribution cluster.

phishingagentteslac2aptspearphishing

Classification: TLP:AMBER Report Date: 2026-03-12 Analyst: fgbot Sample Reporter: abuse_ch

Executive Summary

This report documents a multi-stage AgentTesla credential-stealing campaign delivered via a heavily obfuscated JScript dropper disguised as a business "Request for Quote" document. The infection chain consists of four stages: a JScript dropper, an embedded PowerShell decryptor, a .NET reflective loader (DEV.dll), and the AgentTesla v3 final payload. The malware exfiltrates credentials, keystrokes, and clipboard data to an attacker-controlled SMTP server hosted in Ukraine. The operator exhibits low operational security, with plaintext credentials hardcoded in the payload and self-signed TLS certificates on the C2 mail server.

Sample Metadata

Field	Value
SHA256	eba6c85e9ad11c6457780c7edfd5cc5807d8b88d0edb76866fd39540c4678361
MD5	f49c10a3bd04f2f0312773be0cd9ea53
SHA1	26ae4e519f01347f5ffe13743c4e3e75f69cd46c
Submitted Filename	Request for quote 77060.js
Stored Filename	f49c10a3bd04f2f0312773be0cd9ea53.js
File Type	ASCII text / JScript
File Size	1,343,328 bytes (1.3 MB)
First Seen	2026-03-12 17:17:58 UTC
VT Detections	22/76

Antivirus Detections (Selected)

Engine	Detection Name
McAfeeD	AgentTesla.AC
ESET	JS/TrojanDropper.Agent.QAW
BitDefender	JS:Trojan.Cryxos.15791
ALYac	JS:Trojan.Cryxos.15791
GData	JS:Trojan.Cryxos.15791
Fortinet	JS/Formbook.JAE!tr
Kaspersky	HEUR:Trojan-Downloader.Script.Generic

Infection Chain Overview

The malware uses a four-stage infection chain designed to frustrate static analysis and sandboxing. Each stage decrypts or reflectively loads the next, maintaining only a minimal footprint on disk at each step.

Stage 0: JScript Dropper (.js, 1.3MB)
    └─> Stage 1: PowerShell Decryptor (.ps1, ~980KB, embedded in JS)
            └─> Stage 2: .NET Reflective Loader (DEV.dll, 47KB, embedded in PS1)
                    └─> Stage 3: AgentTesla Final Payload (240KB .NET PE, injected)

Stage 0: Initial JScript Dropper

File: f49c10a3bd04f2f0312773be0cd9ea53.js (submitted as "Request for quote 77060.js") Size: 1,343,328 bytes

Obfuscation Technique

The JScript dropper is heavily obfuscated using a string-array rotation technique broadly similar to that produced by obfuscation tools in the ObfuscatorIO family. Key characteristics:

565-entry rotation string table stored in var AR=[...] — a large array of encoded strings that the runtime decodes on demand.
String decoder function r() performs index arithmetic against the rotation table.
String lookup function A() wraps r() to resolve all string references at execution time, preventing static string extraction from source alone.
Initializer function C() seeds the rotation state prior to any payload execution.

COM Object References

The dropper references the following COM/ActiveX objects, indicating its environmental requirements and capabilities:

COM ProgID	Purpose
`WScript.Shell`	Command execution, registry write, shortcut creation
`ADODB.Stream`	Binary file I/O for writing embedded payloads
`MSXML2.DOMDocument`	XML/base64 parsing utility
`PowerShell`	Stage 1 PS1 execution
`VBScript.RegExp`	String manipulation during deobfuscation

Execution Flow

C() initializes the string rotation table.
A() / r() decode all runtime strings on demand.
ExecutePayload() orchestrates the following actions:
- Writes the embedded Stage 1 PowerShell script to a .ps1 file in %TEMP%.
- Launches PowerShell with -ExecutionPolicy Bypass -NonInteractive -WindowStyle Hidden via WScript.Shell.
- Creates a .lnk shortcut in the Windows Startup folder for persistence.
- Writes a registry Run key (HKCU\...\Run\GLOZVJ) pointing to the installed payload.

The dropper's large file size (1.3 MB) is primarily attributable to the embedded, base64-encoded Stage 1 PowerShell script (~980 KB).

Stage 1: Multi-Stage PowerShell Decryptor

Embedded in: Stage 0 JScript string table (base64-encoded) Decoded size: ~980 KB Type: PowerShell script

Description

The PowerShell script includes the comment header "Multi-Stage Rotational XOR Decryption Framework", a deliberate naming convention that describes its own architecture. It implements a five-sub-stage decryption pipeline:

Sub-Stage	Variable / Component	Role
1	`$securecontainer`	Holds the encrypted binary blob (~962 KB, base64-encoded)
2	Base64 reconstruction module	Decodes `$securecontainer` into raw bytes
3	Rotational XOR decryptor	Applies key-rotating XOR cipher to produce the Stage 2 PE
4	`$masterdecoder`	Orchestrates sub-stages 2 and 3
5	`$executionhandler`	Invokes the resulting PE in memory via `Invoke-Expression`

Rotational XOR Cipher

The XOR decryption algorithm uses a rotating key position rather than a simple repeating XOR. The key position for each byte is computed as:

keyPosition     = (bytePos + rotationTracker) % keyLen
rotationTracker = (rotationTracker + key[keyPosition]) % 7

This rotation means that the effective key byte applied to each ciphertext byte depends on all preceding decryption state, making brute-force keyspace attacks without the full key impractical.

XOR Key Material

Encoding	Value
Base64	`VRbDCXBbSgCtUEyICdn420qmiFD2vr/A6GgKzTP1sE4=`
Hex	`5516c309705b4a00ad504c8809d9f8db4aa68850f6bebfc0e8680acd33f5b04e`

Stage 2: .NET Reflective Loader (DEV.dll)

Size: 47 KB Format: PE32 .NET DLL PE Sections: 4 Assembly GUID: ef3c7d6a-da4e-4ac2-9b35-d57b6ca04251

Identification

Attribute	Value
Namespace	`DEV`
Class	`DOWN`
Entry Method	`SHOOT`

The loader is a compact .NET DLL whose sole purpose is to inject the Stage 3 AgentTesla payload into a host process using reflective loading techniques.

Injection Mechanism

Uses LoadLibraryA and GetProcAddress via P/Invoke to locate shellcode execution primitives in native Windows DLLs.
The DEV.DOWN.SHOOT method orchestrates process-hollowing into the injection target.
Injection target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe — a legitimate signed Microsoft .NET utility chosen to blend in with normal system activity.

Persistence Monitoring

The loader implements a Start-MonitoringCycle loop that polls for the presence of the Aspnet_compiler.exe process every 5 seconds. If the process is not found (e.g., killed by the user or an AV product), the loader re-injects the payload automatically. This watchdog mechanism significantly complicates manual remediation.

Stage 3: AgentTesla Final Payload

Size: 240 KB Format: PE32 GUI .NET assembly PE Sections: 3 Assembly GUID: db0ffc43-fde8-4e4a-8ebf-2d30cae27e9c Delivery: Process-hollowed into Aspnet_compiler.exe

Overview

AgentTesla is a commercially sold and widely-distributed .NET-based information stealer and keylogger, operating as Malware-as-a-Service (MaaS). This sample is consistent with AgentTesla v3 with SMTP exfiltration mode. The payload was fully decompiled via ILSpyCMD, allowing complete extraction of configuration and capability data.

AgentTesla Configuration (Extracted)

The following configuration values were extracted directly from the decompiled .NET assembly:

Parameter	Value
EnableKeylogger	True
EnableClipboardLogger	True
EnableScreenLogger	False
EnableTorPanel	False
EnableCookies	False
EnableContacts	False
DeleteBackspace	False
KeyloggerInterval	20 minutes
ScreenInterval	20 minutes
LogType	1
SmtpSSL	False
SmtpPort	587
SmtpAttach	False
SmtpServer	mail.cottondreams.org
SmtpSender	paid@cottondreams.org
SmtpPassword	Payday2025
SmtpReceiver	receive1@cottondreams.org
AppAddStartup	False
StartupEnvName	appdata
StartupDirectoryName	GLOZVJ
StartupInstallationName	GLOZVJ.exe
StartupRegName	GLOZVJ
PublicUserAgent	Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0

Note: Startup persistence is configured within the payload but AppAddStartup is set to False, indicating the JS dropper (Stage 0) handles persistence independently via the LNK and registry Run key mechanisms described above.

Capabilities

Keylogging

AgentTesla installs a low-level keyboard hook (WH_KEYBOARD_LL) to capture all keystrokes system-wide. Captured keystrokes are buffered and transmitted every 20 minutes via SMTP. Email subject prefix: KL.

Clipboard Monitoring

The payload registers as a clipboard viewer using SetClipboardViewer / ChangeClipboardChain to intercept clipboard contents continuously. Clipboard data is included in exfiltration emails.

Screen Capture

Screen capture capability (CopyFromScreen) is present in the compiled code but disabled in this sample configuration (EnableScreenLogger = False). Email subject prefix when active: SC.

Credential Stealing

The payload targets a broad range of credential stores. Stolen credentials are packaged and emailed with subject prefix PW.

Chromium-Based Browsers

Chrome, Edge Chromium, Chromium, Opera, Vivaldi, Brave, Yandex Browser, Coccoc, Torch, Kometa, Orbitum, Coowon, Sputnik, Uran, Sleipnir 6, Elements Browser, 360 Browser, Liebao Browser

Mozilla-Based Browsers

Firefox, Waterfox, CyberFox, PaleMoon, K-Meleon, Postbox, Flock, Thunderbird

Legacy / Other Browsers

Internet Explorer, Microsoft Edge Legacy, UC Browser, Safari for Windows, QQ Browser, Falkon Browser

Email Clients

Microsoft Outlook (Office versions 11 through 16), Foxmail, Opera Mail, eM Client, IncrediMail, Eudora

FTP Clients

FileZilla (via recentservers.xml), CoreFTP, WinSCP, FlashFXP, FTP Navigator, SmartFTP, WS_FTP (3DES-encrypted credentials), FTP Commander, FTPGetter

VPN Clients

OpenVPN, NordVPN

Messaging / Token Theft

Discord (session token extraction from local storage files)

Victim Fingerprinting

Prior to exfiltration, the payload collects the following victim system information and includes it in each email:

Computer name
Public IP address (via IpApi geolocation service)
Operating system version

Anti-Analysis Techniques

Technique	Description
Process injection	Payload runs inside signed `Aspnet_compiler.exe`, not standalone
Multi-layer obfuscation	Four-stage chain: JS → PS1 → .NET loader → .NET payload
Process watchdog	Re-injection if `Aspnet_compiler.exe` is terminated
TLS version permissiveness	TLS 1.0, 1.1, and 1.2 all enabled; certificate validation bypassed
In-memory execution	Stages 1–3 never written to disk as standalone files

C2 Infrastructure

Primary Domain: cottondreams.org

Attribute	Value
Resolves To	31.222.235.198
Country	Ukraine (Kyiv)
ASN	AS202302
ISP / Org	NETH LLC
Registrar	NameCheap, Inc.
Domain Created	2024-03-24
Domain Expires	2026-03-24
Nameservers	cosmin.ns.cloudflare.com, jacqueline.ns.cloudflare.com
SPF Record	`v=spf1 ip4:31.222.235.198 ~all`
MX Record	mail.cottondreams.org (priority 10)
VT Reputation	Malicious (CRDF, CyRadar, Forcepoint, Fortinet:spam, Seclookup, Webroot, alphaMountain)

The domain was registered approximately two years before the sample was first observed, suggesting either long-term infrastructure investment or repurposed hosting.

Open Services on 31.222.235.198 (Shodan)

Port	Protocol	Service	Notable Details
21/tcp	FTP	ProFTPD	"220 ProFTPD Server (Debian)"
22/tcp	SSH	OpenSSH 8.9p1	Ubuntu 3ubuntu0.13
25/tcp	SMTP	Exim 4.95	STARTTLS; fake cert (CN=etc, O=CompanyName, C=EE)
80/tcp	HTTP	nginx 1.28.0	FASTPANEL default hosting page
110/tcp	POP3	Dovecot	CN=dedaGLmj.netx.com.ua
143/tcp	IMAP	Dovecot	CN=dedaGLmj.netx.com.ua
443/tcp	HTTPS	nginx 1.28.0	FASTPANEL (CN=parking, O=FASTPANEL)
465/tcp	SMTPS	Exim 4.95	SSL; fake cert
587/tcp	SMTP/STARTTLS	Exim 4.95	Active C2 exfiltration port
993/tcp	IMAPS	Dovecot	CN=dedaGLmj.netx.com.ua
995/tcp	POP3S	Dovecot	CN=dedaGLmj.netx.com.ua
7777/tcp	HTTP	nginx	Web panel / application
8888/tcp	HTTP	nginx	302 redirect

Operator OPSEC Failures

The operator demonstrated several significant operational security failures:

Hardcoded SMTP credentials in plaintext. The password Payday2025 is stored unencrypted in the .NET PE and is extractable without executing the sample in a sandbox — any static .NET decompiler recovers it directly.
Fake TLS certificates on mail server. Ports 25, 465, and 587 on the C2 host present a self-signed certificate with placeholder values (C=EE, CN=etc, L=Tallinn, O=CompanyName), a clear network indicator detectable by TLS inspection tools.
Dovecot SSL certificate leaks alternate hostname. The IMAP/POP3 services (ports 110, 143, 993, 995) present a certificate with CN=dedaGLmj.netx.com.ua, revealing an alternate hostname on the same IP that can be used for pivot searches and attribution.
FASTPANEL hosting control panel exposed. The nginx default page on ports 80 and 443 is the FASTPANEL web hosting control panel with no domain configured, confirming the server is a rented VPS on Ukrainian hosting infrastructure with minimal hardening.

Indicator	Type	Notes
dedaGLmj.netx.com.ua	Hostname	Alternate hostname on 31.222.235.198, leaked via Dovecot SSL cert
netx.com.ua	Domain	Ukrainian hosting provider domain

VirusTotal pivot on 31.222.235.198 reveals at least 10 additional malware samples communicating with this infrastructure, including filenames: advise invoice P100186803.exe, CRYPTED.exe, Anglophile.exe, wbt7azg.exe. These are consistent with ongoing AgentTesla SMTP exfiltration campaigns operated from the same server.

MITRE ATT&CK Mapping

Technique ID	Name	Implementation
T1566.001	Phishing: Spearphishing Attachment	JS file delivered as "Request for quote" lure targeting procurement/finance
T1059.007	Command and Scripting Interpreter: JavaScript	JScript dropper (Stage 0)
T1059.001	Command and Scripting Interpreter: PowerShell	PowerShell launched with `-ExecutionPolicy Bypass -WindowStyle Hidden`
T1140	Deobfuscate/Decode Files or Information	Multi-stage base64 + rotational XOR decryption pipeline
T1027	Obfuscated Files or Information	565-entry string-array rotation obfuscation in JScript
T1027.002	Obfuscated Files or Information: Software Packing	Base64-encoded PE embedded within PS1 script
T1055	Process Injection	Reflective .NET injection into `Aspnet_compiler.exe`
T1055.004	Process Injection: Asynchronous Procedure Call	`DEV.DOWN.SHOOT` method using `LoadLibraryA` / `GetProcAddress`
T1547.001	Boot or Logon Autostart Execution: Registry Run Keys	`HKCU\...\Run\GLOZVJ`
T1547.009	Boot or Logon Autostart Execution: Shortcut Modification	LNK shortcut written to Startup folder
T1056.001	Input Capture: Keylogging	`WH_KEYBOARD_LL` low-level keyboard hook
T1115	Clipboard Data	`SetClipboardViewer` / `ChangeClipboardChain`
T1113	Screen Capture	`CopyFromScreen` present but disabled in this build
T1555.003	Credentials from Password Stores: Web Browser	Chromium and Mozilla-based browser credential extraction
T1555	Credentials from Password Stores	Email client and FTP client credential extraction
T1552.001	Unsecured Credentials: Credentials in Files	FTP client configuration file parsing (e.g., FileZilla `recentservers.xml`)
T1041	Exfiltration Over C2 Channel	SMTP exfiltration to receive1@cottondreams.org
T1071.003	Application Layer Protocol: Mail Protocols	SMTP on port 587 to mail.cottondreams.org
T1082	System Information Discovery	Enumerates OS version and computer name
T1614	System Location Discovery	Public IP geolocation via IpApi
T1057	Process Discovery	`Get-Process Aspnet_compiler` watchdog check

Campaign Context

Attribute	Assessment
Lure Theme	Business Email Compromise (BEC) — purchase order / request for quotation
Target Demographic	Procurement, finance, and supply-chain personnel
File Naming Convention	"Request for quote [number].js" — implies mass or semi-targeted distribution
First Observation	2026-03-12 (this sample)
Domain Registration	2024-03-24 — infrastructure nearly two years old
Campaign Scale	10+ additional malware samples using same C2 IP
Business Model	Likely AgentTesla Malware-as-a-Service (MaaS) purchase with operator-supplied SMTP credentials

The campaign follows a well-established pattern for AgentTesla deployment: a socially-engineered email attachment impersonating a business document triggers a multi-stage dropper chain that ultimately installs a credential stealer configured to exfiltrate data via SMTP to an attacker-controlled mailbox. The use of Cloudflare nameservers for the C2 domain provides some degree of IP concealment for DNS lookups, though the actual mail server IP is hardcoded in the payload configuration.

Attribution

Attribute	Assessment
Confidence Level	MEDIUM
Threat Actor Type	Financially motivated cybercriminal
Suspected Origin	Likely Nigerian/West African BEC actor based on campaign patterns (lure themes, tooling); infrastructure is Ukraine-hosted
MaaS Operator	Unknown — purchased or leased AgentTesla builder
Infrastructure Host	NETH LLC, Ukraine (AS202302) — low-cost hosting frequently abused by threat actors
OPSEC Level	LOW — plaintext credentials in payload, fake TLS certificates, minimal infrastructure hardening
Campaign Name	Unattributed — consistent with AgentTesla v3 SMTP exfiltration campaigns

Indicators of Compromise (IOCs)

File Hashes

Type	Hash
SHA256	eba6c85e9ad11c6457780c7edfd5cc5807d8b88d0edb76866fd39540c4678361
MD5	f49c10a3bd04f2f0312773be0cd9ea53
SHA1	26ae4e519f01347f5ffe13743c4e3e75f69cd46c

Network Indicators

Indicator	Type	Role
cottondreams.org	Domain	C2 / mail server domain
mail.cottondreams.org	Hostname	SMTP C2 exfiltration endpoint
31.222.235.198	IPv4	C2 infrastructure IP (Ukraine, AS202302, NETH LLC)
paid@cottondreams.org	Email address	SMTP sender (attacker-controlled)
receive1@cottondreams.org	Email address	SMTP receiver (attacker inbox)

Encryption and Authentication Material

Type	Value
XOR Key (Base64)	`VRbDCXBbSgCtUEyICdn420qmiFD2vr/A6GgKzTP1sE4=`
XOR Key (Hex)	`5516c309705b4a00ad504c8809d9f8db4aa68850f6bebfc0e8680acd33f5b04e`
SMTP Credential	`paid@cottondreams.org` / `Payday2025`

Host-Based Indicators

Indicator	Type	Details
`%APPDATA%\GLOZVJ\GLOZVJ.exe`	File path	Persistence installation location
`GLOZVJ`	Registry value	`HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GLOZVJ`
`Aspnet_compiler.exe`	Process name	Injection host process (`C:\Windows\Microsoft.NET\Framework\v4.0.30319\`)
`%TEMP%\*.ps1`	File path pattern	Stage 1 PowerShell dropper written to disk
`%TEMP%\log.tmp`	File path	Keylogger buffer file
`ef3c7d6a-da4e-4ac2-9b35-d57b6ca04251`	.NET Assembly GUID	DEV.dll (Stage 2 reflective loader)
`db0ffc43-fde8-4e4a-8ebf-2d30cae27e9c`	.NET Assembly GUID	AgentTesla payload (Stage 3)

Unique Strings

String	Location	Significance
`Payday2025`	Stage 3 .NET config	SMTP authentication password
`GLOZVJ`	Stage 3 .NET config	Installation / persistence directory and registry name
`Multi-Stage Rotational XOR Decryption Framework`	Stage 1 PS1 comment header	Unique string for YARA / memory detection
`DEV.DOWN.SHOOT`	Stage 2 .NET method signature	Unique .NET method path for detection

Detection and Response Guidance

Network-Based Detection

Block or alert on SMTP connections to mail.cottondreams.org / 31.222.235.198:587.
Alert on TLS certificates with CN=etc, O=CompanyName, C=EE on SMTP ports (indicator of fake cert on attacker mail server).
Monitor for DNS queries to cottondreams.org or dedaGLmj.netx.com.ua.

Endpoint-Based Detection

Alert on WScript.exe spawning powershell.exe with -ExecutionPolicy Bypass -WindowStyle Hidden.
Monitor for .ps1 file creation in %TEMP% followed by PowerShell execution.
Detect new .lnk files appearing in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\.
Alert on registry write to HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run with value name GLOZVJ.
Monitor Aspnet_compiler.exe for unusual network activity or parent processes other than .NET tooling.
File creation at %APPDATA%\GLOZVJ\GLOZVJ.exe is a high-confidence indicator of compromise.

YARA Detection Opportunities

String "Multi-Stage Rotational XOR Decryption Framework" in PowerShell scripts or memory.
.NET assembly GUID ef3c7d6a-da4e-4ac2-9b35-d57b6ca04251 (DEV.dll loader).
.NET assembly GUID db0ffc43-fde8-4e4a-8ebf-2d30cae27e9c (AgentTesla payload).
String "DEV.DOWN.SHOOT" in memory or file scans.
Combination of "GLOZVJ" and "cottondreams.org" in the same PE.

Remediation Steps

Isolate the affected host immediately.
Terminate Aspnet_compiler.exe processes not originating from legitimate .NET compilation workflows.
Delete %APPDATA%\GLOZVJ\GLOZVJ.exe and the GLOZVJ directory.
Remove the registry Run key HKCU\...\Run\GLOZVJ.
Remove any .lnk files from the Startup folder not placed by the user.
Delete any *.ps1 files from %TEMP%.
Rotate all credentials for browsers, email clients, FTP clients, and VPN clients stored on the affected system — assume all were exfiltrated.
Notify affected users and review inbound email filtering for .js attachments.

References

VirusTotal: SHA256 eba6c85e9ad11c6457780c7edfd5cc5807d8b88d0edb76866fd39540c4678361
Abuse.ch reporter submission, 2026-03-12
Shodan host report for 31.222.235.198
ILSpyCMD decompilation of Stage 3 .NET assembly
MITRE ATT&CK: https://attack.mitre.org/

Infrastructure Pivot: Extended Actor Infrastructure

Co-Hosted Domains on 31.222.235.198 (Active Pivots)

Domain	Registration	Status	Notes
`cottondreams.org`	NameCheap / Cloudflare	ACTIVE C2	Primary SMTP C2
`gunsaldi.com`	NameCheap / Cloudflare	MALICIOUS	Same registrar+NS combo; detected by CyRadar, Fortinet:spam, Seclookup
`stackscripts.store`	Unknown	Currently clean	Co-hosted; likely related
`bulpoonl.top`	Unknown	Unscanned	.top TLD, suspicious name

Key finding: cottondreams.org and gunsaldi.com share identical registrar (NameCheap) and identical Cloudflare nameservers (cosmin.ns.cloudflare.com, jacqueline.ns.cloudflare.com), which is a strong actor-attribution cluster.

Historical IP Addresses for cottondreams.org

Date (approx)	IP	ASN	Organization	Country	Notes
2026-03-12	31.222.235.198	AS202302	NETH LLC	Ukraine	Current C2
2026-01-xx	5.252.153.82	Unknown	Unknown	Unknown	Migration hop
2025-10-xx	83.217.209.216	AS205775	Neon Core Network LLC	Russia	Russian VPS
2025-01-xx	209.172.2.100	AS19853	OrangeHost	USA	US hosting
2024-10-xx	46.175.145.195	Unknown	Unknown	Unknown	Migration hop
2024-10-xx	46.175.145.91	Unknown	Unknown	Unknown	Migration hop
2024-10-xx	91.219.60.131	Unknown	Unknown	Unknown	Migration hop
2024-04-xx	163.123.181.69	AS33387	Nocix LLC	USA	US hosting
2024-03-xx	165.73.244.93	AS40676	Psychz Networks	USA	US hosting
2024-03-xx	194.61.52.186	AS202302	NETH LLC	Ukraine	Same ISP as current

Pattern: The operator consistently returns to NETH LLC (Ukraine, AS202302) hosting. Migration from US/Russian VPS to Ukrainian infrastructure. Domain has been active since March 2024.

NETH LLC / AS202302 Infrastructure Significance

AS202302 (NETH LLC, Kyiv, Ukraine) is a bulletproof/permissive hosting provider frequently cited in abuse reports
The domain cottondreams.org has been using this ASN since the domain's registration in March 2024
dedaGLmj.netx.com.ua — alternate hostname on same server, leaked via Dovecot SSL certificate; netx.com.ua is a Ukrainian web hosting brand
The server runs FASTPANEL control panel, typical of cheap shared Ukrainian VPS hosting

Report generated: 2026-03-12 | TLP:AMBER — share only with members of your organization and trusted partners