Iron Man System + YamStore PhaaS: OTX Pulse Analysis — Global Postal, Bank and Government Lure Infrastructure

Threat Summary

AlienVault OTX pulse data describes a commercial Phishing-as-a-Service ecosystem branded Iron Man System, with YamStore assessed as the licensing/backend component used to sell, activate, and manage criminal deployments. The operation is not a single intrusion set; it is an enabling platform that lets less-skilled buyers stand up convincing lure pages impersonating postal services, banks, government agencies, healthcare portals, telecommunications providers, retailers, and transportation brands. The listed targeting breadth plus tags for banking fraud, postal impersonation, phishing templates, Chinese threat actor communities, and a licensing backend indicate a monetized credential-and-payment-data supply chain rather than bespoke espionage.

The likely attack chain is: criminal buyer purchases or rents access through a Chinese-language community channel, receives a self-hosted kit or panel, deploys it to VPS/container infrastructure, configures lure templates for a target country or sector, seeds links through smishing, email, malicious ads, SEO poisoning, or compromised social accounts, harvests credentials/PII/card data, and either uses the data for fraud or resells it. Infrastructure naming in the IOC sample — api2., bin2., docker.* — is consistent with API endpoints, binary/template delivery, and containerized deployment used to separate victim-facing lure pages from operator backends.

Confidence: high that the listed indicators are associated with the reported PhaaS ecosystem; moderate on exact victim delivery channels until local telemetry confirms clicks, DNS, proxy, or mail events. Treat protonmail.me as suspicious in this context because the pulse associates it with the infrastructure, even though operators frequently abuse lookalike or privacy-forward mail branding in lure workflows.

Threat Actor / Malware Profile

Attribution: Unknown operators; OTX metadata references Chinese threat actor communities and a globally marketed criminal service. The economically motivated model lowers attribution value and raises infrastructure-sharing risk: unrelated customers can reuse the same kit, templates, API patterns, and hosting providers.

Distribution method: Smishing and email lures themed around missed deliveries, customs fees, bank verification, government rebates, healthcare appointments, telecom billing, and retail refunds. Expect shortened URLs, QR codes, localized sender names, compromised WordPress redirectors, and paid search/social ads. Because the kit is self-hosted, each customer can register fresh domains while reusing backend endpoints and templates.

Payload behavior: The payload is usually not an executable on first contact. It is a phishing workflow: cloned login or payment pages, form-grabbing JavaScript, victim fingerprinting, bot filtering, geo/device checks, optional OTP/MFA prompt capture, and staged redirection to the real brand after submission to reduce suspicion. Enterprise risk concentrates in credential reuse, session theft where MFA relay or OTP capture is enabled, payment-card fraud, business email compromise pretexting, and help-desk social engineering using harvested PII.

C2 and backend communication: Victim browsers communicate over HTTPS to lure domains and backend API endpoints. Operators may segregate roles across hostnames such as api2.haoyutai.cc, api2.peaceman.cc, bin2.peaceman.cc, docker.aidchildren.cc, and parent domains including aidchildren.cc, haoeryu.top, loveboy.xyz, peaceman.cc, and haoyutai.cc. Pattern-wise, hunt for TLS sessions to low-reputation domains with POST bodies to /api, /bin, /license, /verify, /collect, /gate, or similarly generic paths, followed by redirects to legitimate postal/bank/government sites.

Persistence mechanism: Persistence is primarily infrastructure-side: reseller accounts, license checks, template updates, domain rotation, Docker/container restart policies, reverse proxies, and backend panels. Endpoint persistence may appear only when a victim is steered into installing a remote-support tool, fake browser update, Android APK, or credential-theft follow-on payload.

Anti-analysis techniques: License gating, buyer-specific builds, server-side bot filtering, ASN/geofencing, short-lived lure domains, CAPTCHAs, Cloudflare or reverse-proxy masking, template obfuscation, disposable containers, and separation between victim pages and administrative API hosts. SOC teams should expect clean pages for sandboxes and real forms only for targeted mobile carriers, countries, or user-agents.

IOC Analysis

The sample is domain/hostname-heavy: loveboy.xyz, protonmail.me, docker.aidchildren.cc, aidchildren.cc, haoeryu.top, api2.haoyutai.cc, api2.peaceman.cc, and bin2.peaceman.cc. There are no file hashes in the provided sample, so detection should not depend on AV signature coverage. Operationalize the indicators as high-severity DNS, web proxy, TLS SNI, and URL intelligence rather than simple IP blocklists, because PhaaS operators rotate front domains quickly and can place backends behind shared hosting or CDN IP space.

Recommended workflow: push domains to DNS protective filtering, secure web gateway, mail secure gateway URL rewrite/click-time protection, EDR network indicators, and SIEM watchlists. Enrich with passive DNS, certificate transparency, WHOIS/registrar history, URLScan, VirusTotal, Shodan/Censys, sandbox detonation with mobile and desktop user-agents, and OTX pulse subscriptions. Expand by pivoting on certificates, favicon hashes, page title similarity, kit ZIP names, /api2 and /bin2 URI structure, reused fonts/assets, and backend response headers. Block at click time where possible; retrospective DNS and proxy hunts should cover at least 30 days and longer for executive, finance, healthcare, telecom, and government-adjacent users.

Detection Engineering

Use these analytics as a starting point and tune to your normal CDN, mail-scanning, and sandbox egress ranges.

---
title: Iron Man YamStore PhaaS IOC DNS Query
id: 9f9f9d10-6f42-4b5b-9b0e-ironmanphaas01
status: experimental
description: Detects DNS queries for domains and hostnames associated with the Iron Man System / YamStore Phishing-as-a-Service ecosystem reported in OTX.
author: Security Arsenal
logsource:
  category: dns
product: windows
level: high
fields:
  - QueryName
  - ClientIP
  - Image
detection:
  selection:
    QueryName|contains:
      - loveboy.xyz
      - protonmail.me
      - aidchildren.cc
      - haoeryu.top
      - haoyutai.cc
      - peaceman.cc
      - api2.haoyutai.cc
      - api2.peaceman.cc
      - bin2.peaceman.cc
      - docker.aidchildren.cc
  condition: selection
falsepositives:
  - Threat intel validation, sandbox detonation, or analyst browsing
  - Security scanners resolving blocklisted domains
references:
  - https://otx.alienvault.com
---
title: Suspicious Download or Container Pull From Iron Man YamStore Infrastructure
id: 2a7c1a20-1d28-4f4c-9e1a-ironmanphaas02
status: experimental
description: Detects command-line retrieval, archive download, Docker activity, or scripting-engine network access referencing Iron Man/YamStore PhaaS indicators.
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
level: high
detection:
  selection_img:
    Image|endswith:
      - powershell.exe
      - pwsh.exe
      - cmd.exe
      - curl.exe
      - wget.exe
      - docker.exe
      - docker-compose.exe
      - mshta.exe
      - rundll32.exe
  selection_cli:
    CommandLine|contains:
      - loveboy.xyz
      - protonmail.me
      - aidchildren.cc
      - haoeryu.top
      - haoyutai.cc
      - peaceman.cc
      - api2.haoyutai.cc
      - api2.peaceman.cc
      - bin2.peaceman.cc
      - docker.aidchildren.cc
      - iwr
      - Invoke-WebRequest
      - curl
      - wget
      - docker pull
      - docker compose
  condition: selection_img and selection_cli
fields:
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Legitimate containers or support tools; validate destination reputation and business purpose
references:
  - https://otx.alienvault.com
---
title: PhaaS Credential Harvest Flow to Low-Reputation API Backend
id: 7c33dd30-8ee9-4c38-a1f0-ironmanphaas03
status: experimental
description: Detects web egress to generic collection paths on newly observed or low-reputation domains consistent with self-hosted phishing kit backends; pair with OTX watchlist for best fidelity.
author: Security Arsenal
logsource:
  category: proxy
level: medium
detection:
  selection_path:
    c-uri|contains:
      - /api/
      - /api2/
      - /bin/
      - /bin2/
      - /collect
      - /license
      - /verify
      - /gate
      - /otp
      - /session
  selection_risk:
    cs-host|contains:
      - .xyz
      - .top
      - .cc
  filter_known:
    cs-host|contains:
      - your-company.com
      - microsoft.com
      - google.com
  condition: selection_path and selection_risk and not filter_known
fields:
  - c-ip
  - cs-host
  - c-uri
  - cs-method
  - sc-bytes
  - cs-user-agent
falsepositives:
  - Startup SaaS domains, marketing endpoints, mobile app APIs
references:
  - https://otx.alienvault.com

let Lookback = 30d;
let IOCs = dynamic(["loveboy.xyz","protonmail.me","aidchildren.cc","haoeryu.top","haoyutai.cc","peaceman.cc","api2.haoyutai.cc","api2.peaceman.cc","bin2.peaceman.cc","docker.aidchildren.cc"]);
let Net = DeviceNetworkEvents
| where Timestamp >= ago(Lookback)
| where RemoteUrl has_any (IOCs) or tostring(AdditionalFields) has_any (IOCs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType, AdditionalFields;
let Proc = DeviceProcessEvents
| where Timestamp >= ago(Lookback)
| where ProcessCommandLine has_any (IOCs) or FileName in~ ("powershell.exe","pwsh.exe","cmd.exe","curl.exe","wget.exe","docker.exe","mshta.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256;
union Net, Proc
| extend IndicatorHit = iif(tostring(RemoteUrl) has_any (IOCs) or tostring(ProcessCommandLine) has_any (IOCs) or tostring(AdditionalFields) has_any (IOCs), "OTX-IronMan-YamStore", "SuspiciousProcess")
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Hits=count(), Devices=dcount(DeviceName) by DeviceName, AccountName=coalesce(InitiatingProcessAccountName, AccountName), FileName=coalesce(InitiatingProcessFileName, FileName), CommandLine=coalesce(InitiatingProcessCommandLine, ProcessCommandLine), RemoteUrl, RemoteIP, IndicatorHit
| order by LastSeen desc

#!/usr/bin/env bash
set -euo pipefail
IOCS='loveboy.xyz protonmail.me aidchildren.cc haoeryu.top haoyutai.cc peaceman.cc api2.haoyutai.cc api2.peaceman.cc bin2.peaceman.cc docker.aidchildren.cc'
OUT="ironman_yamstore_hunt_$(date +%Y%m%d_%H%M%S).txt"
echo '[+] Resolving OTX IOCs' | tee "$OUT"
for d in $IOCS; do
  getent hosts "$d" 2>/dev/null | sed "s/^/DNS:$d:/" | tee -a "$OUT" || true
done
echo '[+] Recent established and listening sockets matching resolved IOC addresses' | tee -a "$OUT"
IPS=$(awk -F: '/^DNS:/{print $3}' "$OUT" | awk '{print $1}' | sort -u | tr '\n' '|' | sed 's/|$//')
if command -v ss >/dev/null 2>&1; then ss -antup 2>/dev/null | grep -E "$IPS" | tee -a "$OUT" || true; else netstat -antup 2>/dev/null | grep -E "$IPS" | tee -a "$OUT" || true; fi
echo '[+] Hosts file and local resolver artifacts' | tee -a "$OUT"
grep -E "$(echo $IOCS | tr ' ' '|')" /etc/hosts 2>/dev/null | tee -a "$OUT" || true
(resolvectl statistics 2>/dev/null || systemd-resolve --statistics 2>/dev/null || true) | tee -a "$OUT"
echo '[+] Container and compose exposure' | tee -a "$OUT"
if command -v docker >/dev/null 2>&1; then
  docker ps --format '{{.Names}} {{.Image}} {{.Ports}} {{.Command}}' 2>/dev/null | tee -a "$OUT" || true
  docker images --format '{{.Repository}} {{.Tag}} {{.CreatedAt}}' 2>/dev/null | grep -Ei 'iron|yam|phish|panel|license|nginx|apache|caddy' | tee -a "$OUT" || true
fi
echo '[+] Web roots, cron, and systemd timers' | tee -a "$OUT"
grep -RInE "$(echo $IOCS | tr ' ' '|')" /var/www /srv /opt /etc/nginx /etc/apache2 /etc/caddy 2>/dev/null | tee -a "$OUT" || true
crontab -l 2>/dev/null | tee -a "$OUT" || true
ls -l /etc/cron.d /etc/cron.daily /etc/cron.hourly 2>/dev/null | tee -a "$OUT" || true
systemctl list-timers --all 2>/dev/null | grep -Ei 'docker|compose|nginx|apache|caddy|php|certbot' | tee -a "$OUT" || true
echo '[+] Recently modified web and archive artifacts' | tee -a "$OUT"
find /var/www /srv /opt /tmp /home -maxdepth 4 -type f \( -iname '*.zip' -o -iname '*.tar.gz' -o -iname '*.php' -o -iname '*.js' \) -mtime -14 2>/dev/null | head -300 | tee -a "$OUT"
echo "[+] Hunt output written to $OUT"

Response Priorities

Immediate: Add all listed domains/hostnames to DNS protection, secure web gateway, mail gateway click-time URL defense, EDR custom indicators, and SIEM watchlists. Block categories for newly registered domains, .cc/.top/.xyz where policy permits, and known postal/bank impersonation kits. Hunt 30 days of DNS, proxy, TLS SNI, mail URL clicks, and EDR network events. Preserve pcaps and proxy logs for any user who reached api2., bin2., docker.*, or parent domains. Reset sessions and credentials for users who submitted data, even if the endpoint shows no malware.

24 hours: Because this is credential/payment harvesting infrastructure, prioritize identity verification over host reimaging unless a follow-on payload is confirmed. Force password resets for exposed users, revoke OAuth grants and refresh tokens, invalidate cookies/sessions, check MFA registration changes, mailbox rules, forwarding, unusual sign-ins, impossible travel, SIM-swap signals for telecom users, and card-not-present fraud alerts for finance/retail. Contact abuse teams, registrars, hosting providers, and relevant national CERT/ISAC channels with observed lure URLs and screenshots.

1 week: Harden the phishing surface rather than only blocking domains. Enforce phishing-resistant MFA for email, VPN, IdP, finance, healthcare, telecom admin, and remote access; deploy conditional access and token binding where possible; restrict legacy auth; tighten DMARC/DKIM/SPF and lookalike-domain monitoring; enable safe-links click isolation for high-risk users; add browser isolation for unknown categories; alert on OTP prompts on non-corporate domains; create detections for Docker/container installation outside approved build paths and for web roots spawning curl/wget/package managers; run targeted awareness for delivery-fee, customs, benefits, invoice, and appointment lures in the languages used by your workforce.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub