{
  "metadata": {
    "generator": "Bulwark Black IOC Extractor",
    "source": "https://bulwarkblack.com/apt29-poisoned-source-mobile-watering-holes-session-recovery/",
    "fang": "live",
    "exported_at": "2026-11-04T10:14:09Z",
    "total": 56,
    "categories": 6
  },
  "iocs": {
    "IPv4": [
      "109.104.106.107",
      "188.190.17.232",
      "192.121.46.25",
      "195.58.140.105",
      "95.133.231.28"
    ],
    "ASN": [
      "AS219399",
      "AS395092",
      "AS57169",
      "AS9009"
    ],
    "Domains": [
      "a.plerdy.com",
      "ad.starx-net.com",
      "ads-it-assets.com",
      "adsprism-stat.com",
      "america250.holiday",
      "america250.org",
      "assets-int.com",
      "cdn.adv-static.com",
      "clouds-stacks.com",
      "edge-ord.clouds-stacks.com",
      "flux-telemetry.com",
      "plerdy.com",
      "starx-net.com",
      "static.flux-telemetry.com",
      "theowo.club",
      "wpvortex-mod.com"
    ],
    "URLs": [
      "https://a.plerdy.com/public/js/click/main.js",
      "https://ad.starx-net.com/api/",
      "https://ad.starx-net.com:8881/telemetry/v12",
      "https://edge-ord.clouds-stacks.com/module/5b4c8fea5cbcee273e8d830f52-temfp.js",
      "https://static.flux-telemetry.com/api/uGmlx2pmMHU1jq7wZU2QWgeC28vbXalf/v1",
      "https://static.flux-telemetry.com/module/5b4c8fea5cbcee273e8d830f52-temfp.js"
    ],
    "sha256": [
      "06c17b31d36838f3d29044784aa047d5c2d9174d3356c1211cf25f9df677445f",
      "183d62d682aea8018491c8559544e8d6a9ab0e1abd05ecbb6c97daa4f438d2b8",
      "29d283ebd08d0cd3b2e6f4a67718d3d6e7a6be01d0613d716bce218dba57a928",
      "2ffb35e3f9e55286a930fb887e73764a913166648135fe0ca7551736d97d7bfa",
      "35c0cd19a7334b544c193e392bcd9a8f1d1f43cf6b61be5bf1d9e35537aff2ef",
      "387a7fb768db1350a9788d9704e7a72abe07152734e0ff026af72b417e36268c",
      "41e6fd33a30d36dabff9ea408d9766a6583edcc107968f6dc1499f2586381967",
      "621112712ec515e8791129c62feda8fff6654a0116882401609503cacc08054a",
      "69b6cb327a4d5da99399718f6a66f84de69f89425b0a31f2dcee0682f811596f",
      "a7d2493df00565c21587b0cad2a9fe7ca1e5590acf796da6e499be0ffde44cc3",
      "ae3241d96cc2d99538c7aff60f382cc8dac13859bcbea3ee84992d24d22a8108",
      "bee3e014e3df87ddce0250b0985b87f6868a427a7b650a74b7ffedb9d57f3088",
      "c170fda024183645c0aa681149304e50506509c3498bb6b9a5f5ced6aa73e5fa"
    ],
    "CVEs": [
      "CVE-2024-27808",
      "CVE-2024-27833",
      "CVE-2024-27834",
      "CVE-2025-14174",
      "CVE-2025-24201",
      "CVE-2025-27038",
      "CVE-2025-31277",
      "CVE-2025-43510",
      "CVE-2025-43520",
      "CVE-2025-43529",
      "CVE-2026-20700",
      "CVE-2026-3910"
    ]
  }
}