import "hash"

rule bulwark_https_bulwarkblack_com_internet_scanning_open_ports_threat_intel_pivots
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/internet-scanning-open-ports-threat-intel-pivots/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-10-09T20:06:07Z"
        tlp = "TLP:CLEAR"
        indicator_count = "20"
    strings:
        $s0 = "b4ck.my" ascii wide nocase  // Domains
        $s1 = "grabber.cy" ascii wide nocase  // Domains
        $s2 = "lumma.cy" ascii wide nocase  // Domains
        $s3 = "https://5.175.221.206:8443/" ascii wide nocase  // URLs
        $s4 = "157.254.194.31" ascii wide nocase  // IPv4
        $s5 = "167.148.41.164" ascii wide nocase  // IPv4
        $s6 = "185.14.92.162" ascii wide nocase  // IPv4
        $s7 = "185.14.92.223" ascii wide nocase  // IPv4
        $s8 = "185.146.232.3" ascii wide nocase  // IPv4
        $s9 = "45.87.41.133" ascii wide nocase  // IPv4
        $s10 = "5.175.221.206" ascii wide nocase  // IPv4
        $s11 = "51.89.199.118" ascii wide nocase  // IPv4
        $s12 = "51.89.199.125" ascii wide nocase  // IPv4
        $s13 = "54.37.237.164" ascii wide nocase  // IPv4
        $s14 = "54.37.237.166" ascii wide nocase  // IPv4
        $s15 = "64.111.92.89" ascii wide nocase  // IPv4
        $s16 = "91.219.237.110" ascii wide nocase  // IPv4
        $s17 = "96.9.125.59" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "29f69693228c27033209532b5a6a97d1" or
        hash.md5(0, filesize) == "3a85f1d2131fa2723ac6ade171eafacd"
}