{
  "metadata": {
    "generator": "Bulwark Black IOC Extractor",
    "source": "https://bulwarkblack.com/offerloader-ppi-commodity-malware-funnel-aware-defense/",
    "fang": "live",
    "exported_at": "2026-09-09T15:08:01Z",
    "total": 332,
    "categories": 3
  },
  "iocs": {
    "Domains": [
      "5.xxx.xx.xxx",
      "aa.amazingshield.xyz",
      "achievershelf.space",
      "activitymeal.space",
      "additionplot.cfd",
      "adex-blog.blogspot.com",
      "adviceturn.xyz",
      "afternoonscrew.space",
      "agreementjuice.space",
      "airplaneiron.xyz",
      "airtwig.xyz",
      "amazingshield.xyz",
      "amountfuel.icu",
      "animalrecord.xyz",
      "animalview.xyz",
      "apparatustruck.xyz",
      "apparelplate.space",
      "archairport.xyz",
      "atthelake.info",
      "authoritykittens.info",
      "babyvein.xyz",
      "badgewing.xyz",
      "bagcare.space",
      "basesfile.com",
      "basinpleasure.xyz",
      "basketballyear.xyz",
      "baskethumor.xyz",
      "bedroomdesire.xyz",
      "beliefpicture.xyz",
      "bellplayground.xyz",
      "bikesdonkey.info",
      "birthdaymagic.xyz",
      "boardmagic.info",
      "boatthought.xyz",
      "boundarychickens.xyz",
      "boytank.xyz",
      "branchmorning.xyz",
      "breathdoctor.xyz",
      "bubbleslip.xyz",
      "cabbagemeasure.xyz",
      "cablecanvas.xyz",
      "cardgrape.xyz",
      "cattlegold.xyz",
      "celeryerror.xyz",
      "centscarf.xyz",
      "chalkprose.xyz",
      "chawton.info",
      "cherriestruck.space",
      "chesstail.xyz",
      "chickensmine.space",
      "churchpail.xyz",
      "clothcrib.xyz",
      "clothcurrent.xyz",
      "coatberry.xyz",
      "collartitle.info",
      "connect.activitykitty.xyz",
      "connect.apparatustaste.xyz",
      "connect.armcard.xyz",
      "connect.badgeterritory.xyz",
      "connect.baitmetal.xyz",
      "connect.beefteeth.xyz",
      "connect.believesisters.xyz",
      "connect.boundaryfly.xyz",
      "connect.bubbleappliance.xyz",
      "connect.cableland.xyz",
      "connect.chinexpert.xyz",
      "connect.conditiongrade.xyz",
      "connect.coppersummer.xyz",
      "connect.creatorcreator.xyz",
      "connect.dresstent.xyz",
      "connect.dropjeans.xyz",
      "connect.edgeplayground.xyz",
      "connect.exchangeclub.xyz",
      "connect.existencediscussion.info",
      "connect.expansionsalt.info",
      "connect.fangstitch.xyz",
      "connect.fogparcel.info",
      "connect.foodhook.info",
      "connect.forkcountry.xyz",
      "connect.fuelleg.info",
      "connect.geesepurpose.xyz",
      "connect.giantsdogs.info",
      "connect.giraffetoothpaste.xyz",
      "connect.guitarrobin.xyz",
      "connect.halllunch.info",
      "connect.harborclam.xyz",
      "connect.holecompany.info",
      "connect.knifesea.icu",
      "connect.monthsmoke.info",
      "connect.nosegovernor.xyz",
      "connect.pagesubstance.xyz",
      "connect.poisonblade.xyz",
      "connect.prosesalt.xyz",
      "connect.purposethings.info",
      "connect.quiltgirls.xyz",
      "connect.reactionbit.info",
      "connect.rewardrun.xyz",
      "connect.riceapparel.xyz",
      "connect.seashoreletters.info",
      "connect.selectiondogs.xyz",
      "connect.shapeboot.info",
      "connect.shoptax.xyz",
      "connect.stopfinger.info",
      "connect.structurekiss.xyz",
      "connect.tanksuggestion.xyz",
      "connect.thingbrass.xyz",
      "connect.thoughtslave.xyz",
      "connect.threadfuel.xyz",
      "connect.trailcontrol.xyz",
      "connect.trickbushes.info",
      "connect.vacationthought.xyz",
      "connect.viewschool.xyz",
      "connect.voyagelaugh.xyz",
      "connect.woolreward.xyz",
      "connect.yearicicle.xyz",
      "connect.zebratransport.xyz",
      "controlprice.xyz",
      "coughcoal.icu",
      "countrypipe.space",
      "cowsfoot.xyz",
      "crackfood.space",
      "creamfurniture.space",
      "creditchickens.xyz",
      "crediteducation.cfd",
      "crimestreet.xyz",
      "crimesupport.cfd",
      "crowdstri.com",
      "curvebite.xyz",
      "deathrock.xyz",
      "deathshop.xyz",
      "decisionreaction.xyz",
      "dinosaursjam.cfd",
      "distancebedroom.xyz",
      "distributiontheory.cfd",
      "dolldebt.xyz",
      "doorsoap.cfd",
      "drelto.info",
      "dustprotest.icu",
      "dw.xrsdownload.com",
      "expansionsalt.info",
      "extentrack.com",
      "fallbeginner.xyz",
      "fangbear.xyz",
      "filescenter.cloud",
      "filescloud.pro",
      "filesilo.cloud",
      "filexstorage.site",
      "finersto.com",
      "fingerbasketball.xyz",
      "flavorwood.xyz",
      "fleshfrog.xyz",
      "fleshplants.xyz",
      "fleshproduce.xyz",
      "foodrock.space",
      "forkmice.xyz",
      "friendjewel.cfd",
      "geeseairport.xyz",
      "girlsgrain.xyz",
      "glassmove.xyz",
      "goldsteel.cfd",
      "governmentyard.cfd",
      "grandfatherquiver.xyz",
      "gripcollar.xyz",
      "gripsleep.xyz",
      "gunbear.xyz",
      "hairreward.xyz",
      "hatescale.info",
      "healthiron.space",
      "holemuscle.xyz",
      "homecub.cfd",
      "homefireman.xyz",
      "honeyfear.xyz",
      "igk.filexspace.com",
      "ikx.filexspace.com",
      "ilesilo.cloud",
      "instrumentvolcano.space",
      "kittenschalk.xyz",
      "kittensgrade.cfd",
      "kittensrobin.info",
      "landerror.xyz",
      "lesilo.cloud",
      "liptendency.info",
      "liquidtoes.xyz",
      "liquidwrench.cfd",
      "lockettrail.xyz",
      "lumberbaseball.xyz",
      "memorycompany.xyz",
      "micesisters.xyz",
      "mifilesx.site",
      "milkname.xyz",
      "minewave.info",
      "minuteblade.xyz",
      "mountainsurprise.cfd",
      "mouthfruit.cfd",
      "mqsearch.com",
      "needcherries.online",
      "noiseship.cfd",
      "northbox.xyz",
      "partpipe.xyz",
      "partyfriends.cfd",
      "passengerbrake.space",
      "peacejewel.xyz",
      "peacetongue.xyz",
      "petminister.xyz",
      "pictureporter.cfd",
      "pieplant.space",
      "pizzasthread.xyz",
      "placespoon.xyz",
      "pleasurewaves.info",
      "popcornregret.xyz",
      "porterdebt.xyz",
      "powerbushes.xyz",
      "profitfact.xyz",
      "prosetoothbrush.xyz",
      "quincepage.xyz",
      "raintexture.xyz",
      "rakepurpose.xyz",
      "raterake.cfd",
      "ravexoffical.blogspot.com",
      "readingscience.xyz",
      "reasonachiever.xyz",
      "recessgiraffe.xyz",
      "recordhistory.xyz",
      "reg.pcsdkflyer.ca",
      "regretsquirrel.xyz",
      "restbucket.xyz",
      "ricestar.xyz",
      "rifledog.xyz",
      "ringsparcel.xyz",
      "roadyear.xyz",
      "rockcredit.space",
      "rollglass.xyz",
      "roofbattle.xyz",
      "roofreaction.xyz",
      "rosegrip.xyz",
      "routeletters.xyz",
      "runhouses.xyz",
      "scarecrowcare.xyz",
      "scentrod.info",
      "screwbirth.xyz",
      "seatlace.space",
      "seaword.xyz",
      "servantadvice.xyz",
      "shiptank.cfd",
      "shirtexample.xyz",
      "shoesearthquake.xyz",
      "sinkwash.space",
      "skirtloss.xyz",
      "slipvegetable.xyz",
      "smokecar.space",
      "songtheory.xyz",
      "spadeleg.xyz",
      "sparkrice.space",
      "sparkrub.xyz",
      "spoonducks.cfd",
      "springdogs.xyz",
      "spybaseball.space",
      "startmonkey.cfd",
      "statementservant.xyz",
      "statementtouch.xyz",
      "steamhouses.cfd",
      "stopzinc.xyz",
      "storage.ggclicker.com",
      "structurelinen.xyz",
      "stryper.info",
      "suggestioncemetery.xyz",
      "suitsoap.xyz",
      "suitstraw.info",
      "swimrest.xyz",
      "tablechess.info",
      "tailsilk.xyz",
      "territorycaption.xyz",
      "texturebadge.xyz",
      "thrillducks.xyz",
      "throneback.xyz",
      "tinsofa.xyz",
      "toespiders.xyz",
      "toothpastesense.xyz",
      "toothpastesun.xyz",
      "townquiver.xyz",
      "trampdonkey.icu",
      "treesboard.xyz",
      "trickflag.info",
      "truckpig.cfd",
      "truckshat.xyz",
      "turnclass.xyz",
      "umbrellavessel.xyz",
      "uy.basesfiles.com",
      "vacationengine.xyz",
      "velfps.blogspot.com",
      "velvoxlab.blogspot.com",
      "vendralo.info",
      "venrx.blogspot.com",
      "venrx.xyz",
      "venrxhub.blogspot.com",
      "vesselsystem.xyz",
      "vestthings.cfd",
      "volcanopin.xyz",
      "voyagemist.space",
      "wastereading.xyz",
      "wasteturkey.xyz",
      "wastewine.xyz",
      "watchadvance.com",
      "wavepan.xyz",
      "whistlebook.cfd",
      "whistlesong.xyz",
      "wormspark.xyz",
      "woundsecretary.xyz",
      "wrenobservation.xyz",
      "yamsmell.xyz",
      "yardvalue.cfd",
      "zephyrhall.cfd",
      "zippyfiles.net"
    ],
    "URLs": [
      "http://aa.amazingshield.xyz/33244556546.py",
      "https://stryper.info/aa.js",
      "https://stryper.info/t.ps1"
    ],
    "sha256": [
      "06e0afd01bbc6c9d5dc16c3165089b233dc071e1f251abd06235d1b9166cdac5",
      "25558ea78c4aa0fdd0f45fafcaa546d3115dc5806809d144a5801a40e48fd4c5",
      "2c6e11027b011042c9a118fc20728f8f4ebb6be8795cc84cc9a45622c297d354",
      "3052bd320a34e12ee694811ed0578797477dfd480c664491e509ed15ce1a6961",
      "553ce594c9c6afdd4794fddc28c194e3bc3c1b052310e5099c58ac15bab72104",
      "62d49d0c78207ec2452cc8a30501db771c9edbae89889e41a7dd227551243e8e",
      "7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c",
      "9b0d9cbc0fd4a7bae8b78a15dfbe63052779414ad725845732c4a0083008da69",
      "aaebc8c07de485be6d1bfa956668c5e18aa1ff5588dfe84672e20ae90b4560f1",
      "b367762140ae7f5098230b8a5da738c9241f286281ec9439dd6ca581fc87989c",
      "ceb30a5eb9ad9d9c6712c80726df16f96f99d9fc0753be241b00b4d636eb576e",
      "cf184d04ca31fb2b6b7efd85399c29c1136b539153e137ceb3877b1b905791de",
      "d8d783f8e050a6e394f3c0aa5e2bc73a38d822e55fbc39c0648cbff566de3cdf",
      "e05bc22afbc5ddd50b49c85ee169dd13318000d38286de2b8bcff98217256a8d",
      "fc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73",
      "fdcc95b7791c0d6590dcf1a412dc9fcc92ad2095818d1b78368b31efad012007"
    ]
  }
}