{
  "metadata": {
    "generator": "Bulwark Black IOC Extractor",
    "source": "https://bulwarkblack.com/white-label-router-backdoors-edge-provenance/",
    "fang": "live",
    "exported_at": "2026-08-27T20:04:38Z",
    "total": 30,
    "categories": 4
  },
  "iocs": {
    "IPv4": [
      "1.0.0.2",
      "1.0.0.3",
      "3.0.0.4",
      "45.156.37.159",
      "47.107.224.89"
    ],
    "Domains": [
      "ac-link.com",
      "api.vulncheck.com",
      "cswlink.com",
      "en.fofa.info",
      "findmyipaddr.com",
      "mqonu.com",
      "platform.censys.io",
      "r.co",
      "www.ac-link.com",
      "www.findmyipaddr.com",
      "www.shodan.io",
      "www.zoomeye.ai"
    ],
    "URLs": [
      "https://api.vulncheck.com/v3/index/target-intel?port=9992\\&transport=udp\\&classification=c2",
      "https://en.fofa.info/result?qbase64=Ym9keT0id2stbG9naW4taHRtbCI=",
      "https://en.fofa.info/result?qbase64=YmFubmVyPSIwOzBIV2VsY29tZSB0byBNUVdydEAi",
      "https://en.fofa.info/result?qbase64=YmFubmVyPSJTU0gtMi4wLWRyb3BiZWFyXzIwMTQuNjMiICYmICJlMGFjNmMwODM0OTdkMTllNWFiM2QyOGY5MzU0ZTdkODRiMzA3OTNlYmE3MjBjN2Y3OTNhZWIxY2E5YmU5YTQxIg==",
      "https://platform.censys.io/search?q=host.services.endpoints.http.body%3A%22wk-login-html%22",
      "https://platform.censys.io/search?q=host.services.ssh.server\\_host\\_key.fingerprint\\_sha256%3D%22e0ac6c083497d19e5ab3d28f9354e7d84b30793eba720c7f793aeb1ca9be9a41%22",
      "https://www.shodan.io/search?query=%220%3B0HWelcome+to+MQWrt%40%22",
      "https://www.shodan.io/search?query=ad%3A9a%3A52%3Aad%3A2b%3A05%3A7c%3Aca%3A13%3A7d%3A12%3Ac6%3Aa7%3Aa9%3A7e%3A79",
      "https://www.shodan.io/search?query=html%3A%22wk-login-html%22",
      "https://www.zoomeye.ai/searchResult?q=aHR0cC5ib2R5PSJ3ay1sb2dpbi1odG1sIg%3D%3D"
    ],
    "sha256": [
      "7e2e036fec2fe7ab4bbd43978d9296563894c92a112f5ac2f39957f12108e245",
      "ae6c356f1f09260b859f84d994ef8423540a6c0bdf98510d86b85834283e4926",
      "b77811db4d218c65670a6c9a5b33c30ff81c6d779e15d658643138771178a818"
    ]
  }
}