// Selected evidence-qualified indicators only; not the complete article IOC inventory. // Source context is not a confirmed-malicious verdict; verify before operational use. import "hash" rule bulwark_https_bulwarkblack_com_xcpe_firmware_backdoor_device_trust_botnet_takedown { meta: author = "Bulwark Black LLC" source = "https://bulwarkblack.com/xcpe-firmware-backdoor-device-trust-botnet-takedown/" description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule." generated = "2026-11-03T20:23:46Z" tlp = "TLP:CLEAR" indicator_count = "225" strings: $s0 = "absolut.fit" ascii wide nocase // Domains $s1 = "alpivara.com" ascii wide nocase // Domains $s2 = "alptk.com" ascii wide nocase // Domains $s3 = "amhib.com" ascii wide nocase // Domains $s4 = "analysis.shixunsuda.com" ascii wide nocase // Domains $s5 = "anyevonline.com" ascii wide nocase // Domains $s6 = "auqee.com" ascii wide nocase // Domains $s7 = "bd-devmetrics.net" ascii wide nocase // Domains $s8 = "beepityping.com" ascii wide nocase // Domains $s9 = "beezlepongmad.com" ascii wide nocase // Domains $s10 = "bestipip.com" ascii wide nocase // Domains $s11 = "bkdomain.cn" ascii wide nocase // Domains $s12 = "bloopondle.com" ascii wide nocase // Domains $s13 = "blustpong.com" ascii wide nocase // Domains $s14 = "braigwshat.com" ascii wide nocase // Domains $s15 = "brisping.com" ascii wide nocase // Domains $s16 = "bronglepong.com" ascii wide nocase // Domains $s17 = "clapslpist.com" ascii wide nocase // Domains $s18 = "clapslport.com" ascii wide nocase // Domains $s19 = "cloudbrokerapi.xyz" ascii wide nocase // Domains $s20 = "collection.shixunsuda.com" ascii wide nocase // Domains $s21 = "columbus2024.com" ascii wide nocase // Domains $s22 = "com.abc.nexus" ascii wide nocase // Domains $s23 = "craipivolta.com" ascii wide nocase // Domains $s24 = "creapslpinut.com" ascii wide nocase // Domains $s25 = "crodipolis.com" ascii wide nocase // Domains $s26 = "dddlink.link" ascii wide nocase // Domains $s27 = "delpiverno.com" ascii wide nocase // Domains $s28 = "depomancy.com" ascii wide nocase // Domains $s29 = "dewswyra.com" ascii wide nocase // Domains $s30 = "dgjm.online" ascii wide nocase // Domains $s31 = "disview.com" ascii wide nocase // Domains $s32 = "dmurdce.xyz" ascii wide nocase // Domains $s33 = "drackpingcare.com" ascii wide nocase // Domains $s34 = "dramapi.com" ascii wide nocase // Domains $s35 = "drapithon.com" ascii wide nocase // Domains $s36 = "drgdj.top" ascii wide nocase // Domains $s37 = "earn.fm" ascii wide nocase // Domains $s38 = "edisajalsjfdfh.shop" ascii wide nocase // Domains $s39 = "fawsilver.com" ascii wide nocase // Domains $s40 = "fawsindra.com" ascii wide nocase // Domains $s41 = "fecebbbk.xyz" ascii wide nocase // Domains $s42 = "filemail.com" ascii wide nocase // Domains $s43 = "fizzlepong.com" ascii wide nocase // Domains $s44 = "flaigwern.com" ascii wide nocase // Domains $s45 = "flapilo.com" ascii wide nocase // Domains $s46 = "flapslwstorm.com" ascii wide nocase // Domains $s47 = "flawsino.com" ascii wide nocase // Domains $s48 = "flewsnark.com" ascii wide nocase // Domains $s49 = "floporin.com" ascii wide nocase // Domains $s50 = "floppipple.com" ascii wide nocase // Domains $s51 = "flumpipoodle.com" ascii wide nocase // Domains $s52 = "frosping.com" ascii wide nocase // Domains $s53 = "fshuaons2.online" ascii wide nocase // Domains $s54 = "fuioahsdoa3.store" ascii wide nocase // Domains $s55 = "fuisans1.online" ascii wide nocase // Domains $s56 = "gapslpinch.com" ascii wide nocase // Domains $s57 = "gapslwsbor.com" ascii wide nocase // Domains $s58 = "geo-loadbalanced.com" ascii wide nocase // Domains $s59 = "glapoton.com" ascii wide nocase // Domains $s60 = "glewsnap.com" ascii wide nocase // Domains $s61 = "glippinger.com" ascii wide nocase // Domains $s62 = "gloobfnatch.com" ascii wide nocase // Domains $s63 = "gloopong.com" ascii wide nocase // Domains $s64 = "glowspar.com" ascii wide nocase // Domains $s65 = "grasplpond.com" ascii wide nocase // Domains $s66 = "grinapslpocal.com" ascii wide nocase // Domains $s67 = "gtxvdqvuweqs.com" ascii wide nocase // Domains $s68 = "guangzhouroot.com" ascii wide nocase // Domains $s69 = "haimnsgsjhansj.shop" ascii wide nocase // Domains $s70 = "hawsith.com" ascii wide nocase // Domains $s71 = "hiddeninplainsight.top" ascii wide nocase // Domains $s72 = "intermedia-arts.tv" ascii wide nocase // Domains $s73 = "ip-api.com" ascii wide nocase // Domains $s74 = "ishano456.sbs" ascii wide nocase // Domains $s75 = "ishuoabh3years.online" ascii wide nocase // Domains $s76 = "jaguar-distributor.logreporter.com" ascii wide nocase // Domains $s77 = "jaguar-distributor.syslogcollector.com" ascii wide nocase // Domains $s78 = "lapslponze.com" ascii wide nocase // Domains $s79 = "leisurepuz.com" ascii wide nocase // Domains $s80 = "lepovia.com" ascii wide nocase // Domains $s81 = "limpingcare.com" ascii wide nocase // Domains $s82 = "linkfog.cn" ascii wide nocase // Domains $s83 = "lorapslpifyx.com" ascii wide nocase // Domains $s84 = "lowswyn.com" ascii wide nocase // Domains $s85 = "lunapiris.com" ascii wide nocase // Domains $s86 = "mfiny.com" ascii wide nocase // Domains $s87 = "mopith.com" ascii wide nocase // Domains $s88 = "mqtt.szbboys.com" ascii wide nocase // Domains $s89 = "mudponger.com" ascii wide nocase // Domains $s90 = "nepiral.com" ascii wide nocase // Domains $s91 = "opostra.com" ascii wide nocase // Domains $s92 = "ott.szbboys.com" ascii wide nocase // Domains $s93 = "pibberflop.com" ascii wide nocase // Domains $s94 = "pikaroodle.com" ascii wide nocase // Domains $s95 = "ploponix.com" ascii wide nocase // Domains $s96 = "prataw.com" ascii wide nocase // Domains $s97 = "qepoth.com" ascii wide nocase // Domains $s98 = "rapinel.com" ascii wide nocase // Domains $s99 = "rapslpine.com" ascii wide nocase // Domains $s100 = "rapslponic.com" ascii wide nocase // Domains $s101 = "rapslwsweave.com" ascii wide nocase // Domains $s102 = "raspongle.com" ascii wide nocase // Domains $s103 = "ripotus.com" ascii wide nocase // Domains $s104 = "rowswyn.com" ascii wide nocase // Domains $s105 = "scapslwshell.com" ascii wide nocase // Domains $s106 = "sdoisanadf.shop" ascii wide nocase // Domains $s107 = "shaiosjdaln.shop" ascii wide nocase // Domains $s108 = "shsuanalsjai.shop" ascii wide nocase // Domains $s109 = "smrtai.cc" ascii wide nocase // Domains $s110 = "snarpong.com" ascii wide nocase // Domains $s111 = "snorpdoodle.com" ascii wide nocase // Domains $s112 = "sofpilan.com" ascii wide nocase // Domains $s113 = "soporth.com" ascii wide nocase // Domains $s114 = "spiritlib.cyou" ascii wide nocase // Domains $s115 = "spopel.com" ascii wide nocase // Domains $s116 = "szbboys.com" ascii wide nocase // Domains $s117 = "tawserin.com" ascii wide nocase // Domains $s118 = "tawswizzle.com" ascii wide nocase // Domains $s119 = "teowsmera.com" ascii wide nocase // Domains $s120 = "tepiol.com" ascii wide nocase // Domains $s121 = "tewsmariel.com" ascii wide nocase // Domains $s122 = "thaiporix.com" ascii wide nocase // Domains $s123 = "thapolex.com" ascii wide nocase // Domains $s124 = "torpoodle.com" ascii wide nocase // Domains $s125 = "trapslwsin.com" ascii wide nocase // Domains $s126 = "trawsica.com" ascii wide nocase // Domains $s127 = "tripikazu.com" ascii wide nocase // Domains $s128 = "twindping.com" ascii wide nocase // Domains $s129 = "tx-devmetrics.net" ascii wide nocase // Domains $s130 = "ty4523.space" ascii wide nocase // Domains $s131 = "ty54fgd435.my" ascii wide nocase // Domains $s132 = "ue886578433.online" ascii wide nocase // Domains $s133 = "vaiporun.com" ascii wide nocase // Domains $s134 = "vespilara.com" ascii wide nocase // Domains $s135 = "vorpolis.com" ascii wide nocase // Domains $s136 = "vrr8345.site" ascii wide nocase // Domains $s137 = "whispong.com" ascii wide nocase // Domains $s138 = "winklenark.com" ascii wide nocase // Domains $s139 = "wizzleplonk.com" ascii wide nocase // Domains $s140 = "wogglenift.com" ascii wide nocase // Domains $s141 = "xmsae.sbs" ascii wide nocase // Domains $s142 = "xshaon123.sbs" ascii wide nocase // Domains $s143 = "yapodust.com" ascii wide nocase // Domains $s144 = "yewsara.com" ascii wide nocase // Domains $s145 = "yokatvonline.com" ascii wide nocase // Domains $s146 = "zarflonk.com" ascii wide nocase // Domains $s147 = "zenapslpinic.com" ascii wide nocase // Domains $s148 = "zerapslpomat.com" ascii wide nocase // Domains $s149 = "zimpire.com" ascii wide nocase // Domains $s150 = "zingpingbees.com" ascii wide nocase // Domains $s151 = "zippypongbee.com" ascii wide nocase // Domains $s152 = "zoraipinex.com" ascii wide nocase // Domains $s153 = "zorapslwsnic.com" ascii wide nocase // Domains $s154 = "zrawsomble.com" ascii wide nocase // Domains $s155 = "http://ott.szbboys.com:8000/cpe/file/upload" ascii wide nocase // URLs $s156 = "219.134.163.210" ascii wide nocase // IPv4 $s157 = "219.134.163.211" ascii wide nocase // IPv4 $s158 = "23.94.49.57" ascii wide nocase // IPv4 $s159 = "38.145.197.135" ascii wide nocase // IPv4 condition: any of ($s*) or hash.sha256(0, filesize) == "0135b69bab304564628488829b825050d1dd6dab98e86ec6776839dac9365af9" or hash.sha256(0, filesize) == "01b8c78f5509119b3e27ea4d628048985b94b5e00db0431d843519cf1d3e2cde" or hash.sha256(0, filesize) == "02490fa9f472ec872723d64d03402967e77932d2df72c588b0d7a7df9e17ae62" or hash.sha256(0, filesize) == "02b94ae4ee0fd2bab915fe2911d15ee70e51ca0564ba43c746593e7fe0b7ccd3" or hash.sha256(0, filesize) == "049b626ca9bc4cf552e675dd5bf6215753caa3a3d28fab17b2a8fa9e0c8421c0" or hash.sha256(0, filesize) == "04ffe332458931d82c0503daba1859622540828302af1190d2d3c6447094428c" or hash.sha256(0, filesize) == "05e2e32e08073081adcb8875c3b7350fff53e7ea8f36d6388fb3daa626015d22" or hash.sha256(0, filesize) == "07b511a6f7715ccd2f77b5f51e4cf46542ccaada99564252711f4a142ac26179" or hash.sha256(0, filesize) == "085662ba43e22d04d6f69b7b5176c68cedee6507c5d34973c94459f324b44c8d" or hash.sha256(0, filesize) == "08edc09f4465cd784360c223275c45a5e95d7dc8a5e796537ea5251848b3d2f1" or hash.sha256(0, filesize) == "0d90d0e5009d0c67e978dffb1f78278fa22f296ebc14add1fe338abea8690867" or hash.sha256(0, filesize) == "0ed2ec71901210b1100c6a4abee48ad36774962496d57577d58630072e30cc60" or hash.sha256(0, filesize) == "17d4929578dac90af7da3a9c8bbd6f516ade8cc803c82a0f64849fb2a346a894" or hash.sha256(0, filesize) == "1806a1a93a6bce28cc6e95e9001f06370eaef9c66846ade9aecaf220d7ac91a4" or hash.sha256(0, filesize) == "1c34f551cea557b24f6f3776de7fecaf40536c749d5b9734242acde4dd578c53" or hash.sha256(0, filesize) == "1c8408f80dcdac5c9cae5b2ac785e6f0aa97ad2ec6c8701e3ab661882e9fdd63" or hash.sha256(0, filesize) == "1c989cef1b9cc5a39715d172e3f3acb574a958765f4a9df50c952c0a359826cd" or hash.sha256(0, filesize) == "1de0a368599ab04b8863c0e61c2d5a75e00f742a3326325f2870a9a72ee8d200" or hash.sha256(0, filesize) == "1f2ab93c35f0c37d9b88f82268183a2f77491aa6b142a48381524b18e217b960" or hash.sha256(0, filesize) == "20af9e1538e1c211687c53e71318d9d265e36ce154457cade3266c7633fb953d" or hash.sha256(0, filesize) == "22c0279d23973fd9b3bfd9f42fd19ea1595c6e3f71a89b698828c79fa8e4edd2" or hash.sha256(0, filesize) == "2cdb1f0f0969766142f3debbab55eef5e24c15d49a513753f1f6b67bc3e8438b" or hash.sha256(0, filesize) == "2d4b5c50e57e3e9b57d4ee02bef1dcd56163550a5e01c966e0f0fb6d46b2aeed" or hash.sha256(0, filesize) == "3295d193ac405112ad076d7fab23274d44f8d0be6614a250a474c5ed7c95356f" or hash.sha256(0, filesize) == "350d6db477e8567cf9347c1144b3a0b25550e7ce63bb800b056b8a7a8ef56af4" or hash.sha256(0, filesize) == "3627f848804f49c041203e8d754e8d89f3ff6243b6d9e1ca6e50bbf08dbd9785" or hash.sha256(0, filesize) == "3768f470934a111f1c3e3d098eb1392a3cb6f3e298ef5fd2a6309e6a98ee1e18" or hash.sha256(0, filesize) == "39792bed070b1128cd67178591804fafb82112d371ccdb2b51cd600b2d435922" or hash.sha256(0, filesize) == "3e891f061daf73c2edc14ed98512cad008346679645e8165320bf96fb8b0e0d6" or hash.sha256(0, filesize) == "415d54757c2f96fd28404f1ab8da1e90297a381ec3d7fb47d33126644a0a421b" or hash.sha256(0, filesize) == "42be8f18d6006ca092de191331d38e70a0d8383db701a759466dec59a0986135" or hash.sha256(0, filesize) == "471e76cce87e280a2fe11046fcb58c0817558ffbc8a526d84fb40c45b03ac9bc" or hash.sha256(0, filesize) == "486a784cbd6335d31214edd7bed7fcfb486b875374597c139826c77c91ccbbaa" or hash.sha256(0, filesize) == "498d0862ce2ce972e9ac9bd3ea592b9f9cd8c5119dcc90fcb1b14a547889e9f9" or hash.sha256(0, filesize) == "4f860efa8d8b9b8f35f343d524500181607a0cdc9fac35394cf16b71ff4ad1d0" or hash.sha256(0, filesize) == "4fd0ddb15849137df77e8cb86cd951d2d220fd8dd5b8b03c5a7e23e815092fdd" or hash.sha256(0, filesize) == "5ae5df84cdce0100eb957cf235d1f3fd85fa634592e7ca137de12535e9f8ad2a" or hash.sha256(0, filesize) == "69116e8f681ea312e7e9e3a8a436f66b3e98566c621412599ecaaa25348daadb" or hash.sha256(0, filesize) == "6b55b8b3ff7bd31af93b59612f0800c09e49d3badc772e2395736616c87d5612" or hash.sha256(0, filesize) == "6f7f4b22eb7841d2b828f1eda77173880d42267a33b387bee9cee983c03bf291" or hash.sha256(0, filesize) == "76b4bf6f55aaab35428260a830ac9a2c437a09aefd521c5b51618db47beca3b2" or hash.sha256(0, filesize) == "7830ce3c3222dd9b25a77a16116dcf832a24b4b9a0bc998501e12415a828fb42" or hash.sha256(0, filesize) == "7eb1afbf4428a9a3b41a6faf9a7497aab1d7768a8370d475f580e574145a9e7d" or hash.sha256(0, filesize) == "8365658b7c51d7b607fe83d862d05e619cad5249c96db61a3d33a95c615c8194" or hash.sha256(0, filesize) == "83b3cfb7655483e0d421737c2bed707fdd1747f105deca6980233c011aaaea30" or hash.sha256(0, filesize) == "8953f9013eb8c31b27c86ba90edbdb9ecba216ed2cb6a992508c1964d53b8eee" or hash.sha256(0, filesize) == "9216a0a460400403027d4dfc9a6193a776603b64735f174e74a89607567ac6f2" or hash.sha256(0, filesize) == "92326f3065273d619f866f76e3542b6271886f92b1342c5ccc27cb7150c75176" or hash.sha256(0, filesize) == "99874d087e3f72a9d78439118361f438f7a156af318c788183d338cc315d7fa8" or hash.sha256(0, filesize) == "9df157f3975b582074033c80d0d586f3911fb6bd3813539e2edf87ada4eee9fb" or hash.sha256(0, filesize) == "a552bcb7d37c2bdb5c71e923157571598643de4051bfa3e5158fde3cb8709de7" or hash.sha256(0, filesize) == "b2e55884c819c210eaf46aeb7970a1ec623944b5d1a8c2178904f998b9682ac0" or hash.sha256(0, filesize) == "b3690b3b013ac60752a6d05c3f53ea1f3e844d4603c5b90d258a30c596d0691b" or hash.sha256(0, filesize) == "bcf142ba37e897b7fcbb89353ec9b5a7c3bfb1d167838d3b91c347b9fdfb2230" or hash.sha256(0, filesize) == "be9990489fbf36100ec148f3a83795f2674d17063edb8accd560f1ce2f97dedd" or hash.sha256(0, filesize) == "c0e1fad801d87531ee889fa6ec344f14868e7cdac06c93d2d3de742f1a9293c5" or hash.sha256(0, filesize) == "cad908ad09d029971b24b4ad653fe680101ccaddd94b4e530c58bf45430fd1a4" or hash.sha256(0, filesize) == "cd8ef4ba20823b926b45a04946f24e45a7bcd4bf2bfc439cac8061a43f146903" or hash.sha256(0, filesize) == "d4011b684ba389bf0b2dd8ded74fe8a4729b1cad4e6c18cfd928cb99a625a6e4" or hash.sha256(0, filesize) == "da5246fb62db91eda31df0873835e1c96a3187df1a760ffc87abf9788ba69104" or hash.sha256(0, filesize) == "dca25ff0d11d49e9969be3177b50aa8bf120b5ad3946409dedae143a8a69aa99" or hash.sha256(0, filesize) == "e25616a0c64734f00d1f6dfb064d8f7bf1e4b95aac8b2e4aabb44b2950751bd0" or hash.sha256(0, filesize) == "ebcca22b96f7a30ae155efa2f25af29a369c6e9cfc99cb3bb0b72f35bc5528ed" or hash.sha256(0, filesize) == "f451c0b770049c71fb0d8efd45115dfc3336f636fb6a0617ec5a5c58632196f4" or hash.sha256(0, filesize) == "fda3c8fdf7849814e270bbbc00adfa1e15ba8977f5b2508df5febf5dbd3075b2" }