# Bulwark Black - Malicious URLs # 363 indicators, auto-extracted from published cyber threat reporting. # Home: https://bulwarkblack.com/feeds/ Regenerated on every new report. # Values are LIVE (functional). Auto-extracted — verify before blocking. # Generated: 2026-07-16 alwayswait.site api.anthropic.com/v1/api api.wigetticks.com/logout/private-response[ api.wizzleticks.com/claims/scope-schema[ aquasecurtiy.org atsheisdomestic.org/update-thanks.html auraguest.lk/m/douV2quu.php authentication-check.io/ authentication-check.io/black/api/send.php autoupdate.xyz awaitingfor.online awaitingfor.site/update azurewebsites.net best-tinted.com/github-download.html botshield.vu/KKRkm9 botshield.vu/kFcjld bulletmailer.net cdn-static.okendo.io/reviews-widget-plus/js/okendo-reviews[ cdncounter.net chkactive.online/update chkstate.online cloud-server.store/update co.uk commoncome.online crystalpdf.com/conditions cutt.ly/lwD7B7lp datatabletemplate.shop datatabletemplate.xyz datatabletemplate.xyz/account/register/id=8118555902061899& dataupload.store/uploadfiles dropbox.com/scl/fi/tmwi4j86op04r9qo2xdgh/zoomupdate.msi?rlkey=ymr9yn5p3q2w2l3uz9cg71dvm& duchop.gov.vn enrollms.com ernigr-esfilc.com/security/logon[ etoftheappyrince.org/update-delay everycarebd.com/imagelkjh0987[ face-online.world file-server.store/update filedrive.online/uploadfiles filemail.com/api/file/get?filekey=T0EnWQ6NugHkW_kLfDxPBEw_um6NSkg9ZwNRQ_5lrKrLLUo35pV8m3TKv1LqF3zZzdUm firstfromsep.online/client flashserve.store/update flipboxstudio.info/exfil freefoodaid.com/documents/2_2.d freefoodaid.com/documents/2_2.lNk freefoodaid.com/tables/tables.d ftp://47.237.15.197/update.7z funnull.host getintwopc.site/config.json getintwopc.site/config.json' gosiclass.com/m/gnu/convert/html/com/list.php?query=6 healightejustb.org/checkupdateTO.js helpdesk.com hero-sms.co herosms.ai herosms.co herosms.io hf.co/r hf.co/repos/a5/0c/a50cf45d8b119af0cc75679c8307b05e29f2bc85b6d0bd55999dd018639f1c72/19f1a6b9ad1a9654e7c78fa2d37a3ec10192b01b636c5fc1995b80bf6f7dcb36?response-content-disposition=attachment%3B+filename*%3DUTF-8%27%27b.apk%3B+filename%3D%22b.apk%22%3B& hightkdhe.store/star/main.php homeatedke.store/star/main.php http://13.62.52.206:5004  http://13.62.52.206:5004” http://130.94.6.228/amp.tar.gz http://130.94.6.228/apt.tar.gz http://130.94.6.228/update.tar.gz http://134.122.13.34:8979/c http://139.180.134.221/PerfWatson2.exe http://139.180.134.221/sdksdk608/1.zip http://139.180.134.221/sdksdk608/anydesk%5f0117.zip http://139.180.134.221/sdksdk608/hamcore.se2 http://139.180.134.221/sdksdk608/httpdf http://139.180.134.221/sdksdk608/vpn%5fbridge.config http://139.180.134.221/sdksdk608/win-vpn.rar http://146.70.100.69:8000/php_sess http://193.143.1.104:5000 http://194.233.92.26:2222/ http://194.233.92.26:8088/ http://206.189.27.39:8888/5 http://216.126.225.129:8443 http://216.126.225.129:8443?h=megalodon&l=gh_dump&id=hefs8esnhgkx" http://217.15.160.247:2222/ http://217.15.160.247:8088/ http://217.15.160.247:99/ http://217.15.164.147:2222/ http://217.15.164.147:8088/ http://217.15.164.147:99/ http://39uchxifap4cvgzsuirom0szrrg.d65lre9sfqnlcv49317gcis6pyjsatzho.oast.pro http://45.93.20.195:5000 http://45.93.20.61:5466/api/x32_chromium http://64.31.28.221/support http://8.210.50.65:60126/linux http://82.29.53.187:8778/app_cli http://83.138.53.110/dl/p.exe http://83.138.53.110/service/save.php http://83.229.126.195:8081/config.json http://83.229.126.195:8081/xmrig http://85.155.186.121/access http://95.182.100.231:2222/ http://api.ipify.org/?format=json http://cdn-static.okendo.io/reviews-widget-plus/js/okendo-reviews.js http://clawdbot.getintwopc.site/config.json' http://clawdbot.getintwopc.site/dl/Lightshot.dll' http://clawdbot.getintwopc.site/dl/Lightshot.exe' http://cutt.ly/lwD7B7lp,” http://gosiweb.gosiclass.com/m/gnu/convert/html/com/list.php?query=6 http://ip-api.com/json http://pub-3bc1de741f8149f49bdbafa703067f24.r2.dev/wwa.txt http://web071zoom.us/fix/audio-fv/7217417464 http://web071zoom.us/fix/audio-tr/7217417464 http://web071zoom.us/fix/audio/4542828056 https://1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p.worf.replit.dev/download https://2117.filemail.com/api/file/get?filekey=T0EnWQ6NugHkW_kLfDxPBEw_um6NSkg9ZwNRQ_5lrKrLLUo35pV8m3TKv1LqF3zZzdUm https://64.95.10.115:23011/update.sh https://85.155.186.121/access/Remote%20Access-linux64-offline.tar?language=en&app=76049110434275449312180081368257747094 https://ElementShift.azurewebsites.net https://NanoMatrix.azurewebsites.net https://QuantumWeave.azurewebsites.net https://academy.breakdev.org/evilginx-mastery https://aka.ms/threatintelblog https://api.anthropic.com/v1/api https://api.telegram.org https://api.wigetticks.com/logout/private-response.php?8D1V4th3 https://api.wizzleticks.com/claims/scope-schema.php?4ManBBdA https://apisix.apache.org https://apps.nulab.com/signup/verify https://assets.lumen.com/is/content/Lumen/Black_Lotus_Labs_Video-6341053041112 https://assets.lumen.com/is/image/Lumen/author-black-lotus-labs-logo-image-300x300?Creativeid=b08a9660-2840-4cf8-b2b4-aa45b9585632 https://assets.lumen.com/is/image/Lumen/img-blog-bll-malware-fig1?$PNG$&Creativeid=baae57fe-30cb-446d-9373-b5835ed6d74a https://assets.lumen.com/is/image/Lumen/img-blog-bll-malware-fig2?$PNG$&Creativeid=679e321b-7df3-45e4-9292-c1c02c13732c https://assets.lumen.com/is/image/Lumen/img-blog-bll-malware-fig3?$PNG$&Creativeid=c742db12-86dc-4216-b182-07991ebadce5 https://assets.lumen.com/is/image/Lumen/img-blog-bll-malware-fig4?$PNG$&Creativeid=f104f1c6-3a1f-460b-b597-813b63e43e0d https://assets.lumen.com/is/image/Lumen/img-blog-bll-malware-fig5?$PNG$&Creativeid=9f6a7f84-711d-4f83-b1b4-38b6129e1d23 https://assets.lumen.com/is/image/Lumen/img-blog-bll-malware-fig6?$PNG$&Creativeid=a9148deb-22b8-43c8-bb11-dc6feceb9714 https://assets.lumen.com/is/image/Lumen/img-blog-bll-malware-fig8?$PNG$&Creativeid=bdd1dcd8-5848-4020-b2e8-448ad48d9e98 https://assets.lumen.com/is/image/Lumen/img-blog-bll-malware-showboat-table?$JPG$&Creativeid=416e9156-1fd8-4382-b2a3-107f5062946a https://assets.lumen.com/is/image/Lumen/img-blog-bll-newmalware-figure7?$PNG$&Creativeid=adbfea9c-c17b-4cbe-bb9d-c800b6b23a84 https://assets.lumen.com/is/image/Lumen/img-blog-featured-resource-card-bll?Creativeid=844b527d-b24a-4d66-928e-9d6964fc2220 https://assets.lumen.com/is/image/Lumen/img-blog-header-bll-malware-848x566?$PNG$&Creativeid=7832e142-117a-4b22-9ce4-cf575ba34f02 https://atsheisdomestic.org/update-thanks.html https://auraguest.lk/m/douV2quu.php https://badkeys.info/ https://basecon.com.ua/calculator.rar https://best-tinted.com/github-download.html https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/ https://bots.autoupdate.online:8080/test https://botshield.vu/KKRkm9 https://botshield.vu/kFcjld https://business-data-leaks.com https://caliber-spinner-finishing.ngrok-free.dev:443/ https://cdn-lfs-us-1.hf.co/r https://cdn-lfs-us-1.hf.co/repos/a5/0c/a50cf45d8b119af0cc75679c8307b05e29f2bc85b6d0bd55999dd018639f1c72/19f1a6b9ad1a9654e7c78fa2d37a3ec10192b01b636c5fc1995b80bf6f7dcb36?response-content-disposition=attachment%3B+filename*%3DUTF-8%27%27b.apk%3B+filename%3D%22b.apk%22%3B&response-content-type=application%2Fvnd.android.package-archive&Expires=1764089304&Policy=eyJTdGF0ZW1lbnQiOlt7IkNvbmRpdGlvbiI6eyJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTc2NDA4OTMwNH19LCJSZXNvdXJjZSI6Imh0dHBzOi8vY2RuLWxmcy11cy0xLmhmLmNvL3JlcG9zL2E1LzBjL2E1MGNmNDVkOGIxMTlhZjBjYzc1Njc5YzgzMDdiMDVlMjlmMmJjODViNmQwYmQ1NTk5OWRkMDE4NjM5ZjFjNzIvMTlmMWE2YjlhZDFhOTY1NGU3Yzc4ZmEyZDM3YTNlYzEwMTkyYjAxYjYzNmM1ZmMxOTk1YjgwYmY2ZjdkY2IzNj9yZXNwb25zZS1jb250ZW50LWRpc3Bvc2l0aW9uPSomcmVzcG9uc2UtY29udGVudC10eXBlPSoifV19&Signature=Mqc2vLuG17L9PD9eOO96Tbl8S1P6Efgzc1c%7EvjGQqg7jE6NcLyKqkIn7Koq06ybpChfuNeUOUSIRvqUXUd%7EAUt1mvivbp8cZla5frbYSx6ce2-Enp7KmhKXafgpPH6Hr8sGEt8EO56g3oF867bsCO3qH4Q9HqcX6DZZfgyysDxK22VIzEOYCoGqzIa0pj1gFr57PGdcyQJxqFDvpQ9KiCoLxqGjf4O5EpO-4bLJ53D3nZUTrDZX3sCHo7hUOxwqBMUefhgL0BKhL4JPfaBsHyfM9Cj%7EO1yPsf6CqZd%7EVfQWh9CH6ZW834YlKppFxovUMdg3dUHxUNUBDZg2-Nf3plw__&Key-Pair-Id=K24J24Z295AEI9 https://championships-peoples-point-cassette.trycloudflare.com https://championships-peoples-point-cassette.trycloudflare.com/prop.py https://chkactive.online/update https://ci.appveyor.com/project/plusvic/yara/build/job/wthlb30bklmlns0a/artifacts https://circoloesteri.elezioni.idnet.it/admin-election/riepilogo.php https://cloud-server.store/update https://cloud.projectdiscovery.io/ https://cloud.projectdiscovery.io/?ref=api_key https://cockpit.sumsub.com/checkus#/applicant/66a453df5137ba3da8742f58/basicInfo?clientId=gate.us_60664 https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b https://community.spiceworks.com/topic/2107142-what-are-all-of-the-file-types-on-a-windows-pc-that-contain-executable-code https://company.sharepoint.com/sites/ProductionOps/ https://darkgptprivate.com/d111" https://dataupload.store/uploadfiles https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/ https://decoraat.net:443 https://discord.com/register https://dl.k8s.io/release/$(curl https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl" https://docspace-twpf0e.onlyoffice.com/storage/files/root/folder_3765000/file_3764519/v1/content.zip?filename=remote.[REDACTED].zip https://docspace-y4cumb.onlyoffice.com/storage/files/root/folder_3602000/file_3601577/v1/content.zip[ https://doi.org/10.48550/arXiv.2509.14233 https://download.datatabletemplate.xyz/account/register/id=8118555902061899&secret=QwLoOZSDakFh https://ehxbxtjliybbloantpwq.supabase.co/rest/v1/agents?select https://ehxbxtjliybbloantpwq.supabase.co/rest/v1/owners?select=email,x_handle,x_name&email=neq.null&limit=5 https://ehxbxtjliybbloantpwq.supabase.co/rest/v1/posts?id=eq.74b073fd-37db-4a32-a9e1-c7652e5c0d59 https://ehxbxtjliybbloantpwq.supabase.co/rest/v1/users https://ernigr-esfilc.com/security/logon.jsp?verify=7g2q978fg11jka=891FHjaH32-2f1Hnb2sF https://etoftheappyrince.org/update-delay https://everycarebd.com/imagelkjh0987.png https://evil.com https://file-server.store/update https://filedrive.online/uploadfiles https://flashserve.store/update https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340?language=en_US https://freefoodaid.com/documents/2_2.d https://freefoodaid.com/documents/2_2.lNk https://freefoodaid.com/tables/tables.d https://gy4q3fpx3gh77gw.kk5yuzmev2qbgulz.com/#/domin/list https://hackaday.io/project/162131-graphical-pinout-generator/ https://healightejustb.org/checkupdateTO.js https://help.evilginx.com/docs/category/getting-started https://help.ivanti.com/mi/help/en_us/core/11.x/gsg/CoreGettingStarted/Configuring_LDAP_servers.htm https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/ https://huggingface.co https://huggingface.co/datasets/xcvqsccm/sfxyt851/resolve/main/b.apk?download=true https://ico.org.uk/media2/xdrfahsw/south-staffordshire-plc-and-south-staffordshire-water-plc-monetary-penalty-notice.pdf https://interoperability.blob.core.windows.net/files/MS-ONE/%5bMS-ONE%5d.pdf https://investigation-launches-hearings-copying.trycloudflare.com/ https://itsec.hboeck.de/ https://judiemkqjajsfzpidfjlowgl8nyrtd49x.oast.fun https://kiamatka.com/kaiok.kakman https://ledger.setuptransactioncheck.com/ https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html https://lrtechs.backlog.com/dashboard https://malpedia.caad.fkie.fraunhofer.de/details/win.clop https://malpedia.caad.fkie.fraunhofer.de/details/win.get2 https://malpedia.caad.fkie.fraunhofer.de/details/win.sdbbot https://malpedia.caad.fkie.fraunhofer.de/details/win.shadowpad" https://malvuln.com/advisory/b8e1e5b832e5947f41fd6ae6ef6d09a1.txt https://metamask.awaitingfor.site/update https://mononapfp.sharepoint.com/:f:/document/INV-IgCx1X50pgUjR7iAjZL2fuQaAW4GfKVs6wHT3BYv9sgwW7g” https://mononapfpcom.sharepoint.com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEc https://my.f5.com/manage/s/article/K000156741 https://niscarea.com/in.php?cn=[base64]&fn=[DateTime https://onedow.gesecole.net/download https://onedown.gesecole.net/download https://online.zp.ua/wp-content/uploads/Tools/EditorToolsPdf.zip https://organization.sharepoint.com/sites/Legal_Archive/ https://osandamalith.com/2020/07/19/exploring-the-ms-dos-stub/ https://ottawacitizen.com/news/local-news/what-is-going-on-in-ottawa-handcuffing-of-another-child-with-autism-worries-advocates https://parkspringshotel.com/m/Lu6aeloo.php https://pastebin.com/raw/[actor_page https://penskecar.riersrmissecured.com/_c/cstm/4325/reg/DOTLookup.aspx https://pub-3bc1de741f8149f49bdbafa703067f24.r2.dev/wwa.txt https://redcanary.com/blog/raspberry-robin https://redmaple.tech/blogs/macho-files/ https://res.cloudinary.com/dbjtzqp4q/image/upload/v1767455040/ https://res.cloudinary.com/dbjtzqp4q/image/upload/v1767455040/optimized_MSI_lpsd9p.jpg https://retrodayaengineering.icu/HGG.hta https://rsrmissecured.top/.git/config https://safeup.store/test https://safeupload.online/uploadfiles https://scan.aquasecurtiy.org https://scheta.site/api.store/Setup.msix https://scheta.site/api.store/ZoomInstaller.msix https://securityintelligence.com/posts/raspberry-robin-worm-dridex-malware/ https://simple-help.com/release-news https://simple-help.com/security/simplehelp-security-update-2026-05 https://sinterfumesco.com/search?utn=[Tracking https://socprime.com/active-threats/solyximmortal-python-malware-analysis/ https://souls-entire-defined-routes.trycloudflare.com/ https://souls-entire-defined-routes.trycloudflare.com/kamikaze.sh https://souls-entire-defined-routes.trycloudflare.com/kube.py" https://static.cdncounter.net/assets/index.html https://static.cdncounter.net/widgets.js?uhfiu27fajf2948fjfefaa42"></script> https://support.ms-live.us/301631/check https://support.ms-live.us/register/22989524464UcX2b5w52 https://support.ms-live.us/update/02583235891M49FYUN57 https://tbhmlive.com/ https://tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io/ https://thecyberwire.com/podcasts/microsoft-threat-intelligence https://transfer.weepee.io/7nZw7/blue.drx https://trezor.authentication-check.io/ https://trezor.authentication-check.io/black/api/send.php https://tria.ge/250530-ttmjhayzhw https://tria.ge/250812-zw4tfszpy4 https://trueconf.com/docs/server/en/admin/info/ https://urgent-update.cloud/uploadfiles https://vision.stark-industries.solutions/auth/login https://writeup.live/test https://www.aikido.dev/blog/fake-clawdbot-vscode-extension-malware https://www.aikido.dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran https://www.ambitiouspr.co.uk/ https://www.circoloesteri.it/ https://www.crystalpdf.com/conditions https://www.cve.org/CVERecord?id=CVE-2026-24061 https://www.cve.org/CVERecord?id=CVE-2026-39999 https://www.cvedetails.com/cve/CVE-2026-24061/ https://www.cyfirma.com/research/solyximmortal-python-malware-analysis/ https://www.darktrace.com/blog/darktraces-view-on-operation-lunar-peek-exploitation-of-palo-alto-firewall-devices-cve-2024-2012-and-2024-9474 https://www.dropbox.com/scl/fi/tmwi4j86op04r9qo2xdgh/zoomupdate.msi?rlkey=ymr9yn5p3q2w2l3uz9cg71dvm&st=q93av9p6&dl=1 https://www.drs.gov.ua/wp-content/themes/twentytwentyfive/docs.zip https://www.garykessler.net/library/file_sigs.html https://www.hightkdhe.store/star/main.php https://www.homeatedke.store/star/main.php https://www.hudsonrock.com/schedule-demo https://www.lumen.com/en-us/security/black-lotus-labs.html https://www.mediafire.com/file/gflsp6ovigjnvms/@#Full_Istaller_Pc_Setup_2024_PaSSW%E1%B9%8FrD^$.zip/file https://www.moltbook.com/_next/static/chunks/18e24eafc444b2b9.js https://www.news9live.com/technology/tech-news/hackers-used-claude-hit-mexico-agencies-150gb-data-claim-report-2936314 https://www.philion.store/star/main.php https://www.r-tec.net/r-tec-blog-evade-signature-based-phishing-detections.html https://www.ransomware.live/group/clop https://www.schneier.com https://www.securityjoes.com/post/hide-and-seek-in-windows-closet-unmasking-the-winsxs-hijacking-hideout https://www.sparkfun.com/news/1947 https://www.tarlogic.com/blog/seloaddriverprivilege-privilege-escalation/ https://www.treadstone71.com/cognitive-army https://www.treadstone71.com/training/building-a-cognitive-warfare-cyber-psyops-program https://www.treadstone71.com/training/p-omega-syllabus https://www.treadstone71.com/training/the-mission https://www.trustbastion.com/xiazz.html huggingface.co/datasets/xcvqsccm/sfxyt851/resolve/main/b.apk?download=true ip-api.com/json ipify.org it.com itdesk.com ithr.org kiamatka.com/kaiok.kakman longlastfor.online malaymoil.com ms-live.us/301631/check ms-live.us/register/22989524464UcX2b5w52 ms-live.us/update/02583235891M49FYUN57 niscarea.com/in.php?cn=[base64 notemacro.com oast.fun oast.pro onedow.gesecole.net/download onedown.gesecole.net/download onlyoffice.com onlyoffice.com/storage/files/root/folder_3602000/file_3601577/v1/content.zip[ onlyoffice.com/storage/files/root/folder_3765000/file_3764519/v1/content.zip?filename=remote.[REDACTED pamconj.com parkspringshotel.com/m/Lu6aeloo.php passkeyms.com penskecar.riersrmissecured.com/_c/cstm/4325/reg/DOTLookup.aspx philion.store/star/main.php pub-3bc1de741f8149f49bdbafa703067f24.r2.dev/wwa.txt qzz.io res.cloudinary.com/dbjtzqp4q/image/upload/v1767455040/ res.cloudinary.com/dbjtzqp4q/image/upload/v1767455040/optimized_MSI_lpsd9p.jpg retrodayaengineering.icu/HGG.hta safeup.store/test safeupload.online/uploadfiles scheta.site/api.store/Setup.msix scheta.site/api.store/ZoomInstaller.msix security-update.xyz setupsso.com setuptransactioncheck.com/ shapelie.com sharepoint.com/:f:/document/INV-IgCx1X50pgUjR7iAjZL2fuQaAW4GfKVs6wHT3BYv9sgwW7g” sharepoint.com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEc signsafe.xyz/update sinterfumesco.com/search?utn=[Tracking smshero.ai smshero.co supportxmr.com system-update.xyz systemupdate.cloud systemupdate.cloud/client trustbastion.com/xiazz.html trycloudflare.com/ trycloudflare.com/kube.py" trycloudflare.com/prop.py updatecheck.store urgent-update.cloud/uploadfiles video-meeting.online web071zoom.us/fix/audio-fv/7217417464 web071zoom.us/fix/audio-tr/7217417464 web071zoom.us/fix/audio/4542828056 webredirect.org weepee.io/7nZw7/blue.drx windows.net workers.dev writeup.live/test xyz.com zergpool.com