Bad Epoll Shows Linux Kernel LPEs Belong in the Patch Priority Queue 2 indicators · Jul 8, 2026
CVEs (2)
Threat Intelligence
Indicator Database
Every indicator we auto-extract from our threat reports, grouped by report. Search by value or report, filter by type, and jump straight to the source. Values are defanged for safe viewing; live values and YARA rules download from each report.
4963 indicators · 234 reports
234 reports
Fake Payment SDKs Show Why Dependency Risk Is Credential Risk 62 indicators · Jul 8, 2026
Domains (4)
api[.]paysafe[.]comapi[.]test[.]paysafe[.]comcaliber-spinner-finishing[.]ngrok-free[.]devngrok-free[.]dev
URLs (2)
caliber-spinner-finishing[.]ngrok-free[.]devhxxps://caliber-spinner-finishing[.]ngrok-free[.]dev:443/
sha256 (56)
1314fc888ca5b3ea91a04e1f5b63039ffc7fc3832b8d809a28ad549c6f9d4f231bae9f2fb9866422f07345501fa2cb4c3a99f2652c8c9decdc27ffbf9714e7bc1bfa32548676d32b7639d3171e2f9feefba5026dc336968c91f4ae2b152c54101d567795a366b9edcfef7f1fa2d398b7cb41890dd3b2f3f1f9803de0cdba0c891df8c579ffcbf5527b1856bd1774601a5188b380e442c5a0fbd400bd86a4501b2303a74a5fac917279f1078e03a4bfd6afbb89462f97d7344ed10e6e9e9e92b72b7696575278e6e223cc44553c687e45afd04df7eb32efbf49b39da64b7959822bc8af4bd2f539630f7800f3491b64c7e2bffe12e955d0d4f03a4f6a4b0018bd2cbfc4e4b1de5e68ab81fba7e1b0c711b4d26197b48ea4db6819c9cea223b0ed2edb3f162f9676196e818d9b795d599ba119a961ffe98c4866351735980d213d313853a82bce61052c00e6a6af85b5069e007a76122c727f31661bc636b12f14390bca9d70efa42cb792f7f677189821a24527cd4298ab2acb954df0abb5c1c339371ac7061168dd3d890061267b3875bc4b30dca5e28d40dbc27a4396439ff13a0dd3479eaf85b65e5abd63d6451f98506faddee47cf4bebd9f91296abb29f0447484c76a06918d7f6f6c6f95ee2bced6dd2e9b282c6f5b92b2b7c0976381d54a4b5c1bc1e948c853cb0978c07c7b8d1540c7b1ded95f8d5ad25c126cb6c7b050cb7550224d8d227a0625e7f53be86924d8e057e403b6b91b83ea20df8340485242c5086d75a492d14e474de7c8f34b18ec0a8a9ce6d77eec8675a9572d9d2352a57c502e40b3f9897d0ca32bba6f844b4113f5c017627ea9eba660eb47f4055c4faef80c83c7ec0925a4aacb4bddabe82b91066ac41305907ba277cd7b3b855cd62e708ae4393c99579ec1433571998299bf7e2fde9bafeb9a79f8bdf065e9615805652b2f006e69512b90d0d63883d7ae1ede69d86384fd77bd46235b2369616b41657e9afaa9354fc1a106393373dcbf8aac8455b7d2cbbb44463434528e61b61dd25cd8dcc43cd78418f3e3eb3fd9002d9e49961eefb12c1022ce4c3b6367e4d6a4f53098e48bfa6ecceeaa754592bc249b83404bcfb8542977ae36dac467eb3bd505ebfffbd73fc3ef0b2976c375df732f0bd0496ed6653c3e2be5a0e56dc672e3bab8bcf80c66b2f95150067fb47429d4cf65eb95215e5f3abc7cade56e251c3d2bde8fff0487c1eecd359c4a544a09fd708755020e4b1c53ad6b8dd1727fe9c1dfa39d6590012e0593c9837c628fc2cd22aa0f4e486b7ed1aec026978a58e3ed713c1c70f421ab56a18cfb6a120c960d227e495b511c2552f25f188b8a70a5c1075f2dea4db94633ddc64b0d03d0385fdeda7c226acc944331febf439727c804c4354e481d2ff9d4934bd1b2518293a9ca34a14f5c7ae9d0cd30ce949e9655f54bfac8a937d78ac506722bae1468ead4cc9ee95b35e0f8ef17ee13d99fd06d823d54183cc91625fdc6decffe8db2863f6499a955656ebdcc089792cfa0313822513f9b89479f666888a4784a3fc99b4cc4566213dcda66b03b47120ca677c02e545941e43f8b21a5761b035e911b53e2c065fea219e0f3462f282fd8af66bc2b516d1ef71af9b6ee9f8f5af0a99fed562b34809cd55071b94c2d1304b04daeacd1d1c9020cce2a97fa7af83dbedf4e6d17dd12c0f337f32240399785b157a66826d27512c3618817fee924e53d14cabb2c4c7f454affde37350f55f0b29973eda4d0c090608c15a976688cad0b2114fdc0dcb89ad37515287ba13aadb2ea8d69f6792a87327ffde2ee4551bb6b99617f53e1ba71bf9a70f45dbc57eac2a361a7d8feb95be97c957fc7652d348f4fa9a987bde5f09883f46b65c460f1c2a69a33b086364ca51b030b6b15e99be46ce8255ddf62839a4fc7f2b34023dec2e4483abea830ba8b8230540ace51788d0712bed9006697ddddb9cbf133c151c51c0b6c7817443b021aff44d4416c09fd039849db81860b9b5144e789fa3987c6af37a6739f0d919ab7049caf3a85831cab44bdbea27e0d9de7adec80334e2bc8b4d17c1f0aa7c50f2fa23d7c328482a4ad2c4da4d600f358ebdf200cbefd83cd7255730b6a7a3895d622d37d0e8f984d2d280689acef56ff195d663e7723adce09810adca70ebec87bc455380ef629ceaa2a0d926149d9115604060167682cd1889d81cfa99d52017732da9dc52127d03893037874c8671943cede4b8d1bb2d4ed2d87942fbefa5d7b7f19fb6f2e9bc293c96bf577bb97ed3ca56185abcf25dabb47d75f2efa6a5540661484efa989ccb338f24938b23152f14f3e424b0cb5e076e13a7e112d364f03bd1ead7abaa83249d544491621254860ab0a73adc9b9eae055c5736366811d2a4b1f78ff206486e7f7445040122efbe023ecd2d20bccf43cb68850a2506805d60ff466f54eba331e1cc2a513b329f5121e0c39104418f7d9865ea3874d2b135eeee0aa0d12fc108d89e1dd706e4e40eb7605b76d35ca
Critical UniFi Flaws Put Network Control Planes Back in the Patch Queue 10 indicators · Jul 8, 2026
Vidar Stealer Campaign Shows Why File Size and Fake Signatures Still Beat Weak Controls 119 indicators · Jul 7, 2026
IPv4 (4)
116[.]203[.]243[.]208136[.]243[.]203[.]109136[.]243[.]203[.]111138[.]199[.]246[.]13
Domains (4)
URLs (5)
BleacherReport[.]combleacherreport[.]comip-api[.]com/jsonjustwatch[.]comsupportxmr[.]com
md5 (4)
sha256 (100)
03e6f4f49cec3af38bbec9ed64c195c7a85a630ec989efb3669f04a2993c1dd7097a87cfa4a5186aba3bba096866692951bde59c6f0c2e8c1c4a599246d14da80a6a67a2fc4d79ec1cd8afc5b8b7a5e69a406e53d57a7334e097c5d0644de5f615489bcd6e4602b41c9a787ec8d7ab027d5e45d400938048bb1c702ad5937980169a330353e53a409e0109c914404354741ff1e1c64e501738dc05e58ea92abc201594c9d173bba6cb509407ecba378c19b93da0a81a2182a913c480e6dbb54e20bf39e1e67152039e70a01ad9e7b23c08d23d2a724ef9c44903f3d4353a22752a02ec4af5ed591afdf1236a443e3b68642ee133f38a2857d1eada51246ab4982b7297a5f502a2e9a59066f0a370bc5a8b28addd0e27975db3d770f801c153972c0b344af415b787b396c8e23bbeb112bd471a1ca1d12cf357c48e2ee1ae068c2c6e8f86c05781af12b323311e83e011f1a603928e2086c48e2ca59e33d90dbe2e11a16f94484e0f43eb4572f800f26f0b4a1314cbdae3c44c1ae35f376906d82f1400a91c853d61622f4d21ed97d96ea1093c0fa1586669bea6f6baa331251f314ce675c040c63b825f213965f5c76a3bd09bf70e138708367e2a84e9e84b3032172e4d8d2ab9fb29b36c9b279117be6ff611b5b91ff7b1c42501a5ec969f2b330efeebba3782994612fdfe20ff96c930af33a83b88a342b6622461511921b235b51bbe42edd15918b015eaa1b4f0e6b5c94f186d71d887e39f1da69a4dec3f35dde1b2482b12582820a861e7c46f10721af6b75052fc872c05d2230a4e8ca13c3f12531045b7eedfe25e0f291d4792b0d8c8366f8de043e2fa8ecf34ccb9133db33b0423bb9278db267a7adb036ecbd6aeebd7909d06d824919708b1e12e1b3e906ae47e9836a591f44d4b743e961d634a404fa8fd8bfae64f1d54c853be2b43920ef7d2742d140a1ab2a1ef172c716903474c73561377dc4f1534d2c5f58147d6d1a38534ba897a5a1e293e3d5df303bbd8e0526e756ad08887ffc1417bef488d941b7b4428b0f4a0e5495e3857b9b96215fb3e7f164b06640d59096425e64bf770a59d367b532dec32668f86003b17d93918dba5ef5fd2b19c53942524364f456142caf590d98fb11ca247800bb417766714527e5a4707ac2f5d0154262653d263b292be387843fadb7131c2d538b4262c81f5b95cfacafacf2d5446c06e5494909e0f5221db75e933b28981b2d0e118f227b7d8a5980d88b500b76dfc2e54dc05ab56244444f86d69b8274a6075906f7ba2307b08e08d3884abde255495559f46ceb801a3540eace594476718e1486b5b4423cfb4ff64530ff8fb4a38155838ae6c748dcbdfa13c6529c654cb821897d29835d3e7e05ca23fb2f3794f0259b9153c4c9e155c976db1a2fd4d1b28fa10bb9c4dcafdc4758b352c037e3d865b6a466b65d479b77a03b15a95ac097b45e23ff7ae5ef6282985b2a503deb6915d7324d8b5a25f862ef8223c6766d0e80af3ad168e17312b265e13a3a68e0ded613e5314a7ded3155cdec49fd34e852e181f4651d78bd8bf3adad2f4dbf22b0d62877a5096828c4bc2fca7cbee7d38b11a0c90fd0d3fc8c37981581e9988c919634e89d8592d7c9e2bc1c098217a813947b44a4f80bc569e9a15c1e8b0864b9167569adec99fd38b114ae07e2e549e6c16f75368f3c5373022c84934ed1c8e8468ced9d7c1b1ff8ffb5f56c7d3f849d4fd16a1b95324426811424b40043d6d2569946018ddda1058ce5c2a556c78a747838865c47074dcb165effb0840cb1cf56b7ff061eebeb9ead8812c410247768a7ba90786aeeb1bafa6412cc5b08237b56d49233b1fca22f3823e856e4c16749e9c45f384ea57055fead16df35b21722671c79e8bf71ed257435ea9b8b91e118ba03ec681860651190f7d7457804313ee739cdedb20de39aeb1f15dc8c2dbbf15fa993250fd879bf87443ff9aeaf4997b74df77b6a83d89fa137fd285a2efde36b1d62c00b3be81cc93df7d1e6e94837b7720e83c02a027d70ae201c393c1956aa2fa8199879a3a4c4fd1d20b03022cfd77469615c5f548063922b469a8c0a4116511395d013e5a798e123e9c119acc4b7828e17e674507ab13dfd84b31b361fa19b9cb27ee130620ba9211feef746d317e49da0ae2f81e14841f356b4d69f0480c2d9ce3fab5a3fa91b0036d9a36fa0f7ed4a256e1d281cb4f194d13ff554fd4fb280dafde0a67a18115ea038ea6c87d8b40cc7d173efd27fb60f3d260acef28f58d67d1f39597e1d611db311a305f628dbcde2a28a0b3de201214d7e3bd43acc97561924daa247c05c4b0536d42be85901a43b42f997710147295a0625e20c935207f8c531daf5311449ec119a37dcc914c18a04a2727bba9cecab78a1d516ec3c7a3f667e0e5a6081aa0e9206a69fe94db6fa14b4e487dffba709b87e8a7e25483300ed409de243b19fff7cf2f097895cd48130247525d8a7e966bd3fa07e9d6c39ebbe3058ecccb336f66bb8e3d1e9656d3301f63ef6114289739a1c44082206298f787238fc6c190ad87eab2475196bb418128deeb2b9d2e4b66b98cae07b238b326b6456cc9b86802e67c504a0398cce1e69873de25e5139aa848f469bef2af345a8a49d15000b5b5e72b5828969b3df1b6c1b98c201de09a7719066f7bcae6b66a3173b703a617f53fddf67d51a1039de7ec690d64db9d7d91f3d777d308e49e958de4154aa0b62ded7820f1fea17a972a05afe387ed32aa2986d5be8bca2f22619d0aedfa834c6963abfab3bfa4f979b4a5d7bc8bc455dd4c09b44e51a389576fccce35a2c8da3ce680237565a64843ebfbc39e96ec7613003b1b5c3a9b878874ea15a05e1d34ce91781ebfb6a785fc61fc4ff7cff0ddb540bf7ff12111ed0d6031f78f48387a6c16cb3c5451aa0083f662f055e8d911c5de3a8f3a31b3c84cacc7dccc30c98f2be14dba4102aaa2bc1128d8b8b2da76262bf87ede19bac053cca6576efba6aaa71c9438c304b58814fb3ce5a085014ee6e8d89f7cc1380b234b97170fd5f3398031281c6a77b6912c23cccc4b0964d55608916297f6978f0b38c80a4beac472004a786fcef7b830f043076a12748b6a2dc0810ece85439ee77434d991ae7d84201b09ead756b8b5f6991a3a61083461d5269245bebf28b90934c328848ba8c1e084a5a6216cb927d265fa29e471c1ae0d31516e480c09c0fb17f480ad08ea8d5b73e84b7a1bb9b6893fa6b04ee8daa29e515c08239ac5204af1a1fa2bc10006eede1b41329bbb30cc2b302d9a6963109b201b78d4163bb6c2d7bc8bf5a66e9a744b62fc2717bd3230e4ceaf32ad2248ab069b164bd2144401967ac69de0a4cd1734fe429d9cc25799facb3e788830bcf614f33411d3bcfc0edd4a2200e160b5eb4ce700039fc328b78c21060e2203ac517833fce41572b91878e187f85fa434cd6914659834c39fedb662259bd76b11616966c41ff1fbda58d9b129b9c1bd818700eea92b29c7a4a547eb7f6b0b4b75bb6dd8955244bb2618ba234ae740cdedd7c2d30e3465c7c37a973b14edd5b6b2da4a1497c593e43640735ff54aecc9a3288fa5e548e3ca8a00c9d36c64e5dcf562c7ae2b8df4bd6455fe0b41b32ee3a2a528ddc2d155ce379de03e35e0ea2c88744c29b9e2678165214065f9b957177002c6bbe69084d18369be4487d7cd0e4bd3dd0da720672e56e13ca43627305e26767e26925551d2148a458da46e81702136aa915312d360805f083d1f37ff5531db9fbdb8ad6dd384c403c084967d8c967501ee6332b050af04ef424f13a3f5a88d155389d98cd6446f2803444bd2200d48a01a9ad7d487e67e8e831c9cd13f89cbfec17fd4e2d7745513034af14617436ad6b3fc125fd0343218411d0c79bda56b0dadc86b2bd78082dc33c6dca98316e865efa9829c6eb5a97c2ca3cd4ea6c2123a5f6ae45bd7b56818c829960b692de9ad5a14e52669d953e9f074f7218c3fe34ede4a11a0d7c9c9469c513c05aa431fae34f414f91fcf3f794d3e76b6e4d0b92c4cd3ff2ed8ac0c08e4c698017558e532974cf749135d3d49757f05001e6127dc6e07cf17d8c1f96107a3349e62b3ab9afc60f62af9c89b6961b637a26b71e1230f2b3b8adb2a872f712fbdb1e347d06e29a9ed8278d86710ffc14ff04422be76e47124f4dccf9f008b42a04f7e69d3bbf7b5ce81e71308545d6176cc4763920a424e5ac1e5341edb7c039c456d46c39f194be86ce4b41725d7ad12d297d18aa99cddd675e88c41a6f769cd760e323b4f7c01835433cd4059cd59630cb1a9eb1181b350ede9e5e748ec5c0b811c8e60b0e55059edb4d2df86ff3ca45969e57d5fecb11a38f0dcb7e407de85d8de8e2221df8dddecac8aec88af8975c9f07e14100f6edb88f13f9cef5cc020bf673c7f4e19c93c312a043867f46796a8f01927a9a14c2533f760bc16a585325ba9d74917f9e0994d3a4164c1141158c799b619d2c823e818
Bitcoin Addresses (1)
UAT-7810 Shows Edge Devices Are Becoming China-Nexus Relay Infrastructure 96 indicators · Jul 7, 2026
IPv4 (4)
194[.]233[.]92[.]26217[.]15[.]160[.]247217[.]15[.]164[.]14795[.]182[.]100[.]231
URLs (9)
hxxp://194[.]233[.]92[.]26:2222/hxxp://194[.]233[.]92[.]26:8088/hxxp://217[.]15[.]160[.]247:2222/hxxp://217[.]15[.]160[.]247:8088/hxxp://217[.]15[.]160[.]247:99/hxxp://217[.]15[.]164[.]147:2222/hxxp://217[.]15[.]164[.]147:8088/hxxp://217[.]15[.]164[.]147:99/hxxp://95[.]182[.]100[.]231:2222/
sha256 (77)
0352f3e338261d98895df4c7b7a76b296485b2290c72bce56603351d167d060103926e3da998f32ad898b640bd15cf145768f9e849e6f18d81350234254c424e08701ed7975bf4f5688c2724d27ab497764200ad6f4dc53d3cc03b170378ced00a8555a71868749be8c905ed53296ce335af50a9262772b5e154ad3f9c35c2e40a8cae96e25e85c612b0736fe886f9b124ad70ec425bc2ec1a8a4135b25436ba0af4c52a1d13e4132a1843ce7727abcf0ddd4d1ca6a4b17cdf599ec3f355c24113acadb3541e75af50e02d5be56c2238b93d8f154ce5514be1558e6ee59a14321660536f448b8b9f086ce9ea3ce4e9deefc59a76711ea53ee6d8f08fc8c1bb9916971f9706d70ac4925651c7c8719b9d77aff63e4c0a618129efc32c2c46b9891b5649b479fd625de5c8120873644b5eb669cc89cd504582c18e0ae350fd882320fcba222f74dd68aaeb1f0ad30cdf702a828ee164a182b30d05d600c35b72d929686c933cec1e274467e2dae264625ae6f754824bb7f550bc9c3131f625562c29c7fccc6ef8cbfe4da9a169c7c74bacaea1fb515a1fddef91ab1b1522f76e4c2e0e43776e2e1a37d882a1b2ebb7d337ee88950177e43831dae645a367824feb2ebc1b6cf543e2cb3f22d9a5b54b6676bb71dde98df7532f8791297734e44fdd3169a6dbcce684e2c5a2f166996b58ffa673df6e58b8edf2bdf3e66271c8c69e323c3a91be60ebc3e06e942bad04899a15911cea23269e43d07829164b2ce5d4324d95024fc8da5c92b5a1f4825aed5a2a91c9ca8fb6aa52abb332a4c9cf425733c10b77e1da9f0679023d55fb3057879d15609db9c1d46ee5c3ff1240a3d0523878dd5c8eba1e5b53ab2e07e7b5482e95a3fd3e98268bcd7861318bc99023763b89d183eb014e29d9d0d4e45fc2b784a7fcfcf31dd48fd3bde30f8d956383d13d296af7f29c0425655bd1cc0be48fe4aba52ee6760a89e805ca2589f4ef4d773fcaa3038e365b6ab0b121e2cd319c56b74e37381943a0da0e8dce407087cdb84130f49fa81a699a667cafdbd6d1f6e781edd686c947eb8ae27134f6dc2c43d7425bf771c8c9f740b1ae9803dcb4fd45af4d6a6f171fcc72fc7d511095ca82ce52b871429833e1dee348263844efb531f6a3fcd321f88dc8a876caaee912cedd534a4a5bff2609a2d6e088cb87465c08c2d69c6aaa7d2ffcbcd491274b8505f153ac2b231c23d41234e55b1f7ed89f86234f785adbbe820959655d7b019d7df957bdab2ba4b05ec0338c06632599393d5b14227f31a43fe950ea8fdd474287155c3f190571645c4641dcff2c07a4c3ab9acad06aa9607350a385729d8d6139f15db2ce9acd50f96d566e8d139f6490abf2bbf7a9293b876eeb4598fd2c37c5155dbfa033676b5caacfae902734ce462cd871181eefbe299250ca8ac7e139719e5e225ea2648a8cba0fd94ec7fd8ce5315f5d0cc2922bafc9db3c8c41280e917c5eab4c61baa67ae2838a36c2e6ff0476a8f2117b96a7027b830c8cb46ce78efc5faea1650cac0f3ffd2dc1fb220182095a46e34158967d37c2a942e85e2ca97b604b53f87d6c070bf387e80c70a6df8d272fa3fc143148d41f13e59d52ab1f1362d4ec87ed21f0d15cb769b0b2a5577cab41fc2cdb1e7e796c5bdff09264dd9a6366d59b573d50fd23ff650923c4a8c1c918518a02d0a56f12c23533c45f439d65feba2c971c214e71303ad2e0fbf62b45ebcaa784cbf3d0dab62786cb4c046968445a37a9943a267a8b2100fba2678353d6ec88844505ccbba659e586c7a1056917c0f9eafefe42e33e791b75a7e503ff8b081bc10a98449e4076787dfc6c166cda1e81667f869940401f05a55c8dea94dbdf3ceffb93b5f320a6462cfea44d6dbd507ca7cecea861f9cf704b3c5c37f5bd5392886a8c2562088892b7703fa5745538dea8ed9aec4466e67a9d0aecf9e7026ff16a792d1d6f306e8b67d3f34c755fcee1337a252203002ecfdf673a08cfadeda8d738bef2d518a08e0626aa4f76d9e2a2ff313f5b91cc67aab1127122baee1c3efbae1087e58a25bc5f1eb0658459ff264a2c81c68a34c4ee6bc109d141ad28b96037d34ff112322a4c853739880425fee707e9f42e0b8d60119ed639b1ad506ea29877d126bdebce379cd22989f0a67bc595ab8bce02c2f95f9292ad06e1868207e809c76bd16f0cab800c068c104da0e66ef6384663309aaf8fb49f549f2785d835eec620b265f8aa11d9f0912adea5339c73cb4a777a3e9f98bf3cb08da6622c9dd3b4cc9b083cb03d10a29a927c37a31b80975c5c5467f112b61478c9493c046281046443525358a5acb09b9e0e5a1eb469b8d20dc23351e08ff5d5731e1cedce0ddee9bbd00a76217f139d52cb4febf3342c34dcc8198dcaf453458be3699ab47dc08616aa7f18daa7faac8eae94d27122f4751bc96d9ea52d30000b7ca37569a2291b2710824ca3396fb5969636eec376ad6c3ece2202b1722219955638e09b6f96d4cfc0598d3b1890b8d247fd1fb85d24a17afeec3815906dfbcdc5359647910b4a153900ec999a0fb9fe48bda9a6c8787981a24f8bbc723a6f6aa80cab5fa53481937382f3c6ce85bafba443170e54ef7fd431ce7f1b5e202719f3fd022e4ef70788904f574d2cdfbf70c6f3a8e913f526ec57eeec50e1306f7b34b037915b7a1cf2968cc46acc58c2ab9adaba93ff094b8f3fc37d906014d870582039d276b7bd03e6fd583d8a15c494c878e28284539419612616d964ab9224cbe27e57f42293d91d02d684e3dbc7c9bfa9ffcd8fb6a2afe656f510c406ddc58ebff48ce1d0fd3fad951b46a36ec92541f273eeb576d39235d0a5c6f18f2574b132a1022598edfa38065783ab98d1f963b88672f3676a7da1580262ba0d4f367cc57a94b551754c20f77a670c43d4861088161fc72b9922abf933b4ea664a807105ec1eab4a173253aa60bfe6d7d5cf7315186a78ab6a7475c338bdf101bc6461930aaa7a012a02cf93f347c207d81201d0fc19977e51104438a5b9cba861f4da20cea3ae9183edf16ab11d98f8d871d76171504597bbda387689e12e7a5e354c360ff135f4df231cec68c761afd973ad5a80c3d7468a9c392db4166857ed32b5d61cd6755766ba8922156dada3dc4f25b2247cfdd6fc96848db30a178baa4419a4c854e86e315b465836102d14dd0fc1a88180fde8367bec7086f99294f36b8332f12994293139ed532d2ebbace5d2de8ae98579bfb940290f60e59a502b3065345aaf765456387989c0488b20e799d72929d7ccc7f6b6109742b8cc482838303207efc989543b6e1ca6d16e9cf235d2e044c2f7814e6bbcd835b9fd9f10f227dacfb9396185ec2013e7df4db4f3fbf4481f30fd840f35568746f54be49eb92b2c9ac95597a7760abb171cb54bf5a57dfae488d9dfe260b32460a1d947fb5af58ceaf2fb0139bc08b4bb79a966
Vect and TeamPCP Show Supply-Chain Credentials Are Ransomware Fuel 1 indicators · Jul 2, 2026
CVEs (1)
Ousaban Shows Banking Trojans Are Learning to Hide From Sandboxes 36 indicators · Jul 1, 2026
IPv4 (4)
162[.]33[.]179[.]46213[.]159[.]64[.]19178[.]40[.]209[.]3291[.]92[.]240[.]140
Domains (7)
controlfacturas[.]siteduckdns[.]orgfacture-arsys[.]duckdns[.]orgfacture-in[.]pages[.]devfaturanova[.]duckdns[.]orgfaturanova[.]xyzpages[.]dev
URLs (5)
controlfacturas[.]sitefacture-arsys[.]duckdns[.]orgfacture-in[.]pages[.]devfaturanova[.]duckdns[.]orgfaturanova[.]xyz
sha256 (20)
18fd38988d58dd930f5992d448cc09a9400c1eafba76b820b9a83239ac48cf4e19ac18a50abb48dc0ea9524850acfaec49359e6b3bcc67c6193c2d56da812c711e77992666acbbfa0d01fcefa9cc8fbdac291e0681b35745be27c6dfb159a37521b24f7ee1f6bdbbb670f0394d66009ee0daa8ced57048298da715e88f7a7cdd48723a33bab89f174750576f9a62da35b3b9e5ac31a5a8f1ce9859a1b35bf8b84c9fdc2823da505ef339d43c6ad38499b7e3447736733e42b5ab6b1afcfd42aa4ca2c863d740bb7022776dccabd8ae34bb9998768928042d76ebcf08984eefcb540ee1936e61d2344b5ebc93485589a351ec2f113a9b4940ae16f3baa48073925837e47198a20877e1b04b270c36d9194206ee38d4f32fe3151b3c3b396c4f0d5a2ed557c357ba8f96f2d55a8a00695987806b5df766cd1dfdab0cbed111774a5e06af187b45476ade0d953e834fced6197d0a33ac60c2575877660e26ab15e865c1a998bac48e02b52b1c850cd500e9fb87521e21755c3a4a491243f5f9a7006bc2e11b0917f47d0557288c4f0cb20bd7589185943b989a969fdc6d3704ee739d07a83cf89685651ea8992047ae694c24f6ddef193044357debd15ce07a64fe9e81ade09cc18f0fc09d73e72d2e0bffad02f52fdcc26553e473cee8cabc1567d4eb4ff02df659fdeec17d36b77084627469623bb3c7d16383d257404b52d1c3e2f0c2d4c1552cd81fa012043e4a5ac832582b639b7b6b7eccc0c4802d7a8ad8e6e78eb2e9bd41a4bc62f7ad54d095ea9813864bebe37172ae30a1afa631fe14fadbb8061715128bebecf7bc59132b6bb04fe8cc39b965aa5b8722dffe28d7e7ffb9eb47cc0cb2f43e04a10dc84df13d04bca1ebacbe47fad0b669728de2f59c
NUT upsmon Command Injection Shows UPS Monitoring Belongs in the Patch Queue 1 indicators · Jul 1, 2026
CVEs (1)
ARToken Shows Microsoft 365 Tokens Are the New BEC Control Plane 15 indicators · Jul 1, 2026
Domains (6)
clear90489058903-document[.]workers[.]devdashboard-bl[.]pamconj[.]commononapfp[.]sharepoint[.]commononapfpcom[.]sharepoint[.]comsharepoint[.]comspx[.]pamconj[.]com
URLs (6)
hxxps://mononapfp[.]sharepoint[.]com/:f:/document/INV-IgCx1X50pgUjR7iAjZL2fuQaAW4GfKVs6wHT3BYv9sgwW7g”hxxps://mononapfpcom[.]sharepoint[.]com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEcpamconj[.]comsharepoint[.]com/:f:/document/INV-IgCx1X50pgUjR7iAjZL2fuQaAW4GfKVs6wHT3BYv9sgwW7g”sharepoint[.]com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEcworkers[.]dev
CitrixBleed Keeps Returning: NetScaler SAML IdP Memory Leaks Need Edge-Control Discipline 2 indicators · Jun 30, 2026
CVEs (2)
SimpleHelp Exploitation Shows RMM Is a Credential Control Plane 8 indicators · Jun 30, 2026
Domains (3)
URLs (4)
hxxps://blackpointcyber[.]com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/hxxps://horizon3[.]ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/hxxps://simple-help[.]com/release-newshxxps://simple-help[.]com/security/simplehelp-security-update-2026-05
CVEs (1)
Bing SEO Poisoning Shows IT Admin Downloads Are Ransomware Initial Access 75 indicators · Jun 29, 2026
IPv4 (11)
109[.]205[.]195[.]211170[.]130[.]55[.]223171[.]22[.]183[.]43172[.]96[.]137[.]160185[.]174[.]100[.]203188[.]40[.]187[.]145192[.]121[.]22[.]94193[.]242[.]184[.]150194[.]127[.]178[.]214[.]239[.]95[.]184[.]32[.]84[.]32
Domains (29)
2rxyt8yrhq0bgj[.]org2rxyt9urhq0bgj[.]org5ka8rxp6t6eup2[.]org6cimu4mc085em8[.]org8doj8uvx604eck[.]orgTria[.]gecertgraveyard[.]orgd1hmxkpwby0d4s[.]orgdelete[.]medownload-center[.]onlinedownload-server[.]onlineev2sirbd269o5j[.]orgewujsfb1dp5ran[.]orgip-scanner[.]orgks501oz9nm3v05[.]orgkwywztxoo2xdot[.]orgky1d1p1daahe5t[.]orgnetml[.]shopopmanager[.]proovh1kn1tcqw5kp[.]orgshopping5[.]shopsigmasearchengine[.]comsoft-hub[.]prosoft-server[.]onlinetria[.]geurlscan[.]iov5rjsdqogstopr[.]orgyj6jurm5qqkye5[.]orgzenmap[.]pro
URLs (25)
2rxyt8yrhq0bgj[.]org2rxyt9urhq0bgj[.]org5ka8rxp6t6eup2[.]org6cimu4mc085em8[.]org8doj8uvx604eck[.]orgd1hmxkpwby0d4s[.]orgdownload-center[.]onlinedownload-server[.]onlineev2sirbd269o5j[.]orgewujsfb1dp5ran[.]orghxxps://tria[.]ge/250530-ttmjhayzhwhxxps://tria[.]ge/250812-zw4tfszpy4ip-scanner[.]orgks501oz9nm3v05[.]orgkwywztxoo2xdot[.]orgky1d1p1daahe5t[.]orgnetml[.]shopopmanager[.]proovh1kn1tcqw5kp[.]orgshopping5[.]shopsoft-hub[.]prosoft-server[.]onlinev5rjsdqogstopr[.]orgyj6jurm5qqkye5[.]orgzenmap[.]pro
md5 (3)
sha1 (3)
sha256 (3)
Bitcoin Addresses (1)
Fluentd Vulnerabilities Show Logging Pipelines Need Production-Grade Segmentation 6 indicators · Jun 29, 2026
Shai Hulud Shows CI/CD Identity Is Production Cloud Identity 4 indicators · Jun 28, 2026
IPv4 (2)
185[.]204[.]1[.]22589[.]22[.]231[.]63
CIDR (1)
0[.]0[.]0[.]0/0
Domains (1)
1[.]0[.]0[.]dev
Clean Repos Can Still Burn Developer Machines When AI Agents Trust Runtime Setup 1 indicators · Jun 27, 2026
Domains (1)
0din[.]ai
Splunk Enterprise RCE Shows SIEM Servers Are Tier-Zero Infrastructure 5 indicators · Jun 26, 2026
Domains (1)
attacker-db[.]com
NAIC Breach Shows Why PeopleSoft Internet Exposure Needs Immediate Review 1 indicators · Jun 26, 2026
CVEs (1)
Hospitality Photo-ZIP Campaign Shows Front Desk Workflows Are Initial Access Paths 157 indicators · Jun 26, 2026
IPv4 (6)
172[.]67[.]161[.]215178[.]16[.]54[.]27178[.]16[.]55[.]179193[.]202[.]84[.]32208[.]95[.]112[.]195[.]217[.]97[.]121
Domains (64)
aluminiostramuntana[.]combookreservphoto[.]prodancamp[.]infodashgamein[.]infodeeprace[.]infoderbyoni[.]infodoc-imagehub[.]infodocshub-01[.]infodocshub-secure[.]comdocstore-safe[.]infoexpedla-getphoto[.]cloudfairyspells[.]infofinallyrain[.]infohakeiwjs727wj[.]comhaobbao[.]comheliosup[.]infohigoksbupwou[.]comimage-vlt[.]infoimagestore-hub[.]infoimagevault-safe[.]infoip-api[.]comjoincroud[.]infokellystreets[.]infokelopins[.]infokentjerk[.]infokeypmenu[.]infokinghoruswe[.]infokiptownim[.]infolestresot[.]infolookinlip[.]infoministrew[.]infomontagelips[.]infophoto-21473[.]xyzphoto-box[.]infophoto-dekor[.]xyzphoto-hub-io[.]infophotobook-reserv[.]prophotobookadm[.]prophotodoc-secure[.]infophotosafe-hub[.]infoprejointl[.]inforacestrech[.]inforecallnine[.]inforecepyman[.]inforecstrace[.]inforeservebookphot[.]prosafe-picvault[.]infosafedoc-storage[.]infosafedoc-vault[.]infosafedocphoto[.]infosafephoto-vault[.]infosafevault-hub[.]infosec-safe-dc[.]infosecure-imagehub[.]infosnapkeep[.]infotripadvisor-photo-view[.]comvertualstreak[.]infovisa-safedocs[.]infovisa-vault[.]infovisaimage-storage[.]icuvisaimages[.]infovisaphoto-secure[.]infovisaphoto-vault[.]infowidjssij728dj[.]com
URLs (64)
aluminiostramuntana[.]combookreservphoto[.]prodancamp[.]infodashgamein[.]infodeeprace[.]infoderbyoni[.]infodoc-imagehub[.]infodocshub-01[.]infodocshub-secure[.]comdocstore-safe[.]infoexpedla-getphoto[.]cloudfairyspells[.]infofinallyrain[.]infohakeiwjs727wj[.]comhaobbao[.]comheliosup[.]infohigoksbupwou[.]comimage-vlt[.]infoimagestore-hub[.]infoimagevault-safe[.]infoip-api[.]comjoincroud[.]infokellystreets[.]infokelopins[.]infokentjerk[.]infokeypmenu[.]infokinghoruswe[.]infokiptownim[.]infolestresot[.]infolookinlip[.]infoministrew[.]infomontagelips[.]infophoto-21473[.]xyzphoto-box[.]infophoto-dekor[.]xyzphoto-hub-io[.]infophotobook-reserv[.]prophotobookadm[.]prophotodoc-secure[.]infophotosafe-hub[.]infoprejointl[.]inforacestrech[.]inforecallnine[.]inforecepyman[.]inforecstrace[.]inforeservebookphot[.]prosafe-picvault[.]infosafedoc-storage[.]infosafedoc-vault[.]infosafedocphoto[.]infosafephoto-vault[.]infosafevault-hub[.]infosec-safe-dc[.]infosecure-imagehub[.]infosnapkeep[.]infotripadvisor-photo-view[.]comvertualstreak[.]infovisa-safedocs[.]infovisa-vault[.]infovisaimage-storage[.]icuvisaimages[.]infovisaphoto-secure[.]infovisaphoto-vault[.]infowidjssij728dj[.]com
sha256 (20)
04ec44f2618460f5c77c5e56014a512cc03a123c9c5b6b6b1273e2a1681ac2e106a2888c1f07119873ccb051221bd8717281494b33585f4242556e6e5e2279691c693bcdaf1da636eb21c274b21cc2f6c52c62ddd514700783eee83fe13acb0a1f8daffec5945a13a1e9231f4a76655d4c7ef4560d0c64ca3abfe48f38297cbd2e5fd01b7949a45937b853eabcf4b03195614cf84338dcaaa97240d1c5301ddc3f66634f103b80412d1d670b91befab2a74425d2ea76d904c4a7ffae2ae94b4449cc0e0c3ec060fb354cacee244d4f297aaefb6db66e67a21262d6c4d2eae1bd63565f15a99769bbcd527a4d53e5cc259d80e1254463ef9c878c2074685558ae6580de3b74fd635a1d7a887b8f6e5b0c9ac9e90d6e20466ad41489203119cca983e970feb3f10692c164f6889f7a026f135c2433e5bf8e662a6e63a3b81267b789934cb1494cf0327f0ab82fe644c74caf687814379cad116bd7adaca74c102897448688b292bfec6d83b153588076fe59b111c35ac4e42a916238df16a71e2f98825c0c7764f45c891275b2f038ea559e84b340df30b41c2cc77b8d4215c6c89f10e3b6e5745784f26d18c38ce01fba054b19749c17260978ac11472564aee2b7f46b192cd83a1d2487cb048cca645f6e8855b9673d500d50bbdb04eebc6beabd6805782df15e53581096b99bd6bbb81f4d4a5e2d2b30954df63175a4075be9c5baa0c16b0074a1e94b48aa0177e9bfc23746aca8a5b42848a6685da85658b5d14ba95cdce1ef7dc9ad3ac74949ca5db38b27378ee30f30a23cf26f9e875a11da4b72764ae929050353f3da759c839e2a061a8b9a8dd3c3b2e909d4a8a3291cf629311734b7c6e6579f8e1d0e1e3f3bf72c9ac6c301b631ba4df7f393c41b14
Bitcoin Addresses (1)
CL-STA-1062 Shows Critical Infrastructure Intrusions Still Start With Web Shells 17 indicators · Jun 25, 2026
IPv4 (4)
139[.]180[.]134[.]221202[.]182[.]102[.]545[.]32[.]113[.]17245[.]76[.]210[.]43
URLs (7)
hxxp://139[.]180[.]134[.]221/PerfWatson2[.]exehxxp://139[.]180[.]134[.]221/sdksdk608/1[.]ziphxxp://139[.]180[.]134[.]221/sdksdk608/anydesk%5f0117[.]ziphxxp://139[.]180[.]134[.]221/sdksdk608/hamcore[.]se2hxxp://139[.]180[.]134[.]221/sdksdk608/hxxpdfhxxp://139[.]180[.]134[.]221/sdksdk608/vpn%5fbridge[.]confighxxp://139[.]180[.]134[.]221/sdksdk608/win-vpn[.]rar
sha256 (6)
00e09754526d0fe836ba27e3144ae161b0ecd3774abec5560504a16a67f0087c4e1f8888d020decd09799ec946f1bf677cac6612b24582ddbf4d8ede425d83849b481b69cd91b09fa7bae7428f646dd89473a4c03393e43da81fe756cde1c472cbfe8de6ffadbb1d396f61e63eb18e8b11c29527c1528641e3223d4c516cf7c3dce5df29bddff5a4ddaea5c4fec14da91f7b69063a6e1c45ed61e5da4fc6c87bf34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1
Turla’s STOCKSTAY Backdoor Shows Why Espionage Defense Needs Egress Visibility 74 indicators · Jun 25, 2026
IPv4 (1)
4[.]4[.]3[.]12
Domains (16)
basecon[.]combasecon[.]com[.]uacanal1zac1a[.]onrender[.]comcircoloesteri[.]elezioni[.]idnet[.]itdriverx86-adobe[.]onrender[.]comgoogle-ai-labs-it[.]onrender[.]comonline[.]zp[.]uastream[.]bybit[.]comukr[.]netweatherdataai[.]theworkpc[.]comwool-basalt-clock[.]glitch[.]mews-api[.]binance[.]comws-feed-public[.]sandbox[.]exchange[.]coinbase[.]comws-feed[.]exchange[.]coinbase[.]comwww[.]circoloesteri[.]itwww[.]drs[.]gov[.]ua
URLs (5)
hxxps://basecon[.]com[.]ua/calculator[.]rarhxxps://circoloesteri[.]elezioni[.]idnet[.]it/admin-election/riepilogo[.]phphxxps://online[.]zp[.]ua/wp-content/uploads/Tools/EditorToolsPdf[.]ziphxxps://www[.]circoloesteri[.]it/hxxps://www[.]drs[.]gov[.]ua/wp-content/themes/twentytwentyfive/docs[.]zip
sha256 (51)
0a545dd1b703cddfb3d582c8c70f65f556bbd580bfa836a387121eb837bda61b0d6b083208097d5b3e189891338540f6c64faaaaf268b0bb0b085dd53d5857b41682e8d82016b3f10434d2ebac995fd3b6aa812f079bfd7888652e94a994d85119e6ed42248f9d03beb343a7c09a864dcd3cd671c29e1e5eac93579225224ac91a2ca8b8e0344fe3d80da7352206a470245443e2349a237bc093df934ddc011f1fc23ec18a94a599a34c74ef5f49a1e27acd37a07d5846661702b5e7e81a6a24249a4c7cacdd8e99a2a089a5c0ce904f2eff22e0e40fcfb10f7824dca6c51ecb2623c6e3c1f5a7b5e735a64813bc0e1382ae45831f5fadffb08c0e7b096627f72af7b513c05e76d7da5f75bb0a223c894a706c99ef2c2ddfe4eae542f95a08e034fcbe7e90fc87a4f3766469c19a64f24672d7adb99e0198f5ba10d58911368b3627f582420ad2782d452fe6d13fae42658d1484296351d3916703e25dcadd14391e51354118fb87dc57650cbbd94258c3f7c0a0d6868040b7a473ad626ff25e40a3b969d81ef1ef35dd9ebcc6774e060b1b8949d3d74f38ca6b7d789c95cdb340b1208dda0cd5dd95c6b57764b2cfe7145b3ed9457f498408b4aaa05bf3ef50447f430b46fad5a3f8e8c5aad1f8f7f79af069489c3d9c29224bb9f14f0c7bf445bb8d1ab2c13bf4354294e13d3c9be15de625d807301905b98462f43f93e8934e3bed10a8eff3e9205c1f37f647512464271d5ac65df7ae4709735621a3832055249f296b63a8bcf911b8bc96de43c1ac2b4a56c150a19d33d892a47e57352c626330d22f77d9cbca9d40cc06568041703f194610c4c5a84bbb05a2e4ee74596298f3150ad94a242e649886d47c59c634a4d04b9af5ee15e3bf335c40b5e58e667a8f568a611f2f3d84a366b7946b360e055bece9699c95aad619637ab72a386cee9e838792ac5e2098362d68ce93a9a2c095d476dc16b289fe8509c99b2b8b6da0b4c1a5d0d3fb6e6a2990a82ba51db1f68a3bba818baa46526a29731e23427615140f78d9a0ce31cc9fe8c54c60028a7439cb32526fd97b10afef7145dd7877417df21b4b4e8d86b8bda4afeef93fd36f355362586b2d1f51121a8224416780f6c010fd260d0bcf18a4b6a8d62505adbed50d2e615ed9522c4bfd61c00661813c78b5b6ef28a9c0ed35f2c6cd88fc50880ab91f8777dfe7aaccb1c24b08d581aabf646619ea5f4a72457cd3aa17c5988003d67e6454f45e7cb33613021bac82707cfdf24dcb762f4615f01e1ba4d3dfdec4abe9cd588558d2634d7e6a5eeb9164054d0bf0b7c8820da4f742860940998984555e65820e4fa8dd07b6bd67ec98ce3c6e4dd05887ea619f2bbfeb2e2c2805ed07e85e119b79b828b7ef8be3979fe944147c15a87963b06baf6473288d64c23655a0ba9369c35566272d8efc73a40bf9c75d1bfa6d66f1179f2321de6589f80d3089d992797a9cb0e84f6196ceb064a3efb04ed77e6c57955089ce639e193d166c8ea2216c98c3e9b701ea2cffb287347a5bff8af360ce0e6500c336b6fe6d97920abc26202c9d843ffebc5f89b55f3b8a7334af049ba3f70a9ad3fe78574b1e180c68baf9a7110d104387a636b728eba4f0d6d16602fbad05a591f14391594262d3584b2e249e97f86e4dcc5ac905cb512018cc55512c6a22677c3d6f389c47afd54d7c85797868fc4fcb90e9d1e54270433a94aa3d45d888e4c62299bee3480eb2cb4a5489c7dda69d476c3ed3fd32f915c239872c9e7ed9408b1f36dfcef03aa68f9a396d05c437667cdb43d8fe8f3fe838d5b1a1043096f6f6bb6f524f5f1b0c9f83a081078a824daa0cf3da8a96bc74e265f945f1cc6992c6dc0f9ea36ed1991f7b8d312db79d9bf78c40dfd5cb91d06b9649d4cab500343af80ad1144a9e46641cc406f43dd169003c22e1d16fb635060d23e889b0617d77f0cf06d00cc19b43a2c8b5ac53ac027ac722e2a0f4440f67998a0215d49be31746ea192bfcb4dc4ee532a218f8cf13605714e316b1e13154dc6115e1e0c023f6fe3d17861cae839d4a4a81779b6aad9a24f8e3364ee21cae6725451e8bc9ab9933df0000fd19814170bd132da68d1906d5ffe6d8192960a89d5480868b94088cccdaa1560f9c8a0b0282ced2b7c1f72341b6e83f274bf9914c6cfc0c6b3cdadf089565f49dace4aca93287c22aba9641c8f3f04f43b6f7c2d86109c495179b497f7fb45fd95816623de1b77900f71b4f99edf964353b9ae4bedbe62de6c0d7eafa9fb8b87897bbaea483aedaa8ae191834da
CVEs (1)
StrikeShark Shows Loader Malware Is an Edge-Exposure Problem 31 indicators · Jun 25, 2026
Domains (4)
connect-microsoft[.]comms-record[.]comms-record[.]topms-tray[.]top
URLs (4)
connect-microsoft[.]comms-record[.]comms-record[.]topms-tray[.]top
md5 (9)
CVEs (13)
Bitcoin Addresses (1)
Operation Escaneo Shows Latin America’s Edge Devices Are Prime Intrusion Targets 25 indicators · Jun 20, 2026
IPv4 (8)
135[.]237[.]122[.]202165[.]22[.]184[.]26185[.]65[.]245[.]10200[.]79[.]113[.]136201[.]144[.]122[.]58201[.]144[.]122[.]6045[.]61[.]137[.]12662[.]171[.]185[.]97
Domains (3)
ld-linux-x86-64[.]sorev[.]shwww[.]news9live[.]com
URLs (1)
hxxps://www[.]news9live[.]com/technology/tech-news/hackers-used-claude-hit-mexico-agencies-150gb-data-claim-report-2936314
Showboat Malware Shows Telecom Linux Servers Need Rootkit-Level Monitoring 9 indicators · Jun 19, 2026
Domains (4)
URLs (2)
hxxps://pastebin[.]com/raw/[actor_pagewebredirect[.]org
AutoJack Shows AI Browsing Agents Need Localhost Boundaries 4 indicators · Jun 19, 2026
Domains (2)
evil[.]commsft[.]net
URLs (2)
evil[.]comhxxps://evil[.]com
Apache APISIX Auth Bypass Cluster Shows API Gateways Need Plugin-Level Review 5 indicators · Jun 19, 2026
Domains (2)
apisix[.]apache[.]orgwww[.]cve[.]org
URLs (2)
hxxps://apisix[.]apache[.]orghxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-39999
CVEs (1)
FortiBleed Shows Firewall Patching Is Not Compromise Recovery 7 indicators · Jun 18, 2026
Vendor-Signed UEFI Apps Show Secure Boot Still Depends on Revocation Hygiene 1 indicators · Jun 18, 2026
Domains (1)
pg[.]ae
SmartApeSG Okendo Compromise Shows Third-Party Widgets Are Supply-Chain Risk 12 indicators · Jun 18, 2026
Domains (6)
api[.]wigetticks[.]comapi[.]wizzleticks[.]comcdn-static[.]okendo[.]iookendo[.]iowigetticks[.]comwizzleticks[.]com
URLs (6)
api[.]wigetticks[.]com/logout/private-response[api[.]wizzleticks[.]com/claims/scope-schema[cdn-static[.]okendo[.]io/reviews-widget-plus/js/okendo-reviews[hxxp://cdn-static[.]okendo[.]io/reviews-widget-plus/js/okendo-reviews[.]jshxxps://api[.]wigetticks[.]com/logout/private-response[.]php?8D1V4th3hxxps://api[.]wizzleticks[.]com/claims/scope-schema[.]php?4ManBBdA
Tor-Based Crypto Clipper Shows Clipboard Theft Is Now Backdoor Activity 26 indicators · Jun 17, 2026
sha256 (16)
0020d23b0f9c5e6851a7f737af73fd143175ee47054931166369edd93338538a100407796028bf3649752d9d2a67a0e4394d752eb8de86daa42920e814f3fae820db98af3037b197c8a846dbf17b87fc6f049c3e0d9a188f9b9a74d3916dd5e123c1e673f315dafa14b73034a90dd3d393a984451ff6601b8be8142be6487b4335a6bc44b176a050fd6824904b7604f0f45b0fdfa26bf9500b9e05973b387cfd67fc5cf395e28294bbb91ed0e954fdf2e80ebd9119022a115a42c286dc8bacf57630debd35cac6b7d58c4427695579b3e3a8b1cc462f523234cd6c698882a68c7787a9a7d8ae393aa32f257d083903c4dc9b97a1e5b0458c4cd480d4f3cb5b059d90f54ae36c6c5435d5b8bed40faf54cc91f6db28574a6310b5ffaeb0362e96a7abf1d9d6686af1cefcd60b17a312e7eb8cfe267def1ec34aeab6128c811630b2777b73a4c33ac6a409d475057843be6b5d32262ef28a1f1ff5bb52e3834c5fc824630154ac4fdfce94ded01f037c305eab51e9bef3f493c60ff3184a640502cf9fc891ea5ca5ecd8113ef3e69f6f52ff538b6cccbdaa9559106fc72bc6da30d14b80cbd1a19d4ad0473a0661297f8fdf598e81ff6c4ab24e212dcad2e54b3fd43bf94f0cb0ab97c88113b7e07d1a4024d1610617b5ad05882b1dbab89e15baf3b54984caca95fd496bcfe5d7db1611b08d2f5b7d250b43b430e5d76393f9e0
Dark Web (10)
7goms4byw26kkbaanz5a5u5234gusot7rp5imzc3ozh66wwcvmcudjid[.]onioncgky6bn6ux5wvlybtmm3z255igt52ljml2ngnc5qp3cnw5jlglamisad[.]onionfacebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd[.]oniongfoqsewps57xcyxoedle2gd53o6jne6y5nq5eh25muksqwzutzq7b3ad[.]onionhe5vnov645txpcv57el2theky2elesn24ebvgwfoewlpftksxp4fnxad[.]onionijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onionj3bv7g27oramhbxxuv6gl3dcyfmf44qnvju3offdyrap7hurfprq74qd[.]onionlyhizqy2js2eh6ufngkbzntouiikdek5zsdj3qwa22b4z6knpqorgiad[.]onionshinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid[.]onionwt26llpl5k6gok3vnaxmucwgzv2wk3l7nuibbh25clghrtus3p5ctsid[.]onion
FortiPortal CVE-2026-49938 Shows Network Configuration Data Is a High-Value Target 1 indicators · Jun 13, 2026
CVEs (1)
Velvet Ant Shows Authentication Infrastructure Is Critical Infrastructure 6 indicators · Jun 13, 2026
Domains (2)
libethscsi[.]sothc[.]org
URLs (1)
thc[.]org
Email Addresses (1)
contact@sygnia[.]co
CVEs (2)
Shai-Hulud Shows AI Package Scanners Need Prompt-Injection Boundaries 11 indicators · Jun 12, 2026
Domains (5)
URLs (3)
Portainer CVE-2026-33590 Shows Container Admin Tools Need Least Privilege Defaults 1 indicators · Jun 12, 2026
CVEs (1)
ShinyHunters PeopleSoft Exploitation Shows ERP Admin Endpoints Are Breach Surface 13 indicators · Jun 11, 2026
IPv4 (6)
142[.]11[.]200[.]186142[.]11[.]200[.]187142[.]11[.]200[.]188142[.]11[.]200[.]189142[.]11[.]200[.]190176[.]120[.]22[.]24
Domains (1)
azurenetfiles[.]net
sha256 (5)
2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a3568257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711fd83fdb9e53c5ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2ff02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc
CVEs (1)
LangGraph Checkpointer Bugs Show AI Agent Memory Is Backend Attack Surface 4 indicators · Jun 11, 2026
C0XMO Shows IoT Botnets Are Still an Edge Exposure Problem 1 indicators · Jun 7, 2026
CVEs (1)
SolarWinds Serv-U Exploitation Shows File Transfer Availability Is Security 1 indicators · Jun 6, 2026
CVEs (1)
Pink Extortion Shows Microsoft 365 Defense Starts With Vishing Controls 9 indicators · Jun 6, 2026
IPv4 (3)
172[.]93[.]100[.]252185[.]178[.]208[.]15396[.]232[.]20[.]66
Domains (3)
deploypasskey[.]compasskeyadd[.]compasskeydeploy[.]com
URLs (3)
deploypasskey[.]compasskeyadd[.]compasskeydeploy[.]com
PAN-OS GlobalProtect Exploitation Shows VPN Access Needs Log Review, Not Just Patching 22 indicators · Jun 5, 2026
IPv4 (9)
104[.]207[.]144[.]154146[.]19[.]216[.]119146[.]19[.]216[.]120146[.]19[.]216[.]125179[.]43[.]172[.]213185[.]195[.]232[.]139198[.]12[.]106[.]60202[.]144[.]192[.]4723[.]128[.]228[.]6
UNC3753 Brings Vishing, RMM Abuse, and Physical Intrusions to U.S. Law Firms 15 indicators · Jun 5, 2026
IPv4 (7)
174[.]169[.]162[.]62192[.]236[.]146[.]173192[.]236[.]147[.]131192[.]236[.]147[.]138192[.]236[.]154[.]158193[.]141[.]60[.]21264[.]94[.]84[.]97
Domains (2)
business-data-leaks[.]comprivnote[.]com
URLs (6)
business-data-leaks[.]comhelpdesk[.]comhxxps://business-data-leaks[.]comit[.]comitdesk[.]comprivnote[.]com
Cisco SD-WAN Zero-Day Shows Edge Controllers Need Compromise Review 14 indicators · Jun 5, 2026
IPv4 (11)
20[.]12[.]7[.]120[.]12[.]7[.]220[.]15[.]4[.]420[.]15[.]4[.]520[.]15[.]5[.]220[.]15[.]5[.]320[.]18[.]3[.]120[.]9[.]9[.]120[.]9[.]9[.]226[.]1[.]1[.]126[.]1[.]1[.]2
Agentic AI Failure Modes Show Why AI Tools Need Supply-Chain Controls 1 indicators · Jun 4, 2026
CVEs (1)
Error 524 Smishing Shows Why Fraud Infrastructure Needs CTI 8 indicators · Jun 4, 2026
IPv4 (7)
154[.]81[.]166[.]1743[.]159[.]168[.]18643[.]162[.]84[.]20243[.]165[.]6[.]3645[.]135[.]162[.]9047[.]82[.]154[.]28[.]222[.]134[.]149
Domains (1)
ipapi[.]co
TA4922’s Global Expansion Shows HR and Tax Lures Are Initial Access Infrastructure 24 indicators · Jun 3, 2026
IPv4 (5)
103[.]214[.]172[.]33154[.]211[.]86[.]11018[.]139[.]83[.]110206[.]238[.]115[.]5843[.]156[.]77[.]97
Domains (3)
aeya388[.]clubnwphotoblog[.]comsrt[.]tw
URLs (2)
aeya388[.]clubnwphotoblog[.]com
sha256 (14)
0857148fb0bc4aa7adf967ede2307bdb4fc427065d5b6a6db132688a5a8e1eb82d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d3119cf37b8267db8a2dcd11d9a83d5237d7ef1e42388e7c9afa2831b91da8a2d314f4b59535d1b783e1c20c2be00f9e30f8ed27b2e21fad06a73b47ea43279ef40b41979b317406f8abc601677a3b93aaf6ef8ab8ac188b8f383735e388f13b54fcfa88fffacbce30bbe2136753c9ab5a4c092940d2406fd9d44d5118e745b9d584a9448dda46bd590d7a2f86228100d2ae6e0d6d990c1a4459ed5ee28e07ae866a3836b9a17771bce2161f6b73cbc2494a91e49d6aa30d2d53711e8d10de60d8c9b6542f73c5c7fe455b52f5101314407da4f65ff48e7ebf6896605e607c8d09d0a55c545c4147956db2c2667c4ed931a2875309147548b1dfdd216228f5f73a648db354820ea4d02940cb1702b35974513b7aae83f6dffaacaac4ba31f9295a75eab31d7ff06b6864960ad7e633be3f9730ff3d3873e4539c8f425fc632dadde82998ad5fcd63deae030803388e0fb4290d6223fda82368fd25b99b823f0d2e0a6a71c605d9a4076147e9537f82f79f1e1eccadc874595160aa4637ff4088c
Red Hat’s Miasma npm Compromise Shows Trusted Publishing Is Not a Control Boundary 4 indicators · Jun 3, 2026
Domains (1)
URLs (1)
hxxps://www[.]aikido[.]dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm
FlutterBridge Shows Why macOS Malvertising Is Backdoor Delivery, Not Just Adware 38 indicators · Jun 2, 2026
Domains (14)
PDF-Brain[.]appPDF-Ninja[.]appads-parkpro[.]comadsparkpro[.]netadsparkpro[.]topatsheisdomestic[.]orgcom[.]appcom[.]pdfninja[.]appdart[.]devetoftheappyrince[.]orgflutter[.]devhealightejustb[.]orgsinterfumesco[.]comsparkle-project[.]org
URLs (15)
ads-parkpro[.]comadsparkpro[.]netadsparkpro[.]topatsheisdomestic[.]orgatsheisdomestic[.]org/update-thanks[.]htmletoftheappyrince[.]orgetoftheappyrince[.]org/update-delayhealightejustb[.]orghealightejustb[.]org/checkupdateTO[.]jshxxps://atsheisdomestic[.]org/update-thanks[.]htmlhxxps://etoftheappyrince[.]org/update-delayhxxps://healightejustb[.]org/checkupdateTO[.]jshxxps://sinterfumesco[.]com/search?utn=[Trackingsinterfumesco[.]comsinterfumesco[.]com/search?utn=[Tracking
sha256 (9)
021666417de8b9972c179783fe60d4c4ad2d93224e3a0f16137065c960b1b84530448686ec900d5213d74f08f0d2b7924c5336a29445b2a434aba8d8b19d7530363923500ce942bf1a953e8a4e943fbf1fb1b5ed6e5d247964c345b3ad5bfc3448047c34bbd57fe1e24bc538bc2ce9e0ac4c4eb48d3b0c195b414f0379dc0745644fc49fa1006a2a2acace694e5fb83753164e2617051ece6d9dc9ea32329e708421c902364980e3d762ec6dbbe6b0f40577c27bd79b48c57d098328b25331099053e8ddaecca1f960c041c944ca8799fc71dc86a4b50d2639ee4e0d2cb82f479425e8e39fa8a7212cdd07f0917cb3dfde38a90b87297de2c82a5850aff1e4deb60074d1ea2008a581f432f2dee5f84f78668d9dd8e66f75d03c42dabd89bdea
FortiClient EMS Exploitation Turns Endpoint Management Into an Infostealer Delivery System 16 indicators · Jun 1, 2026
IPv4 (3)
185[.]220[.]101[.]15192[.]42[.]116[.]1483[.]138[.]53[.]110
URLs (2)
hxxp://83[.]138[.]53[.]110/dl/p[.]exehxxp://83[.]138[.]53[.]110/service/save[.]php
sha256 (5)
0da123adf9251957a4b850a3f6bd6a753dd4892be176a84a18450e899534cc5e2927bc31b4f8254c6b332fc03110a6373cad00ffa2ff9de427c26bb222017bb22f25ea1b622abf3212141af932c2ec4cbd6b2b5903c2a531121f691227d98cffd91c00fad521e76efa89715cca89db487d5676f2c767c883482f9c8f82bd383afd65051c61a904a304919c04a8c8633c001183ac73ac461cd4d9057946f02bf5
CVEs (2)
Bitcoin Addresses (1)
Meta AI Support Bot Abuse Shows Account Recovery Is Part of the Identity Perimeter 1 indicators · Jun 1, 2026
Domains (1)
thecybersecguru[.]com
SolyxImmortal Shows Why Python Infostealers Are a Business Risk, Not Just Malware Noise 7 indicators · Jun 1, 2026
Domains (2)
socprime[.]comwww[.]cyfirma[.]com
URLs (2)
hxxps://socprime[.]com/active-threats/solyximmortal-python-malware-analysis/hxxps://www[.]cyfirma[.]com/research/solyximmortal-python-malware-analysis/
md5 (1)
Showboat and JFMBackdoor Show Telecom Intrusions Are Built for Pivoting 35 indicators · May 31, 2026
IPv4 (7)
101[.]36[.]105[.]222116[.]169[.]244[.]208139[.]84[.]227[.]139192[.]9[.]141[.]111194[.]135[.]25[.]13223[.]27[.]201[.]16064[.]176[.]43[.]209
Domains (6)
assets[.]lumen[.]comkaztelecom[.]shopsingtelcom[.]sitetelecom[.]webredirect[.]orgwebredirect[.]orgwww[.]lumen[.]com
URLs (18)
hxxps://assets[.]lumen[.]com/is/content/Lumen/Black_Lotus_Labs_Video-6341053041112hxxps://assets[.]lumen[.]com/is/image/Lumen/author-black-lotus-labs-logo-image-300x300?Creativeid=b08a9660-2840-4cf8-b2b4-aa45b9585632hxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-bll-malware-fig1?$PNG$&Creativeid=baae57fe-30cb-446d-9373-b5835ed6d74ahxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-bll-malware-fig2?$PNG$&Creativeid=679e321b-7df3-45e4-9292-c1c02c13732chxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-bll-malware-fig3?$PNG$&Creativeid=c742db12-86dc-4216-b182-07991ebadce5hxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-bll-malware-fig4?$PNG$&Creativeid=f104f1c6-3a1f-460b-b597-813b63e43e0dhxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-bll-malware-fig5?$PNG$&Creativeid=9f6a7f84-711d-4f83-b1b4-38b6129e1d23hxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-bll-malware-fig6?$PNG$&Creativeid=a9148deb-22b8-43c8-bb11-dc6feceb9714hxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-bll-malware-fig8?$PNG$&Creativeid=bdd1dcd8-5848-4020-b2e8-448ad48d9e98hxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-bll-malware-showboat-table?$JPG$&Creativeid=416e9156-1fd8-4382-b2a3-107f5062946ahxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-bll-newmalware-figure7?$PNG$&Creativeid=adbfea9c-c17b-4cbe-bb9d-c800b6b23a84hxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-featured-resource-card-bll?Creativeid=844b527d-b24a-4d66-928e-9d6964fc2220hxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-header-bll-malware-848x566?$PNG$&Creativeid=7832e142-117a-4b22-9ce4-cf575ba34f02hxxps://www[.]lumen[.]com/en-us/security/black-lotus-labs[.]htmlkaztelecom[.]shopsingtelcom[.]sitetelecom[.]webredirect[.]orgwebredirect[.]org
WP Maps Pro Exploitation Shows Why Plugin Support Features Need Security Review 1 indicators · May 31, 2026
CVEs (1)
MediaInfoLib Parser Bugs Show File Metadata Is an Execution Boundary 5 indicators · May 27, 2026
Domains (1)
Snort[.]org
Poisoned Search and AI Recommendations Turn Utility Downloads Into RMM Access 34 indicators · May 26, 2026
IPv4 (4)
193[.]42[.]11[.]108198[.]23[.]185[.]2382[.]59[.]132[.]10693[.]115[.]10[.]35
Domains (11)
Direct-download[.]giize[.]comFree-download[.]giize[.]comdirect-download[.]gleeze[.]comdirect-downloads[.]giize[.]comdirectdownload[.]icudynu[.]comfree-download[.]giize[.]comgiize[.]comgleeze[.]comminemine[.]gleeze[.]comstart-download[.]gleeze[.]com
URLs (7)
Direct-download[.]giize[.]comFree-download[.]giize[.]comdirect-download[.]gleeze[.]comdirectdownload[.]icugiize[.]comgleeze[.]comstart-download[.]gleeze[.]com
sha256 (12)
062bb28765fbaa11f8cc341fa16e2c7f942a122d929cb41f4a0f755b4429f24616562974deec80e41ef57a71a6de8c03ceb393005fb1432f8d9d82c61294ef8c1b2555b09ac62164638f47c8272beb6b0f97186e37d3a54cb84c723ff7a2eee52ee93ccbcd49ed94c65dcf52e7dcb8f0fa0a443ca24c0e0c7f79152efba657b769077fcf940fc5852fb32beed15636756ebc04ac971b7ed71d36251e7ea70a207035c2abeb617e828dfda1b119b8544fa9ae15a1d263d18bc5506acaf381f4969ff07c9fafa9c03fdf69e4abf6806aa7c938b5480e7e258f227db0719ecd6386a460d00ef93c8ce70d32e48e55781af66a53328fc2dde45519be196c265de074c7425fbe6c3a4937934215c54027d4b67202d12ab490682fae03498870d66d06cf3f8160eb5a5580e0c35054847e3ac4d01e9fe74fab8bc12bf6e8a40bf696b2db2d33c4e6e4a5c2263b56e8303c343305a94dde1fc2968304ba260acbbd9f9fe021662a652ba95c8778b991056696ab3c9b0f60d5e23b1e6cf73c3847db6610
LiteSpeed cPanel KEV Shows Shared Hosting Is Privilege Escalation Terrain 1 indicators · May 26, 2026
CVEs (1)
Megalodon GitHub Actions Backdoor Shows CI/CD Is Now a Credential Battlefield 8 indicators · May 26, 2026
IPv4 (1)
216[.]126[.]225[.]129
Domains (2)
safedep[.]ioteaak[.]com
URLs (2)
hxxp://216[.]126[.]225[.]129:8443hxxp://216[.]126[.]225[.]129:8443?h=megalodon&l=gh_dump&id=hefs8esnhgkx"
KnowledgeDeliver RCE Shows Shared Machine Keys Are Shared Blast Radius 4 indicators · May 25, 2026
IPv4 (2)
121[.]0[.]0[.]01[.]9[.]2[.]13
CVEs (1)
Laravel-Lang Compromise Shows Dependency Tags Can Be Weaponized 4 indicators · May 24, 2026
Domains (2)
Fly[.]ioflipboxstudio[.]info
URLs (2)
flipboxstudio[.]infoflipboxstudio[.]info/exfil
Cl0p’s South Staffs Water Case Shows SOC Coverage Must Be Proven 18 indicators · May 24, 2026
Domains (8)
Booking[.]comdecoded[.]avast[.]ioico[.]orgico[.]org[.]ukmalpedia[.]caad[.]fkie[.]fraunhofer[.]deredcanary[.]comsecurityintelligence[.]comwww[.]ransomware[.]live
URLs (8)
hxxps://decoded[.]avast[.]io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/hxxps://ico[.]org[.]uk/media2/xdrfahsw/south-staffordshire-plc-and-south-staffordshire-water-plc-monetary-penalty-notice[.]pdfhxxps://malpedia[.]caad[.]fkie[.]fraunhofer[.]de/details/win[.]clophxxps://malpedia[.]caad[.]fkie[.]fraunhofer[.]de/details/win[.]get2hxxps://malpedia[.]caad[.]fkie[.]fraunhofer[.]de/details/win[.]sdbbothxxps://redcanary[.]com/blog/raspberry-robinhxxps://securityintelligence[.]com/posts/raspberry-robin-worm-dridex-malware/hxxps://www[.]ransomware[.]live/group/clop
CVEs (2)
ROADtools Abuse Shows Cloud Identity Is the New Attack Surface 2 indicators · May 24, 2026
Domains (1)
enterpriseregistration[.]windows[.]net
URLs (1)
windows[.]net
Drupal CVE-2026-9082 Shows Web Asset Inventory Is Emergency Response 1 indicators · May 23, 2026
CVEs (1)
Void Dokkaebi’s InvisibleFerret Shift Shows Developer Endpoints Are Production Risk 9 indicators · May 23, 2026
IPv4 (1)
45[.]59[.]160[.]199
Domains (6)
URLs (2)
hxxp://ip-api[.]com/jsonip-api[.]com/json
F5-to-Confluence Intrusion Shows Edge Devices Are Identity Attack Paths 13 indicators · May 22, 2026
IPv4 (1)
206[.]189[.]27[.]39
Domains (2)
my[.]f5[.]comwww[.]darktrace[.]com
URLs (3)
hxxp://206[.]189[.]27[.]39:8888/5hxxps://my[.]f5[.]com/manage/s/article/K000156741hxxps://www[.]darktrace[.]com/blog/darktraces-view-on-operation-lunar-peek-exploitation-of-palo-alto-firewall-devices-cve-2024-2012-and-2024-9474
sha256 (5)
4a927d031919fd6bd88d3c8a917214b54bca00f8ddc80ecfe4d230663dda746557b3188e24782c27fdf72493ce599537efd3187d03b80f8afe733c72d68c5517710a9d2653c8bd3689e451778dab9daec0de4c4c75f900788ccf23ef254b122ab4592cea69699b2c0737d4e19cff7dca17b5baf5a238cd6da950a37e9986f216bdd5da81ac34d9faa2a5118d4ed8f492239734be02146cd24a0e34270a48a455
CVEs (2)
Screening Serpens Shows Recruiting Is Now an Espionage Attack Surface 53 indicators · May 22, 2026
IPv4 (2)
144[.]0[.]0[.]0146[.]0[.]0[.]0
Domains (23)
2117[.]filemail[.]comBuisness-centeral-transportation[.]comBusinessstartup[.]azurewebsites[.]netElementShift[.]azurewebsites[.]netLicenceSupporting[.]azurewebsites[.]netNanoMatrix[.]azurewebsites[.]netPeerDistSvcManagers[.]azurewebsites[.]netPremier-HealthAdvisory[.]azurewebsites[.]netPremierHealthAdvisory[.]azurewebsites[.]netPremierHealthAdvisory[.]comQuantumWeave[.]azurewebsites[.]netRamiltons-finance[.]azurewebsites[.]netRamiltonsfinance[.]azurewebsites[.]netRamiltonsfinance[.]comThemesManagers[.]azurewebsites[.]netThemesProviderManagers[.]azurewebsites[.]netbuisness-centeral-transportation[.]azurewebsites[.]netbuisness-centeral[.]azurewebsites[.]netbusiness-startup[.]azurewebsites[.]netbusiness-startup[.]orgdocspace-twpf0e[.]onlyoffice[.]comdocspace-y4cumb[.]onlyoffice[.]comlicencemanagers[.]azurewebsites[.]net
URLs (15)
Buisness-centeral-transportation[.]comPremierHealthAdvisory[.]comRamiltonsfinance[.]comazurewebsites[.]netbusiness-startup[.]orgfilemail[.]com/api/file/get?filekey=T0EnWQ6NugHkW_kLfDxPBEw_um6NSkg9ZwNRQ_5lrKrLLUo35pV8m3TKv1LqF3zZzdUmhxxps://2117[.]filemail[.]com/api/file/get?filekey=T0EnWQ6NugHkW_kLfDxPBEw_um6NSkg9ZwNRQ_5lrKrLLUo35pV8m3TKv1LqF3zZzdUmhxxps://ElementShift[.]azurewebsites[.]nethxxps://NanoMatrix[.]azurewebsites[.]nethxxps://QuantumWeave[.]azurewebsites[.]nethxxps://docspace-twpf0e[.]onlyoffice[.]com/storage/files/root/folder_3765000/file_3764519/v1/content[.]zip?filename=remote[.][REDACTED][.]ziphxxps://docspace-y4cumb[.]onlyoffice[.]com/storage/files/root/folder_3602000/file_3601577/v1/content[.]zip[onlyoffice[.]comonlyoffice[.]com/storage/files/root/folder_3602000/file_3601577/v1/content[.]zip[onlyoffice[.]com/storage/files/root/folder_3765000/file_3764519/v1/content[.]zip?filename=remote[.][REDACTED
md5 (1)
sha256 (12)
0db36a04d304ad96f9e6f97b531934594cd95a5cea9ff2c9af249201089dc864332ba2f0297dfb1599adecc3e9067893e7cf243aa23aedce4906a4c480574c1738bd137c672bd58d08c4f0502f993a6561e2c3411773d1ae57ee0151a0a9d11d43dc62cef52ebdd69e79f10015b3e13890f26c058325c0ff139c70f8d8eadcfa44f4f7aca7f1d9bfdaf7b3736934cbe19f851a707662f8f0b0c49b383e05425074882085db2088356ed7f72f01e0404a0a98cda88ef56fb15ce74c1f36b26d278808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b9cf029daca89523d917dafed0568d11d00e45ec96b5b90b4a1f7fd4018c7da849e4a658e6d831c9e9bdfe11884a75b7c64812ed0a80e8495ddf6b316505acac1B19e06da580cf91691eda066ac9ee4b09c6e5dc26c367af12660fe1f9306eec4bc3b44154518c5794ce639108e7b9c5fecb0c189607a26de1aaed518d890c7add4a7e9f107fe40c1a5d0139c6c6e25bf6bf57f61feff090bee28f476bb3cc3c2
Kimwolf Arrest Shows DDoS Risk Starts on Forgotten IoT 2 indicators · May 21, 2026
Domains (1)
ottawacitizen[.]com
URLs (1)
hxxps://ottawacitizen[.]com/news/local-news/what-is-going-on-in-ottawa-handcuffing-of-another-child-with-autism-worries-advocates
TamperedChef Shows Signed Productivity Apps Cannot Be Trusted by Default 7 indicators · May 21, 2026
Domains (2)
onezipapp[.]comwww[.]crystalpdf[.]com
URLs (3)
crystalpdf[.]com/conditionshxxps://www[.]crystalpdf[.]com/conditionsonezipapp[.]com
Patriot Bait Shows AI-Enabled Fraud Can Turn Trust Into Attack Surface 7 indicators · May 21, 2026
IPv4 (4)
213[.]165[.]51[.]11534[.]34[.]57[.]14134[.]34[.]81[.]12935[.]192[.]41[.]201
Domains (3)
ExifTool CVE-2026-3102 Shows Image Metadata Belongs in the Threat Model 2 indicators · May 20, 2026
CVEs (2)
P2Pinfect Shows Exposed Redis in Kubernetes Can Become Dormant Botnet Infrastructure 15 indicators · May 20, 2026
IPv4 (7)
178[.]62[.]63[.]12547[.]237[.]140[.]1247[.]83[.]124[.]12147[.]86[.]33[.]19547[.]86[.]5[.]1768[.]210[.]178[.]408[.]210[.]50[.]65
URLs (1)
hxxp://8[.]210[.]50[.]65:60126/linux
md5 (4)
Fox Tempest Shows Code Signing Trust Can Be Weaponized 7 indicators · May 19, 2026
Domains (1)
signspace[.]cloud
URLs (1)
signspace[.]cloud
Storm-2949 Shows Cloud Breaches Start With Identity, Not Malware 3 indicators · May 18, 2026
IPv4 (3)
176[.]123[.]4[.]44185[.]241[.]208[.]24391[.]208[.]197[.]87
AI Agent Governance Is Becoming a Security Control, Not a Nice-to-Have 1 indicators · May 18, 2026
Domains (1)
Grafana GitHub Token Breach Shows Why Source Code Access Needs Guardrails 1 indicators · May 17, 2026
Domains (1)
Ransomware[.]live
node-ipc Backdoor Shows Why CI Secrets Need Supply Chain Controls 1 indicators · May 17, 2026
Domains (1)
sh[.]azurestaticprovider[.]net
Exchange OWA Zero-Day Shows Why Email Servers Need Emergency Mitigation 1 indicators · May 16, 2026
CVEs (1)
Device Code Phishing Turns Legitimate Login Flows Into Token Theft 88 indicators · May 16, 2026
Domains (46)
019d442a-endpoint[.]com019d442e-endpoint[.]com019d6860-endpoint[.]com0fdba029e6a5-endpoint[.]com2dc62559e005-endpoint[.]com4daa2aea93db-endpoint[.]com6dd5fd945b34-endpoint[.]com7740f766-8d1d-46ad-a6bc-onedrive[.]p-9jluifuu[.]workers[.]dev7806d4cf9366-endpoint[.]comaudit-report-9767d3[.]fullerjp09[.]workers[.]devconsistentdigital[.]decrediblebizextension[.]dedigitalcontinuity[.]dedigitalreliability[.]deed5ce47d835f-endpoint[.]comee10bbf6c689-endpoint[.]comeuromarketsignal[.]deeuropesignaltrust[.]deeuropetrustwave[.]deextendyourcredibility[.]def36c2774f013-endpoint[.]comf8uh-dwam-j4l5[.]pvasquez-princetonpartners-com-s-account[.]workers[.]devheilbronner-fruehlingssymposium[.]dehewktree[.]neths-sites-na2[.]comhti-245401512[.]hs-sites-na2[.]comjo2c9ada427c6-endpoint[.]comkohlhoff-edelstahlverarbeitung[.]demarketcredibilitysignals[.]demarktkarree-langenfeld[.]demethodicalness[.]deonedrive-7tu[.]techroboticslabmade-techie-com-s-account[.]workers[.]devpanel[.]hewktree[.]netreliableinteractions[.]dereliablesupport[.]deservicewithoutinterruption[.]destablewebsystems[.]detrustedengagement[.]deuninterruptedperformance[.]devoicemail-59f[.]admin-treyripple-com-s-account[.]workers[.]devvoicemail-lyr[.]nbuckley-cambek-com-s-account[.]workers[.]devvoicemail-wx7[.]mark-squires-expressrancnes-com-s-account[.]workers[.]devworkers[.]devyaga9b286ae2c101-endpoint[.]comytgw-9n30-xlwd[.]pvasquez-princetonpartners-com-s-account[.]workers[.]devz6e43e5886fe-endpoint[.]com
URLs (42)
019d442a-endpoint[.]com019d442e-endpoint[.]com019d6860-endpoint[.]com0fdba029e6a5-endpoint[.]com2dc62559e005-endpoint[.]com4daa2aea93db-endpoint[.]com6dd5fd945b34-endpoint[.]com7740f766-8d1d-46ad-a6bc-onedrive[.]p-9jluifuu[.]workers[.]dev7806d4cf9366-endpoint[.]comconsistentdigital[.]decrediblebizextension[.]dedigitalcontinuity[.]dedigitalreliability[.]deed5ce47d835f-endpoint[.]comee10bbf6c689-endpoint[.]comeuromarketsignal[.]deeuropesignaltrust[.]deeuropetrustwave[.]deextendyourcredibility[.]def36c2774f013-endpoint[.]comf8uh-dwam-j4l5[.]pvasquez-princetonpartners-com-s-account[.]workers[.]devheilbronner-fruehlingssymposium[.]dehti-245401512[.]hs-sites-na2[.]comjo2c9ada427c6-endpoint[.]comkohlhoff-edelstahlverarbeitung[.]demarketcredibilitysignals[.]demarktkarree-langenfeld[.]demethodicalness[.]deonedrive-7tu[.]techroboticslabmade-techie-com-s-account[.]workers[.]devpanel[.]hewktree[.]netreliableinteractions[.]dereliablesupport[.]deservicewithoutinterruption[.]destablewebsystems[.]detrustedengagement[.]deuninterruptedperformance[.]devoicemail-59f[.]admin-treyripple-com-s-account[.]workers[.]devvoicemail-lyr[.]nbuckley-cambek-com-s-account[.]workers[.]devvoicemail-wx7[.]mark-squires-expressrancnes-com-s-account[.]workers[.]devyaga9b286ae2c101-endpoint[.]comytgw-9n30-xlwd[.]pvasquez-princetonpartners-com-s-account[.]workers[.]devz6e43e5886fe-endpoint[.]com
Recent Linux Kernel Exploits Make Attack Surface Reduction a Practical Priority 4 indicators · May 16, 2026
Domains (2)
badkeys[.]infoitsec[.]hboeck[.]de
URLs (2)
hxxps://badkeys[.]info/hxxps://itsec[.]hboeck[.]de/
PawsRunner Steganography Shows Infostealers Are Hiding in Plain Sight 11 indicators · May 15, 2026
IPv4 (1)
5[.]101[.]84[.]202
Domains (2)
everycarebd[.]comxverse[.]app
URLs (2)
everycarebd[.]com/imagelkjh0987[hxxps://everycarebd[.]com/imagelkjh0987[.]png
sha256 (6)
0fcb86ae384e9975933314ac2a231f0ff46c0208556bf4a16f096a642d3f505e1b730de72f921458b6b162b105a9521a931f07e19d3cac53207c7a8efbc412f96910d27b9e1dc2229a8c280f5d0cea85146d50274c56a4d9a5b8d1793505b1b98d0bcde739929fe41a6bcaaa62f7cba802af90b2ba8dea6ed1a4821236cdd58893724f1a9ad3a28c171927fc449ac34dc6ca890f915f00210e8b305577388c6ee2308749f6b7b7573009d0cac6616a6aa83cecb1f2933e868776400d122c86ec
BlackFile Vishing Campaign Shows Why MFA Alone Is Not Enough 11 indicators · May 15, 2026
IPv4 (1)
179[.]43[.]185[.]226
Domains (3)
company[.]sharepoint[.]comgetsession[.]orgorganization[.]sharepoint[.]com
URLs (5)
enrollms[.]comhxxps://company[.]sharepoint[.]com/sites/ProductionOps/hxxps://organization[.]sharepoint[.]com/sites/Legal_Archive/passkeyms[.]comsetupsso[.]com
Email Addresses (2)
victim[.]user@company[.]comvictim[.]user@organization[.]com
Gremlin Stealer Shows Why Browser Sessions Are Now High-Value Targets 19 indicators · May 15, 2026
IPv4 (1)
194[.]87[.]92[.]109
Domains (3)
api[.]ipify[.]orgapi[.]telegram[.]orgtelegram[.]org
URLs (4)
api[.]telegram[.]orghxxp://api[.]ipify[.]org/?format=jsonhxxps://api[.]telegram[.]orgipify[.]org
sha256 (11)
1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f52172dae9a5a695e00e0e4609e7db0207d8566d225f7e815fada246ae995c0f9b281b970f281dbea3c0e8cfc68b2e9939b253e5d3de52265b454d8f0f578768a2691896c7be87e47f3e9ae914d76caaf026aaad0a1034e9f396c2354245215dc3971198ff86aeb42739ba9381923d0bc6f847a91553ec57ea6bae5becf80f87599aab30a3190301016c79f8a7f8edf45ec088ceecad39926cfcf3418145f3d6149fda1ddb1acf8dd3685ec31b0b07110855832e3bed28a0f3b81c57fe7fe3ac20a9f529a5cbc1f3ee80f785b22e0c472953e6cb226952218aecc7ab07ca328abdab0fa760bd037a95c4dee431e649e0db860f7cdad6428895b9a399b6991bf3cdd11938f14499de03d6a02b5e158782afd903460576e9227e0a15d960a2e9c02cf76ba1a4650d8cafb6d3ff071688c5db6fd37e165050f03cece693826f51d346
Cisco SD-WAN Exploitation Shows Edge Controllers Need Emergency Review 45 indicators · May 14, 2026
IPv4 (16)
104[.]233[.]156[.]113[.]62[.]52[.]206176[.]65[.]139[.]31194[.]163[.]175[.]135194[.]233[.]100[.]40212[.]83[.]162[.]3723[.]27[.]143[.]17038[.]181[.]52[.]8938[.]60[.]214[.]9247[.]104[.]248[.]765[.]20[.]67[.]13471[.]80[.]85[.]13579[.]135[.]105[.]20883[.]229[.]126[.]19589[.]125[.]244[.]3389[.]125[.]244[.]51
Domains (3)
1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p[.]worf[.]replit[.]deva820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p[.]worf[.]replit[.]devreplit[.]dev
URLs (6)
hxxp://13[.]62[.]52[.]206:5004 hxxp://13[.]62[.]52[.]206:5004”hxxp://83[.]229[.]126[.]195:8081/config[.]jsonhxxp://83[.]229[.]126[.]195:8081/xmrighxxps://1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p[.]worf[.]replit[.]dev/downloadreplit[.]dev
md5 (1)
sha256 (12)
02654acfb21f83485393ba8b14bd8862b919b9ec966fc6768f6aac1338a45ee80c87871642f84e09e8d3fb23ec36bf55601323e31151a7017a85dbec929cf15d0ed72d52347bfe4a78afff8a6982a64050c8fc86d8957a20eeb3e0f3f5342ed017302d903baf182f94dc3be40ab1e0874dd0eb2ec5255bf9131fd53591efe92518d77c9c5bbb5b9d5bdfd366fdfcf26bad9e64c63ca865fad711bcce8e3d5a805bc5998161056b7c8f70c9724d8a63abc7ff8c3843b91c30cffab0899e39b7f872f570ce97de3eaaffef33d90b0c337a153fc9690cc34ee207b557d8683600607aa88a64a527ade7d93c20faf23b54f2ee33ad9b1246cdc2f8ded2ab639affb196fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46b0f51b098842cd630097b462aab0ec357e2c7824af37cca6d08165265da2c2d3d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfaf6f8e0d790645395188fc521039385b7c4f42fa8b426fd035f489f6cda9b5da1
Kazuar Shows Russian Espionage Malware Is Engineering for Resilience 5 indicators · May 14, 2026
md5 (1)
May 2026 Patch Tuesday: How SMBs Should Prioritize 132 Microsoft CVEs 279 indicators · May 13, 2026
CVEs (279)
CVE-2025-54518CVE-2026-21530CVE-2026-26129CVE-2026-26164CVE-2026-32161CVE-2026-32170CVE-2026-32175CVE-2026-32177CVE-2026-32185CVE-2026-32204CVE-2026-32207CVE-2026-32209CVE-2026-33109CVE-2026-33110CVE-2026-33111CVE-2026-33112CVE-2026-33117CVE-2026-33821CVE-2026-33823CVE-2026-33833CVE-2026-33834CVE-2026-33835CVE-2026-33837CVE-2026-33838CVE-2026-33839CVE-2026-33840CVE-2026-33841CVE-2026-33844CVE-2026-34327CVE-2026-34329CVE-2026-34330CVE-2026-34331CVE-2026-34332CVE-2026-34333CVE-2026-34334CVE-2026-34336CVE-2026-34337CVE-2026-34338CVE-2026-34339CVE-2026-34340CVE-2026-34341CVE-2026-34342CVE-2026-34343CVE-2026-34344CVE-2026-34345CVE-2026-34347CVE-2026-34350CVE-2026-34351CVE-2026-34645CVE-2026-34646CVE-2026-34647CVE-2026-34648CVE-2026-34649CVE-2026-34650CVE-2026-34651CVE-2026-34652CVE-2026-34653CVE-2026-34654CVE-2026-34655CVE-2026-34656CVE-2026-34658CVE-2026-35415CVE-2026-35416CVE-2026-35417CVE-2026-35418CVE-2026-35419CVE-2026-35420CVE-2026-35421CVE-2026-35422CVE-2026-35423CVE-2026-35424CVE-2026-35428CVE-2026-35429CVE-2026-35432CVE-2026-35433CVE-2026-35435CVE-2026-35436CVE-2026-35438CVE-2026-35439CVE-2026-35440CVE-2026-40357CVE-2026-40358CVE-2026-40359CVE-2026-40360CVE-2026-40361CVE-2026-40362CVE-2026-40363CVE-2026-40364CVE-2026-40365CVE-2026-40366CVE-2026-40367CVE-2026-40368CVE-2026-40369CVE-2026-40370CVE-2026-40374CVE-2026-40377CVE-2026-40379CVE-2026-40380CVE-2026-40381CVE-2026-40382CVE-2026-40397CVE-2026-40398CVE-2026-40399CVE-2026-40401CVE-2026-40402CVE-2026-40403CVE-2026-40405CVE-2026-40406CVE-2026-40407CVE-2026-40408CVE-2026-40410CVE-2026-40413CVE-2026-40414CVE-2026-40415CVE-2026-40416CVE-2026-40417CVE-2026-40418CVE-2026-40419CVE-2026-40420CVE-2026-40421CVE-2026-41086CVE-2026-41088CVE-2026-41089CVE-2026-41094CVE-2026-41095CVE-2026-41096CVE-2026-41097CVE-2026-41100CVE-2026-41101CVE-2026-41102CVE-2026-41103CVE-2026-41105CVE-2026-41107CVE-2026-41109CVE-2026-41610CVE-2026-41611CVE-2026-41612CVE-2026-41613CVE-2026-41614CVE-2026-42823CVE-2026-42825CVE-2026-42826CVE-2026-42830CVE-2026-42831CVE-2026-42832CVE-2026-42833CVE-2026-42838CVE-2026-42891CVE-2026-42893CVE-2026-42896CVE-2026-42898CVE-2026-42899CVE-2026-7896CVE-2026-7897CVE-2026-7898CVE-2026-7899CVE-2026-7900CVE-2026-7901CVE-2026-7902CVE-2026-7903CVE-2026-7904CVE-2026-7905CVE-2026-7906CVE-2026-7907CVE-2026-7908CVE-2026-7909CVE-2026-7910CVE-2026-7911CVE-2026-7912CVE-2026-7913CVE-2026-7914CVE-2026-7915CVE-2026-7916CVE-2026-7917CVE-2026-7918CVE-2026-7919CVE-2026-7920CVE-2026-7921CVE-2026-7922CVE-2026-7923CVE-2026-7924CVE-2026-7925CVE-2026-7926CVE-2026-7927CVE-2026-7928CVE-2026-7929CVE-2026-7930CVE-2026-7931CVE-2026-7932CVE-2026-7933CVE-2026-7934CVE-2026-7935CVE-2026-7936CVE-2026-7937CVE-2026-7938CVE-2026-7939CVE-2026-7940CVE-2026-7941CVE-2026-7942CVE-2026-7943CVE-2026-7944CVE-2026-7945CVE-2026-7946CVE-2026-7947CVE-2026-7948CVE-2026-7949CVE-2026-7950CVE-2026-7951CVE-2026-7952CVE-2026-7953CVE-2026-7954CVE-2026-7955CVE-2026-7956CVE-2026-7957CVE-2026-7958CVE-2026-7959CVE-2026-7960CVE-2026-7961CVE-2026-7962CVE-2026-7963CVE-2026-7964CVE-2026-7965CVE-2026-7966CVE-2026-7967CVE-2026-7968CVE-2026-7969CVE-2026-7970CVE-2026-7971CVE-2026-7972CVE-2026-7973CVE-2026-7974CVE-2026-7975CVE-2026-7976CVE-2026-7977CVE-2026-7978CVE-2026-7979CVE-2026-7980CVE-2026-7981CVE-2026-7982CVE-2026-7983CVE-2026-7984CVE-2026-7985CVE-2026-7986CVE-2026-7987CVE-2026-7988CVE-2026-7989CVE-2026-7990CVE-2026-7991CVE-2026-7992CVE-2026-7993CVE-2026-7994CVE-2026-7995CVE-2026-7996CVE-2026-7997CVE-2026-7998CVE-2026-7999CVE-2026-8000CVE-2026-8001CVE-2026-8002CVE-2026-8003CVE-2026-8004CVE-2026-8005CVE-2026-8006CVE-2026-8007CVE-2026-8008CVE-2026-8009CVE-2026-8010CVE-2026-8011CVE-2026-8012CVE-2026-8013CVE-2026-8014CVE-2026-8015CVE-2026-8016CVE-2026-8017CVE-2026-8018CVE-2026-8019CVE-2026-8020CVE-2026-8021CVE-2026-8022
The Gentlemen RaaS Leak Shows Ransomware Is Still an Edge-Device Problem 69 indicators · May 13, 2026
Domains (1)
chamd5[.]org
md5 (30)
03860d116701cdc9d9bf9c45099bb3d311e7baca7e652995b2364fdab0d362b72cd4eb358c45ca783a20ec854a5a860c2e5d1a352885a6efd84dbc0387cbc79e3b7b4f2d33bdfb8a31b480d0eb2815cd4a94d2b730a5a63e6cd54a9b0bb4ea714e0c37cbf4dde9683943c8a738e5b00a51dec3e170f8a181cc9aea8dcc90c7ab583fe1c1a39f6b873a5c0997bea1f657697f182826495662427ca49edbb345fc71d503709af88821c183a1d0b7ae06ec721606b3659f2c2d80a196ed3cd60053735069890a414869f0113de820ba9afb74ea100b581ec32ea6c2ac2a0030a9f6776e86c13433747299a4e5f9f22e34157aae8fd9187c88dd0292cce1abd050e281a578e065da1ccd8c81a8e90c30927582160a7da5fc4c935e6f48d38a5aaaa6893f735e9a8cc9814dc6eccd5579561c8fceea4fd9ce32dd620ccd580297c7c592d8bd2a6ee7f6d5c84e037066ce0539a023a6b15419600dc3f6b93e11761dfea73526d89e5fb7b57f50d8da340e53e9abd11823ddcc3d746ad8621e677a93ebb5b42ac289581b3387ebf120129a19a6b68e019efb39b85f5a0326e22fd4498abc6b87c79bc71a78da623d031ec1a958d75246d230f22b1da6bbf5fceeed2ef2da9cff1b478b64d47b68d50330e96c60ead0d7a8ae0a6ffb7f0a5873fec4ff5e
sha256 (33)
025fc0976c548fb5a880c83ea3eb21a5f23c5d53c4e51e862bb893c11adf712a1334f0189a8e6dbc48456fa4b482c5726ab7609f7fa652fcc4c1a96f2334436f1af419b36a5edefef387409e2b3248c9223f7dc49a4f7b15ea095d371c3a70b21eece1e1ba4b96e6c784729f0608ad2939cfb67bc4236dfababbe1d09268960c22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f6724ac3588fb8cfbff63b7fdfcbc7dec1f3c60e54e6f949dd69d68e89e0c89d9662ed9494e9b7b68415b4eb151c922c82c0191294d0aa443dd2cb5133e6bfe3d5d3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c92353c2182cb0bc7528829ef03f1b1745a92bcc47d917eb8870862488f21fdf1a6d648d9b2ce4fcd6854a3164ce395d7140014e0b58b77680623f3e4ca22d3a6e7fd4a175eed927c0a477eafb8aa35a93c191748acaa78ac7aecd8ea3c4cd868887c51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd25dc607c8990841139768884b1b43e1403496d5a458788a1937be139594f01dca62c2c24937d67fdeb43f2c9690ab10e8bb90713af46945048db9a94a465ffcb86a3ab9e984a759d55af4e84487d1fc44683065cc9a1089d5aa4ad1c0e4e84a63788ba200f776a188c248d6c2029f00b5d34be45d4444f7cb89ffe838c39b8b19860a6177b055a2f5aa61470d17ec3c69da24f1cdf0a782237055cba43115892387d25d0e5880b3b5cd30106853cbfc6ef1ad38966b30d9bd5b99df46098e546c8aa0cb69ca2777001e0f4ba0eaab0841592710e4cc5ccd6b0b526d78bbd8bfba8c87134c1b45e990e9568f0a3899b0076f94be16d3c40fa824ac1e6c6ee892db91415e0b9fe4e7cbe43ec0558a7adf89423de30d22b00b985c2e4b97e75076b1994d6d1edb57f945f4284cc0163ec998861c7496d85f6d45c08657c9727186e39f61ff4deb8afced8b1ecdc8787a134c63bde632b18293fbfc94a91749e3e454a7a19cab7aab606f833fa8225bc94ec9570a6666660b02cc41a63fe39ea8b0adb67958afc982cafbe1c3f114b444d7f4c91a88a3e7a86f89ab8795ac2110d1e6c46b5a18ab3fb5fd1c5c8288a41c75bf0170c10b5e829af89370a12c86dd10f8c7f7b5a6e7d93221344e6368c7ab4abf93e162f7567e1a7bcb8786cb8a183a73dce2e5cc00eff2493f8ced546dc51f9d5ef78c5ee56805906ec642dfa77a1c70dfe696ff713318c53fb17731bd4a6585a02c085b590149b19847990b324a0be6ec368ae0b4369b6ef0da244774995c819c63cffb7fd2132379963b9c1640ccd2efaf8e7422ffd09c7f03f1a5b4e5c2cc32b05334c18d1ccb9673667f8f43108ff736be55193c77af346dbe905e25f6a1dee3ec1aedca8989ad2088e4f6576b12fc75ed2159e0c8274076e46a37671cfb8d677af9f586224da1713df89490a958
Bitcoin Addresses (2)
JDownloader Site Compromise Shows Why Trusted Downloads Still Need Verification 8 indicators · May 9, 2026
Domains (3)
auraguest[.]lkcheckinnhotels[.]comparkspringshotel[.]com
URLs (5)
auraguest[.]lk/m/douV2quu[.]phpcheckinnhotels[.]comhxxps://auraguest[.]lk/m/douV2quu[.]phphxxps://parkspringshotel[.]com/m/Lu6aeloo[.]phpparkspringshotel[.]com/m/Lu6aeloo[.]php
Fake OpenAI Hugging Face Repo Shows AI Supply Chain Risk Is Already Here 2 indicators · May 9, 2026
Domains (1)
recargapopular[.]com
URLs (1)
recargapopular[.]com
MCP Server Command Injection Shows Why AI Tools Need Real Isolation 1 indicators · May 8, 2026
Dirty Frag Turns Linux Footholds Into Root: What Defenders Should Do Now 4 indicators · May 8, 2026
Prompt Injection Just Became an RCE Problem for AI Agents 3 indicators · May 8, 2026
Domains (1)
param[.]name
CVEs (2)
PAN-OS Captive Portal Zero-Day Shows Why Internet-Facing Edge Devices Need Immediate Review 20 indicators · May 7, 2026
IPv4 (5)
136[.]0[.]8[.]48138[.]0[.]0[.]0146[.]70[.]100[.]69149[.]104[.]66[.]8467[.]206[.]213[.]86
URLs (1)
hxxp://146[.]70[.]100[.]69:8000/php_sess
Critical Cisco IMC Authentication Bypass Enables Unauthenticated Admin Access 3 indicators · Apr 4, 2026
Critical Cisco IMC Authentication Bypass Grants Remote Attackers Admin Privileges 3 indicators · Apr 4, 2026
CL-STA-1087: Chinese APT Targets Southeast Asian Militaries with AppleChris and MemFun Backdoors 16 indicators · Apr 3, 2026
IPv4 (9)
109[.]248[.]24[.]177116[.]63[.]177[.]49118[.]194[.]238[.]51154[.]39[.]137[.]203154[.]39[.]142[.]1778[.]212[.]169[.]278[.]220[.]135[.]1518[.]220[.]177[.]2528[.]220[.]184[.]177
sha256 (7)
0e255b4b04f5064ff97da214050da81a823b3d99bce60cdd9ee90d913cc4a9522ee667c0ddd4aa341adf8d85b54fbb2fce8cc14aa88967a5cb99babb08a10fae413daa580db74a38397d09979090b291f916f0bb26a68e7e0b03b4390c1b472f5a6ba08efcef32f5f38df544c319d1983adc35f3db64f77fa5b51b44d0e5052c9e44a460196cc92fa6c6c8a12d74fb73a55955045733719e3966a7b8ced6c500ad25b40315dad0bda5916854e1925c1514f8f8b94e4ee09a43375cc1e77422adee4d4b7340b3fa70387050cd139b43ecc65d0cfd9e3c7dcb94562f5c9c91f58f
UAT-10608: NEXUS Listener Framework Compromises 766 Next.js Hosts in 24-Hour Credential Harvesting Blitz 5 indicators · Apr 3, 2026
IPv4 (4)
144[.]172[.]102[.]88144[.]172[.]112[.]136144[.]172[.]117[.]112172[.]86[.]127[.]128
CVEs (1)
LiteLLM Supply Chain Attack: TeamPCP Deploys Multi-Stage Credential Stealer to 95M Monthly Downloads 3 indicators · Apr 1, 2026
Domains (2)
URLs (1)
Operation TrueChaos: Chinese APT Exploits TrueConf Zero-Day CVE-2026-3502 to Target Southeast Asian Governments 10 indicators · Apr 1, 2026
IPv4 (3)
43[.]134[.]52[.]22143[.]134[.]90[.]6047[.]237[.]15[.]197
Domains (1)
trueconf[.]com
URLs (2)
fxp://47[.]237[.]15[.]197/update[.]7zhxxps://trueconf[.]com/docs/server/en/admin/info/
md5 (3)
CVEs (1)
Axios npm Supply Chain Attack Deploys Cross-Platform RAT to 83 Million Weekly Users 3 indicators · Mar 31, 2026
Domains (2)
packages[.]npm[.]orgsfrclak[.]com
URLs (1)
sfrclak[.]com
DeepLoad Malware: AI-Generated Evasion Meets ClickFix Delivery in Enterprise Credential Theft Campaign 6 indicators · Mar 31, 2026
Domains (3)
forest-entity[.]cchell1-kitty[.]ccholiday-updateservice[.]com
URLs (3)
forest-entity[.]cchell1-kitty[.]ccholiday-updateservice[.]com
ShinyHunters Breaches European Commission: 350GB of Sensitive Data Exfiltrated from AWS Cloud 1 indicators · Mar 30, 2026
Domains (1)
Infinity Stealer: New macOS Infostealer Combines ClickFix Social Engineering with Nuitka Compilation 2 indicators · Mar 29, 2026
Domains (1)
URLs (1)
Infinity Stealer: New macOS Infostealer Uses ClickFix and Nuitka Compilation to Evade Detection 2 indicators · Mar 29, 2026
Domains (1)
URLs (1)
Infinity Stealer: New macOS Malware Uses ClickFix Lures and Nuitka-Compiled Python Payload 2 indicators · Mar 28, 2026
Domains (1)
URLs (1)
Chinese APT Red Menshen Plants Stealthy BPFdoor Backdoors in Global Telecom Networks 2 indicators · Mar 26, 2026
CVEs (2)
Pawn Storm Deploys PRISMEX Malware Suite Against Ukrainian Defense Supply Chain and NATO Allies 15 indicators · Mar 26, 2026
Domains (10)
Filen[.]ioclaude[.]aidropbox[.]comegest[.]filen[.]iogateway[.]filen-1[.]netgateway[.]filen-6[.]netgateway[.]filen[.]iogateway[.]filen[.]netingest[.]filen[.]iowellnesscaremed[.]com
URLs (2)
dropbox[.]comwellnesscaremed[.]com
CVEs (2)
Oracle Issues Rare Out-of-Band Patch for Critical CVE-2026-21992 RCE in Identity Manager 3 indicators · Mar 25, 2026
IPv4 (2)
12[.]2[.]1[.]414[.]1[.]2[.]1
CVEs (1)
CanisterWorm Wiper Weaponizes Trivy Supply Chain to Target Iran 23 indicators · Mar 24, 2026
Domains (8)
championships-peoples-point-cassette[.]trycloudflare[.]comdl[.]k8s[.]ioicp0[.]ioinvestigation-launches-hearings-copying[.]trycloudflare[.]comsouls-entire-defined-routes[.]trycloudflare[.]comtdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]iotrycloudflare[.]comwww[.]aikido[.]dev
URLs (15)
hxxps://championships-peoples-point-cassette[.]trycloudflare[.]comhxxps://championships-peoples-point-cassette[.]trycloudflare[.]com/prop[.]pyhxxps://dl[.]k8s[.]io/release/$(curlhxxps://dl[.]k8s[.]io/release/stable[.]txt)/bin/linux/${ARCH}/kubectl"hxxps://investigation-launches-hearings-copying[.]trycloudflare[.]com/hxxps://souls-entire-defined-routes[.]trycloudflare[.]com/hxxps://souls-entire-defined-routes[.]trycloudflare[.]com/kamikaze[.]shhxxps://souls-entire-defined-routes[.]trycloudflare[.]com/kube[.]py"hxxps://www[.]aikido[.]dev/blog/teampcp-stage-payload-canisterworm-iranicp0[.]iotdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]iotrycloudflare[.]comtrycloudflare[.]com/trycloudflare[.]com/kube[.]py"trycloudflare[.]com/prop[.]py
TeamPCP Deploys CanisterWorm Wiper to Target Iranian Systems 99 indicators · Mar 24, 2026
IPv4 (1)
45[.]148[.]10[.]212
Domains (3)
plug-tab-protective-relay[.]trycloudflare[.]comscan[.]aquasecurtiy[.]orgtdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io
URLs (3)
aquasecurtiy[.]orghxxps://scan[.]aquasecurtiy[.]orghxxps://tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io/
sha1 (82)
0891663bc55073747be0eb864fbec3727840945d0d49ceb356f7d4735c63bd0d5c7e67665ec7f80c18f01febc4c3cd70ce6b94b70e69ab866fc033f519851bef764b57ff95b35e66589f31949eeb229d1d74e4cf63b7cf083cf92bf5923cf037f7011c6b2297a1b967ecc05ba2285eb6af56ab4da554ecae22e864e71155122e2834eb0c10d0e7e0b8f65aa3252554b0e1130467f4301ba65c55a9c373508e35276ca9680f6df9016db12f7c48571e5c4639451d2a51c5c5bb1fd1f0e134c9754f1702cfa359c3dd2b1dac84ff12ba56158b3a97e2941a587cb20da92e7964d59cd24d1fd2aa4d6a5f93b7f09ea969473201ddddd69a1419c6f1511a14c5945ba3217126384add36b52014a0f99c0ab3a3d58bd47e53d00f38623bf26706d51c45647909dcfb669825442804386c0f18ac3d7f2ed33e2d884761119f4024ff8a3c615ac0f29e743eda8863377f9776619fd2db763d1b5be1589a83fc98b82781c263708b2eb3b47b3dffed04dc90cf1c548f40577d642c52241ec76c405e91f329294fb696f55793203abf1f6aba9b404209dcadeaea6a7df69262fef1beeda940881d4d4bdcc5d9ef3ddb42ccc9126e6c07faa3df2807e3506d7ff06abc509692c600b5b69b4dc6ceaa4b15555e7ad4c895c558c7214496df1cd56d1390c51661fbe20b7589e6b61eedcd5fe1e958e1a95fbd1366c90331c8b991e7895d37796ac712b5895dda3b6d8d730153d6151e03549f276faca0275ed9c7b26ec7aaf336b7d2593d980908be9bc4fed6d407c66fc874a1f9d65052d4c67a314da1dae914f1daff7550f14b64c1c724035a075b36e71423719a1f30794b6d99daefd5e27ecb33e12691c4026739bf987a4b6f31edb8db48cc22a1d41e298b38c4a6417e7b955a5ece1e1b085c12dac7ac10e0eb1f5b0d4d7f6f0ce52a59bdfc5757c3982aac2353b58f4c73820428afeb64484d311211658383ce7f79d31a0a848d665ed24dc1a41f6b4b7c7ffac7693d6b37be8519037888b189f13047371758f7aed2283c6b5885cb72f1e8ee5e6e44488cd6cbdbca94722f96ed8aa8af3ea1de8e968a3e49a40afb063692ab8eae8ae5a08aec3013ee8f6132b2a9012b45002f8eaa8afa9b9f9183b4e00c46e2b82d34047e3c177bd08cfb9c31cc944da57458555aa398bb99336d5a1f9092287c0339a8102f91c5a257a7e27625d9d02991d5e0a13afab54533a95f8019dd7530bd38a07191e7c2c36dcad14149d8e455b960af62a2ffb2759738180dd24427b8824445dbbc23c30ffc1cb0d8985447b035c447c1ed45f38fad7ca7a4254cb66899b93c070aac11b52dfc3e41a55cbb24a331ae759ba3c3cd3b23d033cd91253a9e61a4bf59c8a6709c000ba9d482773cbbc2c3544d61b109bc9eb8329e8968cb83234f0de0217aa8c934a68a317ee518a5b4818debf2adbaba872aaffd6a0f64a26449faa9bc513ea7989e3234b395cafb8ed5ccc3755636aa3c46a9643b18125abb8aefc13219014e9c4be8ab6606b76e5a054be08cab3d07da323e90e751e8ad623e14ebdfe82b9627811d57b9a39e283d6128b7252377a3d82c73d497bfafa3eabe84de1d02c4b745a35bad072d93a9b83080e9920ec52c6b5a27b7befdc106c600585d3eec87d7e98e1c136839aeb9faa60f85f6f780a34b8d0faaf45b3e3966fddabb75a9059c2d5803db49e6ed6c6f7e0b367f96bec19401b2f58dc6d2632cb473d44be98dd8292a93c5967f85626795f647d4bf6eb67227f9b79e02f5cf1692a1fc7a47120e6508309765db7e33477946cf19d27c8a7fb7a8bbf1e1000e9318749bcd82cfd488f4388ff4aa268906e25c2144f1433a4edec2da73ae0790e458e878b300b57ceb5f81ac573b46ddb6697447a97198bdef9bae00215059eb5e8bc2ddb94181dcbc723d96ffc07fddd14d97e4849016ddb9da4475c1cef7d5389062bdfdfbdbd1394648e0198fd2b6e1679e36d32933941182d9afa82f6fe53b0483d08da44da9dfe8a84bf2837e5163699bea56cd31d82b853932d50f1144e95b21817e52cfef3a510e3f94df3ea9fcd01621155ca5f2c3bf5bf4436225d8a5fd1715d3c2290d8a50643e726031f4f1785be270ae13f36f6a8cfbf6faaae50e660af5c9fd927027beaa3760d2a84daa8b00e6e5ee21f77738448eec70113cf711656914b61905b3bd47fa4209b6182a4c1609ce34d40b67f5cfd7f00f53fa78e67c0df002c509bcdea88677fb5e2fe6a9b1fd090040b5f584f4fcbe466878cb204d0735dcf4fd429cf86db999572f3d9ca7c54561fdf7d388a4
sha256 (10)
0880819ef821cff918960a39c1c1aada55a5593c61c608ea9215da858a86e3496328a34b26a63423b555a61f89a6a0525a534e9c88584c815d937910f1ddd538822dd269ec10459572dfaaefe163dae693c344249a0161953f0d5cdd110bd2a0887e1f5b5b50162a60bd03b66269e0ae545d0aef0583c1c5b00972152ad7e073bef7e2c5a92c4fa4af17791efc1e46311c0f304796f1172fce192f5efc40f5d7d5edd791021b966fb6af0ace09319ace7b97d6642363ef27b3d5056ca654a94ce6310d8a003d7ac101a6b1cd39ff6c6a88ee454b767c1bdce143e04bc1113243e64e152afe2c722d750f10259626f357cdea40420c5eedae37969fbf13abbecfecce7ae5ffc9f57bb70efd3ea136a2923f701334a8cd47d4fbf01a97fd22859cf7084b0229dce605ccc5506b14acd4d954a496da4b6134a294844ca8d601970d
Hackers Exploit CVE-2025-32975 (CVSS 10.0) to Hijack Unpatched Quest KACE SMA Systems 2 indicators · Mar 23, 2026
IPv4 (1)
216[.]126[.]225[.]156
CVEs (1)
FBI Flash Alert: Iranian Handala Hackers Weaponize Telegram for Malware C2 Operations 8 indicators · Mar 23, 2026
Domains (4)
handala-hack[.]tohandala-redwanted[.]tojusticehomeland[.]orgkarmabelow80[.]org
URLs (4)
handala-hack[.]tohandala-redwanted[.]tojusticehomeland[.]orgkarmabelow80[.]org
Unit 42 Warns: AI Agents Could Enable Gift Card Theft and Returns Fraud at Scale 2 indicators · Mar 22, 2026
URLs (1)
xyz[.]com
Email Addresses (1)
attacker@xyz[.]com
CVE-2026-33017: Critical Langflow AI Framework Vulnerability Exploited Within 20 Hours of Disclosure 4 indicators · Mar 22, 2026
Interlock Ransomware Exploited Cisco Firewall Zero-Day Weeks Before Public Disclosure 1 indicators · Mar 21, 2026
CVEs (1)
DarkSword iOS Exploit Kit: Russian Hackers Weaponize Six Vulnerabilities for Full iPhone Takeover 20 indicators · Mar 21, 2026
IPv4 (2)
62[.]72[.]21[.]1072[.]60[.]98[.]48
Domains (5)
e5[.]malaymoil[.]comsahibndn[.]iosqwas[.]shapelie[.]comstatic[.]cdncounter[.]netsystemgroup[.]com
URLs (6)
cdncounter[.]nethxxps://static[.]cdncounter[.]net/assets/index[.]htmlhxxps://static[.]cdncounter[.]net/widgets[.]js?uhfiu27fajf2948fjfefaa42"></script>malaymoil[.]comsahibndn[.]ioshapelie[.]com
CVE-2026-33017: Critical Langflow AI Platform Flaw Exploited Within 20 Hours of Disclosure 4 indicators · Mar 21, 2026
Critical Langflow AI Platform Flaw CVE-2026-33017 Exploited Within 20 Hours of Disclosure 4 indicators · Mar 20, 2026
CVE-2026-3564: Critical ScreenConnect Flaw Enables Session Hijacking Through ASP.NET Machine Key Abuse 3 indicators · Mar 20, 2026
Interlock Ransomware Exploited Cisco FMC Zero-Day for Six Weeks Before Patch: Amazon Reveals Full Attack Chain 1 indicators · Mar 20, 2026
CVEs (1)
9 Critical IP KVM Flaws Enable Unauthenticated Root Access Across Four Vendors 14 indicators · Mar 19, 2026
CISA Adds Wing FTP Server Information Disclosure Flaw to KEV Catalog Amid Active Exploitation 2 indicators · Mar 18, 2026
CVEs (2)
GlassWorm Supply Chain Campaign Hijacks 72 Open VSX Extensions to Target Developers 10 indicators · Mar 17, 2026
IPv4 (3)
45[.]32[.]150[.]25145[.]32[.]151[.]15770[.]34[.]242[.]255
Domains (7)
angular-studio[.]ngbrategmaqendaalar-studio[.]prodaeumer-web[.]esoigotm[.]mypessa07tm[.]mypublisher[.]namestudio-velte-distributor[.]pro
Iranian Threat Actors Target Hikvision and Dahua IP Cameras for Kinetic Strike Coordination 5 indicators · Mar 16, 2026
Critical Veeam Backup Vulnerabilities Draw Ransomware Group Attention: Seven CVSS 9.9 Flaws Patched 9 indicators · Mar 16, 2026
Email Addresses (1)
ops@rescana[.]com
The Promptware Kill Chain: A New Framework for Understanding AI Malware Attacks 9 indicators · Mar 15, 2026
Domains (5)
Kore[.]aiVerifiedVoting[.]orgdoi[.]orggo[.]nature[.]comwww[.]schneier[.]com
URLs (2)
hxxps://doi[.]org/10[.]48550/arXiv[.]2509[.]14233hxxps://www[.]schneier[.]com
Email Addresses (1)
schneier@schneier[.]com
CVEs (1)
Operation Lightning: Global Takedown of SocksEscort Botnet That Enslaved 369,000 Routers in 163 Countries 2 indicators · Mar 15, 2026
Domains (1)
socksescort[.]com
URLs (1)
socksescort[.]com
Google Patches Two Chrome Zero-Days Actively Exploited in the Wild, CISA Adds to KEV Catalog 3 indicators · Mar 14, 2026
Pro-Iranian Hackers Expand Targeting of US Critical Infrastructure as Cyber Chaos Escalates 1 indicators · Mar 13, 2026
Domains (1)
ap[.]org
Google Patches Two Actively Exploited Chrome Zero-Days: CVE-2026-3909 and CVE-2026-3910 3 indicators · Mar 13, 2026
Storm-2561 Weaponizes SEO Poisoning to Deploy Trojanized VPN Clients and Steal Enterprise Credentials 51 indicators · Mar 13, 2026
IPv4 (1)
194[.]76[.]226[.]93
Domains (20)
checkpoint-vpn[.]comcisco-secure-client[.]esforticlient-for-mac[.]comforticlient-vpn[.]deforticlient-vpn[.]frforticlient-vpn[.]itforticlient[.]caforticlient[.]coforticlient[.]co[.]ukforticlient[.]nofortinet-vpn[.]comivanti-pulsesecure[.]comivanti-secure-access[.]deivanti-vpn[.]orgmyconnection[.]propn-connection[.]prosonicwall-netextender[.]nlsophos-connect[.]orgvpn-fortinet[.]comwatchguard-vpn[.]com
URLs (19)
checkpoint-vpn[.]comcisco-secure-client[.]esco[.]ukforticlient-for-mac[.]comforticlient-vpn[.]deforticlient-vpn[.]frforticlient-vpn[.]itforticlient[.]caforticlient[.]nofortinet-vpn[.]comivanti-pulsesecure[.]comivanti-secure-access[.]deivanti-vpn[.]orgmyconnection[.]propn-connection[.]prosonicwall-netextender[.]nlsophos-connect[.]orgvpn-fortinet[.]comwatchguard-vpn[.]com
sha256 (11)
26db3fd959f12a61d19d102c1a0fb5ee7ae3661fa2b301135cdb68629898917944906752f500b61d436411a121cab8d88edf614e1140a2d01474bd587a8d7ba857a50a1c04254df3db638e75a64d5dd3b0d6a460829192277e252dc0c157a62f6129d717e4e3a6fb4681463e421a5603b640bc6173fb7ba45a41a881c79415ca6c9ab17a4aff2cdf408815ec120718f19f1a31c13fc5889167065d448a40dfe685c4837e3337165d24c6690ca63a3274dfaaa03b2ddaca7f1d18b3b169c6aac1862f004679d3b142d9d2c729e78df716aeeda0c7a87a11324742a5a8eda9b5578ebe082a4b52ad737f7ed33ccc61024c9f020fd085c7985e9c90dc2008a15adc98f21b8fa426fc79aa82e28669faac9a9c7fce9b49d75bbec7b60167e21963c9cfa4781ebfa5a8d68b233efb723dbde434ca70b2f76ff28127ecf13753bfe011eb8b81277c80eeb3c094d0a168533b07366e759a8671af8bfbe12d8bc87650c9
Infostealer Infection Unmasks DPRK Operative Behind Polyfill.io Supply Chain Attack and US Crypto Exchange Infiltration 33 indicators · Mar 12, 2026
IPv4 (1)
192[.]161[.]60[.]132
Domains (22)
Gate[.]ioGate[.]usPolyfill[.]ioapps[.]nulab[.]comcctest[.]kk5yuzmev2qbgulz[.]comcockpit[.]sumsub[.]comdiscord[.]comfeee[.]iofriday[.]stark-industries[.]solutionsgy4q3fpx3gh77gw[.]kk5yuzmev2qbgulz[.]comkk5yuzmev2qbgulz[.]comlrtechs[.]backlog[.]comlrtechs[.]colrtechs[.]co[.]jppolyfill[.]compolyfill[.]iopolyfillcache[.]comstark-industries[.]solutionst2[.]funnull[.]hostvision[.]stark-industries[.]solutionswww[.]hudsonrock[.]comwww[.]mediafire[.]com
URLs (10)
funnull[.]hosthxxps://apps[.]nulab[.]com/signup/verifyhxxps://cockpit[.]sumsub[.]com/checkus#/applicant/66a453df5137ba3da8742f58/basicInfo?clientId=gate[.]us_60664hxxps://discord[.]com/registerhxxps://gy4q3fpx3gh77gw[.]kk5yuzmev2qbgulz[.]com/#/domin/listhxxps://lrtechs[.]backlog[.]com/dashboardhxxps://vision[.]stark-industries[.]solutions/auth/loginhxxps://www[.]hudsonrock[.]com/schedule-demohxxps://www[.]mediafire[.]com/file/gflsp6ovigjnvms/@#Full_Istaller_Pc_Setup_2024_PaSSW%E1%B9%8FrD^$[.]zip/filekk5yuzmev2qbgulz[.]com
KadNap Botnet Hijacks 14,000+ ASUS Routers Using Novel Kademlia DHT Protocol for Stealth C2 1 indicators · Mar 11, 2026
IPv4 (1)
212[.]104[.]141[.]140
FortiGate Devices Exploited as Network Entry Points for Service Account Credential Theft 4 indicators · Mar 11, 2026
IPv4 (1)
172[.]67[.]196[.]232
Iranian MOIS Cyber Actors Embrace Criminal Ecosystem: From Rhadamanthys to Ransomware Affiliates 26 indicators · Mar 10, 2026
IPv4 (1)
18[.]223[.]24[.]218
md5 (1)
sha1 (10)
0902d7915a19975817ec1ccb0f2f6714aed196382087bb914327e937ea6e77fe6c832576338c2af821a435ecaa7b86efbec7f6fb61fcda3da686125c389b12da259a23fa4559eb1d97198120f2a722fe551bdf646df8e9abe04483882650a8ffae43cb55579a4584a6eef0a2453841453221d0fb25c08c899dcb994ea2b8e6169b76a524fae7b2d2dcd1807db674578d4bdb24cd58bf2dc884eaa658b7aa250cd920ae0f8ea8b5bd42de49e01c6bbd4c2c6d0847f8444dfc740b94227ab9b2e757b8f8f1fa49362a
sha256 (14)
077ab28d66abdafad9f5411e18d26e87fe43da1410ee8fe846bd721ab0cb52de24857fe82f454719cd18bcbe19b0cfa5387bee1022008b7f5f3a8be9f05e4d142a09bbb3d1ddb729ea7591f197b5955453aa3769c6fb98a5ef60c6e4b7df23a52b7d8a519f44d3105e9fde2770c75efb933994c658855dca7d48c8b4897f81e64aef998e3b3f6ca21c78ed71732c9d2bdcc8a4e0284f51d7462c79d446fbc7be64263640a6fdeb2388bca2e9094a17065308cf8dcb0032454c0a71d9b78327eb64cf334716f15da1db7981fad6c81a640d94aa1d65391ef879f4b7b6edf6e7f174db1f653da6de134bdc526412a517a30b6856de9c3e5d0c742cb5fe9959ad0d94f05495eb1b2ebe592481e01d3900615040aa02bd1807b705a50e45d7c53444a4bd1371fe644d7e6898045cc8e7b5e1562bdfd0e4871d46034e29a22dec6377a8c380b57cb7c381ca6ba845bd7af7333f52ee4dc4e935e98b48bb81facad72ba92d28f1d32e3a9ab7c3691f8bfca8f7586bb0666adbba47eab3e1a8faf7ecc0aae017e7a36e016655c91bd01b4f3c46309bbe540733f82cce29392e72e9bd1fddceade244c636435f2444cd4c4d3dc161981f3af1f622c03442747ecef50888
BlackSanta EDR Killer Campaign Targets HR Departments Through Weaponized Resume Files 4 indicators · Mar 10, 2026
Domains (2)
resumebuilders[.]usthresumebuilder[.]com
CVEs (2)
Seedworm APT Deploys Dindoor and Fakeset Backdoors Inside US Critical Infrastructure Networks 2 indicators · Mar 10, 2026
CVEs (2)
Seedworm APT Targets US Banks and Airports with New Dindoor and Fakeset Backdoors 2 indicators · Mar 9, 2026
CVEs (2)
BoryptGrab Stealer Spreads Through 100+ Fake GitHub Repositories in Massive Malware Campaign 34 indicators · Mar 8, 2026
IPv4 (3)
193[.]143[.]1[.]10445[.]93[.]20[.]19545[.]93[.]20[.]61
Domains (4)
URLs (11)
best-tinted[.]com/github-download[.]htmlbotshield[.]vu/KKRkm9botshield[.]vu/kFcjldhxxp://193[.]143[.]1[.]104:5000hxxp://45[.]93[.]20[.]195:5000hxxp://45[.]93[.]20[.]61:5466/api/x32_chromiumhxxps://best-tinted[.]com/github-download[.]htmlhxxps://botshield[.]vu/KKRkm9hxxps://botshield[.]vu/kFcjldhxxps://kiamatka[.]com/kaiok[.]kakmankiamatka[.]com/kaiok[.]kakman
sha256 (16)
0434437a073a3f3a49e84d5ecb20c99dd551bacc32bf100fbb8cf67a5064218115de71073f44c657c23f5f97caa11f1b12e654d4d17684bfc628cc1e5b6bcdd51bd605ef84b6767df74bd6290f1468eed5a88264df23fcf70b6a75d5bdcf7d762050468744e44554fac17fb83f1515c95f2f2236716e2b5267a81c2b94205e6a2abe0ef88ba92db79d82cde4c0ed1f382bb347517a54ea82084c841d0f9555184264a88035aa0b63e9aef96daa78a58114d60a344ea10168a8ef5ef36bf8edbd433a13cc70396f80dc29d1150c050339d78964fdc91bcdc3f40c67a77add1476449f528f5ceae8c3f8336d0d8e3e3ec9031d1ad67c31ee7311b67e01d5fdf2254e90d386c1c7d3d1fd4176975795a2f432d95685690778e09313b4a1dbab9997576692df4bf1c7d8927d3a183f5219a81c3bff3dd22971691f8af6889f80c5a07f2315b89fb9a47e1516def136844d617bfcdce19000a1b0436706692dbe166cc40b9913e79c5dd09751b1afb03aaa98658bab61bacf27a299abd84fd44fe707d295720bc0c1111ce1c3d8b1bc1b36ba840f103b3ca7e95a5a8bf03e2cc44fe5ed1745cc49b929e499966d87e163219fe0f24069fe88dfacbd69c0ebab85a640fa767391b99865f8533efc1fe6dfa6175215718679fb00ca85fc13c3bd4ae4b7fe4e5fb28d2c2b3a640112b6b125ce8c4afa8be28342e3bfda097ad9dd2ef9ee
SAP NetWeaver Critical Zero-Day (CVE-2025-31324) Under Active Exploitation by Initial Access Brokers 2 indicators · Mar 7, 2026
Email Addresses (1)
CVEs (1)
Google Disrupts Chinese APT UNC2814’s GRIDTIDE Backdoor Campaign Targeting 42 Countries 435 indicators · Mar 6, 2026
IPv4 (26)
130[.]94[.]6[.]228139[.]180[.]219[.]115139[.]84[.]236[.]237149[.]28[.]128[.]128149[.]28[.]139[.]125178[.]79[.]188[.]181195[.]123[.]211[.]70195[.]123[.]226[.]235202[.]59[.]10[.]122207[.]148[.]73[.]1838[.]180[.]205[.]1438[.]54[.]112[.]18438[.]54[.]31[.]14638[.]54[.]32[.]24438[.]54[.]37[.]19638[.]54[.]82[.]6938[.]60[.]171[.]24238[.]60[.]194[.]2138[.]60[.]224[.]2538[.]60[.]252[.]6645[.]76[.]157[.]11345[.]76[.]184[.]21445[.]77[.]254[.]16845[.]90[.]59[.]1295[.]34[.]176[.]665[.]20[.]104[.]91
Domains (208)
1cv2f3d5s6a9w[.]ddnsfree[.]comBoemobww[.]ddnsfree[.]comDCLCWPDTSDCC[.]ddnsfree[.]comKaushalya[.]freeddns[.]orgMicrosoft[.]bumbleshrimp[.]comMosplosaq[.]accesscam[.]orgNpeoples[.]theworkpc[.]comPRIFTP[.]kozow[.]comPolicyAgent[.]theworkpc[.]comScopps[.]ddnsgeek[.]comSmartfren[.]giize[.]comUSOShared1[.]ddnsfree[.]comaccesscam[.]orgadmina[.]freeddns[.]orgafsaces[.]accesscam[.]organcisesic[.]accesscam[.]orgapplebox[.]camdvr[.]orgappler[.]kozow[.]comasdad21ww[.]freeddns[.]orgaw2o25forsbc[.]camdvr[.]orgawcc001jdaigfwdagdcew[.]giize[.]combab2o25com[.]accesscam[.]orgbabaji[.]accesscam[.]orgbabi5599ss[.]ddnsgeek[.]combalabalabo[.]mywire[.]orgbggs[.]giize[.]combibabo[.]freeddns[.]orgbinmol[.]webredirect[.]orgbioth[.]giize[.]combrcallletme[.]theworkpc[.]combtbtutil[.]theworkpc[.]combtltan[.]ooguy[.]combumbleshrimp[.]comcamcampkes[.]ddnsfree[.]comcamdvr[.]orgcamsqewivo[.]kozow[.]comcasacam[.]netccammutom[.]ddnsgeek[.]comcdnvmtools[.]theworkpc[.]comcloacpae[.]ddnsfree[.]comcmwwoods1[.]theworkpc[.]comcnrpaslceas[.]freeddns[.]orgcodemicros12[.]gleeze[.]comcressmiss[.]ooguy[.]comcvabiasbae[.]ddnsfree[.]comcvnoc01da1cjmnftsd[.]accesscam[.]orgcvpc01aenusocirem[.]accesscam[.]orgcvpc01cgsdfn53hgd[.]giize[.]comddnsfree[.]comddnsgeek[.]comdlpossie[.]ddnsfree[.]comdnsfreedb[.]ddnsfree[.]comdoboudix1024[.]mywire[.]orgdynuddns[.]netevilginx2[.]loseyourip[.]comexamp1e[.]webredirect[.]orgfaeelt[.]giize[.]comfakjcsaeyhs[.]ddnsfree[.]comfasceadvcva3[.]gleeze[.]comffosies2024[.]camdvr[.]orgfgdedd1dww[.]gleeze[.]comfilipinet[.]ddnsgeek[.]comfreeddns[.]orgfreeios[.]theworkpc[.]comfxpuser14[.]gleeze[.]comfxpzpak[.]kozow[.]comgiize[.]comgleeze[.]comgloboss[.]kozow[.]comgogo2025up[.]ddnsfree[.]comgooglel[.]gleeze[.]comgoogles[.]accesscam[.]orggoogles[.]ddnsfree[.]comgooglett[.]camdvr[.]orggoogllabwws[.]gleeze[.]comgtaldps31c[.]ddnsfree[.]comhamkorg[.]kozow[.]comhonidoo[.]loseyourip[.]comhuygdr12[.]loseyourip[.]comicekancusjhea[.]ddnsgeek[.]comidstandsuui[.]kozow[.]comindoodchat[.]theworkpc[.]comjarvis001[.]freeddns[.]orgkhyes001ndfpnuewdm[.]kozow[.]comkozow[.]comkskxoscieontrolanel[.]gleeze[.]comksv01sokudwongsj[.]theworkpc[.]comlcskiecjj[.]loseyourip[.]comlcskiecs[.]ddnsfree[.]comloseyourip[.]comlosiesca[.]ddnsgeek[.]comlps2staging[.]ddnsfree[.]comlsls[.]casacam[.]netltiuys[.]ddnsgeek[.]comltiuys[.]kozow[.]commailsdy[.]gleeze[.]commaliclick1[.]ddnsfree[.]commauritasszddb[.]ddnsfree[.]commeetls[.]kozow[.]comml3[.]freeddns[.]orgmlksucnayesk[.]kozow[.]commmmfaco2025[.]mywire[.]orgmms[.]bumbleshrimp[.]commmvmtools[.]giize[.]commodgood[.]gleeze[.]commysql[.]casacam[.]netmywire[.]orgnenigncagvawr[.]giize[.]comnenignenigoncqvoo[.]ooguy[.]comnenigoncqnutgo[.]accesscam[.]orgnenigoncuopzc[.]giize[.]comnims[.]gleeze[.]comnisaldwoa[.]theworkpc[.]comnmszablogs[.]ddnsfree[.]comnodekeny11[.]freeddns[.]orgnodjs2o25nodjs[.]giize[.]comofficeshan[.]kozow[.]comokkstt[.]ddnsgeek[.]comoldatain1[.]ddnsgeek[.]comonlyosun[.]ooguy[.]comooguy[.]comosix[.]ddnsgeek[.]comovmmiuy[.]mywire[.]orgpalamolscueajfvc[.]gleeze[.]compawanp[.]kozow[.]compcmainecia[.]ddnsfree[.]compcvmts3[.]kozow[.]compeisuesacae[.]loseyourip[.]compeowork[.]ddnsgeek[.]compepesetup[.]ddnsfree[.]compewsus[.]freeddns[.]orgplcoaweniva[.]ddnsgeek[.]compolokinyea[.]gleeze[.]compplodsssead222[.]loseyourip[.]compplosad231[.]kozow[.]comppsaBedon[.]gleeze[.]comprdanjana01[.]ddnsfree[.]comprepaid127[.]freeddns[.]orgprihxlcs[.]ddnsfree[.]comprihxlcsw[.]theworkpc[.]compxlaxvvva[.]freeddns[.]orgquitgod2023luck[.]giize[.]comrabbit[.]ooguy[.]comrsm323[.]kozow[.]comsaf3asg[.]giize[.]comsdhite43[.]ddnsfree[.]comsdsuytoins63[.]kozow[.]comselfad[.]gleeze[.]comserious[.]kozow[.]comsetupcodpr2[.]freeddns[.]orgsgsn[.]accesscam[.]orgsn0son4t31bbsvopou[.]camdvr[.]orgsn0son4t31opc[.]freeddns[.]orgsoovuy[.]gleeze[.]comstyuij[.]mywire[.]orgsupceasfg1[.]loseyourip[.]comsystemsz[.]kozow[.]comt31c0mjumpcuyerop[.]ooguy[.]comt31c0mopamcuiomx[.]kozow[.]comt31c0mopmiuewklg[.]webredirect[.]orgt31c0mopocuveop[.]accesscam[.]orgt3lc0mcanyqbfac[.]loseyourip[.]comt3lc0mczmoihwc[.]camdvr[.]orgt3lc0mh4udncifw[.]casacam[.]nett3lc0mhasvnctsk[.]giize[.]comt3lm0rtlcagratu[.]kozow[.]comtch[.]giize[.]comtelcomn[.]giize[.]comtelen[.]bumbleshrimp[.]comtelkom[.]ooguy[.]comtelkomservices[.]theworkpc[.]comthbio[.]kozow[.]comtheworkpc[.]comtimpe[.]kozow[.]comtimpe[.]webredirect[.]orgtlse001hdfuwwgdgpnn[.]theworkpc[.]comtltlsktelko[.]ddnsfree[.]comtransport[.]dynuddns[.]nettrvcl[.]bumbleshrimp[.]comttsiou12[.]loseyourip[.]comua2o25yth[.]ddnsgeek[.]comudieyg[.]gleeze[.]comunnjunnani[.]ddnsfree[.]comupdatamail[.]kozow[.]comupdatasuccess[.]ddnsgeek[.]comupdateservices[.]kozow[.]comupdatetools[.]giize[.]comuscplxsecjs[.]ddnsgeek[.]comvals[.]bumbleshrimp[.]comvass2025[.]casacam[.]netvass[.]ooguy[.]comvmtools[.]camdvr[.]orgvmtools[.]loseyourip[.]comvosies[.]ddnsfree[.]comvpaspmine[.]freeddns[.]orgwdlcamaakc[.]ooguy[.]comwebredirect[.]orgwinfoss1[.]kozow[.]comysiohbk[.]camdvr[.]orgzammffayhd[.]ddnsfree[.]comzmcmvmbm[.]ddnsfree[.]comzwmn350n3o1fsdf3gs[.]kozow[.]comzwmn350n3o1ugety2xbe[.]camdvr[.]orgzwmn350n3o1vsdrggs[.]ddnsfree[.]comzwt310n3o1unety2kab[.]webredirect[.]orgzwt310n3o2unety6a3k[.]kozow[.]comzwt31n3t0nidoqmve[.]camdvr[.]orgzwt3ln3t1aimckalw[.]theworkpc[.]com
URLs (195)
1cv2f3d5s6a9w[.]ddnsfree[.]comBoemobww[.]ddnsfree[.]comDCLCWPDTSDCC[.]ddnsfree[.]comKaushalya[.]freeddns[.]orgMicrosoft[.]bumbleshrimp[.]comMosplosaq[.]accesscam[.]orgNpeoples[.]theworkpc[.]comPRIFTP[.]kozow[.]comPolicyAgent[.]theworkpc[.]comScopps[.]ddnsgeek[.]comSmartfren[.]giize[.]comUSOShared1[.]ddnsfree[.]comadmina[.]freeddns[.]orgafsaces[.]accesscam[.]organcisesic[.]accesscam[.]orgapplebox[.]camdvr[.]orgappler[.]kozow[.]comasdad21ww[.]freeddns[.]orgaw2o25forsbc[.]camdvr[.]orgawcc001jdaigfwdagdcew[.]giize[.]combab2o25com[.]accesscam[.]orgbabaji[.]accesscam[.]orgbabi5599ss[.]ddnsgeek[.]combalabalabo[.]mywire[.]orgbggs[.]giize[.]combibabo[.]freeddns[.]orgbinmol[.]webredirect[.]orgbioth[.]giize[.]combrcallletme[.]theworkpc[.]combtbtutil[.]theworkpc[.]combtltan[.]ooguy[.]comcamcampkes[.]ddnsfree[.]comcamsqewivo[.]kozow[.]comccammutom[.]ddnsgeek[.]comcdnvmtools[.]theworkpc[.]comcloacpae[.]ddnsfree[.]comcmwwoods1[.]theworkpc[.]comcnrpaslceas[.]freeddns[.]orgcodemicros12[.]gleeze[.]comcressmiss[.]ooguy[.]comcvabiasbae[.]ddnsfree[.]comcvnoc01da1cjmnftsd[.]accesscam[.]orgcvpc01aenusocirem[.]accesscam[.]orgcvpc01cgsdfn53hgd[.]giize[.]comdlpossie[.]ddnsfree[.]comdnsfreedb[.]ddnsfree[.]comdoboudix1024[.]mywire[.]orgevilginx2[.]loseyourip[.]comexamp1e[.]webredirect[.]orgfaeelt[.]giize[.]comfakjcsaeyhs[.]ddnsfree[.]comfasceadvcva3[.]gleeze[.]comffosies2024[.]camdvr[.]orgfgdedd1dww[.]gleeze[.]comfilipinet[.]ddnsgeek[.]comfreeios[.]theworkpc[.]comfxpuser14[.]gleeze[.]comfxpzpak[.]kozow[.]comgloboss[.]kozow[.]comgogo2025up[.]ddnsfree[.]comgooglel[.]gleeze[.]comgoogles[.]accesscam[.]orggoogles[.]ddnsfree[.]comgooglett[.]camdvr[.]orggoogllabwws[.]gleeze[.]comgtaldps31c[.]ddnsfree[.]comhamkorg[.]kozow[.]comhonidoo[.]loseyourip[.]comhuygdr12[.]loseyourip[.]comhxxp://130[.]94[.]6[.]228/amp[.]tar[.]gzhxxp://130[.]94[.]6[.]228/apt[.]tar[.]gzhxxp://130[.]94[.]6[.]228/update[.]tar[.]gzicekancusjhea[.]ddnsgeek[.]comidstandsuui[.]kozow[.]comindoodchat[.]theworkpc[.]comjarvis001[.]freeddns[.]orgkhyes001ndfpnuewdm[.]kozow[.]comkskxoscieontrolanel[.]gleeze[.]comksv01sokudwongsj[.]theworkpc[.]comlcskiecjj[.]loseyourip[.]comlcskiecs[.]ddnsfree[.]comlosiesca[.]ddnsgeek[.]comlps2staging[.]ddnsfree[.]comlsls[.]casacam[.]netltiuys[.]ddnsgeek[.]comltiuys[.]kozow[.]commailsdy[.]gleeze[.]commaliclick1[.]ddnsfree[.]commauritasszddb[.]ddnsfree[.]commeetls[.]kozow[.]comml3[.]freeddns[.]orgmlksucnayesk[.]kozow[.]commmmfaco2025[.]mywire[.]orgmms[.]bumbleshrimp[.]commmvmtools[.]giize[.]commodgood[.]gleeze[.]commysql[.]casacam[.]netnenigncagvawr[.]giize[.]comnenignenigoncqvoo[.]ooguy[.]comnenigoncqnutgo[.]accesscam[.]orgnenigoncuopzc[.]giize[.]comnims[.]gleeze[.]comnisaldwoa[.]theworkpc[.]comnmszablogs[.]ddnsfree[.]comnodekeny11[.]freeddns[.]orgnodjs2o25nodjs[.]giize[.]comofficeshan[.]kozow[.]comokkstt[.]ddnsgeek[.]comoldatain1[.]ddnsgeek[.]comonlyosun[.]ooguy[.]comosix[.]ddnsgeek[.]comovmmiuy[.]mywire[.]orgpalamolscueajfvc[.]gleeze[.]compawanp[.]kozow[.]compcmainecia[.]ddnsfree[.]compcvmts3[.]kozow[.]compeisuesacae[.]loseyourip[.]compeowork[.]ddnsgeek[.]compepesetup[.]ddnsfree[.]compewsus[.]freeddns[.]orgplcoaweniva[.]ddnsgeek[.]compolokinyea[.]gleeze[.]compplodsssead222[.]loseyourip[.]compplosad231[.]kozow[.]comppsaBedon[.]gleeze[.]comprdanjana01[.]ddnsfree[.]comprepaid127[.]freeddns[.]orgprihxlcs[.]ddnsfree[.]comprihxlcsw[.]theworkpc[.]compxlaxvvva[.]freeddns[.]orgquitgod2023luck[.]giize[.]comrabbit[.]ooguy[.]comrsm323[.]kozow[.]comsaf3asg[.]giize[.]comsdhite43[.]ddnsfree[.]comsdsuytoins63[.]kozow[.]comselfad[.]gleeze[.]comserious[.]kozow[.]comsetupcodpr2[.]freeddns[.]orgsgsn[.]accesscam[.]orgsn0son4t31bbsvopou[.]camdvr[.]orgsn0son4t31opc[.]freeddns[.]orgsoovuy[.]gleeze[.]comstyuij[.]mywire[.]orgsupceasfg1[.]loseyourip[.]comsystemsz[.]kozow[.]comt31c0mjumpcuyerop[.]ooguy[.]comt31c0mopamcuiomx[.]kozow[.]comt31c0mopmiuewklg[.]webredirect[.]orgt31c0mopocuveop[.]accesscam[.]orgt3lc0mcanyqbfac[.]loseyourip[.]comt3lc0mczmoihwc[.]camdvr[.]orgt3lc0mh4udncifw[.]casacam[.]nett3lc0mhasvnctsk[.]giize[.]comt3lm0rtlcagratu[.]kozow[.]comtch[.]giize[.]comtelcomn[.]giize[.]comtelen[.]bumbleshrimp[.]comtelkom[.]ooguy[.]comtelkomservices[.]theworkpc[.]comthbio[.]kozow[.]comtimpe[.]kozow[.]comtimpe[.]webredirect[.]orgtlse001hdfuwwgdgpnn[.]theworkpc[.]comtltlsktelko[.]ddnsfree[.]comtransport[.]dynuddns[.]nettrvcl[.]bumbleshrimp[.]comttsiou12[.]loseyourip[.]comua2o25yth[.]ddnsgeek[.]comudieyg[.]gleeze[.]comunnjunnani[.]ddnsfree[.]comupdatamail[.]kozow[.]comupdatasuccess[.]ddnsgeek[.]comupdateservices[.]kozow[.]comupdatetools[.]giize[.]comuscplxsecjs[.]ddnsgeek[.]comvals[.]bumbleshrimp[.]comvass2025[.]casacam[.]netvass[.]ooguy[.]comvmtools[.]camdvr[.]orgvmtools[.]loseyourip[.]comvosies[.]ddnsfree[.]comvpaspmine[.]freeddns[.]orgwdlcamaakc[.]ooguy[.]comwinfoss1[.]kozow[.]comysiohbk[.]camdvr[.]orgzammffayhd[.]ddnsfree[.]comzmcmvmbm[.]ddnsfree[.]comzwmn350n3o1fsdf3gs[.]kozow[.]comzwmn350n3o1ugety2xbe[.]camdvr[.]orgzwmn350n3o1vsdrggs[.]ddnsfree[.]comzwt310n3o1unety2kab[.]webredirect[.]orgzwt310n3o2unety6a3k[.]kozow[.]comzwt31n3t0nidoqmve[.]camdvr[.]orgzwt3ln3t1aimckalw[.]theworkpc[.]com
sha256 (6)
01fc3bd5a78cd59255a867ffb3dfdd6e0b7713ee90098ea96cc01c640c6495eb4eb994b816a1a24cf97bfd7551d00fe14b810859170dbf15180d39e05cd7c0f9669917bad46a57e5f2de037f8ec200a44fb579d723af3e2f1be1e8479a267966ce36a5fc44cbd7de947130b67be9e732a7b4086fb1df98a5afd724087c973b47d25024ccea8eac85a9522289cfb709f2ed4e20176dd37855bacc2cd75c995606eb08c840f4c95e2fa5eff05e5f922f86c766f5368a63476f046b2b9dbffc2033
Google and Mandiant Disrupt GRIDTIDE: Chinese APT Espionage Campaign Compromises 53 Victims in 42 Countries 435 indicators · Mar 5, 2026
IPv4 (26)
130[.]94[.]6[.]228139[.]180[.]219[.]115139[.]84[.]236[.]237149[.]28[.]128[.]128149[.]28[.]139[.]125178[.]79[.]188[.]181195[.]123[.]211[.]70195[.]123[.]226[.]235202[.]59[.]10[.]122207[.]148[.]73[.]1838[.]180[.]205[.]1438[.]54[.]112[.]18438[.]54[.]31[.]14638[.]54[.]32[.]24438[.]54[.]37[.]19638[.]54[.]82[.]6938[.]60[.]171[.]24238[.]60[.]194[.]2138[.]60[.]224[.]2538[.]60[.]252[.]6645[.]76[.]157[.]11345[.]76[.]184[.]21445[.]77[.]254[.]16845[.]90[.]59[.]1295[.]34[.]176[.]665[.]20[.]104[.]91
Domains (208)
1cv2f3d5s6a9w[.]ddnsfree[.]comBoemobww[.]ddnsfree[.]comDCLCWPDTSDCC[.]ddnsfree[.]comKaushalya[.]freeddns[.]orgMicrosoft[.]bumbleshrimp[.]comMosplosaq[.]accesscam[.]orgNpeoples[.]theworkpc[.]comPRIFTP[.]kozow[.]comPolicyAgent[.]theworkpc[.]comScopps[.]ddnsgeek[.]comSmartfren[.]giize[.]comUSOShared1[.]ddnsfree[.]comaccesscam[.]orgadmina[.]freeddns[.]orgafsaces[.]accesscam[.]organcisesic[.]accesscam[.]orgapplebox[.]camdvr[.]orgappler[.]kozow[.]comasdad21ww[.]freeddns[.]orgaw2o25forsbc[.]camdvr[.]orgawcc001jdaigfwdagdcew[.]giize[.]combab2o25com[.]accesscam[.]orgbabaji[.]accesscam[.]orgbabi5599ss[.]ddnsgeek[.]combalabalabo[.]mywire[.]orgbggs[.]giize[.]combibabo[.]freeddns[.]orgbinmol[.]webredirect[.]orgbioth[.]giize[.]combrcallletme[.]theworkpc[.]combtbtutil[.]theworkpc[.]combtltan[.]ooguy[.]combumbleshrimp[.]comcamcampkes[.]ddnsfree[.]comcamdvr[.]orgcamsqewivo[.]kozow[.]comcasacam[.]netccammutom[.]ddnsgeek[.]comcdnvmtools[.]theworkpc[.]comcloacpae[.]ddnsfree[.]comcmwwoods1[.]theworkpc[.]comcnrpaslceas[.]freeddns[.]orgcodemicros12[.]gleeze[.]comcressmiss[.]ooguy[.]comcvabiasbae[.]ddnsfree[.]comcvnoc01da1cjmnftsd[.]accesscam[.]orgcvpc01aenusocirem[.]accesscam[.]orgcvpc01cgsdfn53hgd[.]giize[.]comddnsfree[.]comddnsgeek[.]comdlpossie[.]ddnsfree[.]comdnsfreedb[.]ddnsfree[.]comdoboudix1024[.]mywire[.]orgdynuddns[.]netevilginx2[.]loseyourip[.]comexamp1e[.]webredirect[.]orgfaeelt[.]giize[.]comfakjcsaeyhs[.]ddnsfree[.]comfasceadvcva3[.]gleeze[.]comffosies2024[.]camdvr[.]orgfgdedd1dww[.]gleeze[.]comfilipinet[.]ddnsgeek[.]comfreeddns[.]orgfreeios[.]theworkpc[.]comfxpuser14[.]gleeze[.]comfxpzpak[.]kozow[.]comgiize[.]comgleeze[.]comgloboss[.]kozow[.]comgogo2025up[.]ddnsfree[.]comgooglel[.]gleeze[.]comgoogles[.]accesscam[.]orggoogles[.]ddnsfree[.]comgooglett[.]camdvr[.]orggoogllabwws[.]gleeze[.]comgtaldps31c[.]ddnsfree[.]comhamkorg[.]kozow[.]comhonidoo[.]loseyourip[.]comhuygdr12[.]loseyourip[.]comicekancusjhea[.]ddnsgeek[.]comidstandsuui[.]kozow[.]comindoodchat[.]theworkpc[.]comjarvis001[.]freeddns[.]orgkhyes001ndfpnuewdm[.]kozow[.]comkozow[.]comkskxoscieontrolanel[.]gleeze[.]comksv01sokudwongsj[.]theworkpc[.]comlcskiecjj[.]loseyourip[.]comlcskiecs[.]ddnsfree[.]comloseyourip[.]comlosiesca[.]ddnsgeek[.]comlps2staging[.]ddnsfree[.]comlsls[.]casacam[.]netltiuys[.]ddnsgeek[.]comltiuys[.]kozow[.]commailsdy[.]gleeze[.]commaliclick1[.]ddnsfree[.]commauritasszddb[.]ddnsfree[.]commeetls[.]kozow[.]comml3[.]freeddns[.]orgmlksucnayesk[.]kozow[.]commmmfaco2025[.]mywire[.]orgmms[.]bumbleshrimp[.]commmvmtools[.]giize[.]commodgood[.]gleeze[.]commysql[.]casacam[.]netmywire[.]orgnenigncagvawr[.]giize[.]comnenignenigoncqvoo[.]ooguy[.]comnenigoncqnutgo[.]accesscam[.]orgnenigoncuopzc[.]giize[.]comnims[.]gleeze[.]comnisaldwoa[.]theworkpc[.]comnmszablogs[.]ddnsfree[.]comnodekeny11[.]freeddns[.]orgnodjs2o25nodjs[.]giize[.]comofficeshan[.]kozow[.]comokkstt[.]ddnsgeek[.]comoldatain1[.]ddnsgeek[.]comonlyosun[.]ooguy[.]comooguy[.]comosix[.]ddnsgeek[.]comovmmiuy[.]mywire[.]orgpalamolscueajfvc[.]gleeze[.]compawanp[.]kozow[.]compcmainecia[.]ddnsfree[.]compcvmts3[.]kozow[.]compeisuesacae[.]loseyourip[.]compeowork[.]ddnsgeek[.]compepesetup[.]ddnsfree[.]compewsus[.]freeddns[.]orgplcoaweniva[.]ddnsgeek[.]compolokinyea[.]gleeze[.]compplodsssead222[.]loseyourip[.]compplosad231[.]kozow[.]comppsaBedon[.]gleeze[.]comprdanjana01[.]ddnsfree[.]comprepaid127[.]freeddns[.]orgprihxlcs[.]ddnsfree[.]comprihxlcsw[.]theworkpc[.]compxlaxvvva[.]freeddns[.]orgquitgod2023luck[.]giize[.]comrabbit[.]ooguy[.]comrsm323[.]kozow[.]comsaf3asg[.]giize[.]comsdhite43[.]ddnsfree[.]comsdsuytoins63[.]kozow[.]comselfad[.]gleeze[.]comserious[.]kozow[.]comsetupcodpr2[.]freeddns[.]orgsgsn[.]accesscam[.]orgsn0son4t31bbsvopou[.]camdvr[.]orgsn0son4t31opc[.]freeddns[.]orgsoovuy[.]gleeze[.]comstyuij[.]mywire[.]orgsupceasfg1[.]loseyourip[.]comsystemsz[.]kozow[.]comt31c0mjumpcuyerop[.]ooguy[.]comt31c0mopamcuiomx[.]kozow[.]comt31c0mopmiuewklg[.]webredirect[.]orgt31c0mopocuveop[.]accesscam[.]orgt3lc0mcanyqbfac[.]loseyourip[.]comt3lc0mczmoihwc[.]camdvr[.]orgt3lc0mh4udncifw[.]casacam[.]nett3lc0mhasvnctsk[.]giize[.]comt3lm0rtlcagratu[.]kozow[.]comtch[.]giize[.]comtelcomn[.]giize[.]comtelen[.]bumbleshrimp[.]comtelkom[.]ooguy[.]comtelkomservices[.]theworkpc[.]comthbio[.]kozow[.]comtheworkpc[.]comtimpe[.]kozow[.]comtimpe[.]webredirect[.]orgtlse001hdfuwwgdgpnn[.]theworkpc[.]comtltlsktelko[.]ddnsfree[.]comtransport[.]dynuddns[.]nettrvcl[.]bumbleshrimp[.]comttsiou12[.]loseyourip[.]comua2o25yth[.]ddnsgeek[.]comudieyg[.]gleeze[.]comunnjunnani[.]ddnsfree[.]comupdatamail[.]kozow[.]comupdatasuccess[.]ddnsgeek[.]comupdateservices[.]kozow[.]comupdatetools[.]giize[.]comuscplxsecjs[.]ddnsgeek[.]comvals[.]bumbleshrimp[.]comvass2025[.]casacam[.]netvass[.]ooguy[.]comvmtools[.]camdvr[.]orgvmtools[.]loseyourip[.]comvosies[.]ddnsfree[.]comvpaspmine[.]freeddns[.]orgwdlcamaakc[.]ooguy[.]comwebredirect[.]orgwinfoss1[.]kozow[.]comysiohbk[.]camdvr[.]orgzammffayhd[.]ddnsfree[.]comzmcmvmbm[.]ddnsfree[.]comzwmn350n3o1fsdf3gs[.]kozow[.]comzwmn350n3o1ugety2xbe[.]camdvr[.]orgzwmn350n3o1vsdrggs[.]ddnsfree[.]comzwt310n3o1unety2kab[.]webredirect[.]orgzwt310n3o2unety6a3k[.]kozow[.]comzwt31n3t0nidoqmve[.]camdvr[.]orgzwt3ln3t1aimckalw[.]theworkpc[.]com
URLs (195)
1cv2f3d5s6a9w[.]ddnsfree[.]comBoemobww[.]ddnsfree[.]comDCLCWPDTSDCC[.]ddnsfree[.]comKaushalya[.]freeddns[.]orgMicrosoft[.]bumbleshrimp[.]comMosplosaq[.]accesscam[.]orgNpeoples[.]theworkpc[.]comPRIFTP[.]kozow[.]comPolicyAgent[.]theworkpc[.]comScopps[.]ddnsgeek[.]comSmartfren[.]giize[.]comUSOShared1[.]ddnsfree[.]comadmina[.]freeddns[.]orgafsaces[.]accesscam[.]organcisesic[.]accesscam[.]orgapplebox[.]camdvr[.]orgappler[.]kozow[.]comasdad21ww[.]freeddns[.]orgaw2o25forsbc[.]camdvr[.]orgawcc001jdaigfwdagdcew[.]giize[.]combab2o25com[.]accesscam[.]orgbabaji[.]accesscam[.]orgbabi5599ss[.]ddnsgeek[.]combalabalabo[.]mywire[.]orgbggs[.]giize[.]combibabo[.]freeddns[.]orgbinmol[.]webredirect[.]orgbioth[.]giize[.]combrcallletme[.]theworkpc[.]combtbtutil[.]theworkpc[.]combtltan[.]ooguy[.]comcamcampkes[.]ddnsfree[.]comcamsqewivo[.]kozow[.]comccammutom[.]ddnsgeek[.]comcdnvmtools[.]theworkpc[.]comcloacpae[.]ddnsfree[.]comcmwwoods1[.]theworkpc[.]comcnrpaslceas[.]freeddns[.]orgcodemicros12[.]gleeze[.]comcressmiss[.]ooguy[.]comcvabiasbae[.]ddnsfree[.]comcvnoc01da1cjmnftsd[.]accesscam[.]orgcvpc01aenusocirem[.]accesscam[.]orgcvpc01cgsdfn53hgd[.]giize[.]comdlpossie[.]ddnsfree[.]comdnsfreedb[.]ddnsfree[.]comdoboudix1024[.]mywire[.]orgevilginx2[.]loseyourip[.]comexamp1e[.]webredirect[.]orgfaeelt[.]giize[.]comfakjcsaeyhs[.]ddnsfree[.]comfasceadvcva3[.]gleeze[.]comffosies2024[.]camdvr[.]orgfgdedd1dww[.]gleeze[.]comfilipinet[.]ddnsgeek[.]comfreeios[.]theworkpc[.]comfxpuser14[.]gleeze[.]comfxpzpak[.]kozow[.]comgloboss[.]kozow[.]comgogo2025up[.]ddnsfree[.]comgooglel[.]gleeze[.]comgoogles[.]accesscam[.]orggoogles[.]ddnsfree[.]comgooglett[.]camdvr[.]orggoogllabwws[.]gleeze[.]comgtaldps31c[.]ddnsfree[.]comhamkorg[.]kozow[.]comhonidoo[.]loseyourip[.]comhuygdr12[.]loseyourip[.]comhxxp://130[.]94[.]6[.]228/amp[.]tar[.]gzhxxp://130[.]94[.]6[.]228/apt[.]tar[.]gzhxxp://130[.]94[.]6[.]228/update[.]tar[.]gzicekancusjhea[.]ddnsgeek[.]comidstandsuui[.]kozow[.]comindoodchat[.]theworkpc[.]comjarvis001[.]freeddns[.]orgkhyes001ndfpnuewdm[.]kozow[.]comkskxoscieontrolanel[.]gleeze[.]comksv01sokudwongsj[.]theworkpc[.]comlcskiecjj[.]loseyourip[.]comlcskiecs[.]ddnsfree[.]comlosiesca[.]ddnsgeek[.]comlps2staging[.]ddnsfree[.]comlsls[.]casacam[.]netltiuys[.]ddnsgeek[.]comltiuys[.]kozow[.]commailsdy[.]gleeze[.]commaliclick1[.]ddnsfree[.]commauritasszddb[.]ddnsfree[.]commeetls[.]kozow[.]comml3[.]freeddns[.]orgmlksucnayesk[.]kozow[.]commmmfaco2025[.]mywire[.]orgmms[.]bumbleshrimp[.]commmvmtools[.]giize[.]commodgood[.]gleeze[.]commysql[.]casacam[.]netnenigncagvawr[.]giize[.]comnenignenigoncqvoo[.]ooguy[.]comnenigoncqnutgo[.]accesscam[.]orgnenigoncuopzc[.]giize[.]comnims[.]gleeze[.]comnisaldwoa[.]theworkpc[.]comnmszablogs[.]ddnsfree[.]comnodekeny11[.]freeddns[.]orgnodjs2o25nodjs[.]giize[.]comofficeshan[.]kozow[.]comokkstt[.]ddnsgeek[.]comoldatain1[.]ddnsgeek[.]comonlyosun[.]ooguy[.]comosix[.]ddnsgeek[.]comovmmiuy[.]mywire[.]orgpalamolscueajfvc[.]gleeze[.]compawanp[.]kozow[.]compcmainecia[.]ddnsfree[.]compcvmts3[.]kozow[.]compeisuesacae[.]loseyourip[.]compeowork[.]ddnsgeek[.]compepesetup[.]ddnsfree[.]compewsus[.]freeddns[.]orgplcoaweniva[.]ddnsgeek[.]compolokinyea[.]gleeze[.]compplodsssead222[.]loseyourip[.]compplosad231[.]kozow[.]comppsaBedon[.]gleeze[.]comprdanjana01[.]ddnsfree[.]comprepaid127[.]freeddns[.]orgprihxlcs[.]ddnsfree[.]comprihxlcsw[.]theworkpc[.]compxlaxvvva[.]freeddns[.]orgquitgod2023luck[.]giize[.]comrabbit[.]ooguy[.]comrsm323[.]kozow[.]comsaf3asg[.]giize[.]comsdhite43[.]ddnsfree[.]comsdsuytoins63[.]kozow[.]comselfad[.]gleeze[.]comserious[.]kozow[.]comsetupcodpr2[.]freeddns[.]orgsgsn[.]accesscam[.]orgsn0son4t31bbsvopou[.]camdvr[.]orgsn0son4t31opc[.]freeddns[.]orgsoovuy[.]gleeze[.]comstyuij[.]mywire[.]orgsupceasfg1[.]loseyourip[.]comsystemsz[.]kozow[.]comt31c0mjumpcuyerop[.]ooguy[.]comt31c0mopamcuiomx[.]kozow[.]comt31c0mopmiuewklg[.]webredirect[.]orgt31c0mopocuveop[.]accesscam[.]orgt3lc0mcanyqbfac[.]loseyourip[.]comt3lc0mczmoihwc[.]camdvr[.]orgt3lc0mh4udncifw[.]casacam[.]nett3lc0mhasvnctsk[.]giize[.]comt3lm0rtlcagratu[.]kozow[.]comtch[.]giize[.]comtelcomn[.]giize[.]comtelen[.]bumbleshrimp[.]comtelkom[.]ooguy[.]comtelkomservices[.]theworkpc[.]comthbio[.]kozow[.]comtimpe[.]kozow[.]comtimpe[.]webredirect[.]orgtlse001hdfuwwgdgpnn[.]theworkpc[.]comtltlsktelko[.]ddnsfree[.]comtransport[.]dynuddns[.]nettrvcl[.]bumbleshrimp[.]comttsiou12[.]loseyourip[.]comua2o25yth[.]ddnsgeek[.]comudieyg[.]gleeze[.]comunnjunnani[.]ddnsfree[.]comupdatamail[.]kozow[.]comupdatasuccess[.]ddnsgeek[.]comupdateservices[.]kozow[.]comupdatetools[.]giize[.]comuscplxsecjs[.]ddnsgeek[.]comvals[.]bumbleshrimp[.]comvass2025[.]casacam[.]netvass[.]ooguy[.]comvmtools[.]camdvr[.]orgvmtools[.]loseyourip[.]comvosies[.]ddnsfree[.]comvpaspmine[.]freeddns[.]orgwdlcamaakc[.]ooguy[.]comwinfoss1[.]kozow[.]comysiohbk[.]camdvr[.]orgzammffayhd[.]ddnsfree[.]comzmcmvmbm[.]ddnsfree[.]comzwmn350n3o1fsdf3gs[.]kozow[.]comzwmn350n3o1ugety2xbe[.]camdvr[.]orgzwmn350n3o1vsdrggs[.]ddnsfree[.]comzwt310n3o1unety2kab[.]webredirect[.]orgzwt310n3o2unety6a3k[.]kozow[.]comzwt31n3t0nidoqmve[.]camdvr[.]orgzwt3ln3t1aimckalw[.]theworkpc[.]com
sha256 (6)
01fc3bd5a78cd59255a867ffb3dfdd6e0b7713ee90098ea96cc01c640c6495eb4eb994b816a1a24cf97bfd7551d00fe14b810859170dbf15180d39e05cd7c0f9669917bad46a57e5f2de037f8ec200a44fb579d723af3e2f1be1e8479a267966ce36a5fc44cbd7de947130b67be9e732a7b4086fb1df98a5afd724087c973b47d25024ccea8eac85a9522289cfb709f2ed4e20176dd37855bacc2cd75c995606eb08c840f4c95e2fa5eff05e5f922f86c766f5368a63476f046b2b9dbffc2033
Coruna iOS Exploit Kit: Nation-State Spyware Tools Now Targeting Crypto Wallet Users 1 indicators · Mar 5, 2026
CVEs (1)
UAT-9244: China-Nexus APT Deploys Three New Malware Implants Against South American Telecom Providers 75 indicators · Mar 5, 2026
IPv4 (24)
149[.]28[.]25[.]33154[.]205[.]154[.]194154[.]205[.]154[.]65154[.]205[.]154[.]70154[.]205[.]154[.]82154[.]223[.]21[.]130154[.]223[.]21[.]194158[.]247[.]238[.]240185[.]196[.]10[.]247185[.]196[.]10[.]38207[.]148[.]120[.]52207[.]148[.]121[.]95212[.]11[.]64[.]105216[.]238[.]112[.]222216[.]238[.]123[.]242216[.]238[.]94[.]3738[.]54[.]125[.]13438[.]60[.]199[.]3445[.]32[.]106[.]9445[.]77[.]34[.]19445[.]77[.]41[.]14147[.]76[.]100[.]15964[.]190[.]113[.]17064[.]95[.]10[.]253
Domains (3)
bloopencil[.]netxcit76[.]comxtibh[.]com
URLs (3)
bloopencil[.]netxcit76[.]comxtibh[.]com
sha256 (44)
00735a8a50d2856c11150ef1e29c05acebce7ad3edad00e37c7f043aacb46330023467e236a95d5f0e62e26445d430d749c59312f66cf136e6e2c2d526c46ba103eac9eb7f4b4bc494ef0496ee23cabbf38f883896838ed813741d8f64ac9fde06b23d84fd7afd525dfd7860ebd561dcdd72ccbeb51981d5d9a75acf068d0a2a075b20a21ea6a0d2201a12a049f332ecc61348fc0ad3cfee038c6ad6aa44e7440c7e36683a100a96f695a952cf07052af9a47f5898e1078311fd58c5fdbdecc815d937803f90c2b9e277ff94d3e98ff30015ecc7f4623a158e3c98861e5cb27817652d7bb5fe0454023db4fc7f608df0dbe6af237be31258e16ba52f0e895e261cedf01dd4b7e50181d0e781825c66957b862941395d77c8bd7705114f319c801f5635a512a923e98a90cdc1b2fb988a2da78706e07e419dae9e1a54dd4d682b1fcdd5a417db31e5e07d32cecfa69e53f0dce95b7130ad9c03b92249f001801d2c3f2261b00ea45e25eb4e9de2b7ff8e41f311c0b3d986461f834022c08b3b992d2ca7d21310b14f5f5641bbf4a9ff4c3e566b1fbbd370034c6844cedc8f053834d64b3cd9430e85edefcb883973a086dd5de9917e05fabec89b1f4ab9627e9138eeaa4eaad72feb3f8e6993565fcc548d8e7bb93642590f00fa24aacc0e28623c098a687947938e36ab34b9f09a11ebd82d50089cbfe6e237d810faa729f8ff3d9fbfc2c056eac857ba54e5ed134aa45a4b8322ee9f9353ba32e5b2ca71b0e33fcadde4b414a18b2fed56c1ec59d97977123615fbbf411a1c78425445a6e71c3fcced9332301ff70b20c98c9434c858400013d659afa6bb5149cffb0206357d56bead2933e91366e4a0d5761daf5b238a7f2c22e597664ef67b3ecae20ab32666adeedfb739774fcc09aa7426c8fad29f8047ab4caee8040d07c0e84d01161166bdce93de3b02cf9cdadad18ca1504ac83e379a752d51f60deae6dcbafe4e3166ce42258062e902bd7f9e90ad5453a901cfc424f0ea497c4d14f063f3acd3296a2d23cc8746a83e9a3b974788fce0e414706b8e75ff390426dd7e10b19967b36ec070457d1f6f239cb02c5e1576a3660cca98f3a07eec6e4e107f698d7fe555711d9427ee43bc2186b9124f31cba2db5f54ec9a0d56dc2948e1a4377bada28974d1a678bdc4bb9f33321e94e3bd1bc1740472ed734231fc46af720072ecb77e74fbc8360d4c95d64d7acaa4d18943dce2d41f91d080b0b5e435d8bce52861a57b70cd956f082b1029d02b4cb7608893f2de7fa9c500d7d7febdd0f745ac3cb6870e791af14caaf395c56028176a9c3f4c1ff0318ef3112d57ecd3d4a1be2ef99a7225c17e4bad3ffe7f080530d36f4f8aca5c116b913caa91ab9b0cee85638eA5e413456ce9fc60bb44d442b72546e9e4118a61894fbe4b5c56e4dfad6055e3a313f76fca50fff1bcd6f2c6cbc1268985f8c0a3a05fe7f43c4fc0ac3aff84dcbabc81fc9c998e9dc4ab545f0e112e34d2641e1333bc81aaa131abd061a5b604bfc35f12d00fa4b40c5fbce9e37d704e12a52262709bcbdf09f97890bc40cad5c9a42423ef08bd7f183915780d39530eba5e4e25968c51965ff8bb3026965a28c9fc2af30f769d856b88b3051f19fdb663b3e0a0916279df9bbcba93c6a110c9d5eb979cb8a72706bfa591fa57d4ebf7d13cecdc9377b0192375e2f570f796dfd78b3c6df8f3756a7e310cf7435fdba201dd03ec9f97420a0db683489a01a7c9e34c9159e6e78c59518a14c5b96bddfee094b684f99d4f69b13371284a014e87ebcb2691b7c92cdf2b2ff5e2d753abeea8cb325c16596cd839e6bd147f80e38af36913607356a32ea106103387105c635fa923f8ed98ad0194b66ec79e379a02f3e899789b56429f483e5096e1f473335024f1f763e2d428132338e30352b89ef8066833e47814793d8c58743622b051070dac09cb010c323970c81b59260f84
Cisco Patches Two Max Severity Secure FMC Flaws Enabling Root Access 2 indicators · Mar 4, 2026
CVEs (2)
Open-Source CyberStrikeAI Tool Weaponized in AI-Driven FortiGate Attacks Across 55 Countries 1 indicators · Mar 4, 2026
IPv4 (1)
212[.]11[.]64[.]250
Zerobot Malware Targets n8n Automation Platform: First Active Exploitation of CVE-2025-68613 18 indicators · Mar 3, 2026
IPv4 (5)
103[.]59[.]160[.]237140[.]233[.]190[.]96144[.]172[.]100[.]228172[.]86[.]123[.]179216[.]126[.]227[.]101
Domains (3)
0bot[.]qzz[.]ioandro[.]notemacro[.]compivot[.]notemacro[.]com
URLs (2)
notemacro[.]comqzz[.]io
sha256 (6)
045a1e42cb64e4aa91601f65a80ec5bd040ea4024c6d3b051cb1a6aa15d03b57360467c3b733513c922b90d0e222067509df6481636926fa1786d0273169f4dac8e8b627398ece071a3a148d6f38e46763dc534f9bfd967ebc8ac3479540111fcc1efbca0da739b7784d833e56a22063ec4719cd095b16e3e10f77efd4277e24d024039824db6fe535ddd51bc81099c946871e4e280c48ed6e90dada79ccfcc7deb70af83a9b3bb8f9424b709c3f6342d0c63aa10e7f8df43dd7a457bda8f060
CVEs (2)
Silver Dragon APT Targets Southeast Asia and Europe Using GearDoor Backdoor with Google Drive C2 63 indicators · Mar 3, 2026
IPv4 (1)
104[.]21[.]51[.]8
Domains (17)
ampolice[.]orgbigflx[.]netcopilot-cloud[.]netdrivefrontend[.]padrivefrontend[.]pa-clients[.]workers[.]devexchange4study[.]commindssurpass[.]comns1[.]exchange4study[.]comns1[.]onedriveconsole[.]comns2[.]onedriveconsole[.]comoicm[.]orgonedriveconsole[.]comprotacik[.]comrevitpourtous[.]comsplunkds[.]comwikipedla[.]blogzhydromet[.]com
URLs (13)
ampolice[.]orgbigflx[.]netcopilot-cloud[.]netexchange4study[.]commindssurpass[.]comoicm[.]orgonedriveconsole[.]comprotacik[.]comrevitpourtous[.]comsplunkds[.]comwikipedla[.]blogworkers[.]devzhydromet[.]com
md5 (1)
sha256 (31)
166e777cb72a7c4e126f8ed97e0a82e7ca9e87df7793fea811daf34e1e7e47a616b9a7358be88632378ba20ba1430786f3b844694b1f876211ecdbecf5cccbc219139a525ee9c22efd6a4842c4cd50ab2c5f9ee391e5531071df0bb4e685f55d2f787c1454891b242ab221b8b8b420373c3eb1a0c1fdcb624dd800c50758bbb03128bdb8efaaa04c0ba96337252f4cc2dc795021cbc410f74ace9dde958bac1d37b485ed8d150d022c41e5e307b8c54c34ef806625b44d0c940b18be7d5b29ce3a2df7a2cfeca5ba315a29cf313268a53a22316c925e6b9760ead8f4df0d1f753e2a0bafbd44e24b17fd7b17c9f2b2a3727349971d42612d55bbc1732082619a43f8f94ca5aa0af7bfb0cc1d2f664a46500a161b2d082b48b516d084ef48534844e769efed3e4f9f04c52dcd13f15cead251a1a08827a2cb6ea68427522c7fbb4f93be0c46a53701b1777ab8df874c837df3d8256e026f138d60fc2932e569a851684a0e356513486489986f5832c948107ff687c8501d64846cdc43074294135341c7256542405abdd01ee288b08e49dcb6d1782be6b7bea63b459d80f9a8f5568c67564d62b09d1a1bc29a494cf4bf31afddcafcf78592b178c63f23ccfcae5ad857df8976523cb3ad2fdf30e87c0e7daa64135716b139ffdcd209b98e165472e4b6540e32b8b7aac850055609bc5afc19e29834e9aa6be29a8ea59a2c97857384462d420bdc9683a4cac2a8ad19353a2aa7d2244c91e9182345777e811e33740a09fcdefa5a5f79355b720f54ff09efa64062229fb388adbccd9c829e9ff074a11a07d167f8f5c0baa724d1f7708985c81d0ac3d0e4d7ef3f3220c335e0097f89a4d5af47bc00a9ad58f0bcbe8a7be2662953dcd03f0e881cc5cbf6b7bca885a03d2e74ae84093a74699057693d11e5c61f85b62e741778cbc5fc9f89022f8c29f9189a9ad75a959024f59e68c62d42a6fd42f9eacf847128c7efe4ef7578948468aba5c851952ebe56a5bf37904ed83a6c8cb520304db6938d79892f0a1b967b5c611d304385807ea2d865fa561c15cde0473dd63e768679a4f29f0e4563a6b5448ba45f3f352f5f4c5376024891adda1ef8ebf62a8fe63424fa230c691db93560c4d18120e113fb8b04a8aa05f66a12116d1fbf18a93186f6314381e97ebcbe2f0a8134c0e7fce18d0394ababc1d910e6f7b77b8c07643434cd14f4c5d6bd699ed720e2bd7085b3444cb8f4d36870b5b48df1055ec6cc1553db3eef7fafc4de1f1a8cb3b0392802ee56096ddb25b6f51c51350ce7c45e14d8c285765300ddaca57f3d5f4986da052ca172631b351410d6f5831f6af351699c6201cc011be3b016f2fc865d0f53f635f740eb0203626517425ed9a2908058f96a3bcf470d
APT28 Exploited CVE-2026-21513 MSHTML Zero-Day as Attack Vector Before February Patch Tuesday 4 indicators · Mar 3, 2026
Domains (1)
URLs (1)
CVEs (2)
Malicious Go Crypto Module Steals Passwords and Deploys Rekoobe Backdoor 2 indicators · Mar 2, 2026
IPv4 (1)
154[.]84[.]63[.]184
Domains (1)
go[.]googlesource[.]com
Fake Google Security Check Transforms Browser Into Surveillance Toolkit via PWA Installation 3 indicators · Mar 2, 2026
Domains (1)
google-prism[.]com
URLs (1)
google-prism[.]com
Google Disrupts UNC2814 GRIDTIDE Campaign: Chinese APT Breaches 53 Organizations Across 42 Countries 435 indicators · Feb 28, 2026
IPv4 (26)
130[.]94[.]6[.]228139[.]180[.]219[.]115139[.]84[.]236[.]237149[.]28[.]128[.]128149[.]28[.]139[.]125178[.]79[.]188[.]181195[.]123[.]211[.]70195[.]123[.]226[.]235202[.]59[.]10[.]122207[.]148[.]73[.]1838[.]180[.]205[.]1438[.]54[.]112[.]18438[.]54[.]31[.]14638[.]54[.]32[.]24438[.]54[.]37[.]19638[.]54[.]82[.]6938[.]60[.]171[.]24238[.]60[.]194[.]2138[.]60[.]224[.]2538[.]60[.]252[.]6645[.]76[.]157[.]11345[.]76[.]184[.]21445[.]77[.]254[.]16845[.]90[.]59[.]1295[.]34[.]176[.]665[.]20[.]104[.]91
Domains (208)
1cv2f3d5s6a9w[.]ddnsfree[.]comBoemobww[.]ddnsfree[.]comDCLCWPDTSDCC[.]ddnsfree[.]comKaushalya[.]freeddns[.]orgMicrosoft[.]bumbleshrimp[.]comMosplosaq[.]accesscam[.]orgNpeoples[.]theworkpc[.]comPRIFTP[.]kozow[.]comPolicyAgent[.]theworkpc[.]comScopps[.]ddnsgeek[.]comSmartfren[.]giize[.]comUSOShared1[.]ddnsfree[.]comaccesscam[.]orgadmina[.]freeddns[.]orgafsaces[.]accesscam[.]organcisesic[.]accesscam[.]orgapplebox[.]camdvr[.]orgappler[.]kozow[.]comasdad21ww[.]freeddns[.]orgaw2o25forsbc[.]camdvr[.]orgawcc001jdaigfwdagdcew[.]giize[.]combab2o25com[.]accesscam[.]orgbabaji[.]accesscam[.]orgbabi5599ss[.]ddnsgeek[.]combalabalabo[.]mywire[.]orgbggs[.]giize[.]combibabo[.]freeddns[.]orgbinmol[.]webredirect[.]orgbioth[.]giize[.]combrcallletme[.]theworkpc[.]combtbtutil[.]theworkpc[.]combtltan[.]ooguy[.]combumbleshrimp[.]comcamcampkes[.]ddnsfree[.]comcamdvr[.]orgcamsqewivo[.]kozow[.]comcasacam[.]netccammutom[.]ddnsgeek[.]comcdnvmtools[.]theworkpc[.]comcloacpae[.]ddnsfree[.]comcmwwoods1[.]theworkpc[.]comcnrpaslceas[.]freeddns[.]orgcodemicros12[.]gleeze[.]comcressmiss[.]ooguy[.]comcvabiasbae[.]ddnsfree[.]comcvnoc01da1cjmnftsd[.]accesscam[.]orgcvpc01aenusocirem[.]accesscam[.]orgcvpc01cgsdfn53hgd[.]giize[.]comddnsfree[.]comddnsgeek[.]comdlpossie[.]ddnsfree[.]comdnsfreedb[.]ddnsfree[.]comdoboudix1024[.]mywire[.]orgdynuddns[.]netevilginx2[.]loseyourip[.]comexamp1e[.]webredirect[.]orgfaeelt[.]giize[.]comfakjcsaeyhs[.]ddnsfree[.]comfasceadvcva3[.]gleeze[.]comffosies2024[.]camdvr[.]orgfgdedd1dww[.]gleeze[.]comfilipinet[.]ddnsgeek[.]comfreeddns[.]orgfreeios[.]theworkpc[.]comfxpuser14[.]gleeze[.]comfxpzpak[.]kozow[.]comgiize[.]comgleeze[.]comgloboss[.]kozow[.]comgogo2025up[.]ddnsfree[.]comgooglel[.]gleeze[.]comgoogles[.]accesscam[.]orggoogles[.]ddnsfree[.]comgooglett[.]camdvr[.]orggoogllabwws[.]gleeze[.]comgtaldps31c[.]ddnsfree[.]comhamkorg[.]kozow[.]comhonidoo[.]loseyourip[.]comhuygdr12[.]loseyourip[.]comicekancusjhea[.]ddnsgeek[.]comidstandsuui[.]kozow[.]comindoodchat[.]theworkpc[.]comjarvis001[.]freeddns[.]orgkhyes001ndfpnuewdm[.]kozow[.]comkozow[.]comkskxoscieontrolanel[.]gleeze[.]comksv01sokudwongsj[.]theworkpc[.]comlcskiecjj[.]loseyourip[.]comlcskiecs[.]ddnsfree[.]comloseyourip[.]comlosiesca[.]ddnsgeek[.]comlps2staging[.]ddnsfree[.]comlsls[.]casacam[.]netltiuys[.]ddnsgeek[.]comltiuys[.]kozow[.]commailsdy[.]gleeze[.]commaliclick1[.]ddnsfree[.]commauritasszddb[.]ddnsfree[.]commeetls[.]kozow[.]comml3[.]freeddns[.]orgmlksucnayesk[.]kozow[.]commmmfaco2025[.]mywire[.]orgmms[.]bumbleshrimp[.]commmvmtools[.]giize[.]commodgood[.]gleeze[.]commysql[.]casacam[.]netmywire[.]orgnenigncagvawr[.]giize[.]comnenignenigoncqvoo[.]ooguy[.]comnenigoncqnutgo[.]accesscam[.]orgnenigoncuopzc[.]giize[.]comnims[.]gleeze[.]comnisaldwoa[.]theworkpc[.]comnmszablogs[.]ddnsfree[.]comnodekeny11[.]freeddns[.]orgnodjs2o25nodjs[.]giize[.]comofficeshan[.]kozow[.]comokkstt[.]ddnsgeek[.]comoldatain1[.]ddnsgeek[.]comonlyosun[.]ooguy[.]comooguy[.]comosix[.]ddnsgeek[.]comovmmiuy[.]mywire[.]orgpalamolscueajfvc[.]gleeze[.]compawanp[.]kozow[.]compcmainecia[.]ddnsfree[.]compcvmts3[.]kozow[.]compeisuesacae[.]loseyourip[.]compeowork[.]ddnsgeek[.]compepesetup[.]ddnsfree[.]compewsus[.]freeddns[.]orgplcoaweniva[.]ddnsgeek[.]compolokinyea[.]gleeze[.]compplodsssead222[.]loseyourip[.]compplosad231[.]kozow[.]comppsaBedon[.]gleeze[.]comprdanjana01[.]ddnsfree[.]comprepaid127[.]freeddns[.]orgprihxlcs[.]ddnsfree[.]comprihxlcsw[.]theworkpc[.]compxlaxvvva[.]freeddns[.]orgquitgod2023luck[.]giize[.]comrabbit[.]ooguy[.]comrsm323[.]kozow[.]comsaf3asg[.]giize[.]comsdhite43[.]ddnsfree[.]comsdsuytoins63[.]kozow[.]comselfad[.]gleeze[.]comserious[.]kozow[.]comsetupcodpr2[.]freeddns[.]orgsgsn[.]accesscam[.]orgsn0son4t31bbsvopou[.]camdvr[.]orgsn0son4t31opc[.]freeddns[.]orgsoovuy[.]gleeze[.]comstyuij[.]mywire[.]orgsupceasfg1[.]loseyourip[.]comsystemsz[.]kozow[.]comt31c0mjumpcuyerop[.]ooguy[.]comt31c0mopamcuiomx[.]kozow[.]comt31c0mopmiuewklg[.]webredirect[.]orgt31c0mopocuveop[.]accesscam[.]orgt3lc0mcanyqbfac[.]loseyourip[.]comt3lc0mczmoihwc[.]camdvr[.]orgt3lc0mh4udncifw[.]casacam[.]nett3lc0mhasvnctsk[.]giize[.]comt3lm0rtlcagratu[.]kozow[.]comtch[.]giize[.]comtelcomn[.]giize[.]comtelen[.]bumbleshrimp[.]comtelkom[.]ooguy[.]comtelkomservices[.]theworkpc[.]comthbio[.]kozow[.]comtheworkpc[.]comtimpe[.]kozow[.]comtimpe[.]webredirect[.]orgtlse001hdfuwwgdgpnn[.]theworkpc[.]comtltlsktelko[.]ddnsfree[.]comtransport[.]dynuddns[.]nettrvcl[.]bumbleshrimp[.]comttsiou12[.]loseyourip[.]comua2o25yth[.]ddnsgeek[.]comudieyg[.]gleeze[.]comunnjunnani[.]ddnsfree[.]comupdatamail[.]kozow[.]comupdatasuccess[.]ddnsgeek[.]comupdateservices[.]kozow[.]comupdatetools[.]giize[.]comuscplxsecjs[.]ddnsgeek[.]comvals[.]bumbleshrimp[.]comvass2025[.]casacam[.]netvass[.]ooguy[.]comvmtools[.]camdvr[.]orgvmtools[.]loseyourip[.]comvosies[.]ddnsfree[.]comvpaspmine[.]freeddns[.]orgwdlcamaakc[.]ooguy[.]comwebredirect[.]orgwinfoss1[.]kozow[.]comysiohbk[.]camdvr[.]orgzammffayhd[.]ddnsfree[.]comzmcmvmbm[.]ddnsfree[.]comzwmn350n3o1fsdf3gs[.]kozow[.]comzwmn350n3o1ugety2xbe[.]camdvr[.]orgzwmn350n3o1vsdrggs[.]ddnsfree[.]comzwt310n3o1unety2kab[.]webredirect[.]orgzwt310n3o2unety6a3k[.]kozow[.]comzwt31n3t0nidoqmve[.]camdvr[.]orgzwt3ln3t1aimckalw[.]theworkpc[.]com
URLs (195)
1cv2f3d5s6a9w[.]ddnsfree[.]comBoemobww[.]ddnsfree[.]comDCLCWPDTSDCC[.]ddnsfree[.]comKaushalya[.]freeddns[.]orgMicrosoft[.]bumbleshrimp[.]comMosplosaq[.]accesscam[.]orgNpeoples[.]theworkpc[.]comPRIFTP[.]kozow[.]comPolicyAgent[.]theworkpc[.]comScopps[.]ddnsgeek[.]comSmartfren[.]giize[.]comUSOShared1[.]ddnsfree[.]comadmina[.]freeddns[.]orgafsaces[.]accesscam[.]organcisesic[.]accesscam[.]orgapplebox[.]camdvr[.]orgappler[.]kozow[.]comasdad21ww[.]freeddns[.]orgaw2o25forsbc[.]camdvr[.]orgawcc001jdaigfwdagdcew[.]giize[.]combab2o25com[.]accesscam[.]orgbabaji[.]accesscam[.]orgbabi5599ss[.]ddnsgeek[.]combalabalabo[.]mywire[.]orgbggs[.]giize[.]combibabo[.]freeddns[.]orgbinmol[.]webredirect[.]orgbioth[.]giize[.]combrcallletme[.]theworkpc[.]combtbtutil[.]theworkpc[.]combtltan[.]ooguy[.]comcamcampkes[.]ddnsfree[.]comcamsqewivo[.]kozow[.]comccammutom[.]ddnsgeek[.]comcdnvmtools[.]theworkpc[.]comcloacpae[.]ddnsfree[.]comcmwwoods1[.]theworkpc[.]comcnrpaslceas[.]freeddns[.]orgcodemicros12[.]gleeze[.]comcressmiss[.]ooguy[.]comcvabiasbae[.]ddnsfree[.]comcvnoc01da1cjmnftsd[.]accesscam[.]orgcvpc01aenusocirem[.]accesscam[.]orgcvpc01cgsdfn53hgd[.]giize[.]comdlpossie[.]ddnsfree[.]comdnsfreedb[.]ddnsfree[.]comdoboudix1024[.]mywire[.]orgevilginx2[.]loseyourip[.]comexamp1e[.]webredirect[.]orgfaeelt[.]giize[.]comfakjcsaeyhs[.]ddnsfree[.]comfasceadvcva3[.]gleeze[.]comffosies2024[.]camdvr[.]orgfgdedd1dww[.]gleeze[.]comfilipinet[.]ddnsgeek[.]comfreeios[.]theworkpc[.]comfxpuser14[.]gleeze[.]comfxpzpak[.]kozow[.]comgloboss[.]kozow[.]comgogo2025up[.]ddnsfree[.]comgooglel[.]gleeze[.]comgoogles[.]accesscam[.]orggoogles[.]ddnsfree[.]comgooglett[.]camdvr[.]orggoogllabwws[.]gleeze[.]comgtaldps31c[.]ddnsfree[.]comhamkorg[.]kozow[.]comhonidoo[.]loseyourip[.]comhuygdr12[.]loseyourip[.]comhxxp://130[.]94[.]6[.]228/amp[.]tar[.]gzhxxp://130[.]94[.]6[.]228/apt[.]tar[.]gzhxxp://130[.]94[.]6[.]228/update[.]tar[.]gzicekancusjhea[.]ddnsgeek[.]comidstandsuui[.]kozow[.]comindoodchat[.]theworkpc[.]comjarvis001[.]freeddns[.]orgkhyes001ndfpnuewdm[.]kozow[.]comkskxoscieontrolanel[.]gleeze[.]comksv01sokudwongsj[.]theworkpc[.]comlcskiecjj[.]loseyourip[.]comlcskiecs[.]ddnsfree[.]comlosiesca[.]ddnsgeek[.]comlps2staging[.]ddnsfree[.]comlsls[.]casacam[.]netltiuys[.]ddnsgeek[.]comltiuys[.]kozow[.]commailsdy[.]gleeze[.]commaliclick1[.]ddnsfree[.]commauritasszddb[.]ddnsfree[.]commeetls[.]kozow[.]comml3[.]freeddns[.]orgmlksucnayesk[.]kozow[.]commmmfaco2025[.]mywire[.]orgmms[.]bumbleshrimp[.]commmvmtools[.]giize[.]commodgood[.]gleeze[.]commysql[.]casacam[.]netnenigncagvawr[.]giize[.]comnenignenigoncqvoo[.]ooguy[.]comnenigoncqnutgo[.]accesscam[.]orgnenigoncuopzc[.]giize[.]comnims[.]gleeze[.]comnisaldwoa[.]theworkpc[.]comnmszablogs[.]ddnsfree[.]comnodekeny11[.]freeddns[.]orgnodjs2o25nodjs[.]giize[.]comofficeshan[.]kozow[.]comokkstt[.]ddnsgeek[.]comoldatain1[.]ddnsgeek[.]comonlyosun[.]ooguy[.]comosix[.]ddnsgeek[.]comovmmiuy[.]mywire[.]orgpalamolscueajfvc[.]gleeze[.]compawanp[.]kozow[.]compcmainecia[.]ddnsfree[.]compcvmts3[.]kozow[.]compeisuesacae[.]loseyourip[.]compeowork[.]ddnsgeek[.]compepesetup[.]ddnsfree[.]compewsus[.]freeddns[.]orgplcoaweniva[.]ddnsgeek[.]compolokinyea[.]gleeze[.]compplodsssead222[.]loseyourip[.]compplosad231[.]kozow[.]comppsaBedon[.]gleeze[.]comprdanjana01[.]ddnsfree[.]comprepaid127[.]freeddns[.]orgprihxlcs[.]ddnsfree[.]comprihxlcsw[.]theworkpc[.]compxlaxvvva[.]freeddns[.]orgquitgod2023luck[.]giize[.]comrabbit[.]ooguy[.]comrsm323[.]kozow[.]comsaf3asg[.]giize[.]comsdhite43[.]ddnsfree[.]comsdsuytoins63[.]kozow[.]comselfad[.]gleeze[.]comserious[.]kozow[.]comsetupcodpr2[.]freeddns[.]orgsgsn[.]accesscam[.]orgsn0son4t31bbsvopou[.]camdvr[.]orgsn0son4t31opc[.]freeddns[.]orgsoovuy[.]gleeze[.]comstyuij[.]mywire[.]orgsupceasfg1[.]loseyourip[.]comsystemsz[.]kozow[.]comt31c0mjumpcuyerop[.]ooguy[.]comt31c0mopamcuiomx[.]kozow[.]comt31c0mopmiuewklg[.]webredirect[.]orgt31c0mopocuveop[.]accesscam[.]orgt3lc0mcanyqbfac[.]loseyourip[.]comt3lc0mczmoihwc[.]camdvr[.]orgt3lc0mh4udncifw[.]casacam[.]nett3lc0mhasvnctsk[.]giize[.]comt3lm0rtlcagratu[.]kozow[.]comtch[.]giize[.]comtelcomn[.]giize[.]comtelen[.]bumbleshrimp[.]comtelkom[.]ooguy[.]comtelkomservices[.]theworkpc[.]comthbio[.]kozow[.]comtimpe[.]kozow[.]comtimpe[.]webredirect[.]orgtlse001hdfuwwgdgpnn[.]theworkpc[.]comtltlsktelko[.]ddnsfree[.]comtransport[.]dynuddns[.]nettrvcl[.]bumbleshrimp[.]comttsiou12[.]loseyourip[.]comua2o25yth[.]ddnsgeek[.]comudieyg[.]gleeze[.]comunnjunnani[.]ddnsfree[.]comupdatamail[.]kozow[.]comupdatasuccess[.]ddnsgeek[.]comupdateservices[.]kozow[.]comupdatetools[.]giize[.]comuscplxsecjs[.]ddnsgeek[.]comvals[.]bumbleshrimp[.]comvass2025[.]casacam[.]netvass[.]ooguy[.]comvmtools[.]camdvr[.]orgvmtools[.]loseyourip[.]comvosies[.]ddnsfree[.]comvpaspmine[.]freeddns[.]orgwdlcamaakc[.]ooguy[.]comwinfoss1[.]kozow[.]comysiohbk[.]camdvr[.]orgzammffayhd[.]ddnsfree[.]comzmcmvmbm[.]ddnsfree[.]comzwmn350n3o1fsdf3gs[.]kozow[.]comzwmn350n3o1ugety2xbe[.]camdvr[.]orgzwmn350n3o1vsdrggs[.]ddnsfree[.]comzwt310n3o1unety2kab[.]webredirect[.]orgzwt310n3o2unety6a3k[.]kozow[.]comzwt31n3t0nidoqmve[.]camdvr[.]orgzwt3ln3t1aimckalw[.]theworkpc[.]com
sha256 (6)
01fc3bd5a78cd59255a867ffb3dfdd6e0b7713ee90098ea96cc01c640c6495eb4eb994b816a1a24cf97bfd7551d00fe14b810859170dbf15180d39e05cd7c0f9669917bad46a57e5f2de037f8ec200a44fb579d723af3e2f1be1e8479a267966ce36a5fc44cbd7de947130b67be9e732a7b4086fb1df98a5afd724087c973b47d25024ccea8eac85a9522289cfb709f2ed4e20176dd37855bacc2cd75c995606eb08c840f4c95e2fa5eff05e5f922f86c766f5368a63476f046b2b9dbffc2033
APT37 Ruby Jumper Campaign: North Korean Hackers Deploy Malware Arsenal to Bridge Air-Gapped Networks 23 indicators · Feb 27, 2026
IPv4 (1)
Domains (6)
URLs (7)
hightkdhe[.]storehightkdhe[.]store/star/main[.]phphomeatedke[.]store/star/main[.]phphxxps://www[.]hightkdhe[.]store/star/main[.]phphxxps://www[.]homeatedke[.]store/star/main[.]phphxxps://www[.]philion[.]store/star/main[.]phpphilion[.]store/star/main[.]php
UAC-0050 Targets European Financial Institution in Strategic Phishing Campaign 1 indicators · Feb 27, 2026
Domains (1)
Chinese APT Campaign Delivers PlugX RAT via G DATA Antivirus DLL Side-Loading 20 indicators · Feb 26, 2026
Domains (5)
decoorat[.]netdecoraat[.]netgesecole[.]netonedow[.]gesecole[.]netonedown[.]gesecole[.]net
URLs (7)
decoorat[.]netdecoraat[.]nethxxps://decoraat[.]net:443hxxps://onedow[.]gesecole[.]net/downloadhxxps://onedown[.]gesecole[.]net/downloadonedow[.]gesecole[.]net/downloadonedown[.]gesecole[.]net/download
sha256 (8)
29cd44aa2a51a200d82cca578d97dc13241bc906ea6a33b132c6ca567dc8f3ad46314092c8d00ab93cbbdc824b9fc39dec9303169163b9625bae3b1717d70ebc5f9af68db10b029453264cfc9b8eee4265549a2855bb79668ccfc571fb11f5fc6df8649bf4e233ee86a896ee8e5a3b3179c168ef927ac9283b945186f8629ee78421e7995778faf1f2a902fb2c51d85ae39481f443b7b3186068d5c33c472d99d293ded5a63679b81556d2c622c78be6253f500b6751d4eeb271e6500a23b21ede8ddc2451fb1305d76ab20661725d11c77625aeeaa1447faf3fbf56706c87f1e7ed0cd4115f3ff35c38d36cc50c6a13eba2d845554439a36108789cd1e05b17
APT37 Deploys Ruby Jumper Campaign to Breach Air-Gapped Networks 23 indicators · Feb 26, 2026
IPv4 (1)
Domains (6)
URLs (7)
hightkdhe[.]storehightkdhe[.]store/star/main[.]phphomeatedke[.]store/star/main[.]phphxxps://www[.]hightkdhe[.]store/star/main[.]phphxxps://www[.]homeatedke[.]store/star/main[.]phphxxps://www[.]philion[.]store/star/main[.]phpphilion[.]store/star/main[.]php
Diesel Vortex: Russian Cybercrime Group Steals 1,600+ Credentials From Global Logistics Sector 27 indicators · Feb 25, 2026
Domains (16)
USCARGOEXPRESSyahoo[.]comernigr-esfilc[.]comglobalprofit-lpanel-abcdefghij[.]topipinfo[.]iolpanel-bckaoplsks[.]toplpanel-bumaepxuje-iframe[.]toplpanel-bumaepxuje[.]toplpanel-kkbnukltpo[.]topns1[.]suspended-domain[.]compenskecar[.]riersrmissecured[.]compenskecar[.]rsrmissecured[.]topriersrmissecured[.]comrsrmissecured[.]topsuspended-domain[.]comt[.]meyasomawork[.]space
URLs (11)
ernigr-esfilc[.]com/security/logon[globalprofit-lpanel-abcdefghij[.]tophxxps://ernigr-esfilc[.]com/security/logon[.]jsp?verify=7g2q978fg11jka=891FHjaH32-2f1Hnb2sFhxxps://penskecar[.]riersrmissecured[.]com/_c/cstm/4325/reg/DOTLookup[.]aspxhxxps://rsrmissecured[.]top/[.]git/configlpanel-bumaepxuje-iframe[.]toplpanel-bumaepxuje[.]toplpanel-kkbnukltpo[.]topns1[.]suspended-domain[.]compenskecar[.]riersrmissecured[.]com/_c/cstm/4325/reg/DOTLookup[.]aspxpenskecar[.]rsrmissecured[.]top
Cisco Talos Exposes Three-Year Campaign: UAT-8616 Exploits SD-WAN Zero-Day for Critical Infrastructure Access 6 indicators · Feb 25, 2026
IPv4 (1)
1[.]1[.]1[.]10
APT31’s Multi-Year Cyber Espionage Campaign Against Czech Ministry of Foreign Affairs 5 indicators · Feb 24, 2026
Domains (1)
www[.]treadstone71[.]com
URLs (4)
hxxps://www[.]treadstone71[.]com/cognitive-armyhxxps://www[.]treadstone71[.]com/training/building-a-cognitive-warfare-cyber-psyops-programhxxps://www[.]treadstone71[.]com/training/p-omega-syllabushxxps://www[.]treadstone71[.]com/training/the-mission
APT28 Deploys Operation MacroMaze: Webhook-Based Macro Malware Targets European Entities 2 indicators · Feb 24, 2026
Domains (1)
URLs (1)
Chinese APT UnsolicitedBooker Deploys LuciDoor and MarsSnake Backdoors Against Central Asian Telecoms 1 indicators · Feb 24, 2026
CVEs (1)
APT28 Targets European Entities with Operation MacroMaze Webhook Malware Campaign 2 indicators · Feb 23, 2026
Domains (1)
URLs (1)
Unit 42 Exposes Active Exploitation of BeyondTrust CVE-2026-1731 with VShell and SparkRAT Backdoors 64 indicators · Feb 23, 2026
IPv4 (19)
134[.]122[.]13[.]34138[.]197[.]14[.]95142[.]111[.]152[.]50144[.]172[.]103[.]200155[.]2[.]215[.]64178[.]128[.]212[.]209179[.]43[.]146[.]4223[.]162[.]40[.]18737[.]19[.]221[.]18045[.]61[.]150[.]9664[.]31[.]28[.]22164[.]95[.]10[.]11570[.]23[.]0[.]6682[.]29[.]53[.]18782[.]29[.]72[.]1683[.]138[.]53[.]13985[.]155[.]186[.]12192[.]223[.]44[.]13498[.]10[.]233[.]76
Domains (7)
39uchxifap4cvgzsuirom0szrrg[.]d65lre9sfqnlcv49317gcis6pyjsatzho[.]oast[.]proaliyundunupdate[.]xyzd65sb7ngveucv5k2nm508abdsjmbn7qmn[.]oast[.]projudiemkqjajsfzpidfjlowgl8nyrtd49x[.]oast[.]funoastify[.]comq0r2e5q2dzbykcox9qmkptm12s8mwb[.]oastify[.]comtransfer[.]weepee[.]io
URLs (14)
aliyundunupdate[.]xyzhxxp://134[.]122[.]13[.]34:8979/chxxp://39uchxifap4cvgzsuirom0szrrg[.]d65lre9sfqnlcv49317gcis6pyjsatzho[.]oast[.]prohxxp://64[.]31[.]28[.]221/supporthxxp://82[.]29[.]53[.]187:8778/app_clihxxp://85[.]155[.]186[.]121/accesshxxps://64[.]95[.]10[.]115:23011/update[.]shhxxps://85[.]155[.]186[.]121/access/Remote%20Access-linux64-offline[.]tar?language=en&app=76049110434275449312180081368257747094hxxps://judiemkqjajsfzpidfjlowgl8nyrtd49x[.]oast[.]funhxxps://transfer[.]weepee[.]io/7nZw7/blue[.]drxoast[.]funoast[.]prooastify[.]comweepee[.]io/7nZw7/blue[.]drx
sha256 (9)
0ecc867ce916d01640d76ec03de24d1d23585eb582e9c48a0364c62a590548ac4762e944a0ce1f9aef243e11538f84f16b6f36560ed6e32dfd9a5f99e17e8e5066cceb2c2f1d9988b501832fd3b559775982e2fce4ab38fc4ffe71b74eafc726679ee05d92a858b6fe70aeb6072eb804548f1732e18b6c181af122b833386afb98442387d466f27357d727b3706037a4df12a78602b93df973b063462a67776198a7b0900a9072bb40af579ec372da7b27af12b15868394df51fefe290ab176b9f431d5549a03aee92cfd2bdbbe90f1c91e965c99e90a0c9ad5a001f4e80c350cc2bc3750cc5125a50466f66ae4f2bedf1cac0e43477a78ed2fd88f3e987a292cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce
CVEs (14)
Bitcoin Addresses (1)
39uchxifap4cvgzsuirom0szrrg
Chinese APT Exploited Dell RecoverPoint Zero-Day for 18 Months Before Discovery 3 indicators · Feb 22, 2026
CVE-2026-20841: Windows Notepad RCE Vulnerability Weaponized with Public PoC Exploit 1 indicators · Feb 22, 2026
CVEs (1)
Facebook Malvertising Campaign Uses Fake Windows 11 Pages to Deploy Credential-Stealing Malware 9 indicators · Feb 20, 2026
Domains (4)
ms-25h2-download[.]proms-25h2-update[.]proms25h2-download[.]proms25h2-update[.]pro
URLs (4)
ms-25h2-download[.]proms-25h2-update[.]proms25h2-download[.]proms25h2-update[.]pro
Kimwolf Botnet Swamps I2P Anonymity Network in Massive Sybil Attack 1 indicators · Feb 19, 2026
Domains (1)
geti2p[.]net
Threat Actors Abuse Atlassian Jira Cloud to Bypass Email Security and Target Government Entities 12 indicators · Feb 18, 2026
IPv4 (1)
13[.]227[.]180[.]4
Domains (7)
adrinal[.]comarchicad3d[.]comatlassian[.]netbarankinyserialxud[.]onlineclaude[.]aigo[.]sparkpostmail1[.]comsparkpostmail1[.]com
URLs (4)
adrinal[.]comarchicad3d[.]combarankinyserialxud[.]onlinego[.]sparkpostmail1[.]com
LockBit 5.0 Ransomware Emerges: Cross-Platform Threat Targeting Windows, Linux, and ESXi Systems 2 indicators · Feb 17, 2026
CVEs (2)
CVE-2026-20700: Apple Patches First Zero-Day of 2026 After Extremely Sophisticated Targeted Attacks 3 indicators · Feb 16, 2026
CVE-2026-2441: Google Patches First Actively Exploited Chrome Zero-Day of 2026 2 indicators · Feb 16, 2026
CVEs (2)
Physical Mail Phishing Targets Trezor and Ledger Users: Attackers Use QR Codes to Steal Recovery Phrases 8 indicators · Feb 15, 2026
Domains (2)
ledger[.]setuptransactioncheck[.]comtrezor[.]authentication-check[.]io
URLs (6)
authentication-check[.]io/authentication-check[.]io/black/api/send[.]phphxxps://ledger[.]setuptransactioncheck[.]com/hxxps://trezor[.]authentication-check[.]io/hxxps://trezor[.]authentication-check[.]io/black/api/send[.]phpsetuptransactioncheck[.]com/
Microsoft Exposes DNS-Based ClickFix Attack: Nslookup Commands Used for Stealth Malware Staging 6 indicators · Feb 15, 2026
Domains (3)
azwsappdev[.]comraxelpak[.]comtestdomain123123[.]shop
URLs (3)
azwsappdev[.]comraxelpak[.]comtestdomain123123[.]shop
CVE-2026-1731: Critical BeyondTrust Remote Support Vulnerability Under Active Exploitation 2 indicators · Feb 14, 2026
Email Addresses (1)
CVEs (1)
Critical Unstructured.io Vulnerability CVE-2025-64712 Threatens AI Pipelines at Amazon, Google, and Fortune 1000 Enterprises 3 indicators · Feb 13, 2026
Domains (2)
Unstructured[.]iounstructured[.]io
CVEs (1)
XWorm RAT Campaign Exploits 7-Year-Old Office Vulnerability with Fileless Techniques 1 indicators · Feb 13, 2026
CVEs (1)
Metro4Shell: Critical React Native CLI Vulnerability Actively Exploited to Deploy Malware 4 indicators · Feb 12, 2026
IPv4 (3)
134[.]209[.]69[.]155223[.]6[.]249[.]1415[.]109[.]182[.]231
CVEs (1)
AiFrame Campaign: 30 Fake AI Chrome Extensions with 300K Users Steal Credentials, Gmail Content 2 indicators · Feb 12, 2026
Domains (1)
tapnetic[.]pro
URLs (1)
tapnetic[.]pro
XWorm RAT Campaign Exploits CVE-2018-0802 in Multi-Language Phishing Attacks Using Fileless Injection 25 indicators · Feb 11, 2026
Domains (6)
berlin101[.]comcloudinary[.]compub-3bc1de741f8149f49bdbafa703067f24[.]r2[.]devr2[.]devres[.]cloudinary[.]comretrodayaengineering[.]icu
URLs (10)
berlin101[.]comhxxp://pub-3bc1de741f8149f49bdbafa703067f24[.]r2[.]dev/wwa[.]txthxxps://pub-3bc1de741f8149f49bdbafa703067f24[.]r2[.]dev/wwa[.]txthxxps://res[.]cloudinary[.]com/dbjtzqp4q/image/upload/v1767455040/hxxps://res[.]cloudinary[.]com/dbjtzqp4q/image/upload/v1767455040/optimized_MSI_lpsd9p[.]jpghxxps://retrodayaengineering[.]icu/HGG[.]htapub-3bc1de741f8149f49bdbafa703067f24[.]r2[.]dev/wwa[.]txtres[.]cloudinary[.]com/dbjtzqp4q/image/upload/v1767455040/res[.]cloudinary[.]com/dbjtzqp4q/image/upload/v1767455040/optimized_MSI_lpsd9p[.]jpgretrodayaengineering[.]icu/HGG[.]hta
md5 (1)
sha256 (5)
3F4C3C16F63FB90D1FD64B031D8A9803035F3CB18332E198850896881FB42FE58665BC1B33CBE6F5859CD6E362AF77738BA73A6E6D4B9974C16C8521D84C1892EACD8E95EAD3FFE2C225768EF6F85672C4BFDF61655ED697B97F598203EF2CF6EE663D016894D44C69B1FDC9D2A5BE02F028A56FC22B694FF7C1DACB2BBBCC6DFD9BA9E6BD4886EDC1123D4074D0EAC363DF61162364530B1303390AA621140B
CVEs (2)
Bitcoin Addresses (1)
Chinese APT UNC3886 Breaches Singapore’s Four Largest Telcos in Coordinated Espionage Campaign 3 indicators · Feb 10, 2026
BlueNoroff’s GhostCall and GhostHire Campaigns Use Stolen Victim Videos to Compromise Crypto Executives 194 indicators · Feb 10, 2026
IPv4 (1)
104[.]168[.]214[.]151
Domains (47)
Backdoor[.]Python[.]Agent[.]brCrypto[.]comTrojan[.]Shell[.]Agent[.]gnautoupdate[.]onlinebots[.]autoupdate[.]onlinebotsc[.]autoupdate[.]xyzcheck[.]datatabletemplate[.]shopchkactive[.]onlinecloud-server[.]storedataupload[.]storedownload[.]datatabletemplate[.]xyzdownload[.]face-online[.]worldfile-server[.]storefiledrive[.]onlinefirst[.]longlastfor[.]onlinefirst[.]system-update[.]xyzfirstfromsep[.]onlineflashserve[.]storegroup[.]comimage-support[.]xyzinstant-update[.]onlinemetamask[.]awaitingfor[.]sitepre[.]alwayswait[.]sitereadysafe[.]xyzreal-update[.]xyzroot[.]chkstate[.]onlineroot[.]security-update[.]xyzsafefor[.]xyzsafeup[.]storesafeupload[.]onlinesecond[.]awaitingfor[.]onlinesecond[.]systemupdate[.]cloudsecondshop[.]onlinesecondshop[.]storesignsafe[.]sitesignsafe[.]xyzsupport[.]mssupport[.]ms-live[.]ussupport[.]video-meeting[.]onlineswissborg[.]blogsystem[.]updatecheck[.]storeurgent-update[.]cloudus[.]zoom[.]comweb071zoom[.]usweb[.]commoncome[.]onlinewriteup[.]livezoom[.]app
URLs (69)
alwayswait[.]siteautoupdate[.]onlineautoupdate[.]xyzawaitingfor[.]onlineawaitingfor[.]site/updatebots[.]autoupdate[.]onlinechkactive[.]online/updatechkstate[.]onlinecloud-server[.]store/updatecommoncome[.]onlinedatatabletemplate[.]shopdatatabletemplate[.]xyzdatatabletemplate[.]xyz/account/register/id=8118555902061899&dataupload[.]storedataupload[.]store/uploadfilesface-online[.]worldfile-server[.]store/updatefiledrive[.]onlinefiledrive[.]online/uploadfilesfirstfromsep[.]online/clientflashserve[.]store/updatehxxp://web071zoom[.]us/fix/audio-fv/7217417464hxxp://web071zoom[.]us/fix/audio-tr/7217417464hxxp://web071zoom[.]us/fix/audio/4542828056hxxps://bots[.]autoupdate[.]online:8080/testhxxps://chkactive[.]online/updatehxxps://cloud-server[.]store/updatehxxps://dataupload[.]store/uploadfileshxxps://download[.]datatabletemplate[.]xyz/account/register/id=8118555902061899&secret=QwLoOZSDakFhhxxps://file-server[.]store/updatehxxps://filedrive[.]online/uploadfileshxxps://flashserve[.]store/updatehxxps://metamask[.]awaitingfor[.]site/updatehxxps://safeup[.]store/testhxxps://safeupload[.]online/uploadfileshxxps://support[.]ms-live[.]us/301631/checkhxxps://support[.]ms-live[.]us/register/22989524464UcX2b5w52hxxps://support[.]ms-live[.]us/update/02583235891M49FYUN57hxxps://urgent-update[.]cloud/uploadfileshxxps://writeup[.]live/testimage-support[.]xyzinstant-update[.]onlinelonglastfor[.]onlinems-live[.]us/301631/checkms-live[.]us/register/22989524464UcX2b5w52ms-live[.]us/update/02583235891M49FYUN57readysafe[.]xyzreal-update[.]xyzsafefor[.]xyzsafeup[.]store/testsafeupload[.]onlinesafeupload[.]online/uploadfilessecondshop[.]onlinesecondshop[.]storesecurity-update[.]xyzsignsafe[.]sitesignsafe[.]xyzsignsafe[.]xyz/updateswissborg[.]blogsystem-update[.]xyzsystemupdate[.]cloudsystemupdate[.]cloud/clientupdatecheck[.]storeurgent-update[.]cloud/uploadfilesvideo-meeting[.]onlineweb071zoom[.]us/fix/audio-fv/7217417464web071zoom[.]us/fix/audio-tr/7217417464web071zoom[.]us/fix/audio/4542828056writeup[.]live/test
md5 (58)
00dd47af3db45548d2722fe8a448950801d3ed1c228f09d8e56bfbc5f5622a6c0af11f610da1f691e43173d44643283f0ca37675d75af0e7def0025cd564d6c510cd1ef394bc2a2d8d8f2558b73ac7b81243968876262c3ad4250e1371447b231653d75d579872fadec1f22cf7fee3c017baae144d383e4dc32f1bf69700e58719a7e16332a6860b65e6944f1f3c50011ee10fa01587cec51f455ceec779a160261a409946b6b4d9ce706242a76134e32B499EB3865A7EF17264D15252B7F73E2c42253ebf9a743814b9b16a89522bef31b88dd319af8e4b8a96fc9732ebc708358c2969041c8be74ce478edb2ffcd19389447013870120775556bb4519dba9738c8d80dd32d00e9c9440a498f7dd7393bbe4dfe3134c8a7928d10c948e20bee50f341b24cb75f37d042d1e5f9e3e5aa529fe6eff1cf452680976087e2250c025ad40a5fd18a1b57b69c44bc2963dc6b5cb4f0084f3c25e640952753ed5b25d060bfe4f378e9f5a84183ac505a0322286348b49f3499d760797247b94385fda36422795a6df10c45c1006f92d686ee7e6aa93664b4852cb5bad84ba1a187f6457168ce5c6e5545a5b389db09c90038da73d26eb56e5a3426884733c104c3f6257581854ff6c890684823f3aed03c210f76ACE3A6892C25512B17ED42AC2EBD0576ace3a6892c25512b17ed42ac2ebd057e50c3f301dd045eb189ba1644ded1557f94ed2d5f566c12de5ebe4b5e3d8aa38006efb8dd703073197e5a27682b35bf8f8942cd14f646f59729f83cbd4c357b931cec3c80c78d233e3602a042a2e71b9551b4af789b2db563f9452eaf46b6aa963f473f1734d8b3fbb8c9a227c06d07a070b77c5028d7a5d2895f1c9d35016fa0eb7e480752d494709c63aa35ccf36ca26f2b97ca4e2b4b5d58933900f02131a6ce961f487b4cbdfe68d0a249647c48ab1e8693931f8c694247d96cf5a85197b2e9a6412fd7c068a5d7c38d0afd946fb567bfdaac131a2d8a23ad8fd450a31dc42c7a2ea1c2f00dddb0cc4c8bfb5bcfc446682f33641cff21083ac2ce477dbec6f0c8d41b9ad4f079161548d2435d80d63805e89053716b6ab93ce6decf8450d8529855fab4b4aa6c2b34449cb3b9fbde93e85199240de761a8ba0a56f0088de33f942cf1479ca8530a916868bad954e8680d17fba6425e4a9bb552fb8db2b1e9fdd703e60b31eb803b1b59985cabeceda0525c078f5a216a977bc64e86160af1bad0efbd3bd5a4202fe740756f977af1d2af27b13cd3424556b18dfd3cf83ff8bb2528bf35f8c11fbc4369e68c4038
sha256 (8)
3DD226D0B700F33974F409142DEFB62A8CD172AE5F2EB9BEB7F5750EB1702E2A4451EE8BC53EA7C148D8348BC7B82ACA9977BDD31C0156DFE25C4A879A1D21905B77F83ECEFA0E32BA922F61C9EFFF7F755BA51A010DB844CA7E8AD3DB28650A71B743C529F0B27735F7774A0903CB908EDC93423B60FE9BE49A3729982D0E8DA6C1A7CE43B029A1EF4AE69B26F745440ECCE8368C89F11AC999D4ED04A31572B3CC15C1033DE79024F9CF3CD6A6A7A9B7E54A1A57D3156036F5C05F541694B7B494A0AE421AFE170F6CB9DE2C1193A78FBE16F627F85139676AFC5D9BFE93A2C4DB903322D17C8CBF1D1DB55124854C0B070D6ECE54162B6A4D06DF24C572DF
Bitcoin Addresses (11)
10cd1ef394bc2a2d8d8f2558b73ac7b81243968876262c3ad4250e1371447b231653d75d579872fadec1f22cf7fee3c017baae144d383e4dc32f1bf69700e58719a7e16332a6860b65e6944f1f3c50011ee10fa01587cec51f455ceec779a16031b88dd319af8e4b8a96fc9732ebc708358c2969041c8be74ce478edb2ffcd19389447013870120775556bb4519dba9738c8d80dd32d00e9c9440a498f7dd7393bbe4dfe3134c8a7928d10c948e20bee
APT28 Exploits CVE-2026-21509 in Operation Neusploit: Stealing Emails with MiniDoor Backdoor 48 indicators · Feb 9, 2026
Domains (2)
freefoodaid[.]comwellnesscaremed[.]com
URLs (8)
freefoodaid[.]comfreefoodaid[.]com/documents/2_2[.]dfreefoodaid[.]com/documents/2_2[.]lNkfreefoodaid[.]com/tables/tables[.]dhxxps://freefoodaid[.]com/documents/2_2[.]dhxxps://freefoodaid[.]com/documents/2_2[.]lNkhxxps://freefoodaid[.]com/tables/tables[.]dwellnesscaremed[.]com
md5 (12)
154ff6774294e0e6a46581c8452a77de2f7b4dca1c79e525aef8da537294a6c44727582023cd8071a6f388ea3ba2feaa7c396677848776f9824ebe408bbba943859c4b85ed85e6cc4eadb1a037a61e1695e59536455a089ced64f5af2539a449d47261e52335b516a777da368208ee91e4a5c4b205e1b80dc20d9a2fb4126d06ea6615942f2c23dba7810a6f7d69e2daee0b44346db028a621d1dec99f429823f05d0b13c633ad889334781cf4091d3ef3b869a8d5ad243e35963ba6d7f89855
sha1 (12)
22da6a104149cad87d5ec5da4c3153bebf68c41123b6f9c00b9d5475212173ec3cbbcff34c4400a74592e6173a643699dc526778aa0a30330d16fe087bbb530eb77c6416f02813cd2764e49bd084465cD577c4a264fee27084ddf717441eb89f714972a5c1b272067491258ea4a2b1d2789d82d157aaf90ac4799d17a4343bd353e0edb0a4de248b99295d4dc8c84bf33c05fb3a69bc5e2d6377b73649b93dcecea7e9323d79054f92634f4032c26d30c1cedd7ed788d85335e20bb1f173d4d0494629d36083dddcda1c3e92f69e6ca0e4f4823525905cb6969a44ade52a9f004f4359ea0f8f9c6eb91731ed78e5c4d3
sha256 (12)
0bb0d54033767f081cae775e3cf9ede7ae6bea75f35fbfb748ccba9325e28e5e1ed863a32372160b3a25549aad25d48d5352d9b4f58d4339408c4eea69807f502822c72a59b58c00fc088aa551cdeeb92ca10fd23e23745610ff207f53118db93f446d316efe2514efd70c975d0c87e12357db9fca54a25834d60b28192c6a695a17cfaea0cc3a82242fdd11b53140c0b56256d769b07c33757d61e0a0a6ec029f4672c1374034ac4556264f0d4bf96ee242c0b5a9edaa4715b5e61fe8d55cc8a876f648991711e44a8dcf888a271880c6c930e5138f284cd6ca6128eca56ba1a944a09783023a2c6c62d3601cbd5392a03d808a6a51728e07a3270861c2a8eeb2ba51b4491da8604ff9410d6e004971e3cd9a321390d0258e294ac42010b546bb23545380fde9f48ad070f88fe0afd695da5fcae8c5274814858c5a681d8c4ec91183175ce77360006f964841eb4048cf37cb82103f2573e262927be4c7607ffd3f13db41cd5b442fa26ba8bc0e9703ed243b3516374e3ef89be71cbf07436b
CVEs (1)
Bitcoin Addresses (1)
Fake 7-Zip Downloads Convert Home PCs Into Residential Proxy Nodes for Cybercriminals 21 indicators · Feb 9, 2026
Domains (9)
7-zip[.]org7zip[.]comapex[.]herosms[.]aiflux[.]smshero[.]coiplogger[.]orgneo[.]herosms[.]conova[.]smshero[.]aisoc[.]hero-sms[.]cospark[.]herosms[.]io
URLs (8)
7zip[.]comhero-sms[.]coherosms[.]aiherosms[.]coherosms[.]ioiplogger[.]orgsmshero[.]aismshero[.]co
sha256 (3)
Mutex Names (1)
Mutex: Global\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7
TGR-STA-1030 Espionage Campaign Compromises 70 Organizations Across 37 Nations Using ShadowGuard Linux Rootkit 1 indicators · Feb 8, 2026
Domains (1)
mega[.]nz
BridgePay Ransomware Attack Forces Nationwide Cash-Only Payment Disruption 1 indicators · Feb 8, 2026
Domains (1)
Gateway[.]Itstgate[.]com
Flickr Data Breach Exposes User Information Through Third-Party Email Vendor Vulnerability 1 indicators · Feb 7, 2026
Domains (1)
Winbuzzer[.]com
APT-Q-27 (GoldenEyeDog) Deploys Fileless Malware in Stealthy Corporate Network Attacks 2 indicators · Feb 7, 2026
IPv4 (1)
185[.]135[.]79[.]200
Domains (1)
wk[.]goldeyeuu[.]io
Iranian APT Infy Resurfaces with New Tornado Malware After Internet Blackout 1 indicators · Feb 6, 2026
CVEs (1)
SystemBC Botnet Survives Law Enforcement Takedown, Infects Over 10,000 Devices Worldwide 30 indicators · Feb 5, 2026
IPv4 (16)
103[.]112[.]211[.]167103[.]28[.]36[.]105148[.]113[.]208[.]227185[.]93[.]89[.]145196[.]13[.]207[.]92202[.]142[.]184[.]23436[.]255[.]98[.]15236[.]255[.]98[.]15936[.]255[.]98[.]16036[.]255[.]98[.]16536[.]255[.]98[.]17962[.]60[.]131[.]18062[.]60[.]131[.]18462[.]60[.]131[.]18762[.]60[.]131[.]19162[.]60[.]131[.]204
Domains (7)
bthoster[.]comconcours[.]govconcours[.]gov[.]bfexploit[.]inforum[.]exploit[.]ingov[.]vnphutho[.]duchop[.]gov[.]vn
URLs (4)
bthoster[.]comconcours[.]gov[.]bfduchop[.]gov[.]vnforum[.]exploit[.]in
DKnife: Cisco Talos Exposes China-Nexus Gateway-Monitoring AitM Framework Active Since 2019 5 indicators · Feb 5, 2026
Domains (2)
URLs (1)
hxxps://malpedia[.]caad[.]fkie[.]fraunhofer[.]de/details/win[.]shadowpad"
CVEs (1)
CISA Confirms VMware ESXi Flaw CVE-2025-22225 Now Exploited in Active Ransomware Campaigns 5 indicators · Feb 4, 2026
EnCase Forensic Driver Weaponized: BYOVD Attack Targets 59 EDR Tools Through SonicWall VPN Breach 5 indicators · Feb 4, 2026
IPv4 (2)
193[.]160[.]216[.]22169[.]10[.]60[.]250
Domains (1)
OemHwUpd[.]sy
PDFSider: The Stealthy Backdoor Targeting Fortune 100 Financial Institutions 50 indicators · Feb 4, 2026
Domains (7)
CVEs (43)
CVE-2009-2265CVE-2017-0199CVE-2021-24093CVE-2022-38028CVE-2023-20593CVE-2023-27350CVE-2023-32046CVE-2023-36884CVE-2024-10470CVE-2024-11972CVE-2024-29510CVE-2024-3400CVE-2024-38213CVE-2024-40766CVE-2024-42057CVE-2024-43491CVE-2024-44082CVE-2024-44131CVE-2024-49035CVE-2024-50550CVE-2024-50623CVE-2024-57726CVE-2024-57727CVE-2024-57728CVE-2024-8260CVE-2025-0282CVE-2025-23121CVE-2025-3052CVE-2025-3248CVE-2025-4322CVE-2025-54135CVE-2025-59287CVE-2025-68613CVE-2025-8088CVE-2026-0628CVE-2026-1591CVE-2026-23111CVE-2026-31431CVE-2026-3502CVE-2026-35273CVE-2026-35616CVE-2026-4020CVE-2026-7482
ShinyHunters Claims Massive Ivy League Breach: 2.2 Million Records from Harvard and UPenn 1 indicators · Feb 4, 2026
Domains (1)
AI-Powered Attack Achieves AWS Admin Access in Under 10 Minutes: A New Era of Automated Intrusions 20 indicators · Feb 4, 2026
IPv4 (18)
103[.]177[.]183[.]165104[.]155[.]129[.]177104[.]155[.]178[.]59104[.]197[.]169[.]222136[.]113[.]159[.]75152[.]58[.]47[.]83194[.]127[.]167[.]92197[.]51[.]170[.]131204[.]152[.]223[.]17234[.]171[.]37[.]3434[.]173[.]176[.]17134[.]30[.]49[.]23534[.]63[.]142[.]3434[.]66[.]36[.]3834[.]69[.]200[.]12534[.]9[.]139[.]20635[.]188[.]114[.]13235[.]192[.]38[.]204
Domains (2)
download[.]pytorch[.]orgterraform-bedrock-deploy[.]tf
ShadowHS: Fileless Linux Post-Exploitation Framework Runs Entirely in Memory 40 indicators · Feb 3, 2026
IPv4 (3)
204[.]93[.]253[.]18062[.]171[.]153[.]4791[.]92[.]242[.]200
Domains (7)
Kawpow[.]asiaKawpow[.]asia[.]mine[.]zergpool[.]comKawpow[.]naKawpow[.]na[.]mine[.]zergpool[.]comkawpow[.]eukawpow[.]eu[.]mine[.]zergpool[.]compayload[.]so
URLs (1)
zergpool[.]com
sha256 (26)
04a072481ebda2aa8f9e0dac371847f210199a503bf31950d796901d5dbe9d58072e08b38a18a00d75b139a5bbb18ac4aa891f4fd013b55bfd3d6747e1ba0a270bb7d4d8a9c8f6b3622d07ae9892aa34dc2d0171209e2829d7d39d5024fd79ef148f199591b9a696197ec72f8edb0cf4f90c5dcad0805cfab4a660f65bf27ef319df5436972b330910f7cb9856ef5fb17320f50b6ced68a76faecddcafa7dcd720c1819c2fb886375d9504b0e7e5debb87ec9d1a53073b1f3f36dd6a6ac3f4273ba88f92a87c0bb01b13754190c36d8af7cd047f738ebb3d6f975960fe7614d63f014aa3e339d33760934f180915045daf922ca8ae07531c8e716608e683d92d4069eaadc94efb5be43b768c47d526e4c080b7d35b4c9e7eeb63b8dcf0038d7d574a17028b28fdf860e23754d16ede622e4e27bac11d33dbf5c39db501dfccdc5a6b08d42cc8296b32034b132bab18d201a48c1628df3200e869722506dd4ec6662d4e58e95b7b27eb961f3d81d299af961892c74bc7a1f2bb7a8f2442030d0e666122c39b2fd4499678105420e21b938f0f62defdbc85275e14156ae69539d66c50fcf14af7f984a152016498bf4096dd1f71e9d35000301b8319bd50f7f6d072023e9829b0de93cf9f057858cac1bcd4a0499b018fb81406e08cd3053ae55b7361c6861fdb08cab819b13bf2327bc82eebdd70651c7de1aed18515c1700d977fbab71fcc454401f6c3db91ed0afb0027266d5681c23900894f1002ceca389a8007b94d367b7dbacaac4c1da0305b489f0f3f7a38770dcdb68d5824fe33d041847846a0f0c76cf5699342a066378774f1101d2fb74850e3731dc9b74e12a69d9f2cfc65b480695aa2fd847db901e6b1135b5ed982d9942c61b629243d6830dd9fdaf64180b7d02b399d2a92f1cdd062af2e6584852ea597c50194b62cca3c0bb3ee445675fce1fccf365a7b681b316124b1a5f0a7e87042136e91776b187f39c679b408275f9624602702f5601954f3b51efbb1acc505950ee88175854e783fe11bcba19ac628ae1d0b56e43646ae1b5da2ccc1da5162e6719d4b7d68d37096e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855e5a6deec56095d0ae702655ea2899c752f4a0735f9077605d933a04d45cd7e24
Ethereum Addresses (1)
0xd67f158b2bcc819eee7029f3477f0270ec1d37b4
Monero Addresses (2)
87YLCx7zEFghgMEeZvJCZ3gHyS3fUsbAnXSTH8nh8EP7SeptPH8Pnh18snravwhE3dfRt5x67aWo8e6tSJ2cv4mpRNkSdqL88H9UmU6QyYiGeZdR6hXZJXtJF9Z8zLHDQbC1NV1PDdjCynBq3QKzB1fo1NRhgMX4cBx68Rva5msyKW3PGXfPhCA4itHmiv
Vibe Coding Gone Wrong: Moltbook AI Social Network Exposes 4.75 Million Records in Massive Database Breach 7 indicators · Feb 3, 2026
Domains (2)
ehxbxtjliybbloantpwq[.]supabase[.]cowww[.]moltbook[.]com
URLs (5)
hxxps://ehxbxtjliybbloantpwq[.]supabase[.]co/rest/v1/agents?selecthxxps://ehxbxtjliybbloantpwq[.]supabase[.]co/rest/v1/owners?select=email,x_handle,x_name&email=neq[.]null&limit=5hxxps://ehxbxtjliybbloantpwq[.]supabase[.]co/rest/v1/posts?id=eq[.]74b073fd-37db-4a32-a9e1-c7652e5c0d59hxxps://ehxbxtjliybbloantpwq[.]supabase[.]co/rest/v1/usershxxps://www[.]moltbook[.]com/_next/static/chunks/18e24eafc444b2b9[.]js
Russian Legion Hacker Alliance Launches OpDenmark Campaign Against Danish Critical Infrastructure 1 indicators · Feb 2, 2026
Domains (1)
sundhed[.]dk
Iconics Suite SCADA Vulnerability Enables Denial-of-Service Through Privileged File Operations 14 indicators · Jan 31, 2026
Global Energy Systems Exposed: Widespread Cybersecurity Gaps Found in Power Grid OT Networks 1 indicators · Jan 31, 2026
Domains (1)
WinRAR CVE-2025-8088: Russia, China, and Cybercriminals Unite to Exploit Path Traversal Flaw 46 indicators · Jan 31, 2026
sha256 (44)
272c86c6db95f1ef8b83f672b65e64df16494cae261e1aba1aeb1e59dcb6852429f89486bb820d40c9bee8bf70ee8664ea270b16e486af4a53ab7039969432562c40e7cf613bf2806ff6e9bc396058fe4f85926493979189dbdbc7d615b7cb1433580073680016f23bf474e6e62c61bf6a776e561385bfb06788a4713114ba9d3b47df790abb4eb3ac570b50bf96bb1943d4b46851430ebf3fc36f645061491b3b85d0261ab2531aba9e2992eb85273be0e26fe61e4592862d8f45d6807ceee4498961237cf1c48f1e7764829818c5ba0af24a234c2f29c4420fb80276aec6764f4567abe9ff520797b04b04255bbbe07ecdddb594559d436ac53314ec62c1b353f1b841d323c211c715b8f80d0efb9529440caae921a60340de027052946dd954305c7b95d8105601461bb18de87f1f679d833f15e38a9ee7895a0c8605c0d055b3dc57929d8eacfdadc71d92483eabe4874bf3d0189f861b145705a0f0a8fe5b64786ed92545eeac013be9456e1ff03d95073910742e45ff6b88a86e91901b5dee69127d501142413fb93fd2af8c8a378682c140c52b48990a5c41f2ce361668d9020aa9b509a6d018d6d9f4c77e7604a588b2848e05da6a4d9f82d725f91b6d3586aa6603f1c1c79d7bd7e0b5c5f0cc8e8a84577c35d21b0f462656c2e1f9867a05d67dd184d544d5513f4f07959a7c2b558197c99cb8139ea797ad9fbece8a7ee2a8e6b3476319a3a0d5846805fd25fa388c7f2215668bc134202ea093fa91e61fd77460393a89a8af657d09df6a815465f6ce22f1db8277d58342b32249958921ea0995482fb04ea4a50bbdb654f272ab991046a43c1fdbd22da302d544a54bcafd9d4ece87fa314d508a68f47b0ec3351c0a270aa2ed3a0e275b9db03ca97f460bfa612f1d406823620d0d25e381f9b980a0497e2775269917a7150f04ae93d9327a91e90bf7744c6ce0eb4affb3acb62a5d1b2dafd645cba9af28d795aea13e5871b683a19a05015ff0369b412b985d47eb67a3af93f44400a026b4b0b2b62703a1ef7d9d3376c6b3609cd901cbccdcca80fba940ce8ed3f4e54cdbe6b53069a380a9dd3dc1c758888d0e50dd43935f16df0f7124c77569375a9f44f5b90ef1d21523eeffbca17181ccccf269bca3840786fcbf5c73218c6e1d6a51a9ba86b6e0199b8907427364246f049efd67dc4eda0b5078f4bc7607253634cf24bb4856a66bf7e0de18522e35798c0a8734179c1aab21ed2ad6821aaa99e1cb4cc7726c166e1947fdbf808a50b75ca7400d56fa6fef2a76cefe314848db22c76ccf35ce47b35f1405969f40633fcf35132ca3ccb3fdfded8cc270fc2223049b80cf8ebfd98da3025dc09d0b3bbeef874d8f9c4d4ba4937719f0a9a3aa04c81bebd418f878fa02729b38b5384bcb3216872a968f5d0c9c77609d8c5aacedb07546d981a16b9da1615514a02f5ebb38416a009f5621c0b718214d5b105c9f552389ddd67dda5d58c7480152c9f6e8043c3ea7de2e593beedf86b867b83f005bf0ccdefe25e400d4925d8a2bb4b1181044d06a8bf61688fd9c9ea59f1e0bb7bc21d8e836873479ff558cfb885097e8783356aad1f2d30b69d825b3a71cb7a57cf930ea0869fa9d5e23bdd16cddfefbbf9c67744598f379be306ff652f910db1ba162ed5b920dad5dcd3f9e55828f82a27211a212839c8942531c288535b92df7f453edc1f7528ca93ec432daca820f47e08d218b79cceca1ee764966f8f90d6a58bdef0e1bb2d389ab8b5f15d2f83cf978662e18e31dbe875f39db563e8a019af577f3e5667d02f95c001c717dfc5a0e100d2b701be4ec35a3e6875dc276431a7497f6761b5341a33188a7a1ca7a904d5866e07b8ddbde9adebdbce4306923cfc60afc2a6138786fae4e33dc343aea2b1a7cd6411187307ea2c82cd96b45f6d1f2a0ffc6c3805bbaef2c4003763fd5fac0ebcccf99a1656f10cf7677f6c2a5d16dbd
CVEs (2)
CVE-2026-24061: 11-Year-Old GNU Telnetd Vulnerability Grants Instant Root Access 12 indicators · Jan 30, 2026
Domains (4)
URLs (5)
hxxps://codeberg[.]org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cchxxps://codeberg[.]org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7bhxxps://lists[.]gnu[.]org/archive/html/bug-inetutils/2026-01/msg00004[.]htmlhxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-24061hxxps://www[.]cvedetails[.]com/cve/CVE-2026-24061/
CVEs (1)
Ivanti Patches Two Critical EPMM Zero-Day Vulnerabilities Under Active Exploitation 7 indicators · Jan 30, 2026
IPv4 (3)
Domains (1)
help[.]ivanti[.]com
URLs (1)
hxxps://help[.]ivanti[.]com/mi/help/en_us/core/11[.]x/gsg/CoreGettingStarted/Configuring_LDAP_servers[.]htm
CVEs (2)
Ivanti EPMM Zero-Days Actively Exploited: Pre-Auth RCE via Bash Arithmetic Expansion 7 indicators · Jan 30, 2026
IPv4 (2)
12[.]7[.]0[.]012[.]8[.]0[.]0
Domains (1)
forums[.]ivanti[.]com
URLs (1)
hxxps://forums[.]ivanti[.]com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340?language=en_US
CVEs (2)
Android Malware Campaign Abuses Hugging Face AI Platform to Distribute RAT 31 indicators · Jan 30, 2026
IPv4 (4)
108[.]187[.]7[.]133143[.]204[.]11[.]112148[.]135[.]44[.]146154[.]198[.]48[.]57
Domains (5)
au-club[.]topcdn-lfs-us-1[.]hf[.]cohuggingface[.]cotrustbastion[.]comwww[.]trustbastion[.]com
URLs (12)
au-club[.]tophf[.]co/rhf[.]co/repos/a5/0c/a50cf45d8b119af0cc75679c8307b05e29f2bc85b6d0bd55999dd018639f1c72/19f1a6b9ad1a9654e7c78fa2d37a3ec10192b01b636c5fc1995b80bf6f7dcb36?response-content-disposition=attachment%3B+filename*%3DUTF-8%27%27b[.]apk%3B+filename%3D%22b[.]apk%22%3B&huggingface[.]cohuggingface[.]co/datasets/xcvqsccm/sfxyt851/resolve/main/b[.]apk?download=truehxxps://cdn-lfs-us-1[.]hf[.]co/rhxxps://cdn-lfs-us-1[.]hf[.]co/repos/a5/0c/a50cf45d8b119af0cc75679c8307b05e29f2bc85b6d0bd55999dd018639f1c72/19f1a6b9ad1a9654e7c78fa2d37a3ec10192b01b636c5fc1995b80bf6f7dcb36?response-content-disposition=attachment%3B+filename*%3DUTF-8%27%27b[.]apk%3B+filename%3D%22b[.]apk%22%3B&response-content-type=application%2Fvnd[.]android[.]package-archive&Expires=1764089304&Policy=eyJTdGF0ZW1lbnQiOlt7IkNvbmRpdGlvbiI6eyJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTc2NDA4OTMwNH19LCJSZXNvdXJjZSI6Imh0dHBzOi8vY2RuLWxmcy11cy0xLmhmLmNvL3JlcG9zL2E1LzBjL2E1MGNmNDVkOGIxMTlhZjBjYzc1Njc5YzgzMDdiMDVlMjlmMmJjODViNmQwYmQ1NTk5OWRkMDE4NjM5ZjFjNzIvMTlmMWE2YjlhZDFhOTY1NGU3Yzc4ZmEyZDM3YTNlYzEwMTkyYjAxYjYzNmM1ZmMxOTk1YjgwYmY2ZjdkY2IzNj9yZXNwb25zZS1jb250ZW50LWRpc3Bvc2l0aW9uPSomcmVzcG9uc2UtY29udGVudC10eXBlPSoifV19&Signature=Mqc2vLuG17L9PD9eOO96Tbl8S1P6Efgzc1c%7EvjGQqg7jE6NcLyKqkIn7Koq06ybpChfuNeUOUSIRvqUXUd%7EAUt1mvivbp8cZla5frbYSx6ce2-Enp7KmhKXafgpPH6Hr8sGEt8EO56g3oF867bsCO3qH4Q9HqcX6DZZfgyysDxK22VIzEOYCoGqzIa0pj1gFr57PGdcyQJxqFDvpQ9KiCoLxqGjf4O5EpO-4bLJ53D3nZUTrDZX3sCHo7hUOxwqBMUefhgL0BKhL4JPfaBsHyfM9Cj%7EO1yPsf6CqZd%7EVfQWh9CH6ZW834YlKppFxovUMdg3dUHxUNUBDZg2-Nf3plw__&Key-Pair-Id=K24J24Z295AEI9hxxps://huggingface[.]cohxxps://huggingface[.]co/datasets/xcvqsccm/sfxyt851/resolve/main/b[.]apk?download=truehxxps://www[.]trustbastion[.]com/xiazz[.]htmltrustbastion[.]comtrustbastion[.]com/xiazz[.]html
md5 (6)
sha256 (2)
Bitcoin Addresses (1)
SmarterMail Fixes Critical Unauthenticated RCE Flaw with CVSS 9.3 Score 4 indicators · Jan 30, 2026
Domains (1)
CVE[.]org
Match Group Data Breach Exposes User Information from Tinder, Hinge, and OkCupid 2 indicators · Jan 30, 2026
Domains (2)
Match[.]commatchinternal[.]com
SolarWinds Fixes Six Critical Web Help Desk Vulnerabilities Including RCE and Auth Bypass 11 indicators · Jan 29, 2026
Google Disrupts World’s Largest Residential Proxy Botnet 45 indicators · Jan 28, 2026
IPv4 (4)
1[.]3[.]6[.]145[.]78[.]214[.]18849[.]51[.]68[.]14360[.]2[.]1[.]3
Domains (23)
00857cca77b615c369f48ead5f8eb7f3[.]com0aa0cf0637d66c0d[.]com31d58c226fc5a0aa976e13ca9ecebcc8[.]com3k7m1n9p4q2r6s8t0v5w2x4y6z8u9[.]com442fe7151fb1e9b5[.]com6b86b273ff34fce1[.]online7x2k9n4p1q0r5s8t3v6w0y2z4u7b9[.]com8b21a945159f23b740c836eb50953818[.]com8f00b204e9800998[.]coma7b37115ce3cc2eb[.]coma8d3b9e1f5c7024d6e0b7a2c9f1d83e5[.]comaa86a52a98162b7d[.]comaf4760df2c08896a9638e26e7dd20aae[.]comb5e9a2d7f4c8e3b1a0d6f2e9c5b8a7d[.]combdrv7wlbszfotkqf[.]ukcfe47df26c8eaf0a7c136b50c703e173[.]come4f8c1b9a2d7e3f6c0b5a8d9e2f1c4d[.]comhexsdk[.]compacketsdk[.]iopacketsdk[.]netpacketsdk[.]xyzv46wd6uramzkmeeo[.]inwillmam[.]com
md5 (10)
00857cca77b615c369f48ead5f8eb7f30c855f87a7574b28df383eca5084fcdc31d58c226fc5a0aa976e13ca9ecebcc88a9bd7e7a806b2cc606b7a1d8f4956628b21a945159f23b740c836eb50953818993AE4FE78B879239BDC14DFBC0963CDa8d3b9e1f5c7024d6e0b7a2c9f1d83e5af4760df2c08896a9638e26e7dd20aaec8eb024c053f82831f2738bd48afc256cfe47df26c8eaf0a7c136b50c703e173
sha256 (6)
01ac6012d4316b68bb3165ee451f2fcc494e4e37011a73b8cf2680de3364fcf42d1891b6d0c158ad7280f0f30f3c9d913960a793c6abcda249f9c76e13014e4559cbdecfc01eba859d12fbeb48f96fe3fe841ac1aafa6bd38eff92f0dcfd4554aef34f14456358db91840c416e55acc7d10185ff2beb362ea24697d7cdad321fb0726bdd53083968870d0b147b72dad422d6d04f27cd52a7891d038ee83aef5bba9b1f4cc2c7f4aeda7a1280bbc901671f4ec3edaa17f1db676e17651e9bff5f
Bitcoin Addresses (2)
31d58c226fc5a0aa976e13ca9ecebcc83k7m1n9p4q2r6s8t0v5w2x4y6z8u9
SoundCloud Data Breach Exposes 29.8 Million User Accounts 1 indicators · Jan 28, 2026
Domains (1)
HaveIBeenPwned[.]com
Fortinet Blocks Actively Exploited FortiCloud SSO Zero-Day Until Patch is Ready 14 indicators · Jan 27, 2026
IPv4 (10)
104[.]28[.]195[.]105104[.]28[.]195[.]106104[.]28[.]212[.]114104[.]28[.]212[.]115104[.]28[.]227[.]105104[.]28[.]227[.]106104[.]28[.]244[.]114104[.]28[.]244[.]115217[.]119[.]139[.]5037[.]1[.]209[.]19
Email Addresses (2)
cloud-init@mail[.]iocloud-noc@mail[.]io
CVEs (2)
Fake Clawdbot VS Code Extension Deploys ScreenConnect RAT 24 indicators · Jan 27, 2026
IPv4 (2)
178[.]16[.]54[.]253179[.]43[.]176[.]32
Domains (6)
clawdbot[.]getintwopc[.]sitedarkgptprivate[.]comgetintwopc[.]sitemeeting[.]bulletmailer[.]netwww[.]aikido[.]devwww[.]dropbox[.]com
URLs (12)
bulletmailer[.]netdarkgptprivate[.]comdropbox[.]com/scl/fi/tmwi4j86op04r9qo2xdgh/zoomupdate[.]msi?rlkey=ymr9yn5p3q2w2l3uz9cg71dvm&getintwopc[.]sitegetintwopc[.]site/config[.]jsongetintwopc[.]site/config[.]json'hxxp://clawdbot[.]getintwopc[.]site/config[.]json'hxxp://clawdbot[.]getintwopc[.]site/dl/Lightshot[.]dll'hxxp://clawdbot[.]getintwopc[.]site/dl/Lightshot[.]exe'hxxps://darkgptprivate[.]com/d111"hxxps://www[.]aikido[.]dev/blog/fake-clawdbot-vscode-extension-malwarehxxps://www[.]dropbox[.]com/scl/fi/tmwi4j86op04r9qo2xdgh/zoomupdate[.]msi?rlkey=ymr9yn5p3q2w2l3uz9cg71dvm&st=q93av9p6&dl=1
Chinese APT Groups Leverage PeckBirdy JavaScript C2 Framework Since 2023 2 indicators · Jan 27, 2026
IPv4 (1)
47[.]238[.]184[.]9
CVEs (1)
Complete Guide: Setting Up FreePBX with VPS, Docker, and VPN (CGNAT Bypass Solution) 3 indicators · Jul 17, 2025
Domains (3)
mypbx[.]pstn[.]ashburn[.]twilio[.]comtwilio[.]comyourname[.]pstn[.]ashburn[.]twilio[.]com
THIS WEEK IN SECURITY: LOOP DOS, FLIPPER RESPONDS, AND MORE! 2 indicators · Mar 22, 2024
CVEs (2)
How to communicate a cyber breach to minimize reputational damage 2 indicators · Mar 22, 2024
Domains (1)
www[.]ambitiouspr[.]co[.]uk
URLs (1)
hxxps://www[.]ambitiouspr[.]co[.]uk/
New Go loader pushes Rhadamanthys stealer 3 indicators · Mar 22, 2024
Domains (2)
arnaudpairoto[.]computty[.]org
URLs (1)
arnaudpairoto[.]com
The Updated APT Playbook: Tales from the Kimsuky threat actor group 19 indicators · Mar 22, 2024
Domains (3)
00701111[.]000webhostapp[.]comgosiweb[.]gosiclass[.]comniscarea[.]com
URLs (4)
gosiclass[.]com/m/gnu/convert/html/com/list[.]php?query=6hxxp://gosiweb[.]gosiclass[.]com/m/gnu/convert/html/com/list[.]php?query=6hxxps://niscarea[.]com/in[.]php?cn=[base64]&fn=[DateTimeniscarea[.]com/in[.]php?cn=[base64
md5 (3)
sha1 (3)
sha256 (3)
CVEs (2)
Bitcoin Addresses (1)
China-Linked Group Breaches Networks via Connectwise, F5 Software Flaws 5 indicators · Mar 22, 2024
Endpoints vs Routes: What every API hacker needs to know 2 indicators · Feb 13, 2024
Domains (2)
u[.]iduser[.]id
Announcing cvemap from ProjectDiscovery 4 indicators · Jan 26, 2024
Domains (1)
cloud[.]projectdiscovery[.]io
URLs (2)
hxxps://cloud[.]projectdiscovery[.]io/hxxps://cloud[.]projectdiscovery[.]io/?ref=api_key
CVEs (1)
How to protect Evilginx using Cloudflare and HTML Obfuscation 7 indicators · Jan 26, 2024
Domains (4)
academy[.]breakdev[.]orghelp[.]evilginx[.]comindex[.]htwww[.]r-tec[.]net
URLs (3)
hxxps://academy[.]breakdev[.]org/evilginx-masteryhxxps://help[.]evilginx[.]com/docs/category/getting-startedhxxps://www[.]r-tec[.]net/r-tec-blog-evade-signature-based-phishing-detections[.]html
THE BUG HUNTERS METHODOLOGY LIVE 3 indicators · Jan 12, 2024
Domains (2)
Hunter[.]iotbhmlive[.]com
URLs (1)
hxxps://tbhmlive[.]com/
FAKING BLUETOOTH LE WITH AN NRF24L01+ MODULE 4 indicators · Jan 11, 2024
Domains (2)
hackaday[.]iowww[.]sparkfun[.]com
URLs (2)
hxxps://hackaday[.]io/project/162131-graphical-pinout-generator/hxxps://www[.]sparkfun[.]com/news/1947
Review: Engineering-grade OT security: A manager’s guide 2 indicators · Jan 11, 2024
CVEs (2)
DreamBus Unleashes Metabase Mayhem With New Exploit Module 29 indicators · Jan 11, 2024
IPv4 (3)
139[.]59[.]150[.]71[.]46[.]6[.]192[.]204[.]243[.]155
Domains (17)
HyMbvhNq[.]tor2web[.]inHyMbvhNq[.]tor2web[.]itHyMbvhNq[.]tor2web[.]rePcSKnocJ[.]tor2web[.]inPcSKnocJ[.]tor2web[.]itPcSKnocJ[.]tor2web[.]redns[.]twnic[.]twdoh-ch[.]blahdns[.]comdoh-de[.]blahdns[.]comdoh-jp[.]blahdns[.]comdoh-sg[.]blahdns[.]comdoh[.]dns[.]sbdoh[.]liident[.]meip[.]sbp2pool[.]itrelay[.]tor2socks[.]in
URLs (1)
p2pool[.]it
Bitcoin Addresses (2)
34603862c5086a9063e42d79fb094e8d83d6238e465d07a71cadfe89877df6ac
Backdoor.Win32 Carbanak (Anunak) / Named Pipe Null DACL 3 indicators · Jan 11, 2024
Domains (1)
malvuln[.]com
URLs (1)
hxxps://malvuln[.]com/advisory/b8e1e5b832e5947f41fd6ae6ef6d09a1[.]txt
md5 (1)
Financially motivated threat actors misusing App Installer 82 indicators · Jan 9, 2024
Domains (40)
1204knos[.]ru1204networks[.]ruabobe[.]ithr[.]orgaka[.]msamgreetings[.]techamgreetings[.]tech-department[.]usamydeks[.]ithr[.]orgapi[.]storecabotcorpsupport-my[.]sharepoint[.]comcbre[.]techcbre[.]tech-department[.]usformeld[.]techformeld[.]tech-department[.]usgertefin[.]comhubergroup[.]techhubergroup[.]tech-department[.]usinfo-zoomapp[.]comkellyhrservices-my[.]sharepoint[.]comkellyservices-hr[.]comkellyservicesheadhunter-my[.]sharepoint[.]comkellyserviceshr-my[.]sharepoint[.]comkellyservicesrecruitmentdep-my[.]sharepoint[.]commckinseyhrcompany-my[.]sharepoint[.]commeetlng[.]groupnixonpeabody[.]technixonpeabody[.]tech-department[.]usperimeter81support-my[.]sharepoint[.]comscheta[.]siteseptcntr[.]comsharepoint[.]comstorageplace[.]prosun1[.]spacetab1eu[.]ithr[.]orgteannviewer[.]ithr[.]orgtech-department[.]usthecyberwire[.]comtnetworkslicense[.]ruwebmicrosoftservicesystem[.]comzoonn[.]ithr[.]orgzoonn[.]meetlng[.]group
URLs (32)
1204knos[.]ru1204networks[.]ruamgreetings[.]tech-department[.]uscabotcorpsupport-my[.]sharepoint[.]comcbre[.]tech-department[.]usformeld[.]tech-department[.]usgertefin[.]comhubergroup[.]tech-department[.]ushxxps://aka[.]ms/threatintelbloghxxps://scheta[.]site/api[.]store/Setup[.]msixhxxps://scheta[.]site/api[.]store/ZoomInstaller[.]msixhxxps://thecyberwire[.]com/podcasts/microsoft-threat-intelligenceinfo-zoomapp[.]comithr[.]orgkellyhrservices-my[.]sharepoint[.]comkellyservices-hr[.]comkellyservicesheadhunter-my[.]sharepoint[.]comkellyserviceshr-my[.]sharepoint[.]comkellyservicesrecruitmentdep-my[.]sharepoint[.]commckinseyhrcompany-my[.]sharepoint[.]comnixonpeabody[.]tech-department[.]usperimeter81support-my[.]sharepoint[.]comscheta[.]sitescheta[.]site/api[.]store/Setup[.]msixscheta[.]site/api[.]store/ZoomInstaller[.]msixseptcntr[.]comstorageplace[.]prosun1[.]spacetech-department[.]ustnetworkslicense[.]ruwebmicrosoftservicesystem[.]comzoonn[.]meetlng[.]group
sha256 (9)
06b4aebbc3cd62e0aadd1852102645f9a00cc7eea492c0939675efba7566a6de11b71429869f29122236a44a292fde3f0269cde8eb76a52c89139f79f4b97e632ba527fb8e31cb209df8d1890a63cda9cd4433aa0b841ed8b86fa801aff4ccbd2ed5660c7b768b4c2a7899d00773af60cd4396f24a2f7d643ccc1bf74a40397044cac5bf0bab56b0840bd1c7b95f9c7f5078ff417705eeaaf5ea5a2167a81dd548aa2393ef590bab4ff2fd1e7d95af36e5b6911348d7674347626c9aaafa255e7e646dfe7b7f330cb21db07b94f611eb39f604fab36e347fb884f797ba462402b79633917e51da2a4401473d08719f493d61fd64a1b10fe482c12d984d791ccbffb45dc14ea908b21e01e87ec18725dff560c093884005c2b71277e2de354866
CVEs (1)
The Underground Economist: Volume 4, Issue 1 8 indicators · Jan 9, 2024
Domains (4)
URLs (4)
Custom GPTs: A Case of Malware Analysis and IoC Analyzing 1 indicators · Jan 9, 2024
Domains (1)
seo[.]ai
Deceptive Cracked Software Spreads Lumma Variant on YouTube 22 indicators · Jan 8, 2024
IPv4 (6)
119[.]0[.]0[.]0176[.]113[.]115[.]224176[.]113[.]115[.]226176[.]113[.]115[.]227176[.]113[.]115[.]229176[.]113[.]115[.]232
Domains (5)
Netovrema[.]pwchincenterblandwka[.]pwcutt[.]lyopposesicknessopw[.]pwpolitefrightenpowoa[.]pw
URLs (6)
Netovrema[.]pwchincenterblandwka[.]pwcutt[.]ly/lwD7B7lphxxp://cutt[.]ly/lwD7B7lp,”opposesicknessopw[.]pwpolitefrightenpowoa[.]pw
sha256 (4)
CVEs (1)
Chapter 84: In-depth analysis and technical analysis of LockBit, the top encryption ransomware organization (Part 1) 1 indicators · Jan 7, 2024
CVEs (1)
JavaScript Malware: 50,000+ Bank Users at Risk Worldwide 2 indicators · Jan 7, 2024
Domains (1)
jscdnpack[.]com
URLs (1)
jscdnpack[.]com
Prior to Cyber Attack, Russian Attackers Spent Months Inside the Ukraine Telecoms Giant 50 indicators · Jan 7, 2024
Domains (7)
CVEs (43)
CVE-2009-2265CVE-2017-0199CVE-2021-24093CVE-2022-38028CVE-2023-20593CVE-2023-27350CVE-2023-32046CVE-2023-36884CVE-2024-10470CVE-2024-11972CVE-2024-29510CVE-2024-3400CVE-2024-38213CVE-2024-40766CVE-2024-42057CVE-2024-43491CVE-2024-44082CVE-2024-44131CVE-2024-49035CVE-2024-50550CVE-2024-50623CVE-2024-57726CVE-2024-57727CVE-2024-57728CVE-2024-8260CVE-2025-0282CVE-2025-23121CVE-2025-3052CVE-2025-3248CVE-2025-4322CVE-2025-54135CVE-2025-59287CVE-2025-68613CVE-2025-8088CVE-2026-0628CVE-2026-1591CVE-2026-23111CVE-2026-31431CVE-2026-3502CVE-2026-35273CVE-2026-35616CVE-2026-4020CVE-2026-7482
Tackling Anti-Analysis Techniques of GuLoader and RedLine Stealer 2 indicators · Jan 5, 2024
Hackers target Apache RocketMQ servers vulnerable to RCE attacks 2 indicators · Jan 5, 2024
CVEs (2)
100 Days of YARA – 2023 37 indicators · Jan 5, 2024
Domains (9)
ci[.]appveyor[.]comcommunity[.]spiceworks[.]comexport[.]nameinteroperability[.]blob[.]core[.]windows[.]netosandamalith[.]comredmaple[.]techsection[.]namewww[.]garykessler[.]netwww[.]tarlogic[.]com
URLs (7)
hxxps://ci[.]appveyor[.]com/project/plusvic/yara/build/job/wthlb30bklmlns0a/artifactshxxps://community[.]spiceworks[.]com/topic/2107142-what-are-all-of-the-file-types-on-a-windows-pc-that-contain-executable-codehxxps://interoperability[.]blob[.]core[.]windows[.]net/files/MS-ONE/%5bMS-ONE%5d[.]pdfhxxps://osandamalith[.]com/2020/07/19/exploring-the-ms-dos-stub/hxxps://redmaple[.]tech/blogs/macho-files/hxxps://www[.]garykessler[.]net/library/file_sigs[.]htmlhxxps://www[.]tarlogic[.]com/blog/seloaddriverprivilege-privilege-escalation/
md5 (6)
sha256 (12)
003669761229d3e1db0f5a5b333ef62b3dffcc8e27c821ce9018362e0a2df7e91db32411a88725b259a7f079bdebd5602f11130f71ec35bec9d18134adbd43522218904238dc4f8bb5bb838ed4fa779f7873814d7711a28ba59603826ae020aa5904bc90aec64b12caa5d352199bd4ec2f5a3a9ac0a08adf954689a58eff3f2a76d54a57bf9521f6558b588acd0326249248f91b27ebc25fd94ebe92dc497809a37a290863fe29b9812e819e4c5b047c44e7a7d7c40e33da6f5662e1957862aba44b35f376f6e493580c988cd697e8a2d64c82ab665dfd100115fb6f700bb82ab7d217f13550227bb6d80d05bde26e43cd752a870973052080a72a510c444b5ac98ac83685cb5f7f72e832998fec753910e77d1b8eee638acb508252912f6cf6eb30a1822bd6f503f8151cb04bfd315a62fa67dbfe1f573e6fcfd74636ecedd5ed48d56a47982c3c9b39ee8859e0b764454ab9ac6e7a7866cdef5c310521be19f119cc4cb5a7972bdc80548982b2b63fac5b48d5fce1517270db67c858e9e8b0
Bitcoin Addresses (1)
Hide and Seek in Windows’ Closet: Unmasking the WinSxS Hijacking Hideout 2 indicators · Jan 5, 2024
Domains (1)
www[.]securityjoes[.]com
URLs (1)
hxxps://www[.]securityjoes[.]com/post/hide-and-seek-in-windows-closet-unmasking-the-winsxs-hijacking-hideout
Auto-extracted from the original source reports and may include false positives, verify before acting. Need to pull IOCs from your own text? Use the IOC Extractor →