Threat Intelligence · Historical Research

IOC Archive

Historical article-derived observables that no longer fall inside the current reporting-recency window for their type. Provider-supported values enter only after the applicable enabled services complete the required boundary check without qualifying positive evidence. They remain available for research, pivots, and attribution review. Archived does not mean clean, benign, remediated, resolved, or safe. This archive is not a blocklist.

Reporting-window dates come from Bulwark Black report publication dates, not provider sightings. IP/CIDR observations use 14 days, domains and URLs 30 days, file identifiers 730 days, and other context 90 days. Types without an applicable exact provider check archive by recency alone. Current verified-feed admission is evaluated separately on each IOC Passport and in the machine-readable feeds.

1123 archived unique observations

← Current observations (2781)Revalidation queue (2058)IOC Archive (1123)

200 archived observations on this page

Showing 1–200 of 1123

Domain

5[.]xxx[.]xx[.]xxx

Last reported Sep 9, 2026 · Reporting window ended Oct 9, 2026 · Archive check completed Oct 8, 2026 · 1 source report

IOC Archive

5[.]xxx[.]xx[.]xxx

adex-blog[.]blogspot[.]com

amazingshield[.]xyz

ravexoffical[.]blogspot[.]com

velfps[.]blogspot[.]com

velvoxlab[.]blogspot[.]com

venrx[.]blogspot[.]com

venrxhub[.]blogspot[.]com

folder[.]id

schemas[.]xmlsoap[.]org

hxxp://schemas[.]xmlsoap[.]org/soap/envelope/

hxxps://images[.]weserv[.]nl/?url=hxxps://acocdn[.]com/assets/v1_SGVsbG8gV29ybGQ

CVE-2026-43074

CVE-2026-46242

13[.]52[.]201[.]0/24

18[.]144[.]76[.]0/24

3[.]101[.]0[.]0/16

3[.]101[.]157[.]240

CVE-2026-34908

CVE-2026-34909

CVE-2026-34910

CVE-2026-50746

CVE-2026-50747

CVE-2026-50748

CVE-2026-54400

CVE-2026-54402

CVE-2026-55115

CVE-2026-55116

synctimes[.]australiaeast[.]cloudapp[.]azure[.]com

update1n5[.]blob[.]core[.]windows[.]net

update1n6[.]blob[.]core[.]windows[.]net

update1n7[.]blob[.]core[.]windows[.]net

update1n9[.]blob[.]core[.]windows[.]net

updatetmp[.]blob[.]core[.]windows[.]net

webwether[.]eastus[.]cloudapp[.]azure[.]com

and[.]to

download[.]anydesk[.]com

hxxps://download[.]anydesk[.]com/AnyDesk[.]exe

hxxps://sendit[.]sh/Gg7Rp/ace[.]exe

CVE-2025-20333

CVE-2025-20362

CVE-2025-2492

laboo[.]boo

pstatic[.]net

104.21.18.89

104.21.20.224

104.21.27.38

172.67.168.224

172.67.212.253

crossdwm[.]azurewebsites[.]net

dnshnsdev[.]azurewebsites[.]net

gamebarapp[.]azurewebsites[.]net

greenyjsgfd[.]azurewebsites[.]net

hecowime-aqdphyd4bbdef6es[.]westeurope-01[.]azurewebsites[.]net

helptellerbls[.]azurewebsites[.]net

hpjumpsrv[.]azurewebsites[.]net

kyrasey-f8hfexa5cqamh7fk[.]westeurope-01[.]azurewebsites[.]net

naturalapplication[.]azurewebsites[.]net

onlyoffice[.]com

oracle-challenge[.]s3[.]us-east-1[.]amazonaws[.]com

plugplay[.]azurewebsites[.]net

retaildemo[.]azurewebsites[.]net

rgbteller[.]azurewebsites[.]net

storview[.]azurewebsites[.]net

timedrv[.]azurewebsites[.]net

tubitak[.]azurewebsites[.]net

userwellgtfs[.]azurewebsites[.]net

wdisystem[.]azurewebsites[.]net

wslmenus[.]azurewebsites[.]net

wslwebui[.]azurewebsites[.]net

hxxps://gamebarapp[.]azurewebsites[.]net

hxxps://gamebarappinformation[.]azurewebsites[.]net

hxxps://kyrasey-f8hfexa5cqamh7fk[.]westeurope-01[.]azurewebsites[.]net

hxxps://oracle-challenge[.]s3[.]us-east-1[.]amazonaws[.]com/Front-Technical-Challenge[.]zip

hxxps://plugplay[.]azurewebsites[.]net

hxxps://rgbteller[.]azurewebsites[.]net

hxxps://wslwebui[.]azurewebsites[.]net

iapi[.]kraken[.]com

resources[.]live[.]ledger[.]app