CVE
CVE-2026-7989
Last reported · Reporting window ended · Context-only recency placement · 1 source report
Threat Intelligence · Historical Research
IOC Archive
Historical article-derived observables that no longer fall inside the current reporting-recency window for their type. Provider-supported values enter only after the applicable enabled services complete the required boundary check without qualifying positive evidence. They remain available for research, pivots, and attribution review. Archived does not mean clean, benign, remediated, resolved, or safe. This archive is not a blocklist.
Reporting-window dates come from Bulwark Black report publication dates, not provider sightings. IP/CIDR observations use 14 days, domains and URLs 30 days, file identifiers 730 days, and other context 90 days. Types without an applicable exact provider check archive by recency alone. Current verified-feed admission is evaluated separately on each IOC Passport and in the machine-readable feeds.
1211 archived unique observations
200 archived observations on this page
Showing 601–800 of 1211
Source report →
CVE
CVE-2026-7990
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-7991
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-7992
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-7993
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-7994
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-7995
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-7996
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-7997
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-7998
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-7999
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8000
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8001
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8002
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8003
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8004
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8005
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8006
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8007
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8008
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8009
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8010
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8011
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8012
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8013
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8014
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8015
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8016
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8017
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8018
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8019
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8020
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8021
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-8022
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-32433
Last reported · Reporting window ended · Context-only recency placement · 1 source report
Domain
bleacherreport[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
justwatch[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
pool[.]supportxmr[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
supportxmr[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
CVE
CVE-2026-46300
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-25592
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-26030
Last reported · Reporting window ended · Context-only recency placement · 1 source report
URL
hxxp://194[.]233[.]92[.]26:2222/
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxp://194[.]233[.]92[.]26:8088/
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxp://217[.]15[.]160[.]247:2222/
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxp://217[.]15[.]160[.]247:8088/
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxp://217[.]15[.]160[.]247:99/
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxp://217[.]15[.]164[.]147:2222/
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxp://217[.]15[.]164[.]147:8088/
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxp://217[.]15[.]164[.]147:99/
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxp://95[.]182[.]100[.]231:2222/
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
ns1[.]fbi[.]seized[.]gov
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
clear90489058903-document[.]workers[.]dev
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
mononapfp[.]sharepoint[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
mononapfpcom[.]sharepoint[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
sharepoint[.]com
Last reported · Reporting window ended · Archive check completed · 2 source reports
Domain
workers[.]dev
Last reported · Reporting window ended · Archive check completed · 3 source reports
URL
hxxps://mononapfp[.]sharepoint[.]com/:f:/document/INV-IgCx1X50pgUjR7iAjZL2fuQaAW4GfKVs6wHT3BYv9sgwW7g
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://mononapfpcom[.]sharepoint[.]com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEc
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://blackpointcyber[.]com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://horizon3[.]ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://simple-help[.]com/release-news
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://simple-help[.]com/security/simplehelp-security-update-2026-05
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
tria[.]ge
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://tria[.]ge/250530-ttmjhayzhw
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://tria[.]ge/250812-zw4tfszpy4
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
0din[.]ai
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
attacker-db[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
basecon[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
canal1zac1a[.]onrender[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
driverx86-adobe[.]onrender[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
google-ai-labs-it[.]onrender[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
stream[.]bybit[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
ukr[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
weatherdataai[.]theworkpc[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
wool-basalt-clock[.]glitch[.]me
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
ws-api[.]binance[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
ws-feed-public[.]sandbox[.]exchange[.]coinbase[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
ws-feed[.]exchange[.]coinbase[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
www[.]circoloesteri[.]it
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
www[.]drs[.]gov[.]ua
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
www[.]news9live[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://www[.]news9live[.]com/technology/tech-news/hackers-used-claude-hit-mexico-agencies-150gb-data-claim-report-2936314
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
msft[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://evil[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
apisix[.]apache[.]org
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://apisix[.]apache[.]org
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-39999
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
pg[.]ae
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
wigetticks[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
wizzleticks[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
thc[.]org
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
172[.]67[.]161[.]215
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
4[.]4[.]3[.]12
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
privnote[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://business-data-leaks[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
200[.]79[.]113[.]136
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
201[.]144[.]122[.]58
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
201[.]144[.]122[.]60
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
45[.]61[.]137[.]126
Last reported · Reporting window ended · Archive check completed · 1 source report
CVE
CVE-2026-20093
Last reported · Reporting window ended · Context-only recency placement · 2 source reports
CVE
CVE-2026-20160
Last reported · Reporting window ended · Context-only recency placement · 2 source reports
Domain
srt[.]tw
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://www[.]aikido[.]dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm
Last reported · Reporting window ended · Archive check completed · 1 source report
Mutex Names
0XFEXYCDAPPLE05CHRIS
Last reported · Reporting window ended · Context-only recency placement · 1 source report
Domain
com[.]pdfninja[.]app
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
dart[.]dev
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
flutter[.]dev
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
pdf-brain[.]app
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
pdf-ninja[.]app
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
thecybersecguru[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
socprime[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://socprime[.]com/active-threats/solyximmortal-python-malware-analysis/
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://www[.]cyfirma[.]com/research/solyximmortal-python-malware-analysis/
Last reported · Reporting window ended · Archive check completed · 1 source report
CVE
CVE-2026-3502
Last reported · Reporting window ended · Context-only recency placement · 1 source report
Domain
t-in-one[.]io
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://oob[.]moika[.]tech/payload/linux
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://oob[.]moika[.]tech/payload/mac
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://oob[.]moika[.]tech/payload/win
Last reported · Reporting window ended · Archive check completed · 1 source report
Email Addresses
ifstap@proton[.]me
Last reported · Reporting window ended · Context-only recency placement · 1 source report
Domain
snort[.]org
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
dynu[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
safedep[.]io
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxp://216[.]126[.]225[.]129:8443?h=megalodon&l=gh_dump&id=hefs8esnhgkx"
Last reported · Reporting window ended · Archive check completed · 1 source report
CVE
CVE-2026-0826
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-52806
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-21513
Last reported · Reporting window ended · Context-only recency placement · 3 source reports
Domain
ico[.]org
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
ico[.]org[.]uk
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
malpedia[.]caad[.]fkie[.]fraunhofer[.]de
Last reported · Reporting window ended · Archive check completed · 2 source reports
Domain
securityintelligence[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://ico[.]org[.]uk/media2/xdrfahsw/south-staffordshire-plc-and-south-staffordshire-water-plc-monetary-penalty-notice[.]pdf
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://malpedia[.]caad[.]fkie[.]fraunhofer[.]de/details/win[.]clop
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://malpedia[.]caad[.]fkie[.]fraunhofer[.]de/details/win[.]get2
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://malpedia[.]caad[.]fkie[.]fraunhofer[.]de/details/win[.]sdbbot
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://redcanary[.]com/blog/raspberry-robin
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://securityintelligence[.]com/posts/raspberry-robin-worm-dridex-malware/
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://www[.]ransomware[.]live/group/clop
Last reported · Reporting window ended · Archive check completed · 1 source report
CVE
CVE-2017-10151
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-61757
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-21992
Last reported · Reporting window ended · Context-only recency placement · 1 source report
Domain
enterpriseregistration[.]windows[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
CVE
CVE-2025-32975
Last reported · Reporting window ended · Context-only recency placement · 1 source report
Domain
my[.]f5[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
www[.]darktrace[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxp://206[.]189[.]27[.]39:8888/5
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://my[.]f5[.]com/manage/s/article/K000156741
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://www[.]darktrace[.]com/blog/darktraces-view-on-operation-lunar-peek-exploitation-of-palo-alto-firewall-devices-cve-2024-2012-and-2024-9474
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
2117[.]filemail[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
buisness-centeral-transportation[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
buisness-centeral[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
business-startup[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
businessstartup[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
docspace-twpf0e[.]onlyoffice[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
docspace-y4cumb[.]onlyoffice[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
elementshift[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
filemail[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
licencemanagers[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
licencesupporting[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
nanomatrix[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
peerdistsvcmanagers[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
premier-healthadvisory[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
premierhealthadvisory[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
quantumweave[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
ramiltons-finance[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
ramiltonsfinance[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
themesmanagers[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
themesprovidermanagers[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://2117[.]filemail[.]com/api/file/get?filekey=T0EnWQ6NugHkW_kLfDxPBEw_um6NSkg9ZwNRQ_5lrKrLLUo35pV8m3TKv1LqF3zZzdUm
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://elementshift[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://nanomatrix[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://quantumweave[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
ottawacitizen[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://ottawacitizen[.]com/news/local-news/what-is-going-on-in-ottawa-handcuffing-of-another-child-with-autism-worries-advocates
Last reported · Reporting window ended · Archive check completed · 1 source report
Email Addresses
attacker@xyz[.]com
Last reported · Reporting window ended · Context-only recency placement · 1 source report
URL
hxxps://www[.]crystalpdf[.]com/conditions
Last reported · Reporting window ended · Archive check completed · 1 source report
CVE
CVE-2025-14174
Last reported · Reporting window ended · Context-only recency placement · 2 source reports
CVE
CVE-2025-31277
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-43510
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-43520
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-43529
Last reported · Reporting window ended · Context-only recency placement · 2 source reports
CVE
CVE-2026-20700
Last reported · Reporting window ended · Context-only recency placement · 3 source reports
IPv4 address
20[.]12[.]7[.]1
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
20[.]12[.]7[.]2
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
20[.]15[.]4[.]4
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
20[.]15[.]4[.]5
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
20[.]15[.]5[.]2
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
20[.]15[.]5[.]3
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
20[.]18[.]2[.]2
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
20[.]18[.]3[.]1
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
20[.]9[.]9[.]1
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
20[.]9[.]9[.]2
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
26[.]1[.]1[.]1
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
26[.]1[.]1[.]2
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4:Port
173[.]212[.]205[.]251:8443
Last reported · Reporting window ended · Context-only recency placement · 2 source reports
CVE
CVE-2026-3564
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-3710
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-3711
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-3712
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-3713
Last reported · Reporting window ended · Context-only recency placement · 1 source report