Domain
attacker-db[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Threat Intelligence · Historical Research
IOC Archive
Historical article-derived observables that no longer fall inside the current reporting-recency window for their type. Provider-supported values enter only after the applicable enabled services complete the required boundary check without qualifying positive evidence. They remain available for research, pivots, and attribution review. Archived does not mean clean, benign, remediated, resolved, or safe. This archive is not a blocklist.
Reporting-window dates come from Bulwark Black report publication dates, not provider sightings. IP/CIDR observations use 14 days, domains and URLs 30 days, file identifiers 730 days, and other context 90 days. Types without an applicable exact provider check archive by recency alone. Current verified-feed admission is evaluated separately on each IOC Passport and in the machine-readable feeds.
1124 archived unique observations
200 archived observations on this page
Showing 601–800 of 1124
Source report →
Domain
basecon[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
canal1zac1a[.]onrender[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
driverx86-adobe[.]onrender[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
google-ai-labs-it[.]onrender[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
stream[.]bybit[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
ukr[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
weatherdataai[.]theworkpc[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
wool-basalt-clock[.]glitch[.]me
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
ws-api[.]binance[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
ws-feed-public[.]sandbox[.]exchange[.]coinbase[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
ws-feed[.]exchange[.]coinbase[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
www[.]circoloesteri[.]it
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
www[.]drs[.]gov[.]ua
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
www[.]news9live[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://www[.]news9live[.]com/technology/tech-news/hackers-used-claude-hit-mexico-agencies-150gb-data-claim-report-2936314
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
msft[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://evil[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
apisix[.]apache[.]org
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://apisix[.]apache[.]org
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-39999
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
pg[.]ae
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
wigetticks[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
wizzleticks[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
thc[.]org
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
172[.]67[.]161[.]215
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
4[.]4[.]3[.]12
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
privnote[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://business-data-leaks[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
200[.]79[.]113[.]136
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
201[.]144[.]122[.]58
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
201[.]144[.]122[.]60
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
45[.]61[.]137[.]126
Last reported · Reporting window ended · Archive check completed · 1 source report
CVE
CVE-2026-20093
Last reported · Reporting window ended · Context-only recency placement · 2 source reports
CVE
CVE-2026-20160
Last reported · Reporting window ended · Context-only recency placement · 2 source reports
Domain
srt[.]tw
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://www[.]aikido[.]dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm
Last reported · Reporting window ended · Archive check completed · 1 source report
Mutex Names
0XFEXYCDAPPLE05CHRIS
Last reported · Reporting window ended · Context-only recency placement · 1 source report
Domain
com[.]pdfninja[.]app
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
dart[.]dev
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
flutter[.]dev
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
pdf-brain[.]app
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
pdf-ninja[.]app
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
thecybersecguru[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
socprime[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://socprime[.]com/active-threats/solyximmortal-python-malware-analysis/
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://www[.]cyfirma[.]com/research/solyximmortal-python-malware-analysis/
Last reported · Reporting window ended · Archive check completed · 1 source report
CVE
CVE-2026-3502
Last reported · Reporting window ended · Context-only recency placement · 1 source report
Domain
t-in-one[.]io
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://oob[.]moika[.]tech/payload/linux
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://oob[.]moika[.]tech/payload/mac
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://oob[.]moika[.]tech/payload/win
Last reported · Reporting window ended · Archive check completed · 1 source report
Email Addresses
ifstap@proton[.]me
Last reported · Reporting window ended · Context-only recency placement · 1 source report
Domain
snort[.]org
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
dynu[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
safedep[.]io
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxp://216[.]126[.]225[.]129:8443?h=megalodon&l=gh_dump&id=hefs8esnhgkx"
Last reported · Reporting window ended · Archive check completed · 1 source report
CVE
CVE-2026-0826
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-52806
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-21513
Last reported · Reporting window ended · Context-only recency placement · 3 source reports
Domain
ico[.]org
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
ico[.]org[.]uk
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
malpedia[.]caad[.]fkie[.]fraunhofer[.]de
Last reported · Reporting window ended · Archive check completed · 2 source reports
Domain
securityintelligence[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://ico[.]org[.]uk/media2/xdrfahsw/south-staffordshire-plc-and-south-staffordshire-water-plc-monetary-penalty-notice[.]pdf
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://malpedia[.]caad[.]fkie[.]fraunhofer[.]de/details/win[.]clop
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://malpedia[.]caad[.]fkie[.]fraunhofer[.]de/details/win[.]get2
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://malpedia[.]caad[.]fkie[.]fraunhofer[.]de/details/win[.]sdbbot
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://redcanary[.]com/blog/raspberry-robin
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://securityintelligence[.]com/posts/raspberry-robin-worm-dridex-malware/
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://www[.]ransomware[.]live/group/clop
Last reported · Reporting window ended · Archive check completed · 1 source report
CVE
CVE-2017-10151
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-61757
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-21992
Last reported · Reporting window ended · Context-only recency placement · 1 source report
Domain
enterpriseregistration[.]windows[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
CVE
CVE-2025-32975
Last reported · Reporting window ended · Context-only recency placement · 1 source report
Domain
my[.]f5[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
www[.]darktrace[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxp://206[.]189[.]27[.]39:8888/5
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://my[.]f5[.]com/manage/s/article/K000156741
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://www[.]darktrace[.]com/blog/darktraces-view-on-operation-lunar-peek-exploitation-of-palo-alto-firewall-devices-cve-2024-2012-and-2024-9474
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
elementshift[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
filemail[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
licencemanagers[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
licencesupporting[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
nanomatrix[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
peerdistsvcmanagers[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
premier-healthadvisory[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
premierhealthadvisory[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
quantumweave[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
ramiltons-finance[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
ramiltonsfinance[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
themesmanagers[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
themesprovidermanagers[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://2117[.]filemail[.]com/api/file/get?filekey=T0EnWQ6NugHkW_kLfDxPBEw_um6NSkg9ZwNRQ_5lrKrLLUo35pV8m3TKv1LqF3zZzdUm
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://elementshift[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://nanomatrix[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://quantumweave[.]azurewebsites[.]net
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
ottawacitizen[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://ottawacitizen[.]com/news/local-news/what-is-going-on-in-ottawa-handcuffing-of-another-child-with-autism-worries-advocates
Last reported · Reporting window ended · Archive check completed · 1 source report
Email Addresses
attacker@xyz[.]com
Last reported · Reporting window ended · Context-only recency placement · 1 source report
URL
hxxps://www[.]crystalpdf[.]com/conditions
Last reported · Reporting window ended · Archive check completed · 1 source report
CVE
CVE-2025-14174
Last reported · Reporting window ended · Context-only recency placement · 2 source reports
CVE
CVE-2025-31277
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-43510
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-43520
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-43529
Last reported · Reporting window ended · Context-only recency placement · 2 source reports
CVE
CVE-2026-20700
Last reported · Reporting window ended · Context-only recency placement · 3 source reports
IPv4 address
20[.]12[.]7[.]1
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
20[.]12[.]7[.]2
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
20[.]15[.]4[.]4
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
20[.]15[.]4[.]5
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
20[.]15[.]5[.]2
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
20[.]15[.]5[.]3
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
20[.]18[.]2[.]2
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
20[.]18[.]3[.]1
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
20[.]9[.]9[.]1
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
20[.]9[.]9[.]2
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
26[.]1[.]1[.]1
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
26[.]1[.]1[.]2
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4:Port
173[.]212[.]205[.]251:8443
Last reported · Reporting window ended · Context-only recency placement · 2 source reports
CVE
CVE-2026-3564
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-3710
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-3711
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-3712
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-3713
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-3714
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-32290
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-32291
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-32292
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-32293
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-32294
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-32295
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-32296
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-32297
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-32298
Last reported · Reporting window ended · Context-only recency placement · 1 source report
IPv4 address
18[.]139[.]83[.]110
Last reported · Reporting window ended · Archive check completed · 1 source report
CVE
CVE-2025-47812
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-47813
Last reported · Reporting window ended · Context-only recency placement · 1 source report
Domain
7740f766-8d1d-46ad-a6bc-onedrive[.]p-9jluifuu[.]workers[.]dev
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
audit-report-9767d3[.]fullerjp09[.]workers[.]dev
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
f8uh-dwam-j4l5[.]pvasquez-princetonpartners-com-s-account[.]workers[.]dev
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
onedrive-7tu[.]techroboticslabmade-techie-com-s-account[.]workers[.]dev
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
voicemail-59f[.]admin-treyripple-com-s-account[.]workers[.]dev
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
voicemail-lyr[.]nbuckley-cambek-com-s-account[.]workers[.]dev
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
voicemail-wx7[.]mark-squires-expressrancnes-com-s-account[.]workers[.]dev
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
ytgw-9n30-xlwd[.]pvasquez-princetonpartners-com-s-account[.]workers[.]dev
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
itsec[.]hboeck[.]de
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://itsec[.]hboeck[.]de/
Last reported · Reporting window ended · Archive check completed · 1 source report
Domain
xverse[.]app
Last reported · Reporting window ended · Archive check completed · 1 source report
Solana Addresses
BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC
Last reported · Reporting window ended · Context-only recency placement · 1 source report
Domain
organization[.]sharepoint[.]com
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://company[.]sharepoint[.]com/sites/ProductionOps/
Last reported · Reporting window ended · Archive check completed · 1 source report
URL
hxxps://organization[.]sharepoint[.]com/sites/Legal_Archive/
Last reported · Reporting window ended · Archive check completed · 1 source report
CVE
CVE-2017-7921
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2021-33044
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2023-6895
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-34067
Last reported · Reporting window ended · Context-only recency placement · 1 source report
Domain
ipify[.]org
Last reported · Reporting window ended · Archive check completed · 1 source report
CVE
CVE-2026-21666
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-21667
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-21668
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-21669
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-21670
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-21671
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-21672
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-21708
Last reported · Reporting window ended · Context-only recency placement · 1 source report
Email Addresses
ops@rescana[.]com
Last reported · Reporting window ended · Context-only recency placement · 1 source report
URL
hxxp://83[.]229[.]126[.]195:8081/xmrig
Last reported · Reporting window ended · Archive check completed · 1 source report
CVE
CVE-2025-15467
Last reported · Reporting window ended · Context-only recency placement · 1 source report
Email Addresses
schneier@schneier[.]com
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-2441
Last reported · Reporting window ended · Context-only recency placement · 4 source reports
CVE
CVE-2026-3909
Last reported · Reporting window ended · Context-only recency placement · 3 source reports
CVE
CVE-2026-3910
Last reported · Reporting window ended · Context-only recency placement · 3 source reports
IPv4:Port
194[.]76[.]226[.]93:8080
Last reported · Reporting window ended · Context-only recency placement · 1 source report
IPv4 address
2[.]59[.]132[.]106
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
93[.]115[.]10[.]35
Last reported · Reporting window ended · Archive check completed · 1 source report
CVE
CVE-2025-59719
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-24858
Last reported · Reporting window ended · Context-only recency placement · 2 source reports
Domain
jdownloader[.]org
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
206[.]189[.]27[.]39
Last reported · Reporting window ended · Archive check completed · 1 source report
CVE
CVE-2025-31324
Last reported · Reporting window ended · Context-only recency placement · 1 source report
Email Addresses
lucian_constantin@foundryco[.]com
Last reported · Reporting window ended · Context-only recency placement · 2 source reports
CVE
CVE-2024-23222
Last reported · Reporting window ended · Context-only recency placement · 1 source report
IPv4:Port
154[.]205[.]154[.]82:443
Last reported · Reporting window ended · Context-only recency placement · 1 source report
IPv4:Port
207[.]148[.]121[.]95:443
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-68613
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2025-7544
Last reported · Reporting window ended · Context-only recency placement · 1 source report
IPv4 address
13[.]62[.]52[.]206
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
194[.]163[.]175[.]135
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
194[.]233[.]100[.]40
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4 address
65[.]20[.]67[.]134
Last reported · Reporting window ended · Archive check completed · 1 source report
IPv4:Port
144[.]172[.]106[.]66:8080
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2022-20775
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2024-12356
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-22769
Last reported · Reporting window ended · Context-only recency placement · 1 source report
Mutex Names
Rmc-GSEGIF
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-20841
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-20805
Last reported · Reporting window ended · Context-only recency placement · 1 source report
CVE
CVE-2026-21510
Last reported · Reporting window ended · Context-only recency placement · 1 source report