Threat Intelligence · Historical Research

IOC Archive

Historical article-derived observables that no longer fall inside the current reporting-recency window for their type. Provider-supported values enter only after the applicable enabled services complete the required boundary check without qualifying positive evidence. They remain available for research, pivots, and attribution review. Archived does not mean clean, benign, remediated, resolved, or safe. This archive is not a blocklist.

Reporting-window dates come from Bulwark Black report publication dates, not provider sightings. IP/CIDR observations use 14 days, domains and URLs 30 days, file identifiers 730 days, and other context 90 days. Types without an applicable exact provider check archive by recency alone. Current verified-feed admission is evaluated separately on each IOC Passport and in the machine-readable feeds.

1124 archived unique observations

← Current observations (2781)Revalidation queue (2057)IOC Archive (1124)

124 archived observations on this page

Showing 1001–1124 of 1124

IPv4 address

204[.]152[.]223[.]172

Last reported Feb 4, 2026 · Reporting window ended Feb 18, 2026 · Archive check completed Aug 27, 2026 · 1 source report

IOC Archive

204[.]152[.]223[.]172

34[.]171[.]37[.]34

34[.]173[.]176[.]171

34[.]30[.]49[.]235

34[.]63[.]142[.]34

34[.]66[.]36[.]38

34[.]69[.]200[.]125

34[.]9[.]139[.]206

35[.]188[.]114[.]132

35[.]192[.]38[.]204

143[.]204[.]11[.]112

60[.]2[.]1[.]3

ae776206422e886961eefb358c4fefda

de2381ccba8aa44b77bda1c971a33b5e

4f6b9c644d4fe517889b3fbb0b4271ca

72f60d7f4ce22db4506547ad555ea0b1

c0de41e45352714500771d43f0d8c4c3

05ef26965be930fade49e5dcba73b9fefc04757e

2b631d0ee47650923955398921c1ceccc3e38cb1

1db32411a88725b259a7f079bdebd5602f11130f71ec35bec9d18134adbd4352

2218904238dc4f8bb5bb838ed4fa779f7873814d7711a28ba59603826ae020aa

76d54a57bf9521f6558b588acd0326249248f91b27ebc25fd94ebe92dc497809

a44b35f376f6e493580c988cd697e8a2d64c82ab665dfd100115fb6f700bb82a

c98ac83685cb5f7f72e832998fec753910e77d1b8eee638acb508252912f6cf6

ed48d56a47982c3c9b39ee8859e0b764454ab9ac6e7a7866cdef5c310521be19

mypbx[.]pstn[.]ashburn[.]twilio[.]com

twilio[.]com

yourname[.]pstn[.]ashburn[.]twilio[.]com

CVE-2023-48788

CVE-2024-2169

CVE-2017-12542

CVE-2017-5689

07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1

CVE-2022-0185

CVE-2022-3052

CVE-2023-22518

CVE-2024-1709

www[.]ambitiouspr[.]co[.]uk

hxxps://www[.]ambitiouspr[.]co[.]uk/

putty[.]org

00701111[.]000webhostapp[.]com

gosiclass[.]com

bbradar[.]io

hxxps://bbradar[.]io/

CVE-2023-33246

CVE-2023-38646

CVE-2023-50164

CVE-2023-51467

CVE-2021-43890

CVE-2024-21412

175[.]45[.]176[.]0/22

210[.]214[.]0[.]0/16

210[.]52[.]109[.]0/24

77[.]94[.]35[.]0/24

CVE-2023-37582

cloud[.]projectdiscovery[.]io

hxxps://cloud[.]projectdiscovery[.]io/

hxxps://cloud[.]projectdiscovery[.]io/?ref=api_key

academy[.]breakdev[.]org

help[.]evilginx[.]com

www[.]r-tec[.]net

hxxps://academy[.]breakdev[.]org/evilginx-mastery

hxxps://help[.]evilginx[.]com/docs/category/getting-started

hxxps://www[.]r-tec[.]net/r-tec-blog-evade-signature-based-phishing-detections[.]html

hunter[.]io

tbhmlive[.]com

hxxps://tbhmlive[.]com/

hackaday[.]io

www[.]sparkfun[.]com

hxxps://hackaday[.]io/project/162131-graphical-pinout-generator/

hxxps://www[.]sparkfun[.]com/news/1947

dns[.]twnic[.]tw

doh-ch[.]blahdns[.]com

doh-de[.]blahdns[.]com

doh-jp[.]blahdns[.]com

doh-sg[.]blahdns[.]com

doh[.]li

hymbvhnq[.]tor2web[.]in

hymbvhnq[.]tor2web[.]it