IOC Passport

stopransomware[.]gov

DomainArticle-derived observationCurrent reporting windowReported in 2 articlesWatch this →

A domain extracted from published reporting. It may be infrastructure, a cited service, or a candidate indicator; check current feed admission before blocking. Shown defanged for safe viewing; use Copy live value for the functional form.

This value remains inside its 30-day domain/URL reporting window. Current reporting status is separate from verified-feed admission. Archive-cleared or archived does not mean clean, inactive, benign, remediated, resolved, or safe, and this lifecycle does not change current verified-feed admission.

Current verified-feed status

Checking live guard…

Article reporting and current malicious-feed admission are evaluated separately.

First reported: Aug 12, 2026
Last reported: Oct 22, 2026
Article count: 2
Admission policy: bulwark-exact-malicious-v2
Research lifecycle: Current

Article reporting history

These dates are report publication dates, not provider sightings or proof of malicious activity.

General CTI·Oct 22, 2026

SafePay Warning: Prove Your Backups Can Survive an Administrator Compromise

Cyber Security Blog·Aug 12, 2026

Gunra Ransomware Shows Why VPN Compromise Is an Incident, Not a Patch Ticket

Related indicators

Observables that appear alongside this one in the same reporting. Co-occurrence can suggest shared infrastructure, but it does not establish common ownership, campaign identity, or actor attribution.

07353237350c35d6dc2c8f143b649cd07c71f62b103[.]125[.]234[.]14104[.]26[.]2[.]223123[.]184[.]143[.]105123[.]244[.]187[.]144123[.]246[.]37[.]108140[.]82[.]114[.]4167[.]235[.]225[.]149173[.]194[.]194[.]94182[.]204[.]16[.]112182[.]204[.]21[.]240182[.]204[.]39[.]118185[.]199[.]108[.]133211[.]21[.]210[.]18123[.]239[.]119[.]223[.]239[.]119[.]323[.]239[.]119[.]423[.]239[.]119[.]523[.]239[.]119[.]62dc70a12d158d437e45a55b1d52f3d61c6082a1e1667573302ba3b62813e2751327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df6791737[.]10[.]71[.]1885[.]255[.]11[.]13467[.]43[.]53[.]106c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a70[.]36[.]99[.]8277[.]37[.]49[.]40834efe9b392c6c000877ea5613a079445affc16fe8af5997d68c55cafc95e5d186[.]54[.]28[.]21688[.]119[.]167[.]23991[.]201[.]66[.]14691f8fc7a3290611e28a35a403fd815554d9d856006cc2ee91ccdb64057ae53b0921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eaea0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526a82e496b7b5279cb6b93393ec167dd3f50aff1557366784b25f9e51cb23689d9b498a2683640c983bb069fa2ea9e67cef4a3797dbbdd3620a67aedec4b9a68b2c9cc880b6631215e129816aea19902a6f4bc6f41bbfed53e3bb1f306f4da97d995cf4ae5b73ad081contact@cisa[.]dhs[.]govCVE-2020-3259

Browse all indicators →IOC Archive →Machine-readable feeds →Extract IOCs from text →

stopransomware[.]gov

The House-Of-L Brief.