Skip to content
Bulwark Black Bulwark Black LLC
Latest
Aeternum Shows Why Blockchain-Based C2 Is a Practical Defense ProblemDeadLock Ransomware Shows Why Recovery Infrastructure Is Part of the Attack SurfaceUNC6671 Shows Why Helpdesk Vishing Is a Cloud Data-Theft ProblemVeloCloud Orchestrator RCE Shows Why SD-WAN Controllers Need Incident ResponseMSI Router Command-Injection Cluster Shows Why Edge Devices Need Exposure ControlJuly CVE Data Shows Why Patch Priority Needs Threat ContextExfilSquad Shows Why CRM and Portal Data Need Extortion-Ready ControlsBdThemes Compromise Shows Why WordPress Plugin Risk Extends Beyond Code UpdatesCloudflare workerd Bugs Show Why Agent Sandboxes Need Real Defense-in-DepthLangflow RCE Shows Why AI Workflow Tools Need Cloud-Grade IsolationBINDCLOAK Shows Why C2 Detection Needs Message-Level VisibilityPasskey Attacks Show Why Passwordless Still Needs Endpoint DefenseDPRK npm Compromises Show Why Dependency Trust Is Now Identity RiskN-able N-central Exploitation Shows Why MSP Tools Are Control-Plane Risk

Indicator of Compromise

tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io

Domain Seen in 2 reports Watch this →

A domain observed in malicious infrastructure. Block or monitor it in DNS and web proxies. Shown defanged for safe viewing; use Copy live value for the functional form.

Included in the Domains feed (live, machine-readable).

Seen in these reports

Iranian Cyber Threat Intelligence · Mar 24, 2026

CanisterWorm Wiper Weaponizes Trivy Supply Chain to Target Iran
Threat Intelligence · Mar 24, 2026

TeamPCP Deploys CanisterWorm Wiper to Target Iranian Systems

Related indicators

Indicators that appear alongside this one in the same reporting, often shared infrastructure or the same campaign.

0880819ef821cff918960a39c1c1aada55a5593c61c608ea9215da858a86e3490891663bc55073747be0eb864fbec3727840945d0d49ceb356f7d4735c63bd0d5c7e67665ec7f80c18f01febc4c3cd70ce6b94b70e69ab866fc033f519851bef764b57ff95b35e66589f31949eeb229d1d74e4cf63b7cf083cf92bf5923cf037f7011c6b2297a1b967ecc05ba2285eb6af56ab4da554ecae22e864e71155122e2834eb0c10d0e7e0b8f65aa3252554b0e1130467f4301ba65c55a9c373508e35276ca9680f6df9016db12f7c48571e5c4639451d2a51c5c5bb1fd1f0e134c9754f1702cfa359c3dd2b1dac84ff12ba56158b3a97e2941a587cb20da92e7964d59cd24d1fd2aa4d6a5f93b7f09ea969473201ddddd69a1419c6f1511a14c5945ba3217126384add36b52014a0f99c0ab3a3d58bd47e53d00f38623bf26706d51c45647909dcfb669825442804386c0f18ac3d7f2ed33e2d884761119f4024ff8a3c615ac0f29e743eda8863377f9776619fd2db763d1b5be1589a83fc98b82781c263708b2eb3b47b3dffed04dc90cf1c548f40577d642c52241ec76c405e91f329294fb696f55793203abf1f6aba9b404209dcadeaea6a7df69262fef1beeda940881d4d45[.]148[.]10[.]2124bdcc5d9ef3ddb42ccc9126e6c07faa3df2807e3506d7ff06abc509692c600b5b69b4dc6ceaa4b15555e7ad4c895c558c7214496df1cd56d1390c51661fbe20b7589e6b61eedcd5fe1e958e1a95fbd136328a34b26a63423b555a61f89a6a0525a534e9c88584c815d937910f1ddd53866c90331c8b991e7895d37796ac712b5895dda3b6d8d730153d6151e03549f276faca0275ed9c7b26ec7aaf336b7d2593d980908be9bc4fed6d407c66fc874a1f9d65052d4c67a314da1dae914f1daff7550f14b64c1c724035a075b36e71423719a1f30794b6d99daefd5e27ecb33e12691c4026739bf987a4b6f31edb8db48cc22a1d41e298b38c4a6417e7b955a5ece1e1b085c12dac7ac10e0eb1f5b0d4d7f6f0ce52a59bdfc5757c3982aac2353b58f4c73820428afeb64484d311211658383ce7f79d31a0a822dd269ec10459572dfaaefe163dae693c344249a0161953f0d5cdd110bd2a0848d665ed24dc1a41f6b4b7c7ffac7693d6b37be
Browse all indicators → Machine-readable feeds → Extract IOCs from text →

Newsletter

The House-Of-L Brief.

Two short reads a day on markets, cyber threats, AI, and geopolitics. A "why it matters" line on every story.

Double opt-in. One-click unsubscribe on every issue. We never share your address.