Indicator of Compromise
www[.]cyfirma[.]com
A domain observed in malicious infrastructure. Block or monitor it in DNS and web proxies. Shown defanged for safe viewing; use Copy live value for the functional form.
Included in the Domains feed (live, machine-readable).
Related indicators
Indicators that appear alongside this one in the same reporting, often shared infrastructure or the same campaign.
103[.]125[.]234[.]14123[.]184[.]143[.]105123[.]244[.]187[.]144123[.]246[.]37[.]108182[.]204[.]16[.]112182[.]204[.]21[.]240182[.]204[.]39[.]118211[.]21[.]210[.]18123[.]239[.]119[.]223[.]239[.]119[.]323[.]239[.]119[.]423[.]239[.]119[.]523[.]239[.]119[.]62690f7c685784fff006fe451fa3b154c2dc70a12d158d437e45a55b1d52f3d61c6082a1e1667573302ba3b62813e27515a1b440861ef652cc207158e7e129f0b3a22ed5ef5d2ea5968e1d9eff33017bc67[.]43[.]53[.]1070[.]36[.]99[.]8281c66c043982cfee9e60ae94203f4336da0b50c0834efe9b392c6c000877ea5613a079445affc16fe8af5997d68c55cafc95e5d186[.]54[.]28[.]21691[.]201[.]66[.]14691f8fc7a3290611e28a35a403fd815554d9d856006cc2ee91ccdb64057ae53b0a82e496b7b5279cb6b93393ec167dd3f50aff1557366784b25f9e51cb23689d9contact@cisa[.]dhs[.]gov CVE-2024-55591 CVE-2025-24472Datapub[.]newshxxps://intel[.]breakglass[.]tech/post/gunra-ransomware-s-linux-variant-has-a-fatal-flaw-time-seeded-rand-makes-encrypted-files-recoverable-without-payinghxxps://socprime[.]com/active-threats/solyximmortal-python-malware-analysis/hxxps://www[.]cloudsek[.]com/blog/inside-gunra-raas-from-affiliate-recruitment-on-the-dark-web-to-full-technical-dissection-of-their-lockerhxxps://www[.]cyfirma[.]com/research/gunra-ransomware-a-brief-analysis/hxxps://www[.]cyfirma[.]com/research/solyximmortal-python-malware-analysis/intel[.]breakglass[.]techsocprime[.]comStopRansomware[.]govwww[.]cloudsek[.]com