import "hash"

rule bulwark_https_bulwarkblack_com_goserpent_data_collection_espionage_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/goserpent-data-collection-espionage-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-20T15:06:06Z"
        tlp = "TLP:CLEAR"
        indicator_count = "24"
    strings:
        $s0 = "www.spacex.com" ascii wide nocase  // Domains
        $s1 = "101.36.104.87" ascii wide nocase  // IPv4
        $s2 = "103.138.13.30" ascii wide nocase  // IPv4
        $s3 = "144.48.6.46" ascii wide nocase  // IPv4
        $s4 = "152.32.160.239" ascii wide nocase  // IPv4
        $s5 = "152.32.222.113" ascii wide nocase  // IPv4
        $s6 = "43.106.30.226" ascii wide nocase  // IPv4
        $s7 = "47.80.22.58" ascii wide nocase  // IPv4
        $s8 = "8.220.193.189" ascii wide nocase  // IPv4
        $s9 = "8.220.194.108" ascii wide nocase  // IPv4
        $s10 = "8.220.209.155" ascii wide nocase  // IPv4
        $s11 = "8.220.214.132" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "19f8befcb035f52bf70094e6b4f5779a" or
        hash.md5(0, filesize) == "31323334353637383930616263646566" or
        hash.md5(0, filesize) == "64e9d1950e42bc98486dfd9919463d1c" or
        hash.md5(0, filesize) == "7f223ee0716ce2ad56f55d3744419449" or
        hash.md5(0, filesize) == "846ef7c1c7323849b2a778c5e4cda162" or
        hash.md5(0, filesize) == "93a1569d5d5ab2c4761fedf84f83709e" or
        hash.md5(0, filesize) == "cb6c4c70a3b171fa3404b8e1a3382116" or
        hash.md5(0, filesize) == "cbbb6d483737ea3566726e51752dff40" or
        hash.md5(0, filesize) == "d08a059e8b815e3b891505bc8777fc28" or
        hash.md5(0, filesize) == "d6e86bf8a90e9b632add5fa495f97fbc" or
        hash.md5(0, filesize) == "dc506ff7bb72735444fb3703a6bee6d8" or
        hash.md5(0, filesize) == "ebffd5a76aaa690bcdb922f82e0bacc5"
}