{
  "metadata": {
    "generator": "Bulwark Black IOC Extractor",
    "source": "https://bulwarkblack.com/sonicwall-sma-inc-ransomware-exploit-chain-defense/",
    "fang": "live",
    "exported_at": "2026-08-01T20:03:51Z",
    "total": 45,
    "categories": 9
  },
  "iocs": {
    "IPv4": [
      "108.205.8.173",
      "147.45.51.19",
      "149.0.0.1",
      "150.241.210.53",
      "173.239.211.0",
      "193.37.32.179",
      "193.37.32.214",
      "202.8.105.201",
      "216.73.163.151",
      "216.73.163.158",
      "217.77.15.99",
      "42.200.172.14",
      "45.131.194.0",
      "45.146.54.0",
      "63.135.161.0",
      "81.19.140.217",
      "89.117.20.1"
    ],
    "CIDR": [
      "173.239.211.0/24",
      "45.131.194.0/24",
      "45.146.54.0/24",
      "63.135.161.0/24"
    ],
    "Domains": [
      "icann.org",
      "whois.ordertld.com",
      "www.ordertld.com"
    ],
    "URLs": [
      "HELPRANS.COM",
      "helprans.com",
      "http://www.ordertld.com",
      "https://icann.org/epp#clientTransferProhibited"
    ],
    "Email Addresses": [
      "abuse@ordertld.com",
      "contact@resecurity.com",
      "info@helprans.com"
    ],
    "md5": [
      "54d21399b8b52b48a0fef68450593e45",
      "5cb00bbfe818ee3e85fb99ab1db1af7c",
      "5f3a55201c511c9ff9be4c16c41028a2",
      "b6df166291f80ee89032d769c99714f3"
    ],
    "sha1": [
      "04d4a9fbb32e967200eb98be014ca914a03bfa6b",
      "5e5b716f2385c818ec61198be1a2a07a4560eac5",
      "b4ee1f50fbb49f0ff5fde3d026343bc23ee08d51",
      "c2b0ae0a1f42a139abe4dd612676066ec1426394"
    ],
    "sha256": [
      "1e1e68bbb899450a57274a8b12082ed4e2040a2aae77014f20431689d2b4edee",
      "81a9af3846bad3a1107164ff7cf0a08e020b31a3b32fd17866e17d4c1565f7f2",
      "8c470301dcb7278f73e622f1950073567b34011c64b60cdfbb0f89803923a5a3",
      "ea9154e374e4f77bc2cf54282e23543573980342a85bc888cb23f20b8bbba081"
    ],
    "CVEs": [
      "CVE-2026-15409",
      "CVE-2026-15410"
    ]
  }
}