[ { "value": "103.102.31.18", "type": "ipv4", "first_seen": "2026-09-05", "last_seen": "2026-09-22", "status": "active", "confidence": "corroborated", "n_sources": 2, "stories": [ "trois-cve-sur-mikrotik-routeros-des-quipements-massivement-d-plo", "cisa-kev-update-five-actively-exploited-artifactory-screenconnec" ], "sources": [ "https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/", "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/" ], "reason": "Attacker IP exploiting MikroTik RouterOS login argument injection" }, { "value": "5.180.41.35", "type": "ipv4", "first_seen": "2026-06-17", "last_seen": "2026-07-25", "status": "expired", "confidence": "corroborated", "n_sources": 2, "stories": [ "clop-created-custom-web-shell-for-windchill-data-theft-attacks", "clop-group-claims-massive-data-heist-from-shell-philips-ge-via-p" ], "sources": [ "https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.html", "https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability" ], "reason": "Clop C2 IP in PTC Windchill webshell attacks" }, { "value": "82.192.72.4", "type": "ipv4", "first_seen": "2026-09-05", "last_seen": "2026-09-22", "status": "active", "confidence": "corroborated", "n_sources": 2, "stories": [ "trois-cve-sur-mikrotik-routeros-des-quipements-massivement-d-plo", "cisa-kev-update-five-actively-exploited-artifactory-screenconnec" ], "sources": [ "https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/", "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/" ], "reason": "Attacker IP exploiting MikroTik RouterOS login argument injection" }, { "value": "103.236.84.103", "type": "ipv4", "first_seen": "2026-09-18", "last_seen": "2026-09-18", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "new-beacon-found-at-103-212-186-85-on-port-8888-please-check-it" ], "sources": [ "https://www.beaconbeagle.com/beacons/103.236.84.103/x86", "https://www.beaconbeagle.com/beacons/103.236.84.103/x64" ], "reason": "C2 beacon IP detected in network telemetry" }, { "value": "104.207.144.154", "type": "ipv4", "first_seen": "2026-05-30", "last_seen": "2026-05-30", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "pan-os-cve-2026-0257-cisa-kev-globalprotect-authentication-bypas" ], "sources": [ "https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257" ], "reason": "Attacker IP in PAN-OS exploitation wave (Vultr hosting, GP-CLIENT)" }, { "value": "111.228.49.20", "type": "ipv4", "first_seen": "2026-09-12", "last_seen": "2026-09-12", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "new-beacon-found-at-103-212-186-85-on-port-8888-please-check-it" ], "sources": [ "https://www.beaconbeagle.com/beacons/111.228.49.20/x86", "https://www.beaconbeagle.com/beacons/111.228.49.20/x64" ], "reason": "Detected C2 beacon IP on port 8888 (BeaconBeagle report)" }, { "value": "118.69.65.60", "type": "ipv4", "first_seen": "2024-02-19", "last_seen": "2024-02-19", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "cisa-adds-connectwise-screenconnect-cve-2024-1708-to-known-explo" ], "sources": [ "https://connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8" ], "reason": "Attack IP in ScreenConnect auth-bypass exploitation (CVE-2024-1709)" }, { "value": "120.53.19.157", "type": "ipv4", "first_seen": "2026-09-15", "last_seen": "2026-09-15", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "new-beacon-found-at-103-212-186-85-on-port-8888-please-check-it" ], "sources": [ "https://www.beaconbeagle.com/beacons/120.53.19.157/x86", "https://www.beaconbeagle.com/beacons/120.53.19.157/x64" ], "reason": "C2 beacon IP on port 8888 (BeaconBeagle report, x64 Cobalt Strike-style beacon)" }, { "value": "135.136.63.63", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570" }, { "value": "138.2.102.66", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "pakistani-ip-chains-cve-2017-9841-and-cve-2021-41773-in-active-e" ], "sources": [ "https://cyberveille.ch/map/" ], "reason": "Pakistani attacker IP chaining CVE-2017-9841 and CVE-2021-41773 in active exploitation" }, { "value": "138.226.246.94", "type": "ipv4", "first_seen": "2026-06-22", "last_seen": "2026-06-22", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "klue-oauth-breach-9-cybersecurity-firms-disclose-impact-icarus-s" ], "sources": [ "https://www.securityweek.com/more-cybersecurity-firms-disclose-impact-from-klue-hack/" ], "reason": "Known attacker IP in Klue OAuth breach (Icarus extortion group)" }, { "value": "139.28.49.138", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570" }, { "value": "144.208.127.155", "type": "ipv4", "first_seen": "2026-06-09", "last_seen": "2026-06-09", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "cisa-orders-feds-to-patch-check-point-vpn-zero-day-by-june-11-qi" ], "sources": [ "https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-check-point-flaw-exploited-by-ransomware-gangs/" ], "reason": "Attacker IP in Check Point VPN zero-day exploitation campaign" }, { "value": "146.19.216.119", "type": "ipv4", "first_seen": "2026-05-30", "last_seen": "2026-05-30", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "pan-os-cve-2026-0257-cisa-kev-globalprotect-authentication-bypas" ], "sources": [ "https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257" ], "reason": "Attacker IP in PAN-OS exploitation wave (Dromatics Systems)" }, { "value": "146.70.139.154", "type": "ipv4", "first_seen": "2026-06-30", "last_seen": "2026-06-30", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "cisa-urges-immediate-patching-of-exploited-progress-loadmaster-v" ], "sources": [ "https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037" ], "reason": "Exploit IP for Progress LoadMaster CVE-2026-8037" }, { "value": "146.70.169.246", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570" }, { "value": "146.70.41.178", "type": "ipv4", "first_seen": "2026-08-30", "last_seen": "2026-08-30", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "reverse-engineering-the-auto-color-linux-backdoor" ], "sources": [ "https://malware.news/t/reverse-engineering-the-auto-color-linux-backdoor/125196#post_1" ], "reason": "C2 IP of Auto-Color Linux backdoor beaconing on port 443" }, { "value": "152.53.173.29", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "Gsocket C2 IP in TargetZimbra ransomware campaign" }, { "value": "152.53.173.30", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "Gsocket C2 IP in TargetZimbra ransomware campaign" }, { "value": "155.133.5.14", "type": "ipv4", "first_seen": "2024-02-19", "last_seen": "2024-02-19", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "cisa-adds-connectwise-screenconnect-cve-2024-1708-to-known-explo" ], "sources": [ "https://connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8" ], "reason": "Attack IP in ScreenConnect auth-bypass exploitation (CVE-2024-1709)" }, { "value": "155.133.5.15", "type": "ipv4", "first_seen": "2024-02-19", "last_seen": "2024-02-19", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "cisa-adds-connectwise-screenconnect-cve-2024-1708-to-known-explo" ], "sources": [ "https://connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8" ], "reason": "Attack IP in ScreenConnect auth-bypass exploitation (CVE-2024-1709)" }, { "value": "158.220.87.79", "type": "ipv4", "first_seen": "2026-08-12", "last_seen": "2026-08-12", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "stealthy-city-forum-attacks-target-salesforce-and-servicenow-wit" ], "sources": [ "https://www.bleepingcomputer.com/news/security/city-forum-data-theft-attacks-target-salesforce-servicenow-portals/" ], "reason": "Attacker IP (Contabo VPS) behind City-Forum data-theft campaign targeting Salesforce/ServiceNow portals" }, { "value": "160.119.76.250", "type": "ipv4", "first_seen": "2026-04-13", "last_seen": "2026-04-13", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "inj3ctor3-s-freepbx-jomangy-campaign-six-layer-self-healing-pers" ], "sources": [ "https://isc.sans.edu/forums/diary/Scans+for+EncystPHP+Webshell/32892/" ], "reason": "Probe IP in FreePBX Jomangy webshell campaign" }, { "value": "160.191.242.92", "type": "ipv4", "first_seen": "2026-09-09", "last_seen": "2026-09-09", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "iot-malware-uses-public-linux-exploits-to-gain-root-and-turn-dev" ], "sources": [ "https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits" ], "reason": "Vietnam IP brute-forcing honeypot and delivering KATARU IoT malware" }, { "value": "160.250.132.238", "type": "ipv4", "first_seen": "2026-09-14", "last_seen": "2026-09-14", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "pakistani-ip-chains-cve-2017-9841-and-cve-2021-41773-in-active-e" ], "sources": [ "https://cyberveille.ch/map/" ], "reason": "Attacker IP chaining CVE-2017-9844 path traversal in Singapore-linked campaign" }, { "value": "162.120.71.224", "type": "ipv4", "first_seen": "2024-08-22", "last_seen": "2024-08-22", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "this-sonicwall-bug-is-2-years-old-akira-ransomware-is-still-expl" ], "sources": [ "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015" ], "reason": "SonicWall exploit IP in Akira ransomware intrusions" }, { "value": "162.219.30.165", "type": "ipv4", "first_seen": "2026-09-25", "last_seen": "2026-09-25", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "shinyhunters-claim-fbi-staff-psychiatric-and-medical-records-sto" ], "sources": [ "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft" ], "reason": "C2 IP (TCP 3333/3334) of SIDEEYE backdoor in PeopleSoft exploitation wave" }, { "value": "162.33.177.101", "type": "ipv4", "first_seen": "2026-06-09", "last_seen": "2026-06-09", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "cisa-orders-feds-to-patch-check-point-vpn-zero-day-by-june-11-qi" ], "sources": [ "https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-check-point-flaw-exploited-by-ransomware-gangs/" ], "reason": "Attacker IP in Check Point VPN zero-day exploitation campaign" }, { "value": "162.35.122.126", "type": "ipv4", "first_seen": "2026-09-12", "last_seen": "2026-09-12", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "new-beacon-found-at-103-212-186-85-on-port-8888-please-check-it" ], "sources": [ "https://www.beaconbeagle.com/beacons/162.35.122.126/x86", "https://www.beaconbeagle.com/beacons/162.35.122.126/x64" ], "reason": "Detected C2 beacon IP on port 8888 (BeaconBeagle report)" }, { "value": "162.55.0.0", "type": "ipv4", "first_seen": "2026-09-01", "last_seen": "2026-09-01", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "bgp-hijack-diverts-softaculous-traffic-to-deliver-malicious-virt" ], "sources": [ "https://cyberpress.org/bgp-hijack-diverts-softaculous-traffic/" ], "reason": "IP range used in BGP hijack diverting Softaculous traffic to deliver malicious Virtualizor update" }, { "value": "162.55.80.0", "type": "ipv4", "first_seen": "2026-09-01", "last_seen": "2026-09-01", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "bgp-hijack-diverts-softaculous-traffic-to-deliver-malicious-virt" ], "sources": [ "https://cyberpress.org/bgp-hijack-diverts-softaculous-traffic/", "https://gbhackers.com/bgp-hijacking-attack-delivers-malicious-virtualizor-updates/" ], "reason": "IP range used in BGP hijack diverting Softaculous traffic to deliver malicious Virtualizor update" }, { "value": "165.154.68.30", "type": "ipv4", "first_seen": "2026-09-12", "last_seen": "2026-09-12", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "new-beacon-found-at-103-212-186-85-on-port-8888-please-check-it" ], "sources": [ "https://www.beaconbeagle.com/beacons/165.154.68.30/x86", "https://www.beaconbeagle.com/beacons/165.154.68.30/x64" ], "reason": "Detected C2 beacon IP on port 8888 (BeaconBeagle report)" }, { "value": "165.99.207.153", "type": "ipv4", "first_seen": "2026-09-15", "last_seen": "2026-09-15", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "pakistani-ip-chains-cve-2017-9841-and-cve-2021-41773-in-active-e" ], "sources": [ "https://cyberveille.ch/map/" ], "reason": "Pakistani attacker IP chaining CVE-2017-9841 and CVE-2021-41773 in active exploitation" }, { "value": "166.88.134.62", "type": "ipv4", "first_seen": "2026-08-02", "last_seen": "2026-08-02", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "dprk-linked-hackers-add-hashhiding-to-blockchain-c2-network-for" ], "sources": [ "https://opensourcemalware.com/blog/nullreceiver-dprk-c2-technique" ], "reason": "C2 endpoint in DPRK XCTDH HashHiding blockchain C2 network" }, { "value": "172.86.116.8", "type": "ipv4", "first_seen": "2024-08-22", "last_seen": "2024-08-22", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "this-sonicwall-bug-is-2-years-old-akira-ransomware-is-still-expl" ], "sources": [ "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015" ], "reason": "SonicWall exploit IP in Akira ransomware intrusions" }, { "value": "176.65.148.184", "type": "ipv4", "first_seen": "2026-09-01", "last_seen": "2026-09-02", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "sangoma-switchvox-rce-flaw-actively-exploited-in-wild-via-unauth" ], "sources": [ "https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/", "https://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/" ], "reason": "Attacker IP actively exploiting CVE-2026-9586 Sangoma Switchvox unauthenticated SQLi RCE" }, { "value": "176.65.149.52", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "Gsocket C2 IP in TargetZimbra ransomware campaign" }, { "value": "187.108.1.130", "type": "ipv4", "first_seen": "2026-01-28", "last_seen": "2026-01-28", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "inj3ctor3-s-freepbx-jomangy-campaign-six-layer-self-healing-pers" ], "sources": [ "https://www.fortinet.com/blog/threat-research/unveiling-the-weaponized-web-shell-encystphp" ], "reason": "Dropper infrastructure in FreePBX Jomangy campaign" }, { "value": "192.236.147.131", "type": "ipv4", "first_seen": "2026-06-06", "last_seen": "2026-06-06", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "unc3753-luna-moth-targets-us-law-firms-with-vishing-physical-off" ], "sources": [ "https://cyberpress.org/unc3753-targets-us-law-firms/" ], "reason": "C2 IP in UNC3753 Luna Moth vishing campaign" }, { "value": "192.236.147.138", "type": "ipv4", "first_seen": "2026-06-06", "last_seen": "2026-06-06", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "unc3753-luna-moth-targets-us-law-firms-with-vishing-physical-off" ], "sources": [ "https://cyberpress.org/unc3753-targets-us-law-firms/" ], "reason": "C2 IP in UNC3753 Luna Moth vishing campaign" }, { "value": "192.42.116.105", "type": "ipv4", "first_seen": "2026-06-30", "last_seen": "2026-06-30", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "cisa-urges-immediate-patching-of-exploited-progress-loadmaster-v" ], "sources": [ "https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037" ], "reason": "Exploit IP for Progress LoadMaster CVE-2026-8037" }, { "value": "192.42.116.58", "type": "ipv4", "first_seen": "2026-06-30", "last_seen": "2026-06-30", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "cisa-urges-immediate-patching-of-exploited-progress-loadmaster-v" ], "sources": [ "https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037" ], "reason": "Exploit IP for Progress LoadMaster CVE-2026-8037" }, { "value": "193.141.60.212", "type": "ipv4", "first_seen": "2026-06-06", "last_seen": "2026-06-06", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "unc3753-luna-moth-targets-us-law-firms-with-vishing-physical-off" ], "sources": [ "https://cyberpress.org/unc3753-targets-us-law-firms/" ], "reason": "C2 IP in UNC3753 Luna Moth vishing campaign" }, { "value": "193.24.211.91", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570" }, { "value": "193.32.126.168", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570" }, { "value": "194.213.18.137", "type": "ipv4", "first_seen": "2026-07-22", "last_seen": "2026-07-22", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "cve-2026-16232-check-point-smartconsole-zero-day-actively-exploi" ], "sources": [ "https://beazley.security/alerts-advisories/critical-check-point-security-management-vulnerabilities-under-active-exploitation-cve-2026-16232-cve-2026--62144-cve-2026-62145" ], "reason": "Observed attacker IP in Check Point SmartConsole zero-day" }, { "value": "194.233.84.90", "type": "ipv4", "first_seen": "2026-09-20", "last_seen": "2026-09-20", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "pakistani-ip-chains-cve-2017-9841-and-cve-2021-41773-in-active-e" ], "sources": [ "https://cyberveille.ch/map/" ], "reason": "Pakistani attacker IP chaining CVE-2017-9841 and CVE-2021-41773 in active exploitation campaign" }, { "value": "194.48.154.67", "type": "ipv4", "first_seen": "2024-08-22", "last_seen": "2024-08-22", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "this-sonicwall-bug-is-2-years-old-akira-ransomware-is-still-expl" ], "sources": [ "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015" ], "reason": "SonicWall exploit IP in Akira ransomware intrusions" }, { "value": "194.58.66.0", "type": "ipv4", "first_seen": "2026-05-13", "last_seen": "2026-05-13", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "gamaredon-uac-0010-sustains-12-wave-phishing-campaign-against-uk" ], "sources": [ "https://harfanglab.io/insidethelab/gamaredon-gammadrop-gammaload/" ], "reason": "Gamaredon phishing mail relay subnet (194.58.66.0/24), CVE-2025-8088" }, { "value": "206.72.242.124", "type": "ipv4", "first_seen": "2026-07-27", "last_seen": "2026-07-27", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "cisa-adds-two-exploited-vulnerabilities-to-kev-arista-velocloud" ], "sources": [ "https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144" ], "reason": "Attacking IP in VeloCloud KEV exploitation" }, { "value": "206.72.242.162", "type": "ipv4", "first_seen": "2026-07-27", "last_seen": "2026-07-27", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "cisa-adds-two-exploited-vulnerabilities-to-kev-arista-velocloud" ], "sources": [ "https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144" ], "reason": "Attacking IP in VeloCloud KEV exploitation" }, { "value": "208.115.232.194", "type": "ipv4", "first_seen": "2024-10-24", "last_seen": "2024-10-24", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "this-sonicwall-bug-is-2-years-old-akira-ransomware-is-still-expl" ], "sources": [ "https://arcticwolf.com/resources/blog/arctic-wolf-labs-observes-increased-fog-and-akira-ransomware-activity-linked-to-sonicwall-ssl-vpn" ], "reason": "Akira ransomware source IP" }, { "value": "209.182.225.136", "type": "ipv4", "first_seen": "2026-06-09", "last_seen": "2026-06-09", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "cisa-orders-feds-to-patch-check-point-vpn-zero-day-by-june-11-qi" ], "sources": [ "https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-check-point-flaw-exploited-by-ransomware-gangs/" ], "reason": "Attacker IP in Check Point VPN zero-day exploitation campaign" }, { "value": "212.132.98.170", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "Gsocket C2 IP in TargetZimbra ransomware campaign" }, { "value": "212.86.125.24", "type": "ipv4", "first_seen": "2026-06-22", "last_seen": "2026-06-22", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "klue-oauth-breach-9-cybersecurity-firms-disclose-impact-icarus-s" ], "sources": [ "https://www.securityweek.com/more-cybersecurity-firms-disclose-impact-from-klue-hack/" ], "reason": "Known attacker IP in Klue OAuth breach (Icarus extortion group)" }, { "value": "213.111.148.90", "type": "ipv4", "first_seen": "2026-06-22", "last_seen": "2026-06-22", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "klue-oauth-breach-9-cybersecurity-firms-disclose-impact-icarus-s" ], "sources": [ "https://www.securityweek.com/more-cybersecurity-firms-disclose-impact-from-klue-hack/" ], "reason": "Known attacker IP in Klue OAuth breach (Icarus extortion group)" }, { "value": "213.209.159.154", "type": "ipv4", "first_seen": "2026-09-12", "last_seen": "2026-09-12", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "pakistani-ip-chains-cve-2017-9841-and-cve-2021-41773-in-active-e" ], "sources": [ "https://cyberveille.ch/map/" ], "reason": "Attacker IP chaining CVE-2017-9841, CVE-2021-41773, CVE-2021-42013 (Path Traversal Tourist)" }, { "value": "216.146.25.208", "type": "ipv4", "first_seen": "2024-08-22", "last_seen": "2024-08-22", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "this-sonicwall-bug-is-2-years-old-akira-ransomware-is-still-expl" ], "sources": [ "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015" ], "reason": "SonicWall exploit IP in Akira ransomware intrusions" }, { "value": "216.152.148.54", "type": "ipv4", "first_seen": "2026-06-26", "last_seen": "2026-06-26", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "clop-group-claims-massive-data-heist-from-shell-philips-ge-via-p" ], "sources": [ "https://thehackernews.com/2026/06/cisa-adds-exploited-ptc-windchill-rce.html" ], "reason": "Clop attacker C2 IP in Windchill data theft" }, { "value": "217.154.53.116", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "Gsocket C2 IP in TargetZimbra ransomware campaign" }, { "value": "217.154.53.187", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "Gsocket C2 IP in TargetZimbra ransomware campaign" }, { "value": "23.225.52.67", "type": "ipv4", "first_seen": "2026-03-12", "last_seen": "2026-03-12", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "packagist-themes-exploit-iphone-visitors-to-steal-messages-passw" ], "sources": [ "https://socket.dev/blog/6-malicious-packagist-themes-ship-trojanized-jquery" ], "reason": "Ad-injection C2 in FUNNULL Packagist jQuery supply-chain attack" }, { "value": "23.234.64.0", "type": "ipv4", "first_seen": "2026-09-08", "last_seen": "2026-09-08", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "critical-n-able-n-central-flaw-enables-pre-auth-remote-code-exec" ], "sources": [ "https://www.securityweek.com/n-able-patches-critical-zero-day-in-n-central/" ], "reason": "Network range associated with N-able N-central pre-auth RCE exploitation" }, { "value": "31.177.110.136", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570" }, { "value": "34.153.223.102", "type": "ipv4", "first_seen": "2026-07-20", "last_seen": "2026-07-20", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "storm-3168-agentic-driven-cloud-attacks-using-compromised-servic" ], "sources": [ "https://www.sysdig.com/blog/jadepuffer-evolves-the-agentic-threat-actor-deploys-ransomware-built-to-destroy-ai-models" ], "reason": "C2 IP in Storm-3168 agentic cloud attacks" }, { "value": "37.32.73.156", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570" }, { "value": "38.54.107.167", "type": "ipv4", "first_seen": "2026-06-09", "last_seen": "2026-06-09", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "cisa-orders-feds-to-patch-check-point-vpn-zero-day-by-june-11-qi" ], "sources": [ "https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-check-point-flaw-exploited-by-ransomware-gangs/" ], "reason": "Attacker IP in Check Point VPN zero-day exploitation campaign" }, { "value": "38.54.88.201", "type": "ipv4", "first_seen": "2026-06-09", "last_seen": "2026-06-09", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "cisa-orders-feds-to-patch-check-point-vpn-zero-day-by-june-11-qi" ], "sources": [ "https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-check-point-flaw-exploited-by-ransomware-gangs/" ], "reason": "Attacker IP in Check Point VPN zero-day exploitation campaign" }, { "value": "38.60.157.139", "type": "ipv4", "first_seen": "2026-06-09", "last_seen": "2026-06-09", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "cisa-orders-feds-to-patch-check-point-vpn-zero-day-by-june-11-qi" ], "sources": [ "https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-check-point-flaw-exploited-by-ransomware-gangs/" ], "reason": "Attacker IP in Check Point VPN zero-day exploitation campaign" }, { "value": "38.60.157.212", "type": "ipv4", "first_seen": "2026-06-26", "last_seen": "2026-06-26", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "clop-group-claims-massive-data-heist-from-shell-philips-ge-via-p" ], "sources": [ "https://thehackernews.com/2026/06/cisa-adds-exploited-ptc-windchill-rce.html" ], "reason": "Clop attacker C2 IP in Windchill data theft" }, { "value": "38.76.183.197", "type": "ipv4", "first_seen": "2026-09-10", "last_seen": "2026-09-10", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "new-beacon-found-at-103-212-186-85-on-port-8888-please-check-it" ], "sources": [ "https://www.beaconbeagle.com/beacons/38.76.183.197/x64" ], "reason": "C2 beacon IP discovered alongside 103.212.186.85 on port 8888" }, { "value": "39.96.201.230", "type": "ipv4", "first_seen": "2026-09-13", "last_seen": "2026-09-13", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "new-beacon-found-at-103-212-186-85-on-port-8888-please-check-it" ], "sources": [ "https://www.beaconbeagle.com/beacons/39.96.201.230/x86", "https://www.beaconbeagle.com/beacons/39.96.201.230/x64" ], "reason": "Detected C2 beacon IP on port 8888 (BeaconBeagle report)" }, { "value": "45.131.66.106", "type": "ipv4", "first_seen": "2026-07-01", "last_seen": "2026-07-01", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "jadepuffer-agentic-ransomware-first-documented-ai-agent-driven-e" ], "sources": [ "https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion" ], "reason": "C2 IP in JadePuffer agentic ransomware attack" }, { "value": "45.140.205.28", "type": "ipv4", "first_seen": "2026-09-28", "last_seen": "2026-09-28", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware" ], "sources": [ "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat" ], "reason": "Attacker host IP in ChatGPT custom GPT ClickFix RAT campaign (Huntress IoC)" }, { "value": "45.149.172.51", "type": "ipv4", "first_seen": "2024-08-22", "last_seen": "2024-08-22", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "this-sonicwall-bug-is-2-years-old-akira-ransomware-is-still-expl" ], "sources": [ "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015" ], "reason": "SonicWall exploit IP in Akira ransomware intrusions" }, { "value": "45.234.176.202", "type": "ipv4", "first_seen": "2026-01-28", "last_seen": "2026-01-28", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "inj3ctor3-s-freepbx-jomangy-campaign-six-layer-self-healing-pers" ], "sources": [ "https://www.fortinet.com/blog/threat-research/unveiling-the-weaponized-web-shell-encystphp" ], "reason": "Dropper infrastructure in FreePBX Jomangy campaign" }, { "value": "45.55.158.47", "type": "ipv4", "first_seen": "2025-01-14", "last_seen": "2025-01-14", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "joint-us-south-korea-advisory-gunra-ransomware-exploits-fortinet" ], "sources": [ "https://www.fortiguard.com/psirt/FG-IR-24-535" ], "reason": "Attacker infrastructure in Gunra ransomware Fortinet advisory" }, { "value": "45.61.157.15", "type": "ipv4", "first_seen": "2024-08-22", "last_seen": "2024-08-22", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "this-sonicwall-bug-is-2-years-old-akira-ransomware-is-still-expl" ], "sources": [ "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015" ], "reason": "SonicWall exploit IP in Akira ransomware intrusions" }, { "value": "45.76.26.42", "type": "ipv4", "first_seen": "2026-06-09", "last_seen": "2026-06-09", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "cisa-orders-feds-to-patch-check-point-vpn-zero-day-by-june-11-qi" ], "sources": [ "https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-check-point-flaw-exploited-by-ransomware-gangs/" ], "reason": "Attacker IP in Check Point VPN zero-day exploitation campaign" }, { "value": "45.77.149.152", "type": "ipv4", "first_seen": "2026-06-09", "last_seen": "2026-06-09", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "cisa-orders-feds-to-patch-check-point-vpn-zero-day-by-june-11-qi" ], "sources": [ "https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-check-point-flaw-exploited-by-ransomware-gangs/" ], "reason": "Attacker IP in Check Point VPN zero-day exploitation campaign" }, { "value": "45.77.212.12", "type": "ipv4", "first_seen": "2023-06-15", "last_seen": "2023-06-15", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "vulnerability-attack-case-installation-of-a-web-shell-and-execut" ], "sources": [ "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a" ], "reason": "C2 IP in Telerik CVE-2019-18935 IIS web shell exploitation" }, { "value": "45.78.224.85", "type": "ipv4", "first_seen": "2026-10-01", "last_seen": "2026-10-01", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "pakistani-ip-chains-cve-2017-9841-and-cve-2021-41773-in-active-e" ], "sources": [ "https://cyberveille.ch/map/" ], "reason": "Scanner IP chaining CVE-2017-9841 (PHPUnit) and CVE-2021-41773 (Apache path traversal) in active exploitation" }, { "value": "45.90.4.121", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "Gsocket C2 IP in TargetZimbra ransomware campaign" }, { "value": "45.90.4.128", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "Gsocket C2 IP in TargetZimbra ransomware campaign" }, { "value": "45.95.147.178", "type": "ipv4", "first_seen": "2026-04-13", "last_seen": "2026-04-13", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "inj3ctor3-s-freepbx-jomangy-campaign-six-layer-self-healing-pers" ], "sources": [ "https://isc.sans.edu/forums/diary/Scans+for+EncystPHP+Webshell/32892/" ], "reason": "Attacker C2 IP in FreePBX post-exploitation script (cron persistence + payload delivery via base64/ROT13 obfuscated shell)" }, { "value": "47.105.36.109", "type": "ipv4", "first_seen": "2026-09-29", "last_seen": "2026-09-29", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "new-beacon-found-at-103-212-186-85-on-port-8888-please-check-it" ], "sources": [ "https://www.beaconbeagle.com/beacons/47.105.36.109/x86", "https://www.beaconbeagle.com/beacons/47.105.36.109/x64" ], "reason": "C2 beacon IP on 443 reported by BeaconBeagle" }, { "value": "47.121.130.18", "type": "ipv4", "first_seen": "2026-09-18", "last_seen": "2026-09-18", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "new-beacon-found-at-103-212-186-85-on-port-8888-please-check-it" ], "sources": [ "https://www.beaconbeagle.com/beacons/47.121.130.18/x64" ], "reason": "C2 beacon IP detected in network telemetry" }, { "value": "47.236.173.77", "type": "ipv4", "first_seen": "2026-09-11", "last_seen": "2026-09-11", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "pakistani-ip-chains-cve-2017-9841-and-cve-2021-41773-in-active-e" ], "sources": [ "https://cyberveille.ch/map/" ], "reason": "Attacker IP chaining CVE-2017-9844 path traversal in Singapore-linked campaign" }, { "value": "47.94.56.71", "type": "ipv4", "first_seen": "2026-09-08", "last_seen": "2026-09-08", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "new-beacon-found-at-103-212-186-85-on-port-8888-please-check-it" ], "sources": [ "https://www.beaconbeagle.com/beacons/47.94.56.71/x86", "https://www.beaconbeagle.com/beacons/47.94.56.71/x64" ], "reason": "C2 beacon IP discovered alongside 103.212.186.85 on port 8888" }, { "value": "49.0.202.115", "type": "ipv4", "first_seen": "2026-10-04", "last_seen": "2026-10-04", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "pakistani-ip-chains-cve-2017-9841-and-cve-2021-41773-in-active-e" ], "sources": [ "https://cyberveille.ch/map/" ], "reason": "Attacker scanner IP (CVE-2021-41773 path traversal attempts, AS136907)" }, { "value": "49.232.21.222", "type": "ipv4", "first_seen": "2026-09-29", "last_seen": "2026-09-29", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "new-beacon-found-at-103-212-186-85-on-port-8888-please-check-it" ], "sources": [ "https://www.beaconbeagle.com/beacons/49.232.21.222/x86", "https://www.beaconbeagle.com/beacons/49.232.21.222/x64" ], "reason": "C2 beacon IP on 8081 reported by BeaconBeagle" }, { "value": "51.91.190.241", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "Gsocket C2 IP in TargetZimbra ransomware campaign" }, { "value": "51.91.190.242", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "Gsocket C2 IP in TargetZimbra ransomware campaign" }, { "value": "64.20.53.230", "type": "ipv4", "first_seen": "2026-07-01", "last_seen": "2026-07-01", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "jadepuffer-agentic-ransomware-first-documented-ai-agent-driven-e" ], "sources": [ "https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion" ], "reason": "Staging server in JadePuffer agentic ransomware attack" }, { "value": "64.62.156.162", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570" }, { "value": "64.62.156.222", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570" }, { "value": "64.62.156.94", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570" }, { "value": "64.94.84.97", "type": "ipv4", "first_seen": "2026-06-06", "last_seen": "2026-06-06", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "unc3753-luna-moth-targets-us-law-firms-with-vishing-physical-off" ], "sources": [ "https://cyberpress.org/unc3753-targets-us-law-firms/" ], "reason": "C2 IP in UNC3753 Luna Moth vishing campaign" }, { "value": "65.109.70.162", "type": "ipv4", "first_seen": "2026-09-02", "last_seen": "2026-09-02", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "ransomware-hackers-built-their-own-c2-framework-to-steal-passwor" ], "sources": [ "https://cyberpress.org/ransomware-c2-disarms-defenses/" ], "reason": "C2 infrastructure IP of custom TukTuk C2 framework used by The Gentlemen ransomware group" }, { "value": "66.42.99.200", "type": "ipv4", "first_seen": "2026-06-09", "last_seen": "2026-06-09", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "cisa-orders-feds-to-patch-check-point-vpn-zero-day-by-june-11-qi" ], "sources": [ "https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-check-point-flaw-exploited-by-ransomware-gangs/" ], "reason": "Attacker IP in Check Point VPN zero-day exploitation campaign" }, { "value": "77.247.126.158", "type": "ipv4", "first_seen": "2024-10-24", "last_seen": "2024-10-24", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "this-sonicwall-bug-is-2-years-old-akira-ransomware-is-still-expl" ], "sources": [ "https://arcticwolf.com/resources/blog/arctic-wolf-labs-observes-increased-fog-and-akira-ransomware-activity-linked-to-sonicwall-ssl-vpn" ], "reason": "Akira ransomware source IP" }, { "value": "79.141.160.78", "type": "ipv4", "first_seen": "2026-07-22", "last_seen": "2026-07-22", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "clop-created-custom-web-shell-for-windchill-data-theft-attacks" ], "sources": [ "https://ransom-isac.org/blog/clop-windchill-flexplm-exploitation/" ], "reason": "Observed C2 IP in Clop PTC compromise" }, { "value": "8.19.75.217", "type": "ipv4", "first_seen": "2026-07-27", "last_seen": "2026-07-27", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "cisa-adds-two-exploited-vulnerabilities-to-kev-arista-velocloud" ], "sources": [ "https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144" ], "reason": "Attacking IP in VeloCloud KEV exploitation" }, { "value": "85.11.187.8", "type": "ipv4", "first_seen": "2026-06-20", "last_seen": "2026-06-20", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "alert-fortibleed-remains-active-campaign-can-lock-out-users-or-l" ], "sources": [ "https://unit42.paloaltonetworks.com/large-scale-credential-attacks/" ], "reason": "Malicious infrastructure IP linked to FortiBleed credential-harvesting campaign" }, { "value": "85.175.101.203", "type": "ipv4", "first_seen": "2026-09-15", "last_seen": "2026-10-03", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "new-beacon-found-at-103-212-186-85-on-port-8888-please-check-it" ], "sources": [ "https://www.beaconbeagle.com/beacons/85.175.101.203/x86", "https://www.beaconbeagle.com/beacons/85.175.101.203/x64" ], "reason": "C2 beacon IP on port 8888 (BeaconBeagle report)" }, { "value": "88.119.175.104", "type": "ipv4", "first_seen": "2024-08-22", "last_seen": "2024-08-22", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "this-sonicwall-bug-is-2-years-old-akira-ransomware-is-still-expl" ], "sources": [ "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015" ], "reason": "SonicWall exploit IP in Akira ransomware intrusions" }, { "value": "88.214.21.183", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570" }, { "value": "89.116.171.182", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570" }, { "value": "89.117.94.35", "type": "ipv4", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570" }, { "value": "89.126.211.166", "type": "ipv4", "first_seen": "2026-10-03", "last_seen": "2026-10-03", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "pakistani-ip-chains-cve-2017-9841-and-cve-2021-41773-in-active-e" ], "sources": [ "https://cyberveille.ch/map/" ], "reason": "Scanner IP chaining CVE-2017-9841 and CVE-2021-41773" }, { "value": "9.20.4.14", "type": "ipv4", "first_seen": "2026-09-09", "last_seen": "2026-09-09", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "active-exploitation-of-cisco-secure-firewall-management-center-v" ], "sources": [ "https://malware.news/t/cisco-security-advisory-av26-197-update-3/125481#post_1" ], "reason": "Attacker IP in Cisco FMC exploitation campaign (CVE-2026-20079 / CVE-2026-20316)" }, { "value": "91.92.242.30", "type": "ipv4", "first_seen": "2026-08-20", "last_seen": "2026-08-20", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "openclaw-novastealer-attacks-target-60-crypto-wallets-ssh-keys-a" ], "sources": [ "https://cyberpress.org/novastealer-targets-crypto-wallets/" ], "reason": "NovaStealer payload download IP in ClawHavoc/OpenClaw supply-chain campaign" }, { "value": "92.63.180.133", "type": "ipv4", "first_seen": "2026-09-14", "last_seen": "2026-09-14", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "3bb-breach-meshcentral-used-as-a-backdoor-in-the-provider-s-netw" ], "sources": [ "https://hunt.io/blog/thai-broadband-fortigate-sslvpn-meshcentral-intrusion" ], "reason": "Attacker open directory serving MeshCentral backdoor in 3BB breach" }, { "value": "94.154.32.160", "type": "ipv4", "first_seen": "2026-06-22", "last_seen": "2026-06-22", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "klue-oauth-breach-9-cybersecurity-firms-disclose-impact-icarus-s" ], "sources": [ "https://www.securityweek.com/more-cybersecurity-firms-disclose-impact-from-klue-hack/" ], "reason": "Known attacker IP in Klue OAuth breach (Icarus extortion group)" }, { "value": "96.62.224.81", "type": "ipv4", "first_seen": "2026-09-28", "last_seen": "2026-09-28", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware" ], "sources": [ "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat" ], "reason": "Decimal-IP stager host in ChatGPT custom GPT ClickFix RAT campaign" }, { "value": "cybersecurefox.com", "type": "domain", "first_seen": "2026-09-09", "last_seen": "2026-10-13", "status": "active", "confidence": "corroborated", "n_sources": 36, "stories": [ "citrix-netscaler-unpatched-rce-zero-days", "cve-2026-56164-sharepoint-privilege-escalation-exploited", "proofpoint-identified-bluemoon-an-exploit-kit-chaining-two-chrom", "cve-2026-105192-unpatched-critical-rce-in-lmcache-cvss-9-8", "apple-patches-coregraphics-out-of-bounds-write-cve-2026-86950", "atlassian-bamboo-cve-2026-21589-critical-path-traversal-cvss-9-3", "cisa-adds-exploited-wso2-adobe-commerce-sharepoint-and-routeros", "cisa-alerts-of-active-exploitation-of-three-linux-kernel-flaws-h", "google-fixes-actively-exploited-android-zero-day-on-pixel-device", "wordpress-7-1-2-patches-a-critical-wordpress-rce-vulnerability-c", "1-basic-information-original-title-cloud-takeover-mass-scanning", "12-year-old-postgresql-flaw-lets-backup-accounts-execute-code-an", "3bb-breach-meshcentral-used-as-a-backdoor-in-the-provider-s-netw", "a-newly-kev-listed-cisco-ise-bug-lets-an-unauthenticated-attacke", "an-exploited-velocloud-vulnerability-with-a-10-0-cvss-score-hits", "an-issabel-pbx-vulnerability-exploited-in-active-attacks-allows", "chrome-153-google-fixes-230-vulnerabilities-including-5-critical", "cisco-patches-critical-zero-day-in-secure-email-gateway-cve-2026", "critical-n-able-n-central-flaw-enables-pre-auth-remote-code-exec", "critical-orkes-conductor-vulnerability-exploited-in-attacks", "cve-2026-12780-aomei-backupper-driver-opens-the-way-to-uefi-atta", "cve-2026-6485-high-8-2-uefi-bios-embedded-shell-could-be-used-to", "cve-2026-84869-critical-9-9-a-condition-in-the-screenconnect-cli", "cve-2026-85889-critical-flaw-in-azure-ai-foundry-missing-authent", "fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day", "gitlab-s-critical-flaw-is-already-drawing-internet-wide-probes", "high-severity-vulnerabilities-patched-in-openssl-wolfssl", "marimo-rce-flaw-lets-hackers-steal-aws-credentials-and-pivot-to", "microsoft-july-2026-patch-tuesday-record-622-cves-two-exploited", "microsoft-s-september-2026-patch-tuesday-fixes-two-zero-day-flaw", "oracle-peoplesoft-cve-2026-35273-cvss-9-8-mitigations-released-m", "red-heron-hackers-exploit-critical-gitea-rce-to-steal-source-cod", "researcher-nightmareeclipse-has-disclosed-bigdiskbuster-a-zero-d", "skullcandy-dime-3-bluetooth-flaw-lets-nearby-attackers-hijack-au", "ssrf-vulnerability-in-onlyoffice-plugin-for-owncloud-no-patch-av", "windows-afd-sys-zero-day-exploited-by-lazarus-hackers-to-gain-sy" ], "sources": [ "https://cybersecurefox.com/en/cisa-critical-vulnerabilities-citrix-netscaler-adc-gateway-cve-2026-88771", "https://cybersecurefox.com/en/zero-day-cve-2026-88779-in-citrix-netscaler-saml", "https://cybersecurefox.com/en/critical-vulnerabilities-in-citrix-netscaler-cve-2026-88771-88772", "https://cybersecurefox.com/en/cve-2026-56164-privilege-escalation-sharepoint", "https://cybersecurefox.com/en/shieldcrash-bypass-patch-cve-2026-69414-microsoft-defender", "https://cybersecurefox.com/en/cve-2026-85880-windows-alpc-heap-overflow-privilege-escalation", "https://cybersecurefox.com/en/critical-rce-in-lmcache-no-patch", "https://cybersecurefox.com/en/cve-2026-86950-apple-coregraphics-targeted-attacks-patch", "https://cybersecurefox.com/en/critical-atlassian-vulnerability-cve-2026-21589", "https://cybersecurefox.com/en/critical-vulnerability-atlassian-data-center-cve-2026-21589", "https://cybersecurefox.com/en/cisa-kev-wso2-cve-2026-5430-adobe-commerce-cve-2026-71362", "https://cybersecurefox.com/en/cisa-kev-sharepoint-mikrotik-routeros-september-2026", "https://cybersecurefox.com/en/cisa-three-linux-kernel-vulnerabilities-kev-ktls-ebtables-af-alg", "https://cybersecurefox.com/en/cve-2026-58704-pixel-modem-privilege-escalation-cisa-kev", "https://cybersecurefox.com/en/cve-2026-87902-critical-lfi-in-wordpress-core", "https://cybersecurefox.com/en/cve-2026-39364-mass-scanning-vite-servers-cloud-credentials-theft", "https://cybersecurefox.com/en/postgresql-cve-2026-6471-logical-decoding", "https://cybersecurefox.com/en/3bb-breach-meshcentral-backdoor-fortigate-cve-2024-21762", "https://cybersecurefox.com/en/cve-2026-76460-cisco-ise-authentication-bypass-cvss-10-0", "https://cybersecurefox.com/en/cve-2026-93952-arista-velocloud-orchestrator-cvss-10-active-exploitation", "https://cybersecurefox.com/en/cve-2026-89026-issabel-framework-jwt-rce", "https://cybersecurefox.com/en/chrome-153-230-vulnerabilities-5-critical-webgl-cast", "https://cybersecurefox.com/en/cve-2026-76461-cisco-secure-email-gateway-sql-injection", "https://cybersecurefox.com/en/n-able-n-central-critical-rce-cve-2026-86218", "https://cybersecurefox.com/en/cve-2026-58138-orkes-conductor-unauthenticated-rce", "https://cybersecurefox.com/en/cve-2026-12780-aomei-backupper-amwrtdrv-uefi-vulnerability", "https://cybersecurefox.com/en/vu-718077-uefi-shell-spi-flash-secure-boot-bypass", "https://cybersecurefox.com/en/screenconnect-cve-2026-84869-wormable-vbscript", "https://cybersecurefox.com/en/cve-2026-85889-azure-ai-foundry-cvss-10-privilege-escalation", "https://cybersecurefox.com/en/critical-fortimail-vulnerability-cve-2026-104286", "https://cybersecurefox.com/en/cve-2026-85706-gitlab-cvss-10-file-reading", "https://cybersecurefox.com/en/cve-2026-84782-openssl-dtls-heap-memory-leak", "https://cybersecurefox.com/en/cve-2026-39987-marimo-rce-ssh-bastion-8-seconds", "https://cybersecurefox.com/en/cve-2026-56155-ad-fs-privilege-escalation-exploited", "https://cybersecurefox.com/en/cve-2026-81963-windows-update-stack-privilege-escalation", "https://cybersecurefox.com/en/shinyhunters-claims-fbi-breach-oracle-peoplesoft-cve-2026-35273", "https://cybersecurefox.com/en/red-heron-gitea-cve-2026-60004-rce-campaign", "https://cybersecurefox.com/en/bigdiskbuster-poc-blocks-microsoft-defender-updates", "https://cybersecurefox.com/en/skullcandy-dime-3-bluetooth-pairing-vulnerability-cve-2025-20701", "https://cybersecurefox.com/en/ssrf-onlyoffice-owncloud-plugin-cve-2026-84282", "https://cybersecurefox.com/en/cve-2026-68820-use-after-free-windows-afd-winsock-exploitation" ], "reason": "BlueMoon exploit kit infrastructure domain (Proofpoint, chaining Chrome/V8 + Windows ALPC)" }, { "value": "apply.fbijobs.gov", "type": "domain", "first_seen": "2026-09-22", "last_seen": "2026-09-22", "status": "revoked", "confidence": "corroborated", "n_sources": 4, "stories": [ "fbi-arrests-key-suspect-in-major-hack-of-agents-data", "shinyhunters-allegedly-breached-the-fbi-to-steal-personal-data-o", "shinyhunters-claim-fbi-staff-psychiatric-and-medical-records-sto", "shinyhunters-claims-it-breached-fbi-systems-via-an-alleged-unpat" ], "sources": [ "https://cyberscoop.com/shinyhunters-claims-fbi-attack/", "https://www.bleepingcomputer.com/news/security/shinyhunters-claims-fbi-hack-data-theft-in-peoplesoft-zero-day-breach/", "https://www.theregister.com/security/2026/09/22/shinyhunters-claims-fbi-hack-this-is-not-financially-motivated/5298385" ], "reason": "ShinyHunters-defaced FBI jobs application host in breach claim" }, { "value": "bigtlog.pipe", "type": "domain", "first_seen": "2026-03-27", "last_seen": "2026-09-07", "status": "expired", "confidence": "corroborated", "n_sources": 2, "stories": [ "hackers-breach-f5-big-ip-apm-devices-to-deploy-linux-rootkit-htt", "poisonedrefresh-malware-backdoors-f5-big-ip-servers-with-memory" ], "sources": [ "https://www.sophos.com/en-us/blog/dissecting-a-php-web-server-rootkit", "https://my.f5.com/manage/s/article/K000160486" ], "reason": "AF_UNIX backdoor socket of F5 BIG-IP c05d5254 implant (K000160486 IoC)" }, { "value": "registry.coder.com", "type": "domain", "first_seen": "2026-09-03", "last_seen": "2026-09-08", "status": "expired", "confidence": "corroborated", "n_sources": 2, "stories": [ "coder-s-registry-infrastructure-compromised-to-push-malicious-mo", "hackers-compromise-coder-module-registry-to-serve-malicious-pack" ], "sources": [ "https://www.bleepingcomputer.com/news/security/coders-registry-infrastructure-compromised-to-push-malicious-modules/", "https://cyberpress.org/hackers-compromise-coder-module-registry/", "https://gbhackers.com/hackers-hijack-coder-module-registry/" ], "reason": "Compromised Coder module registry distributing trojanized Terraform templates (supply-chain hijack Aug 31 2026)" }, { "value": "abacusadv.com", "type": "domain", "first_seen": "2026-08-23", "last_seen": "2026-08-23", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "coinbasecartel-mid-august-ransomware-campaign-wave" ], "sources": [ "https://malware.news/t/coinbasecartel-compromises-abacus-advisors-in-ransomware-attack/125021#post_1" ], "reason": "CoinbaseCartel ransomware campaign infrastructure" }, { "value": "adminmenueditor.com", "type": "domain", "first_seen": "2026-09-15", "last_seen": "2026-09-15", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "malicious-admin-menu-editor-pro-plugin-backdoors-1-500-wordpress" ], "sources": [ "https://www.bleepingcomputer.com/news/security/malcious-admin-menu-editor-pro-plugin-backdoors-1-500-wordpress-sites/" ], "reason": "Compromised plugin vendor site distributing backdoored Admin Menu Editor Pro updates (webshell)" }, { "value": "ai-thermal.com", "type": "domain", "first_seen": "2026-08-27", "last_seen": "2026-08-27", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "qilin-targets-canadian-firm-b-wright-drywall-in-ransomware-attac" ], "sources": [ "https://malware.news/t/qilin-ransomware-strikes-air-international-thermal-systems/125119#post_1" ], "reason": "Ransomware affiliate infrastructure domain linked to Qilin attack on B Wright Drywall" }, { "value": "alduncanson.react", "type": "domain", "first_seen": "2026-08-24", "last_seen": "2026-08-24", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "77-evil-twin-open-vsx-extensions-harvest-developer-metadata-shar" ], "sources": [ "https://cyberpress.org/open-vsx-malicious-extensions/" ], "reason": "Malicious domain in Open VSX evil-twin extension supply-chain attack harvesting developer metadata" }, { "value": "analysis.abyssos", "type": "domain", "first_seen": "2026-08-10", "last_seen": "2026-08-10", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "abyssos-rat-hijacks-browser-sessions-steals-credentials-and-give" ], "sources": [ "https://malware.news/t/abyssos-technical-analysis-of-a-new-modular-rat/124653#post_1" ], "reason": "Abyssos RAT C2 domain" }, { "value": "api.claudeopus", "type": "domain", "first_seen": "2026-08-05", "last_seen": "2026-08-05", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "infostealer-logs-expose-replayable-ai-session-tokens-lumma-steal" ], "sources": [ "https://thehackernews.com/2026/08/poison-claude-sells-discounted-claude.html" ], "reason": "Criminal API endpoint api.claudeopus[.]shop of Poison Claude underground AI service" }, { "value": "api.telegram.org", "type": "domain", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "mois-su-telegram-chosen-brick-spia-dissidenti-e-giornalisti-iran" ], "sources": [ "https://insicurezzadigitale.com/mois-su-telegram-chosen-brick-spia-dissidenti-e-giornalisti-iraniani/" ], "reason": "Telegram Bot API C2 channel of HEAVYGRAM/CHOSEN BRICK spyware (unique bot ID per victim, FBI flash IOC)" }, { "value": "api.virtualizor.com", "type": "domain", "first_seen": "2026-09-01", "last_seen": "2026-09-01", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "bgp-hijack-diverts-softaculous-traffic-to-deliver-malicious-virt" ], "sources": [ "https://cyberpress.org/bgp-hijack-diverts-softaculous-traffic/" ], "reason": "Hijacked Softaculous API endpoint in BGP hijack delivering malicious Virtualizor update" }, { "value": "api.weatherlive", "type": "domain", "first_seen": "2026-10-08", "last_seen": "2026-10-08", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "midnight-mimosa-ad-fraud-malware-preinstalled-in-cheap-android-p" ], "sources": [ "https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware" ], "reason": "C2 domain (api.weatherlive[.]world) of Midnight Mimosa Android firmware malware" }, { "value": "autoload.files", "type": "domain", "first_seen": "2026-05-23", "last_seen": "2026-05-23", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "laravel-lang-supply-chain-attack-compromises-700-package-version" ], "sources": [ "https://gbhackers.com/compromise-laravel-lang-packages/" ], "reason": "Malicious Composer autoload entry in Laravel-Lang supply chain RCE backdoor" }, { "value": "avbuffer.free", "type": "domain", "first_seen": "2026-06-23", "last_seen": "2026-06-23", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "ffmpeg-pixelsmash-cve-2026-8461-magicyuv-heap-overflow-enables-r" ], "sources": [ "https://www.bleepingcomputer.com/news/security/ffmpeg-fixes-pixelsmash-flaw-in-widely-used-video-decoder/" ], "reason": "Malicious domain in FFmpeg Pixelsmash CVE-2026-8461 exploit chain enabling remote code execution" }, { "value": "awqhnjewqjkl.icu", "type": "domain", "first_seen": "2026-08-07", "last_seen": "2026-08-07", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "tracking-shai-hulud-inside-the-chaindrop-npm-worm" ], "sources": [ "https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/" ], "reason": "C2 domain of ChainDrop npm worm, rotated via Ethereum contract" }, { "value": "azurenetfiles.net", "type": "domain", "first_seen": "2026-06-11", "last_seen": "2026-06-11", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "shinyhunters-allegedly-breached-the-fbi-to-steal-personal-data-o" ], "sources": [ "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit" ], "reason": "MeshCentral C2 in ShinyHunters PeopleSoft breach" }, { "value": "backblazeb2.com", "type": "domain", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "mois-su-telegram-chosen-brick-spia-dissidenti-e-giornalisti-iran" ], "sources": [ "https://insicurezzadigitale.com/mois-su-telegram-chosen-brick-spia-dissidenti-e-giornalisti-iraniani/" ], "reason": "File-exfiltration endpoint of CHOSEN BRICK Telegram spyware (FBI flash IOC list)" }, { "value": "backdoor.turn", "type": "domain", "first_seen": "2026-06-16", "last_seen": "2026-06-16", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "dragonforce-ransomware-abuses-microsoft-teams-turn-relays-for-st" ], "sources": [ "https://www.bleepingcomputer.com/news/security/ransomware-gang-abuses-microsoft-teams-relays-to-hide-malicious-traffic/" ], "reason": "DragonForce ransomware Microsoft Teams turn relay abuse" }, { "value": "brmconfig.com", "type": "domain", "first_seen": "2026-09-01", "last_seen": "2026-09-01", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "hackers-abuse-chatgpt-shared-links-and-fake-cloudflare-captcha-t" ], "sources": [ "https://cyberpress.org/chatgpt-links-spread-netsupport-rat/" ], "reason": "C2 domain serving PowerShell loader in ChatGPT shared-links abuse campaign deploying NetSupport RAT" }, { "value": "caldav.icloud", "type": "domain", "first_seen": "2026-09-24", "last_seen": "2026-09-24", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "macsync-malware-uses-public-icloud-calendars-to-deliver-new-payl" ], "sources": [ "https://securelist.com/macsync-new-version/121383/" ], "reason": "iCloud CalDAV dead-drop (caldav.icloud[.]com) staging commands for MacSync macOS stealer (Kaspersky IOC)" }, { "value": "canal1zac1a.onrender.com", "type": "domain", "first_seen": "2026-06-26", "last_seen": "2026-06-26", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "turla-s-stockstay-backdoor-google-exposes-russian-fsb-aligned-ap" ], "sources": [ "https://www.securityweek.com/russian-apt-deploys-stockstay-backdoor-against-ukrainian-targets/" ], "reason": "C2 websocket endpoint of Turla StockStay backdoor" }, { "value": "capabilities.abyssos", "type": "domain", "first_seen": "2026-08-10", "last_seen": "2026-08-10", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "abyssos-rat-hijacks-browser-sessions-steals-credentials-and-give" ], "sources": [ "https://malware.news/t/abyssos-technical-analysis-of-a-new-modular-rat/124653#post_1" ], "reason": "C2 domain of Abyssos RAT hijacking browser sessions and stealing credentials" }, { "value": "cdn.bloom", "type": "domain", "first_seen": "2026-09-09", "last_seen": "2026-09-09", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "phishing-attack-creates-malicious-pages-inside-the-victim-s-brow" ], "sources": [ "https://www.securityweek.com/new-phishing-attack-creates-malicious-pages-inside-the-victims-browser/" ], "reason": "Malicious redirect resource host (cdn.bloom[.]io) in Teams phishing chain" }, { "value": "cdn10.sendibt1.com", "type": "domain", "first_seen": "2026-09-18", "last_seen": "2026-09-18", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "hackers-turn-brevo-widgets-into-malware-delivery-channel-across" ], "sources": [ "https://cyberpress.org/brevo-cdn-javascript-injection/" ], "reason": "Brevo CDN node weaponized for malware delivery across 100K+ compromised websites" }, { "value": "cdn11.sendibt1.com", "type": "domain", "first_seen": "2026-09-18", "last_seen": "2026-09-18", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "hackers-turn-brevo-widgets-into-malware-delivery-channel-across" ], "sources": [ "https://cyberpress.org/brevo-cdn-javascript-injection/" ], "reason": "Brevo CDN node weaponized for malware delivery across 100K+ compromised websites" }, { "value": "cdn2.sendibt1.com", "type": "domain", "first_seen": "2026-09-18", "last_seen": "2026-09-18", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "hackers-turn-brevo-widgets-into-malware-delivery-channel-across" ], "sources": [ "https://cyberpress.org/brevo-cdn-javascript-injection/" ], "reason": "Brevo CDN node weaponized for malware delivery across 100K+ compromised websites" }, { "value": "cdn4.sendibt1.com", "type": "domain", "first_seen": "2026-09-18", "last_seen": "2026-09-18", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "hackers-turn-brevo-widgets-into-malware-delivery-channel-across" ], "sources": [ "https://cyberpress.org/brevo-cdn-javascript-injection/" ], "reason": "Brevo CDN node weaponized for malware delivery across 100K+ compromised websites" }, { "value": "city-forum.com", "type": "domain", "first_seen": "2026-08-12", "last_seen": "2026-08-12", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "stealthy-city-forum-attacks-target-salesforce-and-servicenow-wit" ], "sources": [ "https://www.bleepingcomputer.com/news/security/city-forum-data-theft-attacks-target-salesforce-servicenow-portals/" ], "reason": "C2/attacker infrastructure in City-Forum data theft campaign against Salesforce and ServiceNow" }, { "value": "com.android.sys.bcprot", "type": "domain", "first_seen": "2026-10-08", "last_seen": "2026-10-08", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "midnight-mimosa-ad-fraud-malware-preinstalled-in-cheap-android-p" ], "sources": [ "https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware" ], "reason": "Rotating payload package name of Midnight Mimosa Android malware" }, { "value": "com.android.sys.gmsprot", "type": "domain", "first_seen": "2026-10-08", "last_seen": "2026-10-08", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "midnight-mimosa-ad-fraud-malware-preinstalled-in-cheap-android-p" ], "sources": [ "https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware" ], "reason": "Rotating payload package name of Midnight Mimosa Android malware" }, { "value": "com.android.sys.prot", "type": "domain", "first_seen": "2026-10-08", "last_seen": "2026-10-08", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "midnight-mimosa-ad-fraud-malware-preinstalled-in-cheap-android-p" ], "sources": [ "https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware" ], "reason": "Rotating payload package name of Midnight Mimosa Android malware" }, { "value": "com.android.system.lite", "type": "domain", "first_seen": "2026-10-08", "last_seen": "2026-10-08", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "midnight-mimosa-ad-fraud-malware-preinstalled-in-cheap-android-p" ], "sources": [ "https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware" ], "reason": "Preinstalled payload package name of Midnight Mimosa Android malware" }, { "value": "com.apple.finder.agent", "type": "domain", "first_seen": "2026-09-24", "last_seen": "2026-09-24", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "macsync-malware-uses-public-icloud-calendars-to-deliver-new-payl" ], "sources": [ "https://securelist.com/macsync-new-version/121383/" ], "reason": "LaunchAgent persistence name of PamStealer macOS infostealer" }, { "value": "com.apple.system.services.activity", "type": "domain", "first_seen": "2026-06-24", "last_seen": "2026-06-24", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "macos-gaslight-rust-backdoor-weaponizes-prompt-injection-against" ], "sources": [ "https://www.sentinelone.com/labs/macos-gaslight-rust-backdoor-turns-prompt-injection-on-the-analyst-not-the-sandbox/" ], "reason": "Masquerading LaunchAgent of Gaslight macOS Rust backdoor" }, { "value": "com.finder.helper.plist", "type": "domain", "first_seen": "2025-12-10", "last_seen": "2025-12-10", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware" ], "sources": [ "https://www.bleepingcomputer.com/news/security/google-ads-for-shared-chatgpt-grok-guides-push-macos-infostealer-malware/" ], "reason": "Watchdog LaunchAgent of AMOS infostealer ClickFix campaign" }, { "value": "com.utils.launcher", "type": "domain", "first_seen": "2026-09-10", "last_seen": "2026-09-10", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "macsync-the-evasive-macos-stealer-exploiting-clickfix-lures" ], "sources": [ "https://cyberpress.org/macsync-clickfix-wallet-heist/" ], "reason": "MacSync macOS stealer process bundle identifier (ClickFix delivery)" }, { "value": "comfyupdate.org", "type": "domain", "first_seen": "2025-07-07", "last_seen": "2025-07-07", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "nighteagle-targets-russian-companies" ], "sources": [ "https://cybersecuritynews.com/nighteagle-apt-exploiting-0-days/" ], "reason": "NightEagle per-target attack domain" }, { "value": "communication.abyssos", "type": "domain", "first_seen": "2026-08-10", "last_seen": "2026-08-10", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "abyssos-rat-hijacks-browser-sessions-steals-credentials-and-give" ], "sources": [ "https://malware.news/t/abyssos-technical-analysis-of-a-new-modular-rat/124653#post_1" ], "reason": "C2 domain of Abyssos RAT hijacking browser sessions and stealing credentials" }, { "value": "company.onmicrosoft.com", "type": "domain", "first_seen": "2026-08-24", "last_seen": "2026-08-24", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "synkloader-malware-spreads-through-microsoft-teams-phishing-and" ], "sources": [ "https://cyberpress.org/synkloader-malware-spreads-through-microsoft-teams/" ], "reason": "Attacker-registered Teams account domain pattern in email-bombing phishing campaign" }, { "value": "cre-ads.com", "type": "domain", "first_seen": "2026-03-12", "last_seen": "2026-03-12", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "packagist-themes-exploit-iphone-visitors-to-steal-messages-passw" ], "sources": [ "https://socket.dev/blog/6-malicious-packagist-themes-ship-trojanized-jquery" ], "reason": "Click-hijacking domain in FUNNULL trojanized jQuery" }, { "value": "daymath.mjs", "type": "domain", "first_seen": "2026-08-24", "last_seen": "2026-08-24", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "redc2-4-0-linux-implant-delivered-via-trojanized-npm-packages" ], "sources": [ "https://cyberpress.org/redc2-linux-malware/" ], "reason": "RedC2 4.0 Linux implant npm package entry point in trojanized package campaign" }, { "value": "delivery.evidence", "type": "domain", "first_seen": "2026-08-11", "last_seen": "2026-08-11", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "captivecrunch-midnight-blizzard-sub-cluster-weaponizes-hotel-wi" ], "sources": [ "https://malware.news/t/captivecrunch-midnight-blizzard-weaponizes-hotel-wi-fi-captive-portals-to-steal-microsoft-365-credentials/124711#post_1" ], "reason": "Midnight Blizzard (APT29) hotel Wi-Fi captive portal attack infrastructure" }, { "value": "driverx86-adobe.onrender.com", "type": "domain", "first_seen": "2026-06-26", "last_seen": "2026-06-26", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "turla-s-stockstay-backdoor-google-exposes-russian-fsb-aligned-ap" ], "sources": [ "https://www.securityweek.com/russian-apt-deploys-stockstay-backdoor-against-ukrainian-targets/" ], "reason": "C2 websocket endpoint of Turla StockStay backdoor" }, { "value": "eeongous.com", "type": "domain", "first_seen": "2026-09-04", "last_seen": "2026-09-04", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "trois-cve-sur-mikrotik-routeros-des-quipements-massivement-d-plo" ], "sources": [ "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/" ], "reason": "RouterOS backdoor campaign infrastructure" }, { "value": "env-check.daemontools", "type": "domain", "first_seen": "2026-05-05", "last_seen": "2026-05-05", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "needymantis-unpacking-a-post-compromise-malware-family-used-in-t" ], "sources": [ "https://securelist.com/tr/daemon-tools-backdoor/119654/" ], "reason": "C2 domain in Daemon Tools backdoor (typosquat of daemon-tools.cc)" }, { "value": "files.virtualizor.com", "type": "domain", "first_seen": "2026-09-01", "last_seen": "2026-09-01", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "bgp-hijack-diverts-softaculous-traffic-to-deliver-malicious-virt" ], "sources": [ "https://cyberpress.org/bgp-hijack-diverts-softaculous-traffic/" ], "reason": "Hijacked Softaculous file server in BGP hijack delivering malicious Virtualizor update" }, { "value": "gateway.icloud", "type": "domain", "first_seen": "2026-09-24", "last_seen": "2026-09-24", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "macsync-malware-uses-public-icloud-calendars-to-deliver-new-payl" ], "sources": [ "https://securelist.com/macsync-new-version/121383/" ], "reason": "iCloud dead-drop (gateway.icloud[.]com) delivering MacSync Loader.app.tar.gz payload (Kaspersky IOC)" }, { "value": "git.churchofmalware", "type": "domain", "first_seen": "2026-08-12", "last_seen": "2026-08-12", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "microsoft-defender-shieldbreak-zero-day-grants-system-privileges" ], "sources": [ "https://malware.news/t/shieldbreak-windows-zero-day-that-breaks-microsofts-rogueplanet-fix/124747#post_1" ], "reason": "C2 domain in Microsoft Defender ShieldBreak zero-day exploit chain" }, { "value": "git.projectnightcrawler", "type": "domain", "first_seen": "2026-08-12", "last_seen": "2026-08-12", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "microsoft-defender-shieldbreak-zero-day-grants-system-privileges" ], "sources": [ "https://malware.news/t/shieldbreak-windows-zero-day-that-breaks-microsofts-rogueplanet-fix/124747#post_1" ], "reason": "C2 domain in Microsoft Defender ShieldBreak zero-day exploit chain" }, { "value": "github.aoitour", "type": "domain", "first_seen": "2026-08-14", "last_seen": "2026-08-14", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "amnesiastealer-macos-malware-steals-data-controls-browser-sessio" ], "sources": [ "https://cyberpress.org/amnesiastealer-macos-malware-uses-clickfix/" ], "reason": "Fake GitHub portal distributing AmnesiaStealer macOS malware via ClickFix campaign" }, { "value": "gogets.dev", "type": "domain", "first_seen": "2026-09-18", "last_seen": "2026-09-23", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "graphalgo-malware-hits-terraform-and-go-packages-in-new-supply-c" ], "sources": [ "https://cyberpress.org/graphalgo-malware-poisons-terraform-go/", "https://safedep.io/mathmain-encrypted-loader/", "https://www.aikido.dev/blog/graphalgo-terraform-go-modules" ], "reason": "Hosts malicious Go module gogets.dev/btreex in Graphalgo supply-chain attack" }, { "value": "gs.thc.org", "type": "domain", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks" ], "sources": [ "https://habr.com/ru/companies/pt/articles/1082654/" ], "reason": "GSocket C2 indicators in Zimbra ransomware attack (CVE-2026-73570)" }, { "value": "index-ap3.tyler2miler-proton-me-s-account.workers.dev", "type": "domain", "first_seen": "2026-03-23", "last_seen": "2026-03-23", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "eviltokens-phaas-disrupted-after-compromising-12-000-microsoft-a" ], "sources": [ "https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-03-23-%20Device-Code-based-OAuth-Phishing.txt" ], "reason": "EvilTokens phishing-as-a-service infrastructure" }, { "value": "ipssrl.com", "type": "domain", "first_seen": "2026-08-15", "last_seen": "2026-08-15", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "thegentlemen-ransomware-attack-on-i-p-s-srl" ], "sources": [ "https://malware.news/t/thegentlemen-ransomware-attack-on-i-p-s-srl/124817#post_1" ], "reason": "The Gentlemen ransomware victim I.P.S. Srl" }, { "value": "itorrents.org", "type": "domain", "first_seen": "2026-09-18", "last_seen": "2026-09-19", "status": "revoked", "confidence": "reported", "n_sources": 1, "stories": [ "itorrents-org-compromis-pour-distribuer-un-malware-windows-la-pl" ], "sources": [ "https://www.it-connect.fr/moviereaper-malware-torrents-itorrents-the-odyssey/", "https://www.pcmag.com/news/itorrentsorg-compromised-to-spread-windows-malware-kaspersky-says" ], "reason": "Compromised site distributing MovieReaper malware" }, { "value": "laboo.boo", "type": "domain", "first_seen": "2026-09-04", "last_seen": "2026-09-04", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "hackers-turn-hivemq-and-element-messenger-into-control-channels" ], "sources": [ "https://malware.news/t/angry-birds-toy-ghouls-new-toys/125341#post_1" ], "reason": "C2 domain using HiveMQ MQTT and Element Messenger as covert command channels" }, { "value": "leappoach.info", "type": "domain", "first_seen": "2026-09-04", "last_seen": "2026-09-04", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "trois-cve-sur-mikrotik-routeros-des-quipements-massivement-d-plo" ], "sources": [ "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/" ], "reason": "RouterOS backdoor campaign infrastructure" }, { "value": "magne-sjaastad.opm", "type": "domain", "first_seen": "2026-08-24", "last_seen": "2026-08-24", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "77-evil-twin-open-vsx-extensions-harvest-developer-metadata-shar" ], "sources": [ "https://cyberpress.org/open-vsx-malicious-extensions/" ], "reason": "Malicious domain in Open VSX evil-twin extension supply-chain attack" }, { "value": "mail.uaiubifas", "type": "domain", "first_seen": "2026-09-10", "last_seen": "2026-09-10", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware" ], "sources": [ "https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou" ], "reason": "GrayRabbit malware C2 (mail.uaiubifas[.]top) in Tencent app exploit chain" }, { "value": "mythtime.xyz", "type": "domain", "first_seen": "2026-09-04", "last_seen": "2026-09-04", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "trois-cve-sur-mikrotik-routeros-des-quipements-massivement-d-plo" ], "sources": [ "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/" ], "reason": "RouterOS backdoor campaign infrastructure" }, { "value": "nightmare-stresser.com", "type": "domain", "first_seen": "2026-09-22", "last_seen": "2026-09-22", "status": "revoked", "confidence": "reported", "n_sources": 1, "stories": [ "the-doj-has-seized-nightmare-stresser-com-and-nightmarestresser" ], "sources": [ "https://thehackernews.com/2026/09/us-seizes-nightmarestresser-domains.html" ], "reason": "DDoS-for-hire (booter) domain seized by DOJ" }, { "value": "nightmarestresser.org", "type": "domain", "first_seen": "2026-09-22", "last_seen": "2026-09-22", "status": "revoked", "confidence": "reported", "n_sources": 1, "stories": [ "the-doj-has-seized-nightmare-stresser-com-and-nightmarestresser" ], "sources": [ "https://thehackernews.com/2026/09/us-seizes-nightmarestresser-domains.html" ], "reason": "DDoS-for-hire (booter) domain seized by DOJ" }, { "value": "nqsaaskw.com", "type": "domain", "first_seen": "2026-03-12", "last_seen": "2026-03-12", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "packagist-themes-exploit-iphone-visitors-to-steal-messages-passw" ], "sources": [ "https://socket.dev/blog/6-malicious-packagist-themes-ship-trojanized-jquery" ], "reason": "FUNNULL CDN CNAME domain in trojanized jQuery attack" }, { "value": "openai-backup.one", "type": "domain", "first_seen": "2026-09-01", "last_seen": "2026-09-01", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "hackers-abuse-chatgpt-shared-links-and-fake-cloudflare-captcha-t" ], "sources": [ "https://cyberpress.org/chatgpt-links-spread-netsupport-rat/" ], "reason": "Fake OpenAI backup site distributing NetSupport RAT via fake Cloudflare CAPTCHA ClickFix" }, { "value": "poison-claude.bitsender", "type": "domain", "first_seen": "2026-08-04", "last_seen": "2026-08-04", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "infostealer-logs-expose-replayable-ai-session-tokens-lumma-steal" ], "sources": [ "https://www.okta.com/blog/threat-intelligence/free_tokens_for_sale/" ], "reason": "Phishing domain serving fake Claude session login (Cloudflare warned)" }, { "value": "pool.hashvault", "type": "domain", "first_seen": "2026-08-27", "last_seen": "2026-08-27", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "hackers-are-targeting-ai-servers-to-steal-api-keys-and-install-c" ], "sources": [ "https://www.wiz.io/blog/ai-infrastructure-honeypot" ], "reason": "Crypto mining pool in IoC set for AI-server compromise campaign" }, { "value": "reliaquest.claims", "type": "domain", "first_seen": "2026-08-24", "last_seen": "2026-08-24", "status": "revoked", "confidence": "reported", "n_sources": 1, "stories": [ "hackers-impersonate-security-staff-to-steal-credentials-in-relia" ], "sources": [ "https://www.bleepingcomputer.com/news/security/reliaquest-confirms-failed-data-theft-attack-after-shinyhunters-breach/" ], "reason": "Attacker impersonation domain in ReliaQuest social engineering MFA bypass campaign" }, { "value": "review.chm", "type": "domain", "first_seen": "2026-08-12", "last_seen": "2026-08-12", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "kimsuky-review-chm-malware-targets-north-korean-defector-academi" ], "sources": [ "https://malware.news/t/xx-kimsuky-review-chm/124744#post_1" ], "reason": "CHM malware payload in Kimsuky campaign targeting North Korean defectors" }, { "value": "rumbledb.jsoniq", "type": "domain", "first_seen": "2026-08-24", "last_seen": "2026-08-24", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "77-evil-twin-open-vsx-extensions-harvest-developer-metadata-shar" ], "sources": [ "https://cyberpress.org/open-vsx-malicious-extensions/" ], "reason": "Malicious domain in Open VSX evil-twin extension supply-chain attack" }, { "value": "sendibt1.com", "type": "domain", "first_seen": "2026-09-18", "last_seen": "2026-09-18", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "hackers-turn-brevo-widgets-into-malware-delivery-channel-across" ], "sources": [ "https://cyberpress.org/brevo-cdn-javascript-injection/" ], "reason": "Malware delivery via attacker-controlled Brevo subdomains (cdn2/cdn4.sendibt1.com)" }, { "value": "setup.mdc", "type": "domain", "first_seen": "2026-06-08", "last_seen": "2026-06-08", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "miasma-worm-hits-73-microsoft-github-repositories-supply-chain-a" ], "sources": [ "https://www.computing.co.uk/news/2026/security/microsoft-s-github-repositories-taken-offline-amid-miasma-supply-chain-attack" ], "reason": "Malicious Cursor AI rules file in Miasma worm supply chain attack (73 MS GitHub repos)" }, { "value": "setup.mjs", "type": "domain", "first_seen": "2026-08-05", "last_seen": "2026-08-05", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "tracking-shai-hulud-inside-the-chaindrop-npm-worm" ], "sources": [ "https://www.bleepingcomputer.com/news/security/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages/" ], "reason": "Malicious npm package entry point in ChainDrop/Shai-Hulud supply chain worm" }, { "value": "sphealth.aspx", "type": "domain", "first_seen": "2026-09-24", "last_seen": "2026-09-24", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "cisa-adds-exploited-wso2-adobe-commerce-sharepoint-and-routeros" ], "sources": [ "https://blog.previdian.com/cve-2026-65660-previdian-observes-two-stage-sharepoint-exploitation-attempts/" ], "reason": "Webshell dropped by SharePoint pre-auth exploit chain (CVE-2026-65660)" }, { "value": "stonevillenc.org", "type": "domain", "first_seen": "2026-09-11", "last_seen": "2026-09-11", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "i-m-not-a-security-person-i-found-cloaked-drug-spam-injected-in" ], "sources": [ "https://youtube.com/shorts/X-9jc9YDqYk", "http://stonevillenc.org" ], "reason": "Compromised town website serving cloaked drug-spam pages in front of live content" }, { "value": "synologyupdates.com", "type": "domain", "first_seen": "2025-07-07", "last_seen": "2025-07-07", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "nighteagle-targets-russian-companies" ], "sources": [ "https://cybersecuritynews.com/nighteagle-apt-exploiting-0-days/" ], "reason": "NightEagle per-target attack domain" }, { "value": "sys.rzadmin.password", "type": "domain", "first_seen": "2026-07-08", "last_seen": "2026-07-10", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "cve-2026-11405-tenda-router-firmware-hidden-backdoor-no-patch-av" ], "sources": [ "https://www.bleepingcomputer.com/news/security/hidden-backdoor-in-tenda-router-firmware-grants-admin-access/", "https://socfortress.medium.com/unpatched-backdoor-in-tenda-router-firmware-cve-2026-11405-b2dace8ef73b" ], "reason": "Tenda router firmware hidden backdoor credential (CVE-2026-11405)" }, { "value": "tappercuddy.com", "type": "domain", "first_seen": "2026-08-15", "last_seen": "2026-08-15", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "storm-ransomware-strikes-rood-riddle-equine-hospital" ], "sources": [ "https://malware.news/t/storm-ransomware-targets-canadian-law-firm-tapper-cuddy-llp/124815#post_1" ], "reason": "Storm ransomware victim" }, { "value": "third-party.com", "type": "domain", "first_seen": "2026-05-02", "last_seen": "2026-09-23", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks" ], "sources": [ "https://www.bleepingcomputer.com/news/security/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks/", "https://www.virustotal.com/gui/file/daf619aa8cc74dab02c360f46f9f4b7b1654ba478ee89992a3512a46f1f4c209/relations", "https://www.ipfire.org/dbl/lists/malware/domains/third-party.com", "https://www.manifold.security/blog/third-party-com-placeholder-clickfix" ], "reason": "ClickFix phishing domain serving fake Cloudflare verification page" }, { "value": "trainingannouncement.pdf.lnk", "type": "domain", "first_seen": "2026-08-19", "last_seen": "2026-08-19", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "operation-quicsilver-china-nexus-actor-targets-myanmar-diplomats" ], "sources": [ "https://cyberpress.org/china-linked-quicagent-targets-diplomats/" ], "reason": "LNK lure file in Operation Quicsilver Myanmar diplomat targeting" }, { "value": "trendaisecurity.com", "type": "domain", "first_seen": "2026-08-24", "last_seen": "2026-08-24", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "redc2-4-0-linux-implant-delivered-via-trojanized-npm-packages" ], "sources": [ "https://cyberpress.org/redc2-linux-malware/" ], "reason": "RedC2 4.0 Linux implant C2 domain delivered via trojanized npm packages" }, { "value": "userstat.net", "type": "domain", "first_seen": "2026-03-12", "last_seen": "2026-03-12", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "packagist-themes-exploit-iphone-visitors-to-steal-messages-passw" ], "sources": [ "https://socket.dev/blog/6-malicious-packagist-themes-ship-trojanized-jquery" ], "reason": "Data exfiltration domain in FUNNULL trojanized jQuery" }, { "value": "usher.ttvnw", "type": "domain", "first_seen": "2026-09-14", "last_seen": "2026-09-14", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "malicious-twitch-extension-exposes-30-000-users-oauth-tokens-to" ], "sources": [ "https://www.bleepingcomputer.com/news/security/twitch-extension-with-30k-installs-exposes-users-oauth-tokens/" ], "reason": "Malicious Twitch extension C2 domain harvesting 30K users' OAuth tokens for Russian bot service" }, { "value": "virtualizor.com", "type": "domain", "first_seen": "2026-09-01", "last_seen": "2026-09-01", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "bgp-hijack-diverts-softaculous-traffic-to-deliver-malicious-virt" ], "sources": [ "https://cyberpress.org/bgp-hijack-diverts-softaculous-traffic/" ], "reason": "Softaculous domain hijacked via BGP to distribute malicious Virtualizor update" }, { "value": "vlxx.arm", "type": "domain", "first_seen": "2026-09-09", "last_seen": "2026-09-11", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "iot-malware-uses-public-linux-exploits-to-gain-root-and-turn-dev" ], "sources": [ "https://cyberpress.org/linux-exploits-create-botnets/", "https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits" ], "reason": "Downloaded ARM DDoS payload name of KATARU IoT botnet" }, { "value": "vultrobjects.com", "type": "domain", "first_seen": "2026-09-16", "last_seen": "2026-09-16", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "mois-su-telegram-chosen-brick-spia-dissidenti-e-giornalisti-iran" ], "sources": [ "https://insicurezzadigitale.com/mois-su-telegram-chosen-brick-spia-dissidenti-e-giornalisti-iraniani/" ], "reason": "File-exfiltration endpoint of CHOSEN BRICK Telegram spyware (FBI flash IOC list)" }, { "value": "weatherdataai.theworkpc.com", "type": "domain", "first_seen": "2026-06-26", "last_seen": "2026-06-26", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "turla-s-stockstay-backdoor-google-exposes-russian-fsb-aligned-ap" ], "sources": [ "https://www.securityweek.com/russian-apt-deploys-stockstay-backdoor-against-ukrainian-targets/" ], "reason": "C2 websocket endpoint of Turla StockStay backdoor" }, { "value": "witha.name", "type": "domain", "first_seen": "2026-09-15", "last_seen": "2026-10-06", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "threatintel-ddosia-noname-https-witha-name-data-2026-09-09-08-06" ], "sources": [ "https://witha.name/data/2026-09-15_08-06-06_DDoSia-target-list-full.json", "https://witha.name/data/2026-09-29_12-04-22_DDoSia-target-list-full.json", "https://witha.name/data/2026-10-06_08-02-08_DDoSia-target-list-full.json" ], "reason": "Noname DDoSia DDoS campaign coordination domain" }, { "value": "wp-user-consent.php", "type": "domain", "first_seen": "2026-09-15", "last_seen": "2026-09-15", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "malicious-admin-menu-editor-pro-plugin-backdoors-1-500-wordpress" ], "sources": [ "https://www.bleepingcomputer.com/news/security/malcious-admin-menu-editor-pro-plugin-backdoors-1-500-wordpress-sites/" ], "reason": "Backdoor file in compromised Admin Menu Editor Pro plugin update" }, { "value": "wp2shell.com", "type": "domain", "first_seen": "2026-07-17", "last_seen": "2026-07-19", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "wp2shell-cisa-adds-to-kev-wiz-details-webshell-installation-at-s" ], "sources": [ "https://www.slcyber.io/research/wp2shell-pre-authentication-rce-in-wordpress-core", "https://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now/" ], "reason": "C2 domain for WP2Shell WordPress exploit kit (public exploits, in-the-wild confirmed)" }, { "value": "xemphimlau.com", "type": "domain", "first_seen": "2026-03-12", "last_seen": "2026-03-12", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "packagist-themes-exploit-iphone-visitors-to-steal-messages-passw" ], "sources": [ "https://socket.dev/blog/6-malicious-packagist-themes-ship-trojanized-jquery" ], "reason": "Anti-analysis redirect domain in FUNNULL trojanized jQuery" }, { "value": "zimbra-metadata.com", "type": "domain", "first_seen": "2026-07-23", "last_seen": "2026-07-23", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "laundry-bear-void-blizzard-zimbra-zero-click-espionage-joint-int" ], "sources": [ "https://unit42.paloaltonetworks.com/russian-webmail-espionage/" ], "reason": "Laundry Bear C2 domain in Zimbra zero-click espionage" }, { "value": "zk-call-messenger-installer-3.9.2-lts.dmg", "type": "domain", "first_seen": "2025-12-22", "last_seen": "2025-12-22", "status": "revoked", "confidence": "reported", "n_sources": 1, "stories": [ "macsync-malware-uses-public-icloud-calendars-to-deliver-new-payl" ], "sources": [ "https://www.bleepingcomputer.com/news/security/new-macsync-malware-dropper-evades-macos-gatekeeper-checks/" ], "reason": "Code-signed malicious installer disk image of MacSync variant" }, { "value": "zkcall.net", "type": "domain", "first_seen": "2025-12-22", "last_seen": "2025-12-22", "status": "revoked", "confidence": "reported", "n_sources": 1, "stories": [ "macsync-malware-uses-public-icloud-calendars-to-deliver-new-payl" ], "sources": [ "https://www.bleepingcomputer.com/news/security/new-macsync-malware-dropper-evades-macos-gatekeeper-checks/" ], "reason": "MacSync malware distribution domain" }, { "value": "zmailanalytics.com", "type": "domain", "first_seen": "2026-07-23", "last_seen": "2026-07-23", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "laundry-bear-void-blizzard-zimbra-zero-click-espionage-joint-int" ], "sources": [ "https://unit42.paloaltonetworks.com/russian-webmail-espionage/" ], "reason": "Laundry Bear C2 domain in Zimbra zero-click espionage" }, { "value": "13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4", "type": "sha256", "first_seen": "2026-09-09", "last_seen": "2026-09-09", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "iot-malware-uses-public-linux-exploits-to-gain-root-and-turn-dev" ], "sources": [ "https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits" ], "reason": "KATARU IoT malware ARM payload vlxx.arm" }, { "value": "16df15306f966ae5c5184901747a32087483c03eebd7bf19dbfc38e2c4d23ff8", "type": "sha256", "first_seen": "2025-10-20", "last_seen": "2025-10-20", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "dprk-linked-hackers-add-hashhiding-to-blockchain-c2-network-for" ], "sources": [ "https://ransom-isac.org/blog/cross-chain-txdatahiding-crypto-heist/" ], "reason": "Malicious payload hash in DPRK XCTDH campaign (fake GitHub repo tailwind.config.js)" }, { "value": "26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9", "type": "sha256", "first_seen": "2026-09-07", "last_seen": "2026-09-07", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "hackers-breach-f5-big-ip-apm-devices-to-deploy-linux-rootkit-htt" ], "sources": [ "https://www.sophos.com/en-us/blog/dissecting-a-php-web-server-rootkit" ], "reason": "Linux rootkit sample in F5 BIG-IP APM breach" }, { "value": "321e1fb01eb3462b48ff6ccdef132acc1182e3f7456548439f0d4ead12fd98bf", "type": "sha256", "first_seen": "2026-08-18", "last_seen": "2026-08-18", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "clop-created-custom-web-shell-for-windchill-data-theft-attacks" ], "sources": [ "https://reliaquest.com/blog/clop-returns-with-custom-implant-in-mass-extortion-campaign" ], "reason": "Clop Windchill JSP implant hash" }, { "value": "8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb", "type": "sha256", "first_seen": "2026-09-21", "last_seen": "2026-09-21", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "proofpoint-identified-bluemoon-an-exploit-kit-chaining-two-chrom" ], "sources": [ "https://www.volexity.com/blog/2026/09/21/mind-the-patch-gap-part-2-fake-websites-used-to-deploy-chrome-windows-0-day-exploits/" ], "reason": "CLEANGULP backdoor delivered by UTA0565 Chrome zero-day chain" }, { "value": "bf0681e43f51e98fe7ec24bf73a43facc66b0feb325a3a835f8f01b2861b926e", "type": "sha256", "first_seen": "2026-09-22", "last_seen": "2026-09-22", "status": "active", "confidence": "reported", "n_sources": 1, "stories": [ "inside-bambootoken-s-linux-implant-shell-and-file-control-over-m" ], "sources": [ "https://cyberpress.org/bambootoken-linux-mqtt-backdoor/" ], "reason": "BambooToken Linux MQTT implant payload hash" }, { "value": "daf619aa8cc74dab02c360f46f9f4b7b1654ba478ee89992a3512a46f1f4c209", "type": "sha256", "first_seen": "2026-05-02", "last_seen": "2026-05-02", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks" ], "sources": [ "https://www.virustotal.com/gui/file/daf619aa8cc74dab02c360f46f9f4b7b1654ba478ee89992a3512a46f1f4c209/relations" ], "reason": "ClickFix second-stage archive from elxxvvx.xyz" }, { "value": "e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6", "type": "sha256", "first_seen": "2026-09-08", "last_seen": "2026-09-08", "status": "expired", "confidence": "reported", "n_sources": 1, "stories": [ "npm-supply-chain-worm-returns-after-four-month-dormancy-with-sam" ], "sources": [ "https://cyberpress.org/dormant-npm-worm-returns/" ], "reason": "Shai-Hulud npm supply-chain worm payload hash (reactivated Sep 7 2026 after 111-day dormancy)" } ]