# source_validations

ioc_type: ipv4
ioc_value: 94.103.188.107
source: otx
validated_at: 2026-05-30T00:02:52.576027
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS200019 alexhost srl", "indicator": "94.103.188.107", "tags": ["tpot", "honeytrap", "sensor-tagged", "honeypot", "tanner", "digital ocean", "sentrypeer", "vultr", "portscan", "scanners", "fatt", "suricata", "p0f", "mailoney", "cowrie", "dionaea"], "pulses": ["Honeypot Data \u2013 T-Pot - Sydney, Australia - April 2026", "Vultr Paris (France) Port Scanning Hosts for 2026-04-06", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-04-06", "DigitalOcean Toronto (CA) Port Scanning Hosts for 2026-04-06", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-04-05", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-04-05", "Vultr Paris (France) Port Scanning Hosts for 2026-04-04", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-04-04", "DigitalOcean London (UK) Port Scanning Hosts for 2026-04-04", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-04-03", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-04-03", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-04-02", "DigitalOcean Toronto (CA) Port Scanning Hosts for 2026-04-02", "DigitalOcean Singapore Port Scanning Hosts for 2026-04-02", "DigitalOcean London (UK) Port Scanning Hosts for 2026-04-02", "Honeypot Data \u2013 T-Pot - Sydney, Australia - March 2026", "Vultr Paris (France) Port Scanning Hosts for 2026-04-01", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-04-01", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-04-01", "DigitalOcean Singapore Port Scanning Hosts for 2026-04-01"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 94.103.188.206
source: otx
validated_at: 2026-05-30T00:05:05.745848
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS200019 alexhost srl", "indicator": "94.103.188.206", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 10, "malware_samples": [], "passive_dns": ["technosupremacy.cfd", "dashboard.gestionperso.xyz", "lookup.gestionperso.xyz", "truspilot-fanaccess.com", "www.gestionperso.xyz", "deux.gestionperso.xyz", "bluegrassmissourians.com", "jennywileydulcimers.com", "beviene.com", "khizo.com"]}


ioc_type: ipv4
ioc_value: 94.103.188.248
source: otx
validated_at: 2026-05-30T00:06:48.764697
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS200019 alexhost srl", "indicator": "94.103.188.248", "tags": ["fail2ban", "ssh", "SSH", "Bruteforce", "bruteforce", "brute force", "0xBFKX", "Brute-Force", "Honeypot"], "pulses": ["Server Scanning 2025-12-16", "Automated Threat Intelligence - Brute-force hosts for 2024-01-10", " SSH Brute-Force Honeypot Live", " SSH Brute-Force Honeypot Live", " SSH Brute-Force Honeypot Live", " SSH Brute-Force Honeypot Live", " SSH Brute-Force Honeypot Live", "2024-01-10 Fail2Ban 4fc7633b-ca9a-4ce2-8bb0-ed3db3984949", "07-01-24 - fail2ban SSH - 2bcc956c-adb8-11ee-bd3c-56000486ce98"], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["mevarbitrage.blog", "mevarbitrages.info", "renderdistribution.live", "remixdeployer.com"]}


ioc_type: ipv4
ioc_value: 94.103.188.64
source: otx
validated_at: 2026-05-30T00:07:50.785527
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS200019 alexhost srl", "indicator": "94.103.188.64", "tags": ["Threat Feed", "IOCs", "Malware", "Phishing"], "pulses": ["The Everyman Threat Feed", "Pronsis Loader", "A New Malware Using JPHP And NSIS For Stealthy Attacks"], "malware_count": 0, "passive_dns_count": 134, "malware_samples": [], "passive_dns": ["mianfei.bobobo.pro", "stk.mom", "g36c028.cdn.pbxzccc.shop", "xaz3.shop", "xaz8.shop", "xaz9.shop", "www.wms10.shop", "www.ssqq42.shop", "ssqq42.shop", "www.wums5.mom", "wums5.mom", "sqx2.shop", "tzseo.shop", "sqyy8.shop", "www.mls4.shop", "jhg10.mom", "zhs7.mom", "ssqq22.shop", "ssqq20.shop", "www.ssqq20.shop"]}


ioc_type: ipv4
ioc_value: 94.103.188.8
source: otx
validated_at: 2026-05-30T00:07:56.095361
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS200019 alexhost srl", "indicator": "94.103.188.8", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 15, "malware_samples": [], "passive_dns": ["amptrv.cyou", "gardengatebnb.com", "transferrefund-online.com", "sco-secures-onlineresets.com", "refundinteract-online.com", "firstladytees.info", "thrillercloud.com", "www.thrillercloud.com", "www.billing.thrillercloud.com", "billing.thrillercloud.com", "www.nasavpn.com", "nasavpn.com", "www.mail.privacywebhost.com", "www.privacywebhost.com", "privacywebhost.com"]}


ioc_type: ipv4
ioc_value: 94.103.188.81
source: otx
validated_at: 2026-05-30T00:07:58.960165
raw_response:
  {"pulse_count": 21, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS200019 alexhost srl", "indicator": "94.103.188.81", "tags": ["ssh", "SSH", "Bruteforce", "brute force", "Brute-Force", "Honeypot"], "pulses": ["SSH Brute-Force Honeypot Live", "IOC pulses", "IOC pulses", "IOC pulses", "IOC pulses", "IOC pulses", "IOC pulses", "IOC pulses", "IOC pulses", "IOC pulses", "IOC pulses", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "Automated Threat Intelligence - Brute-force hosts for 2025-03-24"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["streiflerpartner.com"]}


ioc_type: ipv4
ioc_value: 94.103.188.88
source: otx
validated_at: 2026-05-30T00:08:25.905743
raw_response:
  {"pulse_count": 16, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS200019 alexhost srl", "indicator": "94.103.188.88", "tags": [], "pulses": ["2025-10-28 Fail2Ban 732280a4-5640-484c-a05d-036d2de617c7", "2025-10-27 Fail2Ban fc2e9b3e-9798-40e2-b3cd-446abaa0b0fe", "2025-10-25 Fail2Ban ad3ef74c-7c96-4eff-bd00-6759beedbc15", "2025-10-23 Fail2Ban 58490952-2704-4187-a3ae-673af4f67b1a", "2025-10-20 Fail2Ban 1000feec-c80c-4fa1-b266-d163725aef6d", "2025-10-19 Fail2Ban 048d742d-bbff-4790-bbab-ab60cf04916f", "2025-10-14 Fail2Ban dbde7f0b-fc5a-4ba4-9904-5af993d0b027", "2025-10-13 Fail2Ban cc5b3fd4-a449-491d-b5b8-11e65754e93c", "2025-10-11 Fail2Ban 0cefab9f-6c33-41b5-b9bb-e8c93cec726d", "2025-10-11 Fail2Ban 7b1e34bd-f787-42e3-9920-41d583bc9d4a", "2025-10-10 Fail2Ban 3640f478-a11c-4228-8887-bfe721e36555", "2025-10-05 Fail2Ban 61ca8243-f866-4e09-86ac-c97ebb6bbc99", "2025-10-03 Fail2Ban d907642c-5cdc-405e-ad7d-1de673292ac7", "2025-10-03 Fail2Ban 7869e777-b6ca-4339-a1a0-2ef52f48045f", "2025-10-02 Fail2Ban df41ef80-0641-4ac6-8961-fb12a54b947e", "2025-10-02 Fail2Ban d1406486-6d52-4603-8191-620f32f0c28d"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 77.83.247.81
source: otx
validated_at: 2026-05-30T00:13:17.973849
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Israel", "country_code": "IL", "city": "Ashdod", "asn": "AS51765 oy crea nova hosting solution ltd", "indicator": "77.83.247.81", "tags": ["fbi-flash", "vpn", "Nextray", "APT28", "GRU", "anonymization", "cyber security", "threat-infrastructure", "ransomware", "proxy", "ioc", "c2", "phishing", "fvpns https", "firstvpn", "Strontium", "Fancy Bear", "web shell", "malicious", "ver"], "pulses": ["Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments", "IOC Records Provided by @NextRayAI", "First VPN Service Infrastructure Used by Ransomware Operators", "APT28 Group"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["493400c4b9a96166e0e47e07fb764dabd027eb5ed4aaa2b4fb64ee843017b763"], "passive_dns": []}


ioc_type: ipv4
ioc_value: 93.115.28.161
source: otx
validated_at: 2026-05-30T00:13:25.324016
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Lithuania", "country_code": "LT", "city": null, "asn": "AS16125 uab cherry servers", "indicator": "93.115.28.161", "tags": ["Strontium", "Fancy Bear", "Nextray", "web shell", "APT28", "GRU", "ioc", "cyber security", "phishing", "malicious", "ver"], "pulses": ["Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments", "IOC Records Provided by @NextRayAI", "APT28 Group"], "malware_count": 0, "passive_dns_count": 9, "malware_samples": [], "passive_dns": ["altundjung.org", "fotoclub-toggenburg.org", "naturbutter.com", "medoporto.com", "mehrbutter.com", "butterwelt.com", "mehrbiowetter.com", "tanzerinderhaus.com", "clipsnow.com"]}


ioc_type: ipv4
ioc_value: 45.155.54.22
source: otx
validated_at: 2026-05-30T00:13:28.049837
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "St Petersburg", "asn": "AS48430 perviy tsod llc", "indicator": "45.155.54.22", "tags": ["APT", "malware"], "pulses": ["Malware Filter - Botnet List - 06-05-2026 (Part 5)", "Twitter Feed - Cyberteam008 - 06-05-2026"], "malware_count": 0, "passive_dns_count": 15, "malware_samples": [], "passive_dns": ["win-is.com", "mail.digitalarena.space", "digitalarena.space", "slsmtp.net", "devicealert-myphone.shop", "recoverydeviceapple.shop", "maps-l-cloud-location.help", "maps-l-cloud-lost.help", "ns2.legithost-ru.com", "ns1.legithost-ru.com", "us-support-maps.click", "log-in.help", "i-cloud-lat.info", "cioudphone.cfd", "ars-lphone-cioud.cfd"]}


ioc_type: ipv4
ioc_value: 176.123.3.5
source: otx
validated_at: 2026-05-30T00:13:39.112603
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.3.5", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 19, "malware_samples": [], "passive_dns": ["mail.defangtechs.com", "www.grantdrugstore.com", "grantdrugstore.com", "176-123-3-5.cprapid.com", "www.176-123-3-5.cprapid.com", "modavir.com", "alphatolim.club", "www.lookeate.xyz", "lookeate.xyz", "www.etcs.xyz", "etcs.xyz", "www.pelisstar.xyz", "pelisstar.xyz", "tumodaguide.club", "www.tumodaguide.club", "webdesuenos.com", "www.webdesuenos.com", "blogmys.xyz", "www.blogmys.xyz"]}


ioc_type: ipv4
ioc_value: 176.123.3.8
source: otx
validated_at: 2026-05-30T00:13:43.450045
raw_response:
  {"pulse_count": 34, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.3.8", "tags": ["Nextray", "ioc", "cyber security", "phishing", "malicious"], "pulses": ["IOC Records Provided by @NextRayAI", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOC Records \u2192Provided by @NextRayAI", "HIVE           (Pulse created by RVS_i_am)", "HIVE           (Pulse created by RVS_i_am)", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "IOC Records \u2192Provided by @NextRayAI", "IOC Records \u2192Provided by @NextRayAI"], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["cpointsoftware.club", "netcentersupp.com", "www.netcentersupp.com", "helpcenterneta.com"]}


ioc_type: ipv4
ioc_value: 176.123.3.11
source: otx
validated_at: 2026-05-30T00:14:07.012194
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.3.11", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 32, "malware_samples": [], "passive_dns": ["zeeen-rec.click", "zeenit-echarge.click", "thezee-rech.click", "stccrehc-st.click", "thezeenfastcard.click", "thezeenfast.click", "rechaoredoo.click", "rechazaine.click", "mykweeetzain.one", "trannyday.com", "c4v5.com", "bwbbitget.digital", "btget-marchan.com", "paraleell.com", "pendle-app-seths.com", "beoble-chat.app", "ftp.cryptoholm.com", "www.cryptoholm.com", "www.myfavestore.com", "cryptoholm.com"]}


ioc_type: ipv4
ioc_value: 176.123.3.17
source: otx
validated_at: 2026-05-30T00:14:20.417078
raw_response:
  {"pulse_count": 5, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.3.17", "tags": ["ssh", "sipvicious", "sip", "scan"], "pulses": ["Automated Threat Intelligence - Scanning hosts for 2024-02-27", "ETIC Cybersecurity  2024-02-29  Port Scan", "ETIC Cybersecurity  2024-02-28  Port Scan", "ETIC Cybersecurity  2024-02-27  Port Scan", "ETIC Cybersecurity  2024-02-26  Port Scan"], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["nl.onlinecasinosspelen.com", "pavementsmaterials.co.za", "www.pavementsmaterials.co.za"]}


ioc_type: ipv4
ioc_value: 176.123.3.18
source: otx
validated_at: 2026-05-30T00:14:28.041577
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.3.18", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 27, "malware_samples": [], "passive_dns": ["oneezaiinit.one", "charge-oredoos.click", "maio-miiertkh.one", "themokhfaret.one", "recharggee-oreedo.one", "keemiiertkh.one", "maiiei-mer.one", "maio-moigervv.one", "mai-moigerv.one", "rechargee-ooreedo.one", "rechaige-ooredoo.one", "recharg-ooredoo.one", "recharge-ooredo.one", "recharge-ooredoo.one", "kwe-mokhlg.one", "kwe-mokhlgov.one", "kwmed-gevv.one", "fahess.one", "kmeroitkw.one", "kwmed-gevv.com"]}


ioc_type: ipv4
ioc_value: 176.123.4.10
source: otx
validated_at: 2026-05-30T00:15:05.018709
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.4.10", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 14, "malware_samples": [], "passive_dns": ["practical-varahamihira.176-123-4-10.plesk.page", "belt-discount.com", "www.176-123-4-10.cprapid.com", "www.site.cccinfo.bg", "site.cccinfo.bg", "eh.cccinfo.bg", "www.eh.cccinfo.bg", "www.cloud.cccinfo.bg", "cloud.cccinfo.bg", "whm.cccinfo.bg", "www.cccinfo.bg", "cccinfo.bg", "176-123-4-10.cprapid.com", "snoutacid.net"]}


ioc_type: ipv4
ioc_value: 176.123.4.19
source: otx
validated_at: 2026-05-30T00:15:10.865067
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.4.19", "tags": [], "pulses": ["IOCs - 20231221216 - ANIA Threat Feeds - IP Segment 1", "IOCs - 202312162226 - ANIA Threat Feeds - IP Segment 1"], "malware_count": 0, "passive_dns_count": 23, "malware_samples": [], "passive_dns": ["www.portal.nsglobalfx.com", "portal.nsglobalfx.com", "portal.areanglobal.com", "www.crm.amxermarkets.com", "crm.amxermarkets.com", "portal.stptrade.co", "forexcis.com", "www.crm.forexcis.com", "crm.forexcis.com", "portal.xcelfxtrading.com", "www.portal.xcelfxtrading.com", "www.portal.excelfxmarket.com", "portal.excelfxmarket.com", "portal.forexliquidity.biz", "www.portal.forexliquidity.biz", "www.portal.shakemarkets.com", "portal.shakemarkets.com", "portal.maxusmarket.com", "www.portal.maxusmarket.com", "www.portal.tradingmarketspro.com"]}


ioc_type: ipv4
ioc_value: 176.123.8.2
source: otx
validated_at: 2026-05-30T00:15:32.574409
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.2", "tags": ["tsec", "honeypot", "tpot19", "la-safe.org"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 50, "malware_samples": [], "passive_dns": ["theotherindia.org", "signin-hilumia.com", "rewards-wbt.com", "register-mdvmm.com", "protocol-layerzero.com", "protocol-zksync.com", "register-degods.com", "register-premlnt.com", "allocation-zksync.com", "register-premlnt.xyz", "claim-starkware.com", "signin-layerzero.com", "roadmap-zksync.com", "joln-zksync.com", "waitlist-openai.com", "clalm-wbtc.com", "connect-tether.com", "reward-safemoon.com", "connect-klubx.com", "rewards-zksync.com"]}


ioc_type: ipv4
ioc_value: 176.123.8.5
source: otx
validated_at: 2026-05-30T00:15:51.832091
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.5", "tags": ["Nextray", "anonymization_network", "ioc", "cyber security", "phishing", "malicious"], "pulses": ["IOC Records Provided by @NextRayAI", "Anonymization_Network | Apr 11, 2026 | Part 3/5", "Anonymization_Network | Apr 10, 2026 | Part 3/5", "Anonymization_Network | Apr 9, 2026 | Part 3/5", "Anonymization_Network | Apr 8, 2026 | Part 3/5", "Anonymization_Network | Apr 7, 2026 | Part 3/5", "Anonymization_Network | Apr 6, 2026 | Part 3/5", "Anonymization_Network | Apr 5, 2026 | Part 3/5", "Anonymization_Network | Apr 4, 2026 | Part 3/5", "Anonymization_Network | Apr 3, 2026 | Part 3/5", "Anonymization_Network | Apr 2, 2026 | Part 3/5", "Anonymization_Network | Apr 1, 2026 | Part 3/5", "Anonymization_Network | Mar 31, 2026 | Part 3/5", "Anonymization_Network | Mar 30, 2026 | Part 3/5", "Anonymization_Network | Mar 30, 2026 | Part 3/5", "Anonymization_Network | Mar 28, 2026 | Part 3/5", "Anonymization_Network | Mar 25, 2026 | Part 3/5", "Anonymization_Network | Mar 25, 2026 | Part 3/5", "Anonymization_Network | Mar 25, 2026 | Part 3/5", "Anonymization_Network | Mar 24, 2026 | Part 3/5"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 176.123.8.6
source: otx
validated_at: 2026-05-30T00:15:56.510107
raw_response:
  {"pulse_count": 19, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.6", "tags": ["license", "honeypot", "tsec", "scanner", "tpot19", "sql inyection", "botnet", "la-safe.org"], "pulses": ["Suspicious IPs detected in honeypot", "ETIC Cybersecurity 2023-10-22 Port Scan", "ETIC Cybersecurity 2023-10-30 Port Scan", "ETIC Cybersecurity 2023-10-29 Port Scan", "ETIC Cybersecurity 2023-10-28 Port Scan", "ETIC Cybersecurity 2023-10-27 Port Scan", "ETIC Cybersecurity 2023-10-26 Port Scan", "ETIC Cybersecurity 2023-10-25 Port Scan", "ETIC Cybersecurity 2023-10-24 Port Scan", "ETIC Cybersecurity 2023-10-23 Port Scan", "ETIC Cybersecurity 2023-10-21 Port Scan", "ETIC Cybersecurity 2023-10-20 Port Scan", "ETIC Cybersecurity 2023-10-19 Port Scan", "ETIC Cybersecurity 2023-11-04 Port Scan", "ETIC Cybersecurity 2023-09-12 Port Scan", "ETIC Cybersecurity 2023-09-09 Port Scan", "IOCs - 2023117226 - ANIA Threat Feeds - IP Segment 7", "LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 5, "malware_samples": [], "passive_dns": ["gomovies.sk", "mydashbox.one", "uhdtv.xyz", "nephrink.com", "dornebstran.com"]}


ioc_type: ipv4
ioc_value: 176.123.8.8
source: otx
validated_at: 2026-05-30T00:16:16.855853
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.8", "tags": ["tsec", "honeypot", "tpot19", "la-safe.org"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 1, "passive_dns_count": 154, "malware_samples": ["d32ab9e6756ee5eb17accd106ccc544280784d1b4e0da4a6ae32889c478d3da2"], "passive_dns": ["tbjzl.shop", "patoowardmerch.shop", "anime-sword.com", "danaigurira.shop", "thecasestudyofvanitas.shop", "bradleymartyn.shop", "trinityseven.shop", "lalafanfanshop.com", "patriciamerch.shop", "28yearslater.shop", "angelbeats.shop", "bsimone.shop", "machinegunkellymerch.shop", "undeadunluck.shop", "kamitsubakicityunderconstruction.shop", "xavierwoods.shop", "sixdaysinfallujah.shop", "elsbeth.shop", "kirbyplush.com", "minionplush.com"]}


ioc_type: ipv4
ioc_value: 176.123.8.27
source: otx
validated_at: 2026-05-30T00:17:12.780122
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.27", "tags": ["tsec", "honeypot", "tpot19", "la-safe.org"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 42, "malware_samples": [], "passive_dns": ["ns3.hostcreed.com", "ns4.hostcreed.com", "harmonystrusts.com", "chitechstores.top", "worldhallfinance.com", "sentaratrust.com", "fincorpia.com", "www.heritageedgeb.com", "assured-cryptogains.com", "trusteeconvenient.net", "alpha-harshes.com", "acle-da.com", "unitedfstunion.com", "sparkonline.top", "indexoctafunds.com", "silverspringbank.com", "xmaceminalpool.com", "pdocupload.com", "heritageedgeb.com", "globalswiftbanking.com.prosteroidswarehouse.com"]}


ioc_type: ipv4
ioc_value: 176.123.8.28
source: otx
validated_at: 2026-05-30T00:17:15.278167
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.28", "tags": ["tsec", "honeypot", "tpot19", "la-safe.org"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 7, "malware_samples": [], "passive_dns": ["akhbarkalaan.com", "www.yallashoot.sportnewsps.com", "nile4.com", "www.nile4.com", "yalla-shoot-match.com", "sportnewsps.com", "blueh.online"]}


ioc_type: ipv4
ioc_value: 176.123.8.37
source: otx
validated_at: 2026-05-30T00:17:58.785340
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.37", "tags": ["tsec", "honeypot", "tpot19", "la-safe.org"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 27, "malware_samples": [], "passive_dns": ["mail.176-123-8-37.cprapid.com", "www.176-123-8-37.cprapid.com", "176-123-8-37.cprapid.com", "kufd.sale", "www.healthcode-mohp-gov-eg.com", "healthcode-mohp-gov-eg.com", "results.almokhtabor.com", "www.results.almokhtabor.com", "almokhtabor.com", "www.almokhtabor.com", "test2.clobresults-mohp-gov-eg.com", "www.test2.clobresults-mohp-gov-eg.com", "www.clobresults-mohp-gov-eg.com", "clobresults-mohp-gov-eg.com", "api.clobresults-mohp-gov-eg.com", "www.api.clobresults-mohp-gov-eg.com", "www.elkasraleiny.com", "api.elkasraleiny.com", "www.api.elkasraleiny.com", "elkasraleiny.com"]}


ioc_type: ipv4
ioc_value: 176.123.8.38
source: otx
validated_at: 2026-05-30T00:18:01.501352
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.38", "tags": ["tsec", "honeypot", "tpot19", "la-safe.org"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 31, "malware_samples": [], "passive_dns": ["www.unstoppablemedia.io", "www.apps.unstoppableiptv.com", "jusinnovations.com", "unstoppablemedia.io", "allpointiptv.com", "www.resellerpanelpro.com", "resellerpanelpro.com", "allpointvpn.com", "www.milehightvservice.com", "milehightvservice.com", "redpilliptv.com", "www.redpilliptv.com", "www.voipresellerpanel.com", "voipresellerpanel.com", "unstoppableiptv.com", "iptvdnspanel.com", "www.176-123-8-38.cprapid.com", "host.privacy-host.com", "176-123-8-38.cprapid.com", "privacy-host.com"]}


ioc_type: ipv4
ioc_value: 176.123.8.40
source: otx
validated_at: 2026-05-30T00:18:06.448714
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.40", "tags": ["auto-generated security"], "pulses": ["jan2,2025 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2.2025clone-Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan 2 25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan 2 25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan 2 25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan 2 25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan 2 25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan 2 25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "1/2/25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "1/2/25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "1/2/25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "1/2/25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "1/2/25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2,2025 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2,2025 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2.2025clone-Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2.2025clone-Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2.2025clone-Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2.2025clone-Auto-generated Pulse C


ioc_type: ipv4
ioc_value: 176.123.8.48
source: otx
validated_at: 2026-05-30T00:18:41.539566
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.48", "tags": ["anonymization_network"], "pulses": ["Anonymization_Network | Apr 30, 2026 | Part 4/5", "Anonymization_Network | Apr 30, 2026 | Part 1/5", "Anonymization_Network | Apr 29, 2026 | Part 4/5", "Anonymization_Network | Apr 29, 2026 | Part 1/5", "Anonymization_Network | Apr 28, 2026 | Part 4/5", "Anonymization_Network | Apr 28, 2026 | Part 1/5", "Anonymization_Network | Apr 27, 2026 | Part 4/5", "Anonymization_Network | Apr 27, 2026 | Part 1/5", "Anonymization_Network | Apr 26, 2026 | Part 4/5", "Anonymization_Network | Apr 26, 2026 | Part 1/5", "Anonymization_Network | Apr 25, 2026 | Part 4/5", "Anonymization_Network | Apr 25, 2026 | Part 1/5", "Anonymization_Network | Apr 24, 2026 | Part 4/5", "Anonymization_Network | Apr 24, 2026 | Part 1/5", "Anonymization_Network | Apr 23, 2026 | Part 1/5", "Anonymization_Network | Apr 23, 2026 | Part 4/5", "Anonymization_Network | Apr 22, 2026 | Part 4/5", "Anonymization_Network | Apr 22, 2026 | Part 1/5", "Anonymization_Network | Apr 21, 2026 | Part 4/5", "Anonymization_Network | Apr 21, 2026 | Part 1/5"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 176.123.8.53
source: otx
validated_at: 2026-05-30T00:18:47.520829
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.53", "tags": ["tsec", "honeypot", "tpot19", "la-safe.org"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 9, "malware_samples": [], "passive_dns": ["libgen.li", "boring-jennings.176-123-8-53.plesk.page", "tutele.nl", "tutele.sx", "rbca1bay.com", "www.rbca1bay.com", "secureweb-ca.tel", "www.dogo.host", "dogo.host"]}


ioc_type: ipv4
ioc_value: 176.123.8.86
source: otx
validated_at: 2026-05-30T00:21:43.434336
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.86", "tags": ["honeypot", "tsec", "tpot19", "la-safe.org", "TOR", "VPN"], "pulses": ["LCIA:HoneyNet:2022", "test", "test", "test", "test", "test", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 24, "malware_samples": [], "passive_dns": ["b-promax-dash.website", "818ultrabet.com", "vdcasin0814.com", "pepebarbie.app", "www.resim.aylakmarket.com.tr", "resim.aylakmarket.com.tr", "www.simsekdekorasyon.ml.fayansseramikustasi.com.tr", "simsekdekorasyon.ml", "www.simsekdekorasyon.ml", "simsekdekorasyon.ml.fayansseramikustasi.com.tr", "leibnb.app", "www.leibnb.app", "freyjatoken.app", "www.freyjatoken.app", "galiotoken.com", "puffbarroyal.com", "www.puffbarroyal.com", "www.mcsmedya3.pw", "mail.mcsmedya3.pw", "mcsmedya3.pw"]}


ioc_type: ipv4
ioc_value: 176.123.8.97
source: otx
validated_at: 2026-05-30T00:23:13.857039
raw_response:
  {"pulse_count": 31, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.97", "tags": ["Nextray", "ioc", "cyber security", "phishing", "malicious"], "pulses": ["IOC Records Provided by @NextRayAI", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOC Records \u2192Provided by @NextRayAI", "HIVE           (Pulse created by RVS_i_am)", "HIVE           (Pulse created by RVS_i_am)", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "IOC Records \u2192Provided by @NextRayAI", "IOC Records \u2192Provided by @NextRayAI"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 176.123.8.104
source: otx
validated_at: 2026-05-30T00:24:47.532645
raw_response:
  {"pulse_count": 34, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.104", "tags": ["Nextray", "ioc", "cyber security", "phishing", "malicious"], "pulses": ["IOC Records Provided by @NextRayAI", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOC Records \u2192Provided by @NextRayAI", "HIVE           (Pulse created by RVS_i_am)", "HIVE           (Pulse created by RVS_i_am)", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "IOC Records \u2192Provided by @NextRayAI", "IOC Records \u2192Provided by @NextRayAI"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 176.123.8.108
source: otx
validated_at: 2026-05-30T00:25:45.117317
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.108", "tags": ["tsec", "honeypot", "tpot19", "la-safe.org"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 12, "malware_samples": [], "passive_dns": ["sto71.com", "e.tradepdf.com", "libfeed.com", "www.libfeed.com", "www.iydbox.com", "iydbox.com", "libmanual.com", "www.libmanual.com", "www.tradepdf.com", "tradepdf.com", "dlmanual.com", "www.dlmanual.com"]}


ioc_type: ipv4
ioc_value: 176.123.8.117
source: otx
validated_at: 2026-05-30T00:26:16.467182
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.117", "tags": ["tsec", "honeypot", "tpot19", "la-safe.org"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 13, "malware_samples": [], "passive_dns": ["www.erorox.com", "www.adult-fans.com", "adultfans.xyz", "adultfans.vip", "adultfans.one", "adultfans.club", "adult-fans.com", "erorox.com", "exchange.sowete.emakitimed.jp.net", "mx4.sowete.emakitimed.jp.net", "webmail.sowete.emakitimed.jp.net", "sniper.sowete.emakitimed.jp.net", "mx.sowete.emakitimed.jp.net"]}


ioc_type: ipv4
ioc_value: 176.123.8.121
source: otx
validated_at: 2026-05-30T00:26:42.497257
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.121", "tags": ["tsec", "honeypot", "tpot19", "la-safe.org"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 9, "malware_samples": [], "passive_dns": ["mp3beast.cc", "www.celebjihad.me", "www.thebookcelebporn.com", "www.djafromovies.online", "djafromovies.online", "kenyandj.com", "www.176-123-8-121.cprapid.com", "176-123-8-121.cprapid.com", "sizonizilizotafsiri.lol"]}


ioc_type: ipv4
ioc_value: 176.123.8.130
source: otx
validated_at: 2026-05-30T00:27:01.550274
raw_response:
  {"pulse_count": 6, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.130", "tags": ["Stealer", "honeypot", "tsec", "size", "tpot19", "la-safe.org", "sha1", "sha256", "C2", "RedLine"], "pulses": ["readline", "readline", "RedLine Stealer C2 Collection - 2021 -2023", "LCIA:HoneyNet:2022", "RedLine Stealer", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["gelecekelinde.com", "www.gelecekelinde.com", "lecitadelayed.com", "croasteis.com"]}


ioc_type: ipv4
ioc_value: 176.123.8.137
source: otx
validated_at: 2026-05-30T00:27:37.132928
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.137", "tags": ["tsec", "honeypot", "tpot19", "la-safe.org"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 12, "malware_samples": [], "passive_dns": ["minio-a0g8ks4co0go8s08sgsg4cww.176.123.8.137.sslip.io", "snuzzshop.com", "www.nationalreview.top", "voandoparaportugal.com", "www.voandoparaportugal.com", "www.mailsg.voandoparaportugal.com", "mailsg.voandoparaportugal.com", "www.fn-super.top", "fn-super.top", "ckgods.xyz", "ckkopls.xyz", "www.ckkopls.xyz"]}


ioc_type: ipv4
ioc_value: 176.123.8.141
source: otx
validated_at: 2026-05-30T00:27:45.720527
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.141", "tags": ["tsec", "honeypot", "tpot19", "la-safe.org"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 17, "malware_samples": [], "passive_dns": ["www.day-trader-zone.com", "www.c4sale.me", "www.zyenom.com", "www.trading-library.net", "store.c4sale.net", "www.daytradersdvds.com", "www.dlsub.com", "store.tc4s.net", "www.tc4s.net", "www.c4sale.net", "store.pdc4s.com", "www.invest-dvd.com", "cashcowtraders.com", "store.zyenom.com", "sleutelgereedschapverkoop.com", "goodhousehold-store.com", "hometoolsstoreus.com"]}


ioc_type: ipv4
ioc_value: 176.123.8.148
source: otx
validated_at: 2026-05-30T00:28:12.742901
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.148", "tags": ["tsec", "honeypot", "tpot19", "la-safe.org"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 157, "malware_samples": [], "passive_dns": ["www.turkzon.ru", "turkzon.ru", "turokiru.ru", "turkitop.fun", "www.turokstore.ru", "www.turkitop.fun", "www.turoklife.ru", "www.turokfilm.ru", "turokfilm.ru", "www.turokiru.ru", "turoklife.ru", "turokstore.ru", "turokhd.ru", "www.turok-heart.ru", "turok-heart.ru", "www.turokhd.ru", "movie-lords.ru", "turki-serial.fun", "www.turki-serial.fun", "kawaiitoon.fun"]}


ioc_type: ipv4
ioc_value: 176.123.8.154
source: otx
validated_at: 2026-05-30T00:28:54.016387
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.154", "tags": ["honeypot", "tsec", "udp", "la-safe.org", "tcp", "port-scan", "Honeypot", "admin", "tpot19", "Malicious IP", "UPnP", "botnet", "win", "blacklist", "NTP", "windows", "nmap", "mirai", "scan", "Bruteforce", "RDP"], "pulses": ["CROSS-BORDER HACK-FOR-HIRE CAMPAIGN TARGETING CIVIL SOCIETY IN MENA", "LCIA:HoneyNet:2023", "LCIA:HoneyNet:February 2023", "Scan port 1900 UPnP (S3#)", "Scan port 123 NTP (S3#)", "Lion Team_Honeypots_Bruteforce_Source_IP 2023/02/07", "nmap Scanning Hosts for 2023-02-06", "Scan port 3389 RDP (S3#)", "LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["microcutendmill.com", "namidm.com", "bhdm3.cc"]}


ioc_type: ipv4
ioc_value: 176.123.8.155
source: otx
validated_at: 2026-05-30T00:28:57.218002
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.155", "tags": ["tsec", "honeypot", "tpot19", "la-safe.org"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 35, "malware_samples": [], "passive_dns": ["hivetoon.net", "growthgenerator.org", "filezone.info", "jobsonlinese.xyz", "unlock0.com", "boutiqueprive.shop", "robuxmod.live", "verifyyou.net", "verifyus.net", "getunlocked.top", "unlocker24.org", "topunlocker.net", "unlockedhub.club", "webfile24.com", "unlocklocker.info", "gamefix.live", "expresshub.net", "snapverify.xyz", "swift-file.net", "fastverify.info"]}


ioc_type: ipv4
ioc_value: 176.123.8.157
source: otx
validated_at: 2026-05-30T00:29:00.192419
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.157", "tags": ["tsec", "honeypot", "tpot19", "la-safe.org"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 33, "malware_samples": [], "passive_dns": ["hometeethwhitening.u-dns.net", "growthgenerator.org", "private-mirror.cplb4.com", "peco7.xyz", "rbxya.com", "yudaprata.tk", "unlocklocker.info", "filezone.info", "webfile24.com", "unlockedhub.club", "gamefix.live", "getunlocked.top", "verifyus.net", "verifyyou.net", "mediafaire.ga", "catlinne.com", "moody655.xyz", "swift-file.net", "filegroup.net", "filecenter.info"]}


ioc_type: ipv4
ioc_value: 94.103.188.14
source: otx
validated_at: 2026-05-30T06:05:24.188673
raw_response:
  {"pulse_count": 45, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS200019 alexhost srl", "indicator": "94.103.188.14", "tags": ["msi file", "utf8", "zip archive", "currc3adculo", "malspam email", "from email", "associated", "headers", "tuesday", "anna paula"], "pulses": ["test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test", "test", "test"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 94.103.188.28
source: otx
validated_at: 2026-05-30T06:05:45.906116
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS200019 alexhost srl", "indicator": "94.103.188.28", "tags": ["honeypot", "la-safe.org", "tpot19", "tsec"], "pulses": ["LCIA:HoneyNet:2023", "LCIA:HoneyNet:March 2023"], "malware_count": 0, "passive_dns_count": 7, "malware_samples": [], "passive_dns": ["infinitylearners.com", "fin-plan.tech", "johnsonsales.shop", "gouv.antai-reglements-amendes.com", "charming-bohr.94-103-188-28.plesk.page", "neamared.com", "notification803bupe9.info"]}


ioc_type: ipv4
ioc_value: 176.123.8.47
source: otx
validated_at: 2026-05-30T06:06:02.168221
raw_response:
  {"pulse_count": 31, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.47", "tags": ["malicious", "Nextray", "cyber security", "phishing", "ioc"], "pulses": ["IOC Records Provided by @NextRayAI", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOC Records \u2192Provided by @NextRayAI", "HIVE           (Pulse created by RVS_i_am)", "HIVE           (Pulse created by RVS_i_am)", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "IOC Records \u2192Provided by @NextRayAI", "IOC Records \u2192Provided by @NextRayAI"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 176.123.8.199
source: otx
validated_at: 2026-05-30T06:10:17.303199
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.199", "tags": ["honeypot", "la-safe.org", "tpot19", "tsec"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 9, "malware_samples": [], "passive_dns": ["www.server.movietv4u.com", "www.solarmovie.movietv4u.com", "www.vioox2198.movietv4u.com", "www.yifyhq.movietv4u.com", "movietv4u.com", "tokyojapan.top", "www.ukbenzos.com", "ukbenzos.com", "l0a3e98c.justinstalledpanel.com"]}


ioc_type: ipv4
ioc_value: 176.123.8.205
source: otx
validated_at: 2026-05-30T06:10:49.343521
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.205", "tags": ["honeypot", "la-safe.org", "tpot19", "tsec"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 32, "malware_samples": [], "passive_dns": ["patoala.com", "www.zendug.com", "wellnev.com", "formulareview.online", "www.formulareview.online", "pes21.zendug.com", "www.obyso.com", "www.scuris.com", "www.hidated.com", "www.topyon.com", "www.welltary.com", "scuris.com", "welltary.com", "topyon.com", "www.hikurt.com", "zendug.com", "flotak.com", "www.eveits.com", "www.deulas.com", "obyso.com"]}


ioc_type: ipv4
ioc_value: 176.123.8.212
source: otx
validated_at: 2026-05-30T06:11:47.686757
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.212", "tags": ["honeypot", "la-safe.org", "tpot19", "tsec"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 10, "malware_samples": [], "passive_dns": ["speedtest.gplayer.uk", "nzbget.gplayer.uk", "jacket.gplayer.uk", "torrent.gplayer.uk", "radarr.gplayer.uk", "sabnzbd.gplayer.uk", "mellow.gplayer.uk", "ombi.gplayer.uk", "sonarr.gplayer.uk", "lady.fusevfe.us"]}


ioc_type: ipv4
ioc_value: 176.123.8.214
source: otx
validated_at: 2026-05-30T06:11:59.033519
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.214", "tags": ["honeypot", "la-safe.org", "tpot19", "tsec"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 13, "malware_samples": [], "passive_dns": ["123movies-fy.com", "md.game.apeweb.uk", "cpcontacts.iily.cc", "cpcalendars.iily.cc", "gplayer.uk", "printingparts.uk", "farnell.org.uk", "iily.cc", "www.3dlondon.org", "3dlondon.org", "md.mail.bband.net", "md.cpanel.bband.net", "3dlondon.org.bband.net"]}


ioc_type: ipv4
ioc_value: 176.123.8.215
source: otx
validated_at: 2026-05-30T06:12:03.466625
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.215", "tags": ["honeypot", "la-safe.org", "tpot19", "tsec"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 8, "malware_samples": [], "passive_dns": ["audiobook.bband.net", "filesend.bband.net", "bitwarden.bband.net", "cms.apeweb.uk", "transfer.bband.net", "image.bband.net", "speedtest.free.gplayer.uk", "free.gplayer.uk"]}


ioc_type: ipv4
ioc_value: 176.123.8.219
source: otx
validated_at: 2026-05-30T06:12:06.665815
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.219", "tags": ["honeypot", "la-safe.org", "tpot19", "tsec"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 51, "malware_samples": [], "passive_dns": ["eos-uniswap.com", "www.eos-uniswap.com", "www.eosuniswap.com", "eosuniswap.com", "www.eos-uniswap.org", "eos-uniswap.org", "ll-78736635.online", "rodi-47746644.site", "rodi-9488574.site", "rodi-47746477.site", "ll-78736635.biz", "ll-78736635.site", "dd-738746635.biz", "dd-738746635.com", "dd-738746635.org", "dd-738746635.net", "qq-98377366.biz", "qq-98377366.org", "e-s-ho-stalia-s6.us", "e-s-ho-stalia-s4.us"]}


ioc_type: ipv4
ioc_value: 176.123.8.228
source: otx
validated_at: 2026-05-30T06:12:28.103508
raw_response:
  {"pulse_count": 8, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.228", "tags": ["win64", "adrecon", "pixel", "media", "windows nt", "host", "accept", "push", "khtml", "tpot19", "hive leaks", "config", "hive ransomware", "la-safe.org", "hive", "msie", "honeypot", "msoffice", "cookie", "tsec", "post", "gecko", "masp", "cobalt strike", "ransom", "android", "explorer", "boie9", "wow64"], "pulses": ["Hive Attacks: Analysis of the Human-Operated Ransomware Targeting Healthcare", "LCIA:HoneyNet:2022", "Cobal Strike - IOCs", "Cobalt Strike", "LCIA:HoneyNet:June 2022", "Hive Attacks | Analysis of the Human-Operated Ransomware Targeting Healthcare", "Hive Attacks", "Cobalt Strike servers tracked by The DFIR Report"], "malware_count": 0, "passive_dns_count": 9, "malware_samples": [], "passive_dns": ["s11.sharewood.forum", "m1.megasliv.one", "m2.megasliv.one", "www.m2.megasliv.one", "kontinent.info", "www.kontinent.info", "sharewood.forum", "1movietv.com", "176.123.8.228"]}


ioc_type: ipv4
ioc_value: 176.123.8.241
source: otx
validated_at: 2026-05-30T06:12:55.366005
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.241", "tags": ["honeypot", "la-safe.org", "tpot19", "tsec"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 7, "malware_samples": [], "passive_dns": ["bold-lamport.176-123-8-241.plesk.page", "rokettubenew.com", "linktek365.com", "jolly-pasteur.176-123-8-241.plesk.page", "crackingpro.com", "srv.imagehost.headspace-v2.to", "imagehost.headspace-v2.to"]}


ioc_type: ipv4
ioc_value: 176.123.8.245
source: otx
validated_at: 2026-05-30T06:13:00.894730
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.245", "tags": ["ransomware", "lambda", "credentials", "Compromised", "extortion", "threattype/Data Extortion", "impact", "threattype/Data Theft", "service", "mitre att", "target", "tpot19", "confidential p", "unit", "ukraine", "la-safe.org", "figure", "scanning", "hash", "protect", "cortex xdr", "Credentials", "Automation", "industries/All Industries", "aws", "threattype/Access Keys", "cloud", "iam role", "honeypot", "addcolumn", "AWS", "Extortion", "tsec", "sha256", "threattype/Cloud Environments", "technology/Amazon Web Services (AWS)", "s3 bucket", "Scanning", "ransom", "automation", "Cloud", "createrole", "prisma cloud", "defender", "compromised", "aws account", "classification", "threattype/Data Destruction", "threattype/Exposed Files"], "pulses": ["Leaked Environment Variables Allow Large-Scale Extortion Operation of Cloud Environments", "C&C-IP-List", "Extortion Campaign Compromised and Extorted Victim Organizations", "Cloud Extortion Campaign Leverages Exposed .env Files for Access, Data Theft, and Destruction", "Leaked Environment Variables Allow Large-Scale Extortion Operation of Cloud Environments", "Cloud Environments Under Siege: Extortionists Exploit Exposed Credentials", "Cloud Environments Under Siege: Extortionists Exploit Exposed Credentials", "Cloud Environments Under Siege: Extortionists Exploit Exposed Credentials", "LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 176.123.8.251
source: otx
validated_at: 2026-05-30T06:13:43.929781
raw_response:
  {"pulse_count": 5, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.251", "tags": ["sip", "sipvicious", "scan", "la-safe.org", "honeypot", "ssh", "tpot19", "tsec"], "pulses": ["Automated Threat Intelligence - Scanning hosts for 2024-03-07", "ETIC Cybersecurity  2024-03-07  Port Scan", "ETIC Cybersecurity  2024-03-06  Port Scan", "LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 7, "malware_samples": [], "passive_dns": ["craiggeinc.org", "link.apps-test.org", "apps-test.org", "footfetishcave.com", "downloadcias.com", "onlyfootjobs.com", "eontaysstrangerocks.xyz"]}


ioc_type: ipv4
ioc_value: 194.102.104.20
source: otx
validated_at: 2026-05-30T06:23:47.482501
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Romania", "country_code": "RO", "city": null, "asn": "ASNone ", "indicator": "194.102.104.20", "tags": ["sftp", "honeytrap", "malicious", "ssh", "cowrie", "LAMP"], "pulses": ["Malware Filter - Botnet List - 05-09-2025", "LCIA HoneyNet Data - August 2025 - Cowrie"], "malware_count": 1, "passive_dns_count": 3, "malware_samples": ["a0dc3fe6e1fc5c5f564be288241de150191cad88f3c0932f4c75dddb6600cc33"], "passive_dns": ["mgttre.site", "interactivebrokers-secure10.help", "gyztah.online"]}


ioc_type: ipv4
ioc_value: 194.102.104.25
source: otx
validated_at: 2026-05-30T06:24:15.035219
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Romania", "country_code": "RO", "city": null, "asn": "ASNone ", "indicator": "194.102.104.25", "tags": ["", "Pegasus", "KraktenRAT", "32-bit", "sshdkit", "strong", "moobot", "CoinMiner", "protect", "powershell", "api contact", "Brute_Ratel_C4", "SnakeKeylogger", "DBatLoader", "connectwise", "c2-monitor-auto", "sentinel misp", "C2", "ransomware feed", "linkedin page", "PureLogStealer", "SocGholish", "Lazagne", "Deimos", "Lumma", "AsyncRAT", "Bert", "compromise", "sh", "LummaStealer", "Ransomware", "nanocore rat", "mips", "WsgiDAV", "feed", "cobalt", "gafgyt", "dll", "rev-base64-loader", "ps1", "Qakbot", "cobalt strike", "RemcosRAT", "Donut", "hajime", "Remcos", "Hookbot", "Sliver", "RedLineStealer", "precisionsec"], "pulses": ["urlhaus 30days", "Cobalt Strike Indicators of Compromise (IOC) Feed - PrecisionSec - Tracking 2025", "ThreatFix", "Twitter Feed - drb_ra - 15-07-2025", "Twitter Feed - drb_ra - 13-07-2025", "Twitter Feed - drb_ra - 13/07/2025 {by CyberHunterAutoFeed}", "URLHaus data - 23-05-2025", "Threatfox Recent Additions", "Twitter Feed - drb_ra - 07-05-2025"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["mte-rify.co"]}


ioc_type: ipv4
ioc_value: 91.186.210.14
source: otx
validated_at: 2026-05-30T06:26:14.845554
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS59432 ginernet s.l.", "indicator": "91.186.210.14", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 14, "malware_samples": [], "passive_dns": ["scribdfulldescription.my.id", "parentspriviledge.info", "newspiritmagazine.info", "artschools.online", "streamingvideo.info", "hobartbaking.info", "scribdfulldescription.store", "scribdfulldescription.shop", "friendly-party.website", "traffic-management.website", "traffic-management.online", "friendly-party.online", "continue-premier.online", "halllife.online"]}


ioc_type: ipv4
ioc_value: 176.123.8.138
source: otx
validated_at: 2026-05-30T12:10:35.332444
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.138", "tags": ["tsec", "honeypot", "tpot19", "la-safe.org"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 11, "malware_samples": [], "passive_dns": ["chicciel.eu", "www.chicciel.eu", "www.chicciel.com", "katana-sword.au", "www.katana-sword.au", "chicciel.com", "mail.shop-lidls.com", "parkside-fr.com", "parksides-espana.com", "shop-lidls.com", "www.shop-lidls.com"]}


ioc_type: ipv4
ioc_value: 176.123.8.139
source: otx
validated_at: 2026-05-30T12:10:44.620359
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.139", "tags": ["tsec", "honeypot", "tpot19", "la-safe.org"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 9, "malware_samples": [], "passive_dns": ["littlesisterai.com", "www.descargas.jekoso.com", "lolitok.com", "megudolls.com", "jekoso.net", "vipi.jekoso.com", "descargas.jekoso.com", "jekoso.com", "sister-neia.com"]}


ioc_type: ipv4
ioc_value: 176.123.8.224
source: otx
validated_at: 2026-05-30T12:11:25.680213
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS200019 alexhost srl", "indicator": "176.123.8.224", "tags": ["tsec", "honeypot", "tpot19", "la-safe.org"], "pulses": ["LCIA:HoneyNet:2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 29, "malware_samples": [], "passive_dns": ["skillbox.vip", "s53.prosliv.com", "www.s53.prosliv.com", "www.realnoe.net", "prosliv.com", "www.prosliv.com", "www.s39.prosliv.com", "s39.prosliv.com", "www.s44.prosliv.com", "s44.prosliv.com", "www.s29.prosliv.com", "s29.prosliv.com", "realnoe.net", "www.s1.slivmax.com", "s34.prosliv.com", "www.s34.prosliv.com", "s38.prosliv.com", "www.s38.prosliv.com", "s1.slivmax.com", "s2.slivmax.com"]}


ioc_type: ipv4
ioc_value: 94.103.188.18
source: otx
validated_at: 2026-05-30T12:21:00.578677
raw_response:
  {"pulse_count": 12, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS200019 alexhost srl", "indicator": "94.103.188.18", "tags": ["cowrie", "tanner", "attacker-ip", "dionaea", "botnet", "honeypot", "digital ocean", "vultr", "portscan", "adb", "sentrypeer", "scanners", "bruteforce", "sensor-tagged", "automated", "scanner", "android", "mailoney", "suricata", "voidtrap", "p0f", "honeytrap", "tpot", "dropper", "telnet", "fatt"], "pulses": ["Honeypot Data \u2013 T-Pot - Sydney, Australia - March 2026", "ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026", "DigitalOcean Toronto (CA) TELNET Bruteforce Hosts for 2026-03-29", "DigitalOcean Toronto (CA) Port Scanning Hosts for 2026-03-29", "Vultr Paris (France) Port Scanning Hosts for 2026-03-21", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-03-21", "DigitalOcean Singapore Port Scanning Hosts for 2026-03-21", "DigitalOcean London (UK) Port Scanning Hosts for 2026-03-21", "VoidTrap Live Threat Feed \u2014 2026-03-21", "Vultr Paris (France) Port Scanning Hosts for 2026-03-20", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-03-20", "DigitalOcean Toronto (CA) Port Scanning Hosts for 2026-03-20"], "malware_count": 0, "passive_dns_count": 8, "malware_samples": [], "passive_dns": ["w-ceb.com", "web8mallsed.xyz", "zecx.w-ceb.com", "waitaqolang.com", "facturetabonement.blogdns.org", "clientetfacturation.webhop.org", "abonnementclients.webhop.org", "sataani.lol"]}


ioc_type: ipv4
ioc_value: 144.172.112.30
source: otx
validated_at: 2026-05-30T12:30:29.716579
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS213122 hyonix llc", "indicator": "144.172.112.30", "tags": [], "pulses": ["Malware Filter - Botnet List - 16-03-2026 (Part 2)"], "malware_count": 0, "passive_dns_count": 13, "malware_samples": [], "passive_dns": ["www.coinbasebackup.click", "mail.coinbase-update.click", "www.backup-wallet.info", "coinbasebackup.click", "mytrust.cards", "backup-wallet.info", "mail.coinbase-backup.com", "www.rewards-activate.com", "rewards-activate.com", "auth-sumup.com", "membership-payment.info", "myn26-update.com", "rjwegnre.com"]}


ioc_type: ipv4
ioc_value: 144.172.112.211
source: otx
validated_at: 2026-05-30T12:30:58.609910
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS213122 hyonix llc", "indicator": "144.172.112.211", "tags": ["webscanner, bruteforce, web app attack", "ssh", "webscan", "cowrie", "conpot", "sftp", "LAMP", "tanner", "scanning", "honeytrap", "dionaea", "apache", "exploits", "honeypot", "probing", "ipphoney", "malicious", "heralding"], "pulses": ["Webscanners 2018-02-09  thru current day", "Ghosty", "Ghosty", "Ghosty", "LCIA HoneyNet Data - June 2025 - Tanner", "Malware Filter - Botnet List - 24-06-2025", "Apache honeypot logs for 23/Jun/2025", "20250623 Most Active Threat Indicators", "Apache honeypot logs for 19/Jun/2025"], "malware_count": 0, "passive_dns_count": 8, "malware_samples": [], "passive_dns": ["www.betasus-giriisadresi2025.com", "tr.vdcasinomadres-giris.com", "timebet-guncelgiriis.com", "setrabetgiriisyap.com", "betasus-giriisadresi2025.com", "betkoliikk.com", "vdcasinomadres-giris.com", "collections.solera1-intl.com"]}


ioc_type: ipv4
ioc_value: 144.172.112.223
source: otx
validated_at: 2026-05-30T12:31:55.423777
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS213122 hyonix llc", "indicator": "144.172.112.223", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 10, "malware_samples": [], "passive_dns": ["glcbaicu.top", "www.islamic-jo-new.com", "islamic-jo-new.com", "registration-islamic-jo.com", "reggistration-islamic-jo.com", "islamic-jo-winner.com", "islamic-winner.com", "al-islamic-winner.com", "eslamic-winner-jo.com", "hutzip.com"]}


ioc_type: ipv4
ioc_value: 193.42.11.108
source: otx
validated_at: 2026-05-30T12:33:30.507602
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Germany", "country_code": "DE", "city": null, "asn": "AS58212 php-friends gmbh", "indicator": "193.42.11.108", "tags": ["ipv62a03", "screenconnect abuse", "localappdata", "seo poisoning", "domain host", "cryptojacking", "domain hosts", "cve20132597 cve", "gpu mining", "dll sideloading", "simplerunpe", "cve20136282 cve", "process hollowing", "filehashmd5", "filehashsha1", "filehashsha256", "ip address", "dll wss", "ipv62a12", "cve20234966 cve", "redacted"], "pulses": ["From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities", "Malware Filter - Botnet List - 28-05-2026 (Part 4)", "EbeeMay2026 Pt5", "IOC - From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities"], "malware_count": 2, "passive_dns_count": 0, "malware_samples": ["5dc9e67f3add30d5e82fbaef66e12a4b6d72983814ff4d0376d3ac67a4165115", "964843d2ac9fe0a7a7f568afd29dd712e8b2b44d6ac426d961ead5416d6f1999"]}


ioc_type: ipv4
ioc_value: 5.39.220.25
source: shodan
validated_at: 2026-05-31T06:01:58.122750
raw_response:
  {"ports": [22, 25, 943, 1194, 2222, 3001, 3128, 8000, 8080, 8085, 9100, 9101, 9443], "vulns": ["CVE-2022-41317", "CVE-2020-11945", "CVE-2024-45802", "CVE-2022-41318", "CVE-2019-12519", "CVE-2020-15810", "CVE-2024-25617", "CVE-2026-33526", "CVE-2025-54574", "CVE-2024-25111", "CVE-2023-49285", "CVE-2021-28116", "CVE-2024-37894", "CVE-2023-49288", "CVE-2020-24606", "CVE-2021-31806", "CVE-2023-50269", "CVE-2021-31808", "CVE-2021-33620", "CVE-2023-46846", "CVE-2025-59362", "CVE-2026-33515", "CVE-2025-23419", "CVE-2021-28662", "CVE-2020-15049", "CVE-2023-46728", "CVE-2023-46724", "CVE-2026-32748", "CVE-2023-5824", "CVE-2021-46784", "CVE-2023-46847", "CVE-2021-28651", "CVE-2023-49286", "CVE-2020-14058", "CVE-2021-28652", "CVE-2020-25097", "CVE-2021-31807", "CVE-2020-15811", "CVE-2025-62168"], "hostnames": ["ca.rogers.yahoo.com", "brb.yahoo.net", "yahoo.com", "tw.rd.yahoo.com", "ca.my.yahoo.com", "mbp.yimg.com", "hk.rd.yahoo.com", "fr-ca.rogers.yahoo.com", "ddl.fp.yahoo.com", "s.yimg.com", "add.my.yahoo.com", "smtp.konstpic.ru"], "tags": ["vpn", "eol-product", "proxy", "starttls"], "cpes": ["cpe:/a:f5:nginx:1.25.5", "cpe:/a:getbootstrap:bootstrap", "cpe:/a:openbsd:openssh:8.2p1", "cpe:/a:squid-cache:squid:4.10", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:postfix:postfix", "cpe:/a:python:python", "cpe:/a:encode:uvicorn", "cpe:/a:apache:traffic_server", "cpe:/a:jquery:jquery:3.5.1"]}


ioc_type: ipv4
ioc_value: 45.61.130.5
source: shodan
validated_at: 2026-05-31T06:02:21.329276
raw_response:
  {"ports": [443], "vulns": [], "hostnames": ["ru-images.shop.samsung.com", "vdapi.samsung.com", "www-ams.samsung.com", "api.led.samsung.com", "sribsrch.ecom.samsung.com", "ap-author.led.samsung.com", "stg-mena-images.shop.samsung.com", "perf-prod.samsung.com", "eventapi.semiconductor.samsung.com", "download.led.samsung.com", "qapartners.sec.samsung.com", "www.samsungebiz.com", "stg-eu-images.shop.samsung.com", "adn-stg.yourservice.samsung.com", "search.led.samsung.com", "stg-ru-images.shop.samsung.com", "stg-am-images.shop.samsung.com", "stg-au2-images.shop.samsung.com", "au-images.shop.samsung.com", "org.semiconductor.samsung.com", "mena-images.shop.samsung.com", "api.semiconductor.samsung.com", "images.samsung.com", "cdn.samsung.com", "eventadm.semiconductor.samsung.com", "www.semiconductor.samsung.com", "streaming.samsung.com", "legal.samsungdm.com", "eu-images.shop.samsung.com", "am-images.shop.samsung.com", "sribsrch.ecom-qa.samsung.com", "led.samsung.com", "b2bshop.samsung.com", "api.semiconductor.samsung.cn", "semiconductor.samsung.com", "au2-images.shop.samsung.com", "ap-author.semiconductor.samsung.com", "samsung.com", "stg-au-images.shop.samsung.com", "image.semiconductor.samsung.com", "search.semiconductor.samsung.com", "cstudio.semiconductor.samsung.com", "image.led.samsung.com", "api-stg.semiconductor.samsung.cn", "image.samsung.com", "pre-prod.samsung.com", "5.130.61.45.static.cloudzy.com", "www.samsung.com", "qa.semiconductor.samsung.com", "ue-author.semiconductor.samsung.com", "download.semiconductor.samsung.com"], "tags": [], "cpes": []}


ioc_type: ipv4
ioc_value: 46.226.161.5
source: shodan
validated_at: 2026-05-31T06:02:26.659568
raw_response:
  {"ports": [22, 443], "vulns": [], "hostnames": ["au2-images.shop.samsung.com", "api.semiconductor.samsung.com", "am-images.shop.samsung.com", "awfullime.ptr.network", "stg-au2-images.shop.samsung.com", "stg-am-images.shop.samsung.com", "ue-author.semiconductor.samsung.com", "streaming.samsung.com", "qapartners.sec.samsung.com", "download.led.samsung.com", "legal.samsungdm.com", "image.semiconductor.samsung.com", "cdn.samsung.com", "qa.semiconductor.samsung.com", "ap-author.semiconductor.samsung.com", "semiconductor.samsung.com", "search.semiconductor.samsung.com", "b2bshop.samsung.com", "www.samsungebiz.com", "www-ams.samsung.com", "download.semiconductor.samsung.com", "image.led.samsung.com", "api.semiconductor.samsung.cn", "vdapi.samsung.com", "samsung.com", "api-stg.semiconductor.samsung.cn", "eventadm.semiconductor.samsung.com", "led.samsung.com", "ap-author.led.samsung.com", "search.led.samsung.com", "mena-images.shop.samsung.com", "ru-images.shop.samsung.com", "stg-ru-images.shop.samsung.com", "org.semiconductor.samsung.com", "sribsrch.ecom-qa.samsung.com", "sribsrch.ecom.samsung.com", "eu-images.shop.samsung.com", "image.samsung.com", "au-images.shop.samsung.com", "images.samsung.com", "api.led.samsung.com", "stg-mena-images.shop.samsung.com", "pre-prod.samsung.com", "stg-au-images.shop.samsung.com", "adn-stg.yourservice.samsung.com", "stg-eu-images.shop.samsung.com", "cstudio.semiconductor.samsung.com", "eventapi.semiconductor.samsung.com", "www.semiconductor.samsung.com", "perf-prod.samsung.com", "www.samsung.com"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:9.6p1"]}


ioc_type: ipv4
ioc_value: 217.69.3.218
source: otx
validated_at: 2026-05-31T12:07:22.130638
raw_response:
  {"pulse_count": 5, "reputation": 0, "country": "France", "country_code": "FR", "city": "Aubervilliers", "asn": "AS20473 the constant company  llc", "indicator": "217.69.3.218", "tags": ["picus blue", "linux", "microsoft", "javascript", "dbash", "codejoy", "el malware", "fortune", "fuente", "github", "phantom", "devnullbase64", "vs code", "socks proxy", "solana que", "studio", "koidex", "report", "code", "unicode", "shai hulud", "worm", "google calendar", "october", "openvsx y", "glassworm ataca", "glassworm", "openvsx", "koi security"], "pulses": ["GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace.", "ACTIVIDAD MALICIOSA | Relacionada con GlassWorm 21-10-2025", "GlassWorm Infects OpenVSX Extensions with Invisible Unicode Code", "CVE-2024-3400", "Twitter Feed - 500mk500 - 12-11-2022"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["vikin.party"]}


ioc_type: ipv4
ioc_value: 140.82.52.31
source: otx
validated_at: 2026-05-31T12:07:25.360252
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "France", "country_code": "FR", "city": "Aubervilliers", "asn": "AS20473 the constant company  llc", "indicator": "140.82.52.31", "tags": ["vscode", "self-propagating", "javascript", "codejoy", "fortune", "github", "phantom", "solana", "vs code", "socks proxy", "credential-theft", "koidex", "blockchain", "unicode", "shai hulud", "extension", "google calendar", "worm", "october", "glassworm", "openvsx"], "pulses": ["GlassWorm: Self-Propagating VSCode Extension Worm", "GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace.", "EbeeOct2025 Pt3"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 213.165.51.115
source: otx
validated_at: 2026-05-31T12:07:29.614372
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Lebanon", "country_code": "LB", "city": null, "asn": "ASNone ", "indicator": "213.165.51.115", "tags": ["filehashsha256", "wordpress compromise", "filehashmd5", "cryptocurrency fraud", "filehashsha1", "cve20232868 cve", "qanon targeting", "information operation", "credential theft", "cve20231389 cve", "telegram channel", "ai-assisted", "jailbroken gemini", "cve20213493 cve", "maga community", "gotoresolve", "cve20214034 cve"], "pulses": ["One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud 'Patriot Bait' Campaign", "Malware Filter - Botnet List - 27-04-2026 (Part 7)", "IOC - One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud \u2018Patriot Bait\u2019 Campaign", "One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud 'Patriot Bait' Campaign", "SERHFGB", "SERHFGB", "EbeeMay2026 Pt4", "credit: Tr1sa111 [One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud 'Patriot Bait' Campaign CREATED 1 HOUR AGO by Tr1sa111 Public TLP:  White] clone", "One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud 'Patriot Bait' Campaign"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 5.39.220.25
source: censys
validated_at: 2026-05-31T12:28:56.269919
raw_response:
  {"ports": [22, 25, 442, 500, 588, 943, 1194, 2222, 3000, 3001, 3010, 3128, 4443, 4444, 6443, 8000, 8080, 8081, 8085, 8090, 8444, 9100, 9101, 10002, 10003, 10012, 10086, 13443, 13444, 13445, 14080, 14443, 37853], "services": ["22/SSH", "25/SMTP", "442/HTTP", "500/IKE", "588/SMTP", "943/HTTP", "1194/OPENVPN", "2222/UNKNOWN", "3000/HTTP", "3001/HTTP", "3010/HTTP", "3128/HTTP", "4443/HTTP", "4444/HTTP", "6443/HTTP", "8000/HTTP", "8080/HTTP", "8081/HTTP", "8085/HTTP", "8090/HTTP", "8444/HTTP", "9100/HTTP", "9101/HTTP", "10002/HTTP", "10003/HTTP", "10012/UNKNOWN", "10086/UNKNOWN", "13443/HTTP", "13444/HTTP", "13445/HTTP", "14080/HTTP", "14443/HTTP", "37853/UNKNOWN"], "os": "linux", "os_version": "", "asn": 57043, "as_name": "HOSTKEY-AS - HOSTKEY B.V.", "country": "NL", "city": "Amsterdam", "last_updated": "", "labels": [{"value": "BULLETPROOF"}]}


ioc_type: ipv4
ioc_value: 91.186.217.17
source: dshield
validated_at: 2026-05-31T12:29:04.392702
raw_response:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@clouvider.net", "as": 62240, "asname": "CLOUVIDER Clouvider - Global ASN", "ascountry": "GB", "assource": "", "network": "91.186.216.0/22", "threatfeeds": {"blocklistde110": {"lastseen": "2019-02-27", "firstseen": "2019-02-26"}, "blocklistde143": {"lastseen": "2019-02-27", "firstseen": "2019-02-26"}, "blocklistde25": {"lastseen": "2019-02-27", "firstseen": "2019-02-26"}, "blocklistde993": {"lastseen": "2019-02-27", "firstseen": "2019-02-26"}, "blocklistdecourierimap": {"lastseen": "2019-02-27", "firstseen": "2019-02-26"}}}


ioc_type: ipv4
ioc_value: 45.61.130.5
source: stevenblack
validated_at: 2026-05-31T12:31:53.624223
raw_response:
  {"hostnames_checked": ["search.led.samsung.com", "b2bshop.samsung.com", "stg-am-images.shop.samsung.com", "eventapi.semiconductor.samsung.com", "stg-ru-images.shop.samsung.com", "image.led.samsung.com", "legal.samsungdm.com", "www.semiconductor.samsung.com", "api.semiconductor.samsung.com", "api-stg.semiconductor.samsung.cn", "org.semiconductor.samsung.com", "ru-images.shop.samsung.com", "qa.semiconductor.samsung.com", "vdapi.samsung.com", "download.semiconductor.samsung.com", "mena-images.shop.samsung.com", "stg-au2-images.shop.samsung.com", "stg-mena-images.shop.samsung.com", "ue-author.semiconductor.samsung.com", "search.semiconductor.samsung.com", "5.130.61.45.static.cloudzy.com", "stg-eu-images.shop.samsung.com", "www.samsung.com", "perf-prod.samsung.com", "cstudio.semiconductor.samsung.com", "led.samsung.com", "au-images.shop.samsung.com", "eu-images.shop.samsung.com", "sribsrch.ecom-qa.samsung.com", "image.semiconductor.samsung.com", "semiconductor.samsung.com", "cdn.samsung.com", "stg-au-images.shop.samsung.com", "download.led.samsung.com", "qapartners.sec.samsung.com", "au2-images.shop.samsung.com", "pre-prod.samsung.com", "images.samsung.com", "api.semiconductor.samsung.cn", "www.samsungebiz.com", "www-ams.samsung.com", "samsung.com", "eventadm.semiconductor.samsung.com", "sribsrch.ecom.samsung.com", "adn-stg.yourservice.samsung.com", "ap-author.semiconductor.samsung.com", "image.samsung.com", "ap-author.led.samsung.com", "api.led.samsung.com", "am-images.shop.samsung.com"], "hostnames_count": 51, "matched_domains": [], "match_count": 0, "blocklist_size": 81382}


ioc_type: ipv4
ioc_value: 46.226.161.5
source: stevenblack
validated_at: 2026-05-31T12:31:53.704686
raw_response:
  {"hostnames_checked": ["search.led.samsung.com", "b2bshop.samsung.com", "stg-am-images.shop.samsung.com", "stg-ru-images.shop.samsung.com", "image.led.samsung.com", "eventapi.semiconductor.samsung.com", "legal.samsungdm.com", "www.semiconductor.samsung.com", "qa.semiconductor.samsung.com", "api.semiconductor.samsung.com", "api-stg.semiconductor.samsung.cn", "ru-images.shop.samsung.com", "org.semiconductor.samsung.com", "download.semiconductor.samsung.com", "vdapi.samsung.com", "mena-images.shop.samsung.com", "stg-au2-images.shop.samsung.com", "ue-author.semiconductor.samsung.com", "stg-mena-images.shop.samsung.com", "search.semiconductor.samsung.com", "stg-eu-images.shop.samsung.com", "www.samsung.com", "cstudio.semiconductor.samsung.com", "perf-prod.samsung.com", "led.samsung.com", "au-images.shop.samsung.com", "eu-images.shop.samsung.com", "sribsrch.ecom-qa.samsung.com", "image.semiconductor.samsung.com", "semiconductor.samsung.com", "awfullime.ptr.network", "cdn.samsung.com", "stg-au-images.shop.samsung.com", "download.led.samsung.com", "qapartners.sec.samsung.com", "au2-images.shop.samsung.com", "pre-prod.samsung.com", "images.samsung.com", "api.semiconductor.samsung.cn", "www.samsungebiz.com", "www-ams.samsung.com", "samsung.com", "eventadm.semiconductor.samsung.com", "sribsrch.ecom.samsung.com", "adn-stg.yourservice.samsung.com", "ap-author.semiconductor.samsung.com", "image.samsung.com", "ap-author.led.samsung.com", "api.led.samsung.com", "am-images.shop.samsung.com"], "hostnames_count": 51, "matched_domains": [], "match_count": 0, "blocklist_size": 81382}


ioc_type: ipv4
ioc_value: 193.233.23.81
source: otx
validated_at: 2026-06-03T06:05:04.684750
raw_response:
  {"pulse_count": 6, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Khabarovsk", "asn": "AS51659 llc baxet", "indicator": "193.233.23.81", "tags": ["impacket", "mohammad kazem hassan nejad", "javascript", "sha256", "lookvaljs", "spearphishing", "phantomclick", "2026", "phantomrelayv1", "ukraine", "nsis", "ngos", "daylight", "android spyware", "april", "telegram", "legionrelay", "domain name", "coldriver", "service", "kongtuke", "teams", "greyvibe", "phantommail", "fallspy", "captcha", "august", "websocket rat", "domain", "development", "princessclub", "dronelink", "research", "android", "teasoup", "powershell", "club site", "whitepaper", "lookvalps"], "pulses": ["PhantomCaptcha: Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation", "IOC - GREYVIBE: A Russia-nexus group leveraging AI across state-aligned operations", "GREYVIBE Threat Actor: TTPs, Malware, and Infrastructure Analysis.", "EbeeOct2025 Pt3", "IOC - Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation", "Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["princess-mens.click", "zoomconference.click"]}


ioc_type: ipv4
ioc_value: 23.26.237.80
source: otx
validated_at: 2026-06-12T00:03:50.753379
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS48266 catixs ltd", "indicator": "23.26.237.80", "tags": ["c exfiltration", "information stealer", "potential c", "ukraine targeting", "ip address", "winrar exploitation", "c server", "qb5k", "giftedcrook", "url https", "hta infection chain", "gammasteel", "lnk startup", "russia-aligned threats", "shadowearth066", "sha256", "decoy pdf", "giftedcrook stealer", "credential theft", "cve-2025-8088"], "pulses": ["Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open", "Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open", "IOC - Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 38.225.209.122
source: otx
validated_at: 2026-06-12T00:04:02.764442
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS174 cogent communications", "indicator": "38.225.209.122", "tags": ["c exfiltration", "information stealer", "potential c", "ukraine targeting", "ip address", "winrar exploitation", "c server", "qb5k", "giftedcrook", "url https", "hta infection chain", "gammasteel", "lnk startup", "russia-aligned threats", "shadowearth066", "sha256", "decoy pdf", "giftedcrook stealer", "credential theft", "cve-2025-8088"], "pulses": ["Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open", "Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open", "IOC - Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 38.225.209.229
source: otx
validated_at: 2026-06-12T00:04:21.010392
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS174 cogent communications", "indicator": "38.225.209.229", "tags": ["c exfiltration", "information stealer", "potential c", "ukraine targeting", "ip address", "winrar exploitation", "c server", "qb5k", "giftedcrook", "url https", "hta infection chain", "gammasteel", "lnk startup", "russia-aligned threats", "shadowearth066", "sha256", "decoy pdf", "giftedcrook stealer", "credential theft", "cve-2025-8088"], "pulses": ["Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open", "Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open", "IOC - Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 136.0.141.41
source: otx
validated_at: 2026-06-12T00:04:36.523374
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS18779 egihosting", "indicator": "136.0.141.41", "tags": ["c exfiltration", "information stealer", "potential c", "ukraine targeting", "ip address", "winrar exploitation", "c server", "qb5k", "giftedcrook", "url https", "hta infection chain", "gammasteel", "lnk startup", "russia-aligned threats", "shadowearth066", "sha256", "decoy pdf", "giftedcrook stealer", "credential theft", "cve-2025-8088"], "pulses": ["Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open", "Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open", "IOC - Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open"], "malware_count": 0, "passive_dns_count": 13, "malware_samples": [], "passive_dns": ["bet3653155.com", "t8uey.store", "le37v.store", "zyjv8.store", "bnhmt.store", "1x4d8.store", "www.taohai360.com", "taohai360.com", "ofhwi.com", "466486.com", "nhgc4s.com", "nqyzw.com", "mtgzz.com"]}


ioc_type: ipv4
ioc_value: 136.0.141.112
source: otx
validated_at: 2026-06-12T00:04:41.483012
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS18779 egihosting", "indicator": "136.0.141.112", "tags": ["c exfiltration", "information stealer", "potential c", "ukraine targeting", "ip address", "winrar exploitation", "c server", "qb5k", "giftedcrook", "url https", "hta infection chain", "gammasteel", "lnk startup", "russia-aligned threats", "shadowearth066", "sha256", "decoy pdf", "giftedcrook stealer", "credential theft", "cve-2025-8088"], "pulses": ["Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open", "Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open", "IOC - Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open"], "malware_count": 0, "passive_dns_count": 9, "malware_samples": [], "passive_dns": ["mirza.hosthubpanel.ir", "bosnaklar.net", "yxu0.com", "wittsec.com", "designseonweb.com", "bicolhotels.com", "aanagona.com", "atsidi.net", "jtflw.com"]}


ioc_type: ipv4
ioc_value: 136.0.141.138
source: otx
validated_at: 2026-06-12T00:04:50.772564
raw_response:
  {"pulse_count": 6, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS18779 egihosting", "indicator": "136.0.141.138", "tags": ["c exfiltration", "information stealer", "potential c", "ukraine targeting", "ip address", "winrar exploitation", "c server", "qb5k", "powershell payload", "giftedcrook", "rc4 encryption", "data exfiltration", "url https", "hta infection chain", "gammasteel", "phishing campaign", "stealer", "lnk startup", "russia-aligned threats", "shadowearth066", "cve-2025-6218", "sha256", "decoy pdf", "giftedcrook stealer", "credential theft", "cve-2025-8088"], "pulses": ["Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open", "Obfuscation Without Effort: Breaking a GIFTEDCROOK Stealer", "Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open", "IOC - Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open", "EbeeApril2026 Pt3", "Obfuscation Without Effort: Breaking a GIFTEDCROOK Stealer"], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["motherboardmall.com", "mlgfd.com", "www.mlgfd.com", "m.mlgfd.com"]}


ioc_type: ipv4
ioc_value: 166.0.132.237
source: otx
validated_at: 2026-06-12T00:05:15.989019
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS61317 digital energy technologies ltd.", "indicator": "166.0.132.237", "tags": ["c exfiltration", "information stealer", "potential c", "ukraine targeting", "ip address", "winrar exploitation", "c server", "qb5k", "giftedcrook", "url https", "hta infection chain", "gammasteel", "lnk startup", "russia-aligned threats", "shadowearth066", "sha256", "decoy pdf", "giftedcrook stealer", "credential theft", "cve-2025-8088"], "pulses": ["Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open", "Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open", "IOC - Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 104.194.140.6
source: otx
validated_at: 2026-06-12T00:05:33.937594
raw_response:
  {"pulse_count": 8, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS53667 frantech solutions", "indicator": "104.194.140.6", "tags": ["filehashsha256", "turla", "resolvers", "gammaworm", "armageddon", "separator", "filehashsha1", "litterdrifter", "service", "cve20250282 cve", "august", "matryoshka", "gamawiper", "pterodo", "stream", "gamma", "initial access", "desktop", "dead drop", "filehashmd5", "path", "cve20240012 cve", "telegram", "gammaphish", "gammaload", "pteranodon", "ukraine", "first", "fsb", "user", "gamaredon", "gammasteel", "c2 server", "exfiltration", "ultravnc", "next", "userprofile", "windows", "usbstealer", "drop", "cve20246387 cve", "cve20265786 cve", "cve20249474 cve", "winrar", "quietsieve", "gammasteal", "yara"], "pulses": ["FSB\u2019s matryoshka #1/3 \u2013 Gamaredon\u2019s gifts that keeps unpacking \u2013 GammaPhish and GammaWorm", "EbeeJune2026 Pt1", "Malware Filter - Botnet List - 04-06-2026 (Part 1)", "FSB\u2019s Matryoshka  \u2013 Gamaredon\u2019s Gifts That Keeps Unpacking \u2013 Gammaphish and Gammaworm", "FSB\u2019s matryoshka #1/3 \u2013 Gamaredon\u2019s gifts that keeps unpacking \u2013 GammaPhish and GammaWorm", "FSB\u2019s matryoshka #1/3: Inside Gamaredon Cyber Operations", "FSB\u2019s matryoshka #1/3: Inside Gamaredon Cyber Operations", "IOC - FSB\u2019s matryoshka #1/3 \u2013 Gamaredon\u2019s gifts that keeps unpacking \u2013 GammaPhish and GammaWorm"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 31.172.71.5
source: shodan
validated_at: 2026-06-13T00:01:51.110444
raw_response:
  {"ports": [22, 80, 443, 631, 8000], "vulns": ["CVE-2009-0796", "CVE-2025-23048", "CVE-2022-36760", "CVE-2024-42516", "CVE-2022-26377", "CVE-2022-28330", "CVE-2012-4001", "CVE-2022-29404", "CVE-2020-1934", "CVE-2024-38475", "CVE-2026-33523", "CVE-2022-22719", "CVE-2021-30641", "CVE-2024-43394", "CVE-2006-20001", "CVE-2020-35452", "CVE-2021-26691", "CVE-2024-39573", "CVE-2025-58098", "CVE-2020-11984", "CVE-2022-23943", "CVE-2011-2688", "CVE-2026-34059", "CVE-2024-40898", "CVE-2020-13938", "CVE-2025-55753", "CVE-2024-38476", "CVE-2020-11993", "CVE-2025-59775", "CVE-2009-2299", "CVE-2024-38472", "CVE-2024-43204", "CVE-2022-28614", "CVE-2021-26690", "CVE-2023-31122", "CVE-2026-33857", "CVE-2022-31813", "CVE-2022-22720", "CVE-2022-30556", "CVE-2021-33193", "CVE-2021-32785", "CVE-2026-34032", "CVE-2013-2765", "CVE-2023-27522", "CVE-2025-53020", "CVE-2021-44224", "CVE-2022-37436", "CVE-2023-45802", "CVE-2021-44790", "CVE-2022-28615", "CVE-2021-32792", "CVE-2024-24795", "CVE-2023-25690", "CVE-2026-29169", "CVE-2024-38474", "CVE-2021-40438", "CVE-2022-22721", "CVE-2024-27316", "CVE-2026-33006", "CVE-2024-38477", "CVE-2024-38473", "CVE-2013-4365", "CVE-2019-17567", "CVE-2020-9490", "CVE-2025-49812", "CVE-2026-33007", "CVE-2012-3526", "CVE-2025-49630", "CVE-2021-34798", "CVE-2026-24072", "CVE-2021-32791", "CVE-2023-38709", "CVE-2013-0941", "CVE-2011-1176", "CVE-2021-39275", "CVE-2025-66200", "CVE-2025-65082", "CVE-2024-47252", "CVE-2012-4360", "CVE-2007-4723", "CVE-2021-32786", "CVE-2013-0942", "CVE-2021-36160", "CVE-2020-1927", "CVE-2020-13950"], "hostnames": ["lk.progamevl.ru", "simple.progamevl.ru", "235880.fornex.cloud"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:8.2p1", "cpe:/a:apache:http_server:2.4.41", "cpe:/o:canonical:ubuntu_linux"]}


ioc_type: ipv4
ioc_value: 31.172.71.5
source: otx
validated_at: 2026-06-13T00:02:45.861317
raw_response:
  {"pulse_count": 16, "reputation": 0, "country": "Spain", "country_code": "ES", "city": null, "asn": "AS44066 accelerated it services & consulting gmbh", "indicator": "31.172.71.5", "tags": ["filehashsha1", "filehashsha256", "redacted", "eset research", "wiper", "filename", "temp", "december", "energy sector", "february", "poland infrastructure", "reverse proxy", "industroyer2", "powershell", "kerberos", "cyberattack", "bitcoinaddress", "ransomboggs", "arguepatch", "registry", "filehashmd5", "destructive operations", "russia-aligned", "wallpaper", "soloshred", "SSH", "renewable energy", "cve20170199", "caddywiper", "sting wiper", "awfulshred", "strong", "shell", "Honeypot", "ukraine", "network ip", "blackenergy", "rubeus toolset", "details", "wiper attack", "hermeticwiper", "Bruteforce", "doublezero", "notpetya", "microsoft", "socks5 server", "april", "zov", "execution", "nikowiper"], "pulses": ["Energy Sector Incident Report", "DynoWiper update: Technical analysis", "\"E:\\CTIA-Tools\\CTIA Module 05 Data Analysis\\Microsoft Threat Modeling Tool\\TMT7.application\"", "\"E:\\CTIA-Tools\\CTIA Module 05 Data Analysis\\Microsoft Threat Modeling Tool\\TMT7.application\"", "Energy Sector Incident Report", "HANDALA-Iranian Nexus Actor", "Iranian APT Actors-Pt5", "EbeeFeb2026 Pt1", "DynoWiper test", "DynoWiper Data Wiping Malware Targeting Energy Companies", "DynoWiper update: Technical analysis and attribution", "IOC - DynoWiper update: Technical analysis and attribution", "IOC - Energy Sector Incident Report - 29 December 2025", "DynoWiper update: Technical analysis", "CERT Poland Energy Sector Incident Report - 29 December 2025", "kkkk"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 193.200.17.163
source: otx
validated_at: 2026-06-13T00:03:04.538711
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Secaucus", "asn": "AS62005 bluevps ou", "indicator": "193.200.17.163", "tags": ["filehashsha1", "filehashsha256", "cve20170199", "industrial control systems", "fortigate exploitation", "o365", "rubeus", "filename", "temp", "december", "november", "energy sector", "lazywiper", "poland infrastructure", "reverse proxy", "dynowiper", "wiper attack", "powershell", "cve-2024-2617", "impacket", "cve201711882", "bitcoinaddress", "registry", "port8083 domain", "filehashmd5", "destructive operations", "microsoft", "renewable energy", "combined heat power"], "pulses": ["Energy Sector Incident Report", "Malware Filter - Botnet List - 02-05-2026 (Part 4)", "\"E:\\CTIA-Tools\\CTIA Module 05 Data Analysis\\Microsoft Threat Modeling Tool\\TMT7.application\"", "\"E:\\CTIA-Tools\\CTIA Module 05 Data Analysis\\Microsoft Threat Modeling Tool\\TMT7.application\"", "Energy Sector Incident Report", "HANDALA-Iranian Nexus Actor", "Iranian APT Actors-Pt5", "IOC - Energy Sector Incident Report - 29 December 2025", "CERT Poland Energy Sector Incident Report - 29 December 2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 185.82.127.20
source: otx
validated_at: 2026-06-13T00:03:22.574153
raw_response:
  {"pulse_count": 14, "reputation": 0, "country": "Latvia", "country_code": "LV", "city": null, "asn": "AS52173 sia nano it", "indicator": "185.82.127.20", "tags": ["filehashsha1", "filehashsha256", "cve20170199", "industrial control systems", "fortigate exploitation", "o365", "rubeus", "filename", "temp", "december", "november", "energy sector", "lazywiper", "poland infrastructure", "reverse proxy", "dynowiper", "wiper attack", "powershell", "cve-2024-2617", "impacket", "cve201711882", "bitcoinaddress", "registry", "port8083 domain", "filehashmd5", "destructive operations", "microsoft", "renewable energy", "VPN", "combined heat power", "TOR"], "pulses": ["Energy Sector Incident Report", "\"E:\\CTIA-Tools\\CTIA Module 05 Data Analysis\\Microsoft Threat Modeling Tool\\TMT7.application\"", "\"E:\\CTIA-Tools\\CTIA Module 05 Data Analysis\\Microsoft Threat Modeling Tool\\TMT7.application\"", "Energy Sector Incident Report", "HANDALA-Iranian Nexus Actor", "Iranian APT Actors-Pt5", "IOC - Energy Sector Incident Report - 29 December 2025", "CERT Poland Energy Sector Incident Report - 29 December 2025", "test", "test", "test", "test", "test", "Excel Macro Malware drops DLL"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 41.111.178.225
source: otx
validated_at: 2026-06-13T00:03:25.931958
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Algeria", "country_code": "DZ", "city": null, "asn": "AS36947 african network information center", "indicator": "41.111.178.225", "tags": ["filehashsha1", "filehashsha256", "cve20170199", "industrial control systems", "fortigate exploitation", "o365", "rubeus", "filename", "temp", "december", "november", "energy sector", "lazywiper", "poland infrastructure", "reverse proxy", "dynowiper", "wiper attack", "powershell", "cve-2024-2617", "impacket", "cve201711882", "bitcoinaddress", "registry", "port8083 domain", "filehashmd5", "destructive operations", "microsoft", "renewable energy", "combined heat power"], "pulses": ["Energy Sector Incident Report", "Malware Filter - Botnet List - 02-05-2026 (Part 5)", "\"E:\\CTIA-Tools\\CTIA Module 05 Data Analysis\\Microsoft Threat Modeling Tool\\TMT7.application\"", "\"E:\\CTIA-Tools\\CTIA Module 05 Data Analysis\\Microsoft Threat Modeling Tool\\TMT7.application\"", "Energy Sector Incident Report", "HANDALA-Iranian Nexus Actor", "Iranian APT Actors-Pt5", "IOC - Energy Sector Incident Report - 29 December 2025", "CERT Poland Energy Sector Incident Report - 29 December 2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 72.62.35.76
source: otx
validated_at: 2026-06-13T00:03:44.086503
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Phoenix", "asn": "AS1239 sprint", "indicator": "72.62.35.76", "tags": ["filehashsha1", "filehashsha256", "cve20170199", "industrial control systems", "fortigate exploitation", "o365", "rubeus", "filename", "temp", "december", "november", "energy sector", "lazywiper", "poland infrastructure", "reverse proxy", "dynowiper", "wiper attack", "powershell", "cve-2024-2617", "impacket", "cve201711882", "bitcoinaddress", "registry", "port8083 domain", "filehashmd5", "destructive operations", "microsoft", "renewable energy", "combined heat power"], "pulses": ["Energy Sector Incident Report", "Malware Filter - Botnet List - 02-05-2026 (Part 6)", "\"E:\\CTIA-Tools\\CTIA Module 05 Data Analysis\\Microsoft Threat Modeling Tool\\TMT7.application\"", "\"E:\\CTIA-Tools\\CTIA Module 05 Data Analysis\\Microsoft Threat Modeling Tool\\TMT7.application\"", "Energy Sector Incident Report", "HANDALA-Iranian Nexus Actor", "Iranian APT Actors-Pt5", "IOC - Energy Sector Incident Report - 29 December 2025", "CERT Poland Energy Sector Incident Report - 29 December 2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 89.116.111.143
source: otx
validated_at: 2026-06-13T00:04:02.418409
raw_response:
  {"pulse_count": 8, "reputation": 0, "country": "Lithuania", "country_code": "LT", "city": null, "asn": "AS210906 uab bite lietuva", "indicator": "89.116.111.143", "tags": ["filehashsha1", "filehashsha256", "cve20170199", "industrial control systems", "fortigate exploitation", "o365", "rubeus", "filename", "temp", "december", "november", "energy sector", "lazywiper", "poland infrastructure", "reverse proxy", "dynowiper", "wiper attack", "powershell", "cve-2024-2617", "impacket", "cve201711882", "bitcoinaddress", "registry", "port8083 domain", "filehashmd5", "destructive operations", "microsoft", "renewable energy", "combined heat power"], "pulses": ["Energy Sector Incident Report", "\"E:\\CTIA-Tools\\CTIA Module 05 Data Analysis\\Microsoft Threat Modeling Tool\\TMT7.application\"", "\"E:\\CTIA-Tools\\CTIA Module 05 Data Analysis\\Microsoft Threat Modeling Tool\\TMT7.application\"", "Energy Sector Incident Report", "HANDALA-Iranian Nexus Actor", "Iranian APT Actors-Pt5", "IOC - Energy Sector Incident Report - 29 December 2025", "CERT Poland Energy Sector Incident Report - 29 December 2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.61.121.178
source: otx
validated_at: 2026-06-13T00:04:21.122817
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Latvia", "country_code": "LV", "city": "Riga", "asn": "AS57271 bitweb llc", "indicator": "194.61.121.178", "tags": ["filehashsha1", "filehashsha256", "cve20170199", "industrial control systems", "fortigate exploitation", "o365", "rubeus", "filename", "temp", "december", "november", "energy sector", "lazywiper", "poland infrastructure", "reverse proxy", "dynowiper", "wiper attack", "powershell", "cve-2024-2617", "impacket", "cve201711882", "bitcoinaddress", "registry", "port8083 domain", "filehashmd5", "destructive operations", "microsoft", "renewable energy", "combined heat power"], "pulses": ["Energy Sector Incident Report", "Malware Filter - Botnet List - 02-05-2026 (Part 4)", "\"E:\\CTIA-Tools\\CTIA Module 05 Data Analysis\\Microsoft Threat Modeling Tool\\TMT7.application\"", "\"E:\\CTIA-Tools\\CTIA Module 05 Data Analysis\\Microsoft Threat Modeling Tool\\TMT7.application\"", "Energy Sector Incident Report", "HANDALA-Iranian Nexus Actor", "Iranian APT Actors-Pt5", "IOC - Energy Sector Incident Report - 29 December 2025", "CERT Poland Energy Sector Incident Report - 29 December 2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 159.69.50.242
source: otx
validated_at: 2026-06-13T00:04:24.324305
raw_response:
  {"pulse_count": 8, "reputation": 0, "country": "Germany", "country_code": "DE", "city": null, "asn": "AS24940 hetzner online gmbh", "indicator": "159.69.50.242", "tags": ["filehashsha1", "filehashsha256", "cve20170199", "industrial control systems", "fortigate exploitation", "o365", "rubeus", "filename", "temp", "december", "november", "energy sector", "lazywiper", "poland infrastructure", "reverse proxy", "dynowiper", "wiper attack", "powershell", "cve-2024-2617", "impacket", "cve201711882", "bitcoinaddress", "registry", "port8083 domain", "filehashmd5", "destructive operations", "microsoft", "renewable energy", "combined heat power"], "pulses": ["Energy Sector Incident Report", "\"E:\\CTIA-Tools\\CTIA Module 05 Data Analysis\\Microsoft Threat Modeling Tool\\TMT7.application\"", "\"E:\\CTIA-Tools\\CTIA Module 05 Data Analysis\\Microsoft Threat Modeling Tool\\TMT7.application\"", "Energy Sector Incident Report", "HANDALA-Iranian Nexus Actor", "Iranian APT Actors-Pt5", "IOC - Energy Sector Incident Report - 29 December 2025", "CERT Poland Energy Sector Incident Report - 29 December 2025"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["cloud.the-infinite.space"]}


ioc_type: ipv4
ioc_value: 191.96.94.159
source: shodan
validated_at: 2026-06-20T06:05:32.817028
raw_response:
  {"ports": [22, 80, 443], "vulns": ["CVE-2013-0942", "CVE-2026-33007", "CVE-2024-39573", "CVE-2024-24795", "CVE-2012-4360", "CVE-2012-3526", "CVE-2009-0796", "CVE-2025-53020", "CVE-2011-2688", "CVE-2026-34059", "CVE-2024-36387", "CVE-2025-65082", "CVE-2025-55753", "CVE-2025-49812", "CVE-2026-33006", "CVE-2024-27316", "CVE-2013-0941", "CVE-2026-33523", "CVE-2013-4365", "CVE-2024-40898", "CVE-2025-66200", "CVE-2009-2299", "CVE-2026-33857", "CVE-2024-38477", "CVE-2023-38709", "CVE-2026-34032", "CVE-2024-43394", "CVE-2024-38474", "CVE-2024-38476", "CVE-2026-29169", "CVE-2025-23048", "CVE-2024-38473", "CVE-2011-1176", "CVE-2024-42516", "CVE-2007-4723", "CVE-2012-4001", "CVE-2013-2765", "CVE-2025-49630", "CVE-2024-38472", "CVE-2025-58098", "CVE-2025-59775", "CVE-2024-43204", "CVE-2024-38475", "CVE-2026-24072", "CVE-2024-47252"], "hostnames": ["www.degu-online.de", "degu-online.de", "ondricka.degu-online.de"], "tags": [], "cpes": ["cpe:/a:apache:http_server:2.4.58", "cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


ioc_type: ipv4
ioc_value: 209.141.57.1
source: shodan
validated_at: 2026-06-20T06:05:34.573703
raw_response:
  {"ports": [123, 179], "vulns": ["CVE-2015-7973", "CVE-2014-9750", "CVE-2015-7974", "CVE-2015-7977", "CVE-2015-7692", "CVE-2009-3563", "CVE-2016-4953", "CVE-2019-8936", "CVE-2015-7704", "CVE-2018-7170", "CVE-2014-9295", "CVE-2015-7691", "CVE-2015-7848", "CVE-2016-4954", "CVE-2017-6458", "CVE-2015-7701", "CVE-2015-7705", "CVE-2015-7850", "CVE-2016-4956", "CVE-2014-9296", "CVE-2015-1799", "CVE-2014-9293", "CVE-2013-5211", "CVE-2009-0021", "CVE-2014-9294", "CVE-2009-0159", "CVE-2015-7702", "CVE-2020-11868", "CVE-2015-7703", "CVE-2015-7852", "CVE-2015-7851", "CVE-2015-7855", "CVE-2015-7853", "CVE-2016-4955", "CVE-2014-9751", "CVE-2015-1798", "CVE-2015-7854", "CVE-2015-7849", "CVE-2016-2518", "CVE-2020-13817"], "hostnames": [], "tags": [], "cpes": ["cpe:/a:ntp:ntp:4.2.0"]}


ioc_type: ipv4
ioc_value: 144.31.195.142
source: otx
validated_at: 2026-06-20T06:06:40.453359
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "144.31.195.142", "tags": ["LummaStealer, RedLine,...", "DugganUSA", "auto-generated", "cobalt", "apt"], "pulses": ["ThreatFix_IP", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 147.45.199.50
source: otx
validated_at: 2026-06-20T06:06:43.534324
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS2895 ooo freenet group", "indicator": "147.45.199.50", "tags": ["", "LummaStealer, RedLine,...", "DugganUSA", "malware", "auto-generated", "ransomware"], "pulses": ["ThreatFix_IP", "ThreatFix_IP", "ThreatFix", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)"], "malware_count": 0, "passive_dns_count": 5, "malware_samples": [], "passive_dns": ["slowdevaction.com", "rapiddevapi.com", "api.giveawayrandombot.ru", "giveawayrandombot.ru", "fortnite-claim.com"]}


ioc_type: ipv4
ioc_value: 163.227.179.29
source: otx
validated_at: 2026-06-20T06:06:48.455491
raw_response:
  {"pulse_count": 44, "reputation": 0, "country": "Japan", "country_code": "JP", "city": null, "asn": "ASNone ", "indicator": "163.227.179.29", "tags": ["c2-infrastructure", "LummaStealer, RedLine,...", "DugganUSA", "asyncrat", "auto-generated", "automated", "osint-volley", "unknown-malware", "meterpreter", "deimosc2", "unknown-stealer", "threatfox", "cobalt", "apt"], "pulses": ["ThreatFix_IP", "Oz Batch: 46 IOCs (avg BDE: 85)", "OSINT Volley 2026-01-18 - Unknown malware/AsyncRAT/Meterpreter", "OSINT Volley 2026-01-18 - Unknown malware/AsyncRAT/Meterpreter", "OSINT Volley 2026-01-18 - Unknown malware/AsyncRAT/DeimosC2", "OSINT Volley 2026-01-18 - Unknown malware/AsyncRAT/DeimosC2", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "Oz Batch: 30 IOCs (avg BDE: 85)", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["storehouse.beautysupplysalonllc.com"]}


ioc_type: ipv4
ioc_value: 170.130.55.49
source: otx
validated_at: 2026-06-20T06:07:08.447133
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS62904 eonix corporation", "indicator": "170.130.55.49", "tags": ["c2-infrastructure", "LummaStealer, RedLine,...", "DugganUSA", "auto-generated", "automated", "osint-volley", "unknown-malware", "unknown-stealer", "threatfox", "cobalt", "apt", "vidar"], "pulses": ["ThreatFix_IP", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "OSINT Volley 2026-01-14 - Unknown Stealer/Unknown malware/Vidar"], "malware_count": 0, "passive_dns_count": 18, "malware_samples": [], "passive_dns": ["joinnow.diasporamedia.net", "apm.vpce.gdw55e.sharingdashboard.com", "csp.sharingdashboard.com", "privacynotice.account.sharingdashboard.com", "www.sharingdashboard.com", "gui.sharingdashboard.com", "sharedashboardt.com", "claimcaip.com", "intarac.com", "www.170-130-55-49.cprapid.com", "170-130-55-49.cprapid.com", "www.internet-icscards.com", "internet-icscards.com", "www.hjlop.xyz", "hjlop.xyz", "fraisedolipran.life", "gov-financial-process.com", "money-receipt.com"]}


ioc_type: ipv4
ioc_value: 170.75.160.84
source: otx
validated_at: 2026-06-20T06:07:17.787860
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Canada", "country_code": "CA", "city": null, "asn": "AS174 cogent communications", "indicator": "170.75.160.84", "tags": ["", "ransomware", "malware"], "pulses": ["ThreatFix", "Threatfox Recent Additions"], "malware_count": 0, "passive_dns_count": 18, "malware_samples": [], "passive_dns": ["circle.innovativecsportal.com", "knm.cases.pcohenlaw.com", "kfmzh.cases.pcohenlaw.com", "mentor.omgwowhq.org", "hpaiw.cases.pcohenlaw.com", "wogc.cases.pcohenlaw.com", "tekwk.cases.pcohenlaw.com", "eji.cases.pcohenlaw.com", "cst.cases.pcohenlaw.com", "xrqax.cases.pcohenlaw.com", "cxhkh.cases.pcohenlaw.com", "ilywe.cases.pcohenlaw.com", "geui.cases.pcohenlaw.com", "kwsww.cases.pcohenlaw.com", "olympuskawiarna.com", "www.olympuskawiarna.com", "collarcold.com", "btcnode.rarepepes.com"]}


ioc_type: ipv4
ioc_value: 170.75.167.132
source: otx
validated_at: 2026-06-20T06:07:20.612559
raw_response:
  {"pulse_count": 30, "reputation": 0, "country": "Canada", "country_code": "CA", "city": null, "asn": "AS174 cogent communications", "indicator": "170.75.167.132", "tags": ["clearfake", "c2-infrastructure", "LummaStealer, RedLine,...", "DugganUSA", "auto-generated", "automated", "osint-volley", "unknown-malware", "deimosc2", "threatfox", "gootloader"], "pulses": ["ThreatFix_IP", "ThreatFix_IP", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "OSINT Volley 2026-01-10 - Unknown malware/ClearFake/DeimosC2", "OSINT Volley 2026-01-10 - GootLoader/Unknown malware/ClearFake", "OSINT Volley 2026-01-10 - GootLoader/Unknown malware/ClearFake", "OSINT Volley 2026-01-10 - Unknown malware/GootLoader/ClearFake", "OSINT Volley 2026-01-10 - Unknown malware/GootLoader/ClearFake", "OSINT Volley 2026-01-10 - Unknown malware/GootLoader/ClearFake", "OSINT Volley 2026-01-10 - Unknown malware/GootLoader/ClearFake", "OSINT Volley 2026-01-10 - Unknown malware/GootLoader/ClearFake", "OSINT Volley 2026-01-10 - Unknown malware/GootLoader/ClearFake", "OSINT Volley 2026-01-10 - Unknown malware/GootLoader/ClearFake", "OSINT Volley 2026-01-10 - Unknown malware/GootLoader/ClearFake", "OSINT Volley 2026-01-10 - Unknown malware/GootLoader/ClearFake", "OSINT Volley 2026-01-10 - Unknown malware/GootLoader/ClearFake", "OSINT Volley 2026-01-10 - Unknown malware/GootLoader/ClearFake", "OSINT Volley 2026-01-10 - Unknown malware/GootLoader/ClearFake", "OSINT Volley 2026-01-10 - Unknown malware/GootLoader/ClearFake"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["roadmap.lifeinsurancemasters.net"]}


ioc_type: ipv4
ioc_value: 172.81.182.63
source: otx
validated_at: 2026-06-20T06:07:23.777681
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "Canada", "country_code": "CA", "city": "Toronto", "asn": "AS174 cogent communications", "indicator": "172.81.182.63", "tags": ["clearfake", "c2-infrastructure", "DugganUSA", "auto-generated", "automated", "formbook", "osint-volley", "unknown-malware", "unknown-stealer", "threatfox"], "pulses": ["ThreatFix_IP_262", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown malware", "Oz Batch: 50 IOCs (avg BDE: 85)"], "malware_count": 0, "passive_dns_count": 10, "malware_samples": [], "passive_dns": ["booking.fijivacations.com", "ajaxdog.dev", "ajaxdog.best", "mainfly.site", "lotsign.uno", "trueown.top", "gosbyte.cloud", "busman.icu", "cutbear.club", "paybet.best"]}


ioc_type: ipv4
ioc_value: 178.212.12.41
source: otx
validated_at: 2026-06-20T06:07:53.390783
raw_response:
  {"pulse_count": 35, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS41098 netfox ltd.", "indicator": "178.212.12.41", "tags": ["c2-infrastructure", "LummaStealer, RedLine,...", "DugganUSA", "auto-generated", "automated", "osint-volley", "unknown-malware", "deimosc2", "threatfox", "asyncrat", "vidar"], "pulses": ["Undesirable IPs", "ThreatFix_IP", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "ThreatFix_IP", "OSINT Volley 2026-01-12 - Vidar/AsyncRAT/Unknown malware", "OSINT Volley 2026-01-12 - Vidar/AsyncRAT/DeimosC2", "OSINT Volley 2026-01-12 - Vidar/AsyncRAT/DeimosC2", "OSINT Volley 2026-01-12 - Vidar/AsyncRAT/DeimosC2", "OSINT Volley 2026-01-12 - Vidar/AsyncRAT/DeimosC2", "OSINT Volley 2026-01-12 - Vidar/AsyncRAT/DeimosC2", "OSINT Volley 2026-01-12 - Vidar/AsyncRAT/DeimosC2", "OSINT Volley 2026-01-12 - Vidar/AsyncRAT/DeimosC2"], "malware_count": 0, "passive_dns_count": 5, "malware_samples": [], "passive_dns": ["promiseallrace.com", "www.taskrunnersrvmod.com", "commonloamprojects.com", "quietlybuildzone.com", "www.demo.promiseallrace.com"]}


ioc_type: ipv4
ioc_value: 181.214.133.67
source: otx
validated_at: 2026-06-20T06:08:10.844662
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Dallas", "asn": "AS397423 tier.net technologies llc", "indicator": "181.214.133.67", "tags": ["LummaStealer, RedLine,...", "DugganUSA", "auto-generated", "cobalt", "apt"], "pulses": ["ThreatFix_IP", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 184.162.20.200
source: otx
validated_at: 2026-06-20T06:08:13.306253
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Canada", "country_code": "CA", "city": "Montreal", "asn": "AS5769 videotron telecom ltee", "indicator": "184.162.20.200", "tags": ["Havoc", "C2", "Deimos", "CobaltStrike", "Evilginx", "Interactsh", "SocGholish", "Supershell", "Mythic", "Qakbot", "NetSupportRAT", "EvilGoPhish", "Sliver", "Remcos"], "pulses": ["Twitter Feed - drb_ra - 11-08-2025"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["plazageek.ca", "les-secrets-de-la-montagne-rouge.ca"]}


ioc_type: ipv4
ioc_value: 185.105.116.188
source: otx
validated_at: 2026-06-20T06:08:17.659744
raw_response:
  {"pulse_count": 44, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS35196 ihor hosting llc", "indicator": "185.105.116.188", "tags": ["c2-infrastructure", "LummaStealer, RedLine,...", "DugganUSA", "asyncrat", "auto-generated", "automated", "osint-volley", "unknown-malware", "meterpreter", "deimosc2", "unknown-stealer", "threatfox", "cobalt", "apt"], "pulses": ["ThreatFix_IP", "Oz Batch: 46 IOCs (avg BDE: 85)", "OSINT Volley 2026-01-18 - Unknown malware/AsyncRAT/Meterpreter", "OSINT Volley 2026-01-18 - Unknown malware/AsyncRAT/Meterpreter", "OSINT Volley 2026-01-18 - Unknown malware/AsyncRAT/DeimosC2", "OSINT Volley 2026-01-18 - Unknown malware/AsyncRAT/DeimosC2", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "Oz Batch: 30 IOCs (avg BDE: 85)", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT", "OSINT Volley 2026-01-18 - Unknown Stealer/Unknown malware/AsyncRAT"], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["rapiddevapi.com", "lcan1live2act.com", "www.rbcsecuremfa.com"]}


ioc_type: ipv4
ioc_value: 191.96.94.159
source: otx
validated_at: 2026-06-20T06:08:54.156670
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Dulles", "asn": "AS61317 digital energy technologies ltd.", "indicator": "191.96.94.159", "tags": ["", "LummaStealer, RedLine,...", "DugganUSA", "malware", "auto-generated", "ransomware"], "pulses": ["ThreatFix_IP", "ThreatFix_IP", "ThreatFix", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 209.141.57.1
source: otx
validated_at: 2026-06-20T06:09:11.619041
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Las Vegas", "asn": "AS53667 frantech solutions", "indicator": "209.141.57.1", "tags": ["clearfake", "c2-infrastructure", "DugganUSA", "auto-generated", "automated", "formbook", "osint-volley", "unknown-malware", "unknown-stealer", "threatfox"], "pulses": ["ThreatFix_IP_262", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown malware", "Oz Batch: 50 IOCs (avg BDE: 85)"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 213.177.179.94
source: otx
validated_at: 2026-06-20T06:09:21.348953
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Belgium", "country_code": "BE", "city": null, "asn": "ASNone ", "indicator": "213.177.179.94", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 14, "malware_samples": [], "passive_dns": ["www.api.yuretemelo.com", "api.operilezabre.com", "www.api.loretesimorix.com", "www.loretesimorix.com", "www.operilezabre.com", "api.loretesimorix.com", "operilezabre.com", "loretesimorix.com", "www.api.portimaloter.com", "api.portimaloter.com", "api.yuretemelo.com", "www.portimaloter.com", "yuretemelo.com", "portimaloter.com"]}


ioc_type: ipv4
ioc_value: 38.135.54.246
source: otx
validated_at: 2026-06-20T06:09:33.171900
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS174 cogent communications", "indicator": "38.135.54.246", "tags": ["clearfake", "c2-infrastructure", "DugganUSA", "auto-generated", "automated", "formbook", "osint-volley", "unknown-malware", "unknown-stealer", "threatfox"], "pulses": ["ThreatFix_IP_262", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown Stealer", "OSINT Volley 2026-02-14 - Formbook/ClearFake/Unknown malware", "Oz Batch: 50 IOCs (avg BDE: 85)"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["archives.kathmandutribune.com"]}


ioc_type: ipv4
ioc_value: 51.15.16.116
source: otx
validated_at: 2026-06-20T06:09:36.230063
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": "Haarlem", "asn": "AS12876 online s.a.s.", "indicator": "51.15.16.116", "tags": ["fronted domain", "fronting domain", "possible dcrat", "unverified", "strike c2", "apix", "possible pupy", "domain", "c2 fronted", "possible cobalt", "possible havoc", "possible sliver", "c2 domain", "mythic ip", "rat ip", "possible viper", "go trojan", "possible deimos", "cobalt strike", "push", "possible qakbot", "c2 fronting"], "pulses": ["Threatfox Recent Additions", "C2 IOCs"], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["www.travito2.online", "travito2.online", "ns2.travito.live", "travito.live"]}


ioc_type: ipv4
ioc_value: 91.108.244.139
source: otx
validated_at: 2026-06-20T06:10:08.467117
raw_response:
  {"pulse_count": 46, "reputation": 0, "country": "Australia", "country_code": "AU", "city": "Sydney", "asn": "AS213296 sia singularity telecom", "indicator": "91.108.244.139", "tags": ["clearfake", "c2-infrastructure", "DugganUSA", "malware", "auto-generated", "automated", "osint-volley", "unknown-malware", "bad ip's", "scanners", "brute", "threatfox", "cobalt", "cobalt-strike", "apt", "vidar"], "pulses": ["Malware, Scanner's, Brute, Bad IP's", "ThreatFix_IP_262", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "OSINT Volley 2026-01-30 - Vidar/Unknown malware/Cobalt Strike", "OSINT Volley 2026-01-30 - Unknown malware/Vidar/Cobalt Strike", "OSINT Volley 2026-01-30 - Vidar/Unknown malware/ClearFake", "OSINT Volley 2026-01-30 - Vidar/Unknown malware/ClearFake", "OSINT Volley 2026-01-30 - Vidar/Unknown malware/ClearFake", "OSINT Volley 2026-01-30 - Vidar/Unknown malware/ClearFake", "OSINT Volley 2026-01-30 - Vidar/Unknown malware/ClearFake", "OSINT Volley 2026-01-30 - Vidar/Unknown malware/ClearFake"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 170.130.55.49
source: stevenblack
validated_at: 2026-06-20T06:22:57.728661
raw_response:
  {"hostnames_checked": ["gui.sharingdashboard.com", "www.internet-icscards.com", "joinnow.diasporamedia.net", "www.hjlop.xyz", "internet-icscards.com", "gov-financial-process.com", "money-receipt.com", "sharedashboardt.com", "apm.vpce.gdw55e.sharingdashboard.com", "www.170-130-55-49.cprapid.com", "www.sharingdashboard.com", "intarac.com", "170-130-55-49.cprapid.com", "csp.sharingdashboard.com", "hjlop.xyz", "fraisedolipran.life", "privacynotice.account.sharingdashboard.com", "claimcaip.com"], "hostnames_count": 18, "matched_domains": [], "match_count": 0, "blocklist_size": 83944}


ioc_type: ipv4
ioc_value: 170.75.160.84
source: stevenblack
validated_at: 2026-06-20T06:22:57.790960
raw_response:
  {"hostnames_checked": ["cxhkh.cases.pcohenlaw.com", "geui.cases.pcohenlaw.com", "www.olympuskawiarna.com", "olympuskawiarna.com", "hpaiw.cases.pcohenlaw.com", "knm.cases.pcohenlaw.com", "ilywe.cases.pcohenlaw.com", "kwsww.cases.pcohenlaw.com", "kfmzh.cases.pcohenlaw.com", "cst.cases.pcohenlaw.com", "circle.innovativecsportal.com", "tekwk.cases.pcohenlaw.com", "mentor.omgwowhq.org", "xrqax.cases.pcohenlaw.com", "btcnode.rarepepes.com", "wogc.cases.pcohenlaw.com", "collarcold.com", "eji.cases.pcohenlaw.com"], "hostnames_count": 18, "matched_domains": [], "match_count": 0, "blocklist_size": 83944}


ioc_type: ipv4
ioc_value: 138.124.49.159
source: shodan
validated_at: 2026-06-23T06:00:36.878490
raw_response:
  {"ports": [443], "vulns": [], "hostnames": ["people.us.oracle.com", "mymobile.oracle.com", "content.bronto.com", "scm-fusioncrm.oracle.com", "careers.bronto.com", "wikis.oracle.com", "kr.forums.oracle.com", "orabuilder.oracle.com", "covpn-site-portal.oracle.com", "sites.oracle.com", "cloudmarketplace.oracle.com", "ateam-oracle.com", "co19.oracle.com", "www.oracleimg.com", "my.oracle.com", "fusioncrm.oracle.com", "fin-fusioncrm.oracle.com", "search-api.oracle.com", "analystconnect.oracle.com", "www.oracle.com", "covid-analytics.oracle.com", "covid19-rx.org", "www-cs-02.oracle.com", "www.ateam-oracle.com", "myemm.oracle.com", "search.oracle.com", "www.covid19-rx.org", "volunteer.oracle.com", "blogs.bronto.com", "profile.oracle.com", "mydevice.oracle.com", "biapps-fusioncrm.oracle.com", "cn.forums.oracle.com", "bronto.com", "reserved-by-avm.ptr.network", "myvisualization.oracle.com", "oracleassistant.oracle.com", "restgwoci-dr.oracle.com", "wwwcmsapi.oracle.com", "m.oracle.com", "elocation.oracle.com", "community.oracle.com", "covid19.oracle.com", "maps.oracle.com", "covpn.oracle.com", "pressroom.oracle.com", "hcm-fusioncrm.oracle.com", "hrservices.oracle.com", "www.covid19rx.org", "events.oracle.com", "itweb.oracle.com", "redwood.oracle.com", "myprofile.oracle.com", "publicdocs.oracle.com", "appcenter.bronto.com", "ic-fusioncrm.oracle.com", "salesaccelerator.oracle.com", "resources.bronto.com", "container-registry.oracle.com", "ideas.bronto.com", "oraassistant-dr.oracle.com", "oraassistant.oracle.com", "covid19rx.org", "partner.cloudmarketplace.oracle.com", "securesites.oracle.com", "analytics.covid19.oracle.com", "oradocs.oracle.com", "restgwoci.oracle.com", "covpn-admin-portal.oracle.com", "www.blogs.oracle.com", "mysites-api.oracle.com", "profile-api.oracle.com", "oramobile.oracle.com", "mybuilder.oracle.com", "blog.bronto.com", "blogs.oracle.com", "crm-fusioncrm.oracle.com", "myprocess.oracle.com", "ocm-apis-cloud.oracle.com", "www.bronto.com", "aria.us.oracle.com


ioc_type: ipv4
ioc_value: 138.124.50.114
source: shodan
validated_at: 2026-06-23T06:01:05.487630
raw_response:
  {"ports": [5000], "vulns": ["CVE-2025-13462", "CVE-2023-36632", "CVE-2025-12084", "CVE-2023-40217", "CVE-2025-12781", "CVE-2025-13836", "CVE-2026-4519", "CVE-2026-3087", "CVE-2021-32052", "CVE-2023-27043", "CVE-2009-2940", "CVE-2026-6019", "CVE-2026-27205", "CVE-2024-6232", "CVE-2026-7210", "CVE-2025-13837", "CVE-2020-29396", "CVE-2024-7592", "CVE-2024-9287", "CVE-2026-3644", "CVE-2009-3720", "CVE-2023-30861"], "hostnames": [], "tags": [], "cpes": ["cpe:/a:python:python:3.10.12", "cpe:/a:palletsprojects:flask:2.0.2"]}


ioc_type: ipv4
ioc_value: 138.124.51.112
source: shodan
validated_at: 2026-06-23T06:01:53.503948
raw_response:
  {"ports": [443, 6379], "vulns": [], "hostnames": ["yandex.video", "body-core.ru", "scantobuy.ru", "123.ya.rs", "yandexdatafactory.com", "yaconnect.ru", "www.yadi.sk", "homsly-dom.com", "www.fizard.ru", "www.lunnen.pro", "www.drive.yandex", "pragmahome.ru", "www.junion.ru", "wiki.eva.yandex-team.ru", "yandex.com.ru", "yandex-launcher.com", "fizard.ru", "www.nocord-tools.ru", "appmetrica.com", "edu.ya.rs", "www.boxbot-tools.ru", "vygoda.ya.ru", "www.catboost.ai", "nocord-tools.ru", "www.yandex", "cubits.ru", "vigoda.yandex.ru", "yaconnect.com", "yandex.travel", "boxbot-tools.ru", "yandexlauncher.com", "catboost.org", "vigoda.ya.ru", "yandex.market", "www.mutedwear.ru", "eda.rest", "alisa.ai", "www.catboost.yandex", "www.tuvio.ru", "www.catboost.org", "mutedwear.ru", "www.cubits.ru", "raskat-sport.ru", "www.outstep.ru", "beta.wiki.yandex-team.ru", "market.ru", "www.raskat-sport.ru", "wiki-front.eva.yandex-team.ru", "thequestion.com", "junion.ru", "tuvio.ru", "appmetrica.io", "outstep.ru", "lunnen.pro", "thequestion.ru", "yandexdatafactory.ru", "appmetrica.ru", "split.ru", "yandex.market.ru", "yandex.tr"], "tags": [], "cpes": ["cpe:/a:redislabs:redis"]}


ioc_type: ipv4
ioc_value: 138.124.53.58
source: shodan
validated_at: 2026-06-23T12:03:31.129266
raw_response:
  {"ports": [80, 8443], "vulns": ["CVE-2026-4519", "CVE-2021-3618", "CVE-2021-32052", "CVE-2020-29396", "CVE-2021-23017", "CVE-2026-6019", "CVE-2009-2940", "CVE-2009-3720", "CVE-2025-13836", "CVE-2025-12084", "CVE-2025-23419", "CVE-2025-13837", "CVE-2026-4224", "CVE-2026-3644", "CVE-2023-44487", "CVE-2025-13462", "CVE-2026-3087", "CVE-2026-7210", "CVE-2023-36632", "CVE-2025-12781"], "hostnames": ["alpn.one", "go.alpn.one"], "tags": ["eol-product"], "cpes": ["cpe:/a:python:python:3.10", "cpe:/o:linux:linux_kernel", "cpe:/a:f5:nginx:1.18.0", "cpe:/o:canonical:ubuntu_linux"]}


ioc_type: ipv4
ioc_value: 138.124.54.142
source: shodan
validated_at: 2026-06-23T12:03:59.419377
raw_response:
  {"ports": [8443], "vulns": [], "hostnames": ["yandex.video", "body-core.ru", "scantobuy.ru", "123.ya.rs", "yandexdatafactory.com", "yaconnect.ru", "www.yadi.sk", "homsly-dom.com", "www.fizard.ru", "www.lunnen.pro", "www.drive.yandex", "pragmahome.ru", "www.junion.ru", "wiki.eva.yandex-team.ru", "yandex.com.ru", "yandex-launcher.com", "fizard.ru", "www.nocord-tools.ru", "appmetrica.com", "edu.ya.rs", "www.boxbot-tools.ru", "vygoda.ya.ru", "www.catboost.ai", "nocord-tools.ru", "www.yandex", "cubits.ru", "vigoda.yandex.ru", "yaconnect.com", "yandex.travel", "boxbot-tools.ru", "yandexlauncher.com", "catboost.org", "vigoda.ya.ru", "yandex.market", "www.mutedwear.ru", "eda.rest", "alisa.ai", "www.catboost.yandex", "www.tuvio.ru", "www.catboost.org", "mutedwear.ru", "www.cubits.ru", "raskat-sport.ru", "www.outstep.ru", "beta.wiki.yandex-team.ru", "market.ru", "www.raskat-sport.ru", "wiki-front.eva.yandex-team.ru", "thequestion.com", "junion.ru", "tuvio.ru", "appmetrica.io", "outstep.ru", "lunnen.pro", "thequestion.ru", "yandexdatafactory.ru", "appmetrica.ru", "split.ru", "yandex.market.ru", "yandex.tr"], "tags": [], "cpes": []}


ioc_type: ipv4
ioc_value: 138.124.55.69
source: shodan
validated_at: 2026-06-23T12:06:10.689431
raw_response:
  {"ports": [80, 443], "vulns": ["CVE-2024-43394", "CVE-2026-29170", "CVE-2026-29168", "CVE-2009-2299", "CVE-2024-38477", "CVE-2024-42516", "CVE-2013-2765", "CVE-2025-23048", "CVE-2024-24795", "CVE-2026-34355", "CVE-2026-33523", "CVE-2026-33006", "CVE-2024-38472", "CVE-2026-33857", "CVE-2026-34059", "CVE-2026-33007", "CVE-2025-49630", "CVE-2024-43204", "CVE-2026-44119", "CVE-2013-0941", "CVE-2011-2688", "CVE-2009-0796", "CVE-2023-38709", "CVE-2026-49975", "CVE-2026-34032", "CVE-2025-58098", "CVE-2026-44186", "CVE-2025-49812", "CVE-2026-29167", "CVE-2012-4360", "CVE-2025-59775", "CVE-2013-0942", "CVE-2013-4365", "CVE-2026-28780", "CVE-2024-36387", "CVE-2026-29169", "CVE-2025-65082", "CVE-2024-38473", "CVE-2024-39573", "CVE-2011-1176", "CVE-2024-38476", "CVE-2025-66200", "CVE-2024-27316", "CVE-2024-38475", "CVE-2026-43951", "CVE-2024-38474", "CVE-2026-42535", "CVE-2026-34356", "CVE-2025-55753", "CVE-2012-4001", "CVE-2026-24072", "CVE-2025-53020", "CVE-2024-40898", "CVE-2007-4723", "CVE-2012-3526", "CVE-2026-44185", "CVE-2024-47252", "CVE-2026-48913", "CVE-2026-44631", "CVE-2026-42536"], "hostnames": [], "tags": [], "cpes": ["cpe:/a:nodejs:nodejs", "cpe:/a:apache:http_server:2.4.58", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:n8n:n8n"]}


ioc_type: ipv4
ioc_value: 138.124.53.246
source: otx
validated_at: 2026-06-23T12:21:34.799640
raw_response:
  {"pulse_count": 19, "reputation": 0, "country": "Switzerland", "country_code": "CH", "city": null, "asn": "ASNone ", "indicator": "138.124.53.246", "tags": ["Honeypot", "Bruteforce", "SSH", "Brute-Force"], "pulses": ["SSH Brute-Force Honeypot Live", "IOC pulses", "IOC pulses", "IOC pulses", "IOC pulses", "IOC pulses", "IOC pulses", "IOC pulses", "IOC pulses", "IOC pulses", "IOC pulses", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 138.124.53.33
source: otx
validated_at: 2026-06-23T12:22:01.511356
raw_response:
  {"pulse_count": 14, "reputation": 0, "country": "Switzerland", "country_code": "CH", "city": null, "asn": "ASNone ", "indicator": "138.124.53.33", "tags": ["c2-infrastructure", "automated", "osint-volley", "meterpreter", "threatfox", "unknown-malware", "unknown-stealer", "asyncrat"], "pulses": ["ThreatFix_IP_262", "OSINT Volley 2026-02-01 - Unknown malware/Unknown Stealer/AsyncRAT", "OSINT Volley 2026-02-01 - Unknown malware/Unknown Stealer/AsyncRAT", "OSINT Volley 2026-02-01 - Unknown malware/Unknown Stealer/AsyncRAT", "OSINT Volley 2026-01-31 - Unknown malware/Unknown Stealer/AsyncRAT", "OSINT Volley 2026-01-31 - Unknown malware/Unknown Stealer/AsyncRAT", "OSINT Volley 2026-01-31 - Unknown malware/Unknown Stealer/AsyncRAT", "OSINT Volley 2026-01-31 - Unknown malware/Unknown Stealer/AsyncRAT", "OSINT Volley 2026-01-31 - Unknown malware/Unknown Stealer/Meterpreter", "OSINT Volley 2026-01-31 - Unknown malware/Unknown Stealer/Meterpreter", "OSINT Volley 2026-01-31 - Unknown malware/Unknown Stealer/Meterpreter", "OSINT Volley 2026-01-31 - Unknown malware/Unknown Stealer/Meterpreter", "OSINT Volley 2026-01-31 - Unknown malware/Unknown Stealer/Meterpreter", "OSINT Volley 2026-01-31 - Unknown malware/Unknown Stealer/Meterpreter"], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["srvminecraft.online", "jdfgeycbg.cyou", "ijijyuescg.cyou"]}


ioc_type: ipv4
ioc_value: 138.124.55.215
source: otx
validated_at: 2026-06-23T12:29:59.349270
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Switzerland", "country_code": "CH", "city": null, "asn": "ASNone ", "indicator": "138.124.55.215", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 16, "malware_samples": [], "passive_dns": ["www.milonies.site", "milonies.site", "sadom.store", "reggio.store", "monius.site", "normalized.site", "seamly.site", "solpine.site", "salemine.space", "www.globalgis.space", "globalgis.space", "cipated.shop", "parated.store", "secunday.store", "soft-day.shop", "wavenetpulse.com"]}


ioc_type: ipv4
ioc_value: 138.124.61.13
source: otx
validated_at: 2026-06-23T18:19:31.480473
raw_response:
  {"pulse_count": 21, "reputation": 0, "country": "Switzerland", "country_code": "CH", "city": null, "asn": "ASNone ", "indicator": "138.124.61.13", "tags": ["auto-generated security"], "pulses": ["jan2,2025 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2.2025clone-Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan 2 25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan 2 25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan 2 25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan 2 25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan 2 25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan 2 25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "1/2/25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "1/2/25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "1/2/25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "1/2/25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "1/2/25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2,2025 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2,2025 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2.2025clone-Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2.2025clone-Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2.2025clone-Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2.2025clone-Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1


ioc_type: ipv4
ioc_value: 138.124.61.210
source: otx
validated_at: 2026-06-23T18:20:45.497238
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Switzerland", "country_code": "CH", "city": null, "asn": "ASNone ", "indicator": "138.124.61.210", "tags": ["SmartLoader", "github", "backdoor", "arm6", "arc", "GuLoader", "ps1", "dwkch-ru", "msi", "arm7", "kemo828", "zip", "cnc", "AgentTesla", "32-bit", "Kimsuky", "Formbook", "sh4", "PureRAT", "mirai", "mpsl", "exe", "45-92-1-242-8080", "pw-4DKCUJ4DDXS", "ascii", "PureHVNC", "ppc", "MeshAgent", "m68k", "rustystealer", "hta", "lua", "fbf543", "rev-base64-loader", "CoinMiner", "ua-wget", "PureCrypter", "124-198-131-88", "MassLogger", "i468", "arm5", "c2-monitor-auto", "golang", "GoToResolve", "memz", "PhantomStealer", "PowerPC", "rmm", "sh", "x86"], "pulses": ["IOC Blocking", "IOC Blocking", "URLHaus data - 15-04-2026 (Part 2)"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["dwkch.ru"]}


ioc_type: ipv4
ioc_value: 138.124.58.63
source: otx
validated_at: 2026-06-24T00:05:00.821960
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Switzerland", "country_code": "CH", "city": null, "asn": "ASNone ", "indicator": "138.124.58.63", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 22, "passive_dns": ["maks.pics", "otvetuus.top", "likeei.vu", "vkgolos.life", "wildberrsw.info", "golnk.info", "rumax-offsite.top", "maxrussia-official.top", "rumax-officially.top", "xakso2.shop", "wilbderrieshow.info", "hakwjsh.info", "golosnewsi-russia.click", "wcomax.cfd", "opros.help", "baza.poisksvo.top", "pornvideo.icu", "maxverify.shop", "data-svo.site", "dsnitro.cyou"]}


# threat_actors

name: Warlock
aliases: ["Water Manaul","Storm-2603"]
origin_country: CN
threat_type: ransomware
ttps: ["T1486-Data Encrypted for Impact", "T1071-Application Layer Protocol"]
first_seen: 2025-01-01
last_seen: 2026-04-01
created_at: 2026-04-04T18:15:53
description:
  Ransomware group tracked by Trend Micro as Water Manaul. Primary C2 endpoint at 198.13.158.193 hosted on BL Networks (AS399629). UK among top targeted nations.
  [2026-05-26] Attribution pivot: Warlock / Water Manaul attributed to Storm-2603 (China-based) per Microsoft Threat Intelligence and Trend Micro. Aliases extended; origin_country set to CN. Operational role (ransomware) unchanged. sentinel:WARLOCK_RECLASSIFY_2026_05_26


name: Forest Blizzard
aliases: ["APT28", "Fancy Bear", "GRU Unit 26165", "Sofacy", "Sednit", "STRONTIUM"]
origin_country: RU
threat_type: state_sponsored
first_seen: 2004-01-01
last_seen: 2026-04-01
created_at: 2026-04-04T18:15:53
description:
  Russian GRU Unit 26165 (85th GTsSS). Targets NATO logistics, EU governments, defense sector. In Feb 2026, spear-phished Japanese nuclear disarmament orgs via compromised Swiss NGO using CVE-2023-38831. Infrastructure overlap with dataset on 185.220.101.0/24 (CISA Joint Advisory May 2025) and M247 AS9009 (38 IOCs). Mandiant confirms shared infra with Sandworm.

ttps:
  ["T1566.001-Spearphishing Attachment", "T1203-Exploitation for Client Execution", "T1583.006-Web Services", "T1078-Valid Accounts", "T1190-Exploit Public-Facing Application"]


name: Sandworm
origin_country: RU
threat_type: state_sponsored
first_seen: 2009-01-01
last_seen: 2026-03-01
created_at: 2026-04-04T18:15:53
aliases:
  ["APT44", "Seashell Blizzard", "Voodoo Bear", "GRU Unit 74455", "Main Centre for Special Technologies"]

description:
  Russian GRU Unit 74455. Targets energy, critical infrastructure, elections. Mandiant APT44 report confirms infrastructure cohabitation with APT28. Increasing use of criminal BPH marketplaces (including yalishanda) since 2022. Hetzner AS24940 overlap with dataset (47 IOCs).

ttps:
  ["T1059-Command and Scripting Interpreter", "T1071-Application Layer Protocol", "T1486-Data Encrypted for Impact", "T1498-Network Denial of Service"]


name: Cadet Blizzard
aliases: ["Ember Bear", "UNC2589", "GRU Unit 29155", "161st Specialist Training Center"]
origin_country: RU
threat_type: state_sponsored
ttps: ["T1190-Exploit Public-Facing Application", "T1059-Command and Scripting Interpreter"]
first_seen: 2020-01-01
last_seen: 2026-03-01
created_at: 2026-04-04T18:15:53
description:
  Russian GRU Unit 29155. Targets Ukraine government, Western critical infrastructure. Documented by Microsoft and AWS as a Sandworm subgroup. Uses Private Layer AS51852 (179.43.x range per CISA AA24-249A). Dataset has IOCs on same ASN and adjacent subnets.


name: Gamaredon
aliases: ["Primitive Bear", "Shuckworm", "FSB Center 18", "Aqua Blizzard"]
origin_country: RU
threat_type: state_sponsored
first_seen: 2013-01-01
last_seen: 2026-03-01
created_at: 2026-04-04T18:15:53
description:
  Russian FSB Center 18. High-volume, lower sophistication targeting Ukraine gov, Western think tanks, NGOs. ESET (Sep 2025) confirmed first FSB inter-unit collaboration: Gamaredon deploying Turla (Center 16) Kazuar v2 backdoor via PteroGraphin loader. Uses fast-flux DNS infrastructure (Silent Push).

ttps:
  ["T1566.001-Spearphishing Attachment", "T1059.001-PowerShell", "T1071.001-Web Protocols", "T1568.002-Fast Flux DNS"]


name: Turla
aliases: ["Secret Blizzard", "Venomous Bear", "Snake", "FSB Center 16"]
origin_country: RU
threat_type: state_sponsored
first_seen: 2004-01-01
last_seen: 2026-03-01
created_at: 2026-04-04T18:15:53
description:
  Russian FSB Center 16. Elite capabilities targeting high-value diplomatic and defense targets. Received operational access from Gamaredon (Center 18) via Kazuar v2 backdoor — first documented FSB inter-unit cooperation (ESET Sep 2025). NCSC UK documented Turla exploiting Iranian APT infrastructure.

ttps:
  ["T1071-Application Layer Protocol", "T1059-Command and Scripting Interpreter", "T1090-Proxy", "T1027-Obfuscated Files or Information"]


name: Star Blizzard
aliases: ["COLDRIVER", "FSB Center 18", "Callisto Group"]
origin_country: RU
threat_type: state_sponsored
ttps: ["T1566.002-Spearphishing Link", "T1078-Valid Accounts", "T1598.003-Spearphishing Service"]
first_seen: 2017-01-01
last_seen: 2026-03-01
created_at: 2026-04-04T18:15:53
description:
  Russian FSB Center 18 (same unit as Gamaredon). Credential phishing targeting Western think tanks, NGOs. Uses credential phishing without persistent C2. Microsoft and DOJ disrupted operations. Google TAG documented LostKeys malware. CISA/NCSC advisory AA23-341A.


name: APT29
aliases: ["Midnight Blizzard", "Cozy Bear", "The Dukes", "SVR"]
origin_country: RU
threat_type: state_sponsored
first_seen: 2008-01-01
last_seen: 2026-03-01
created_at: 2026-04-04T18:15:53
description:
  Russian SVR foreign intelligence. Primarily uses residential proxies making direct IP attribution difficult. Check Point and Volexity documented overlap with Storm-2372 device-code phishing. Infrastructure observed on Hetzner AS24940 alongside GRU operations and dataset (47 IOCs).

ttps:
  ["T1566.001-Spearphishing Attachment", "T1078-Valid Accounts", "T1090.002-External Proxy", "T1528-Steal Application Access Token"]


name: ALPHV
aliases: ["BlackCat", "Noberus"]
origin_country: RU
threat_type: ransomware
ttps: ["T1486-Data Encrypted for Impact", "T1071-Application Layer Protocol"]
first_seen: 2021-11-01
last_seen: 2024-03-01
created_at: 2026-04-04T18:15:53
description:
  Russian-speaking ransomware-as-a-service (RaaS) operation. Shared AEZA AS210644 infrastructure with state-aligned operations. CISA/FBI/HHS advisory. Overlapping financial flows with LockBit (Chainalysis).


name: LockBit
aliases: ["LockBit 3.0", "LockBit Black"]
origin_country: RU
threat_type: ransomware
ttps: ["T1486-Data Encrypted for Impact", "T1490-Inhibit System Recovery"]
first_seen: 2019-09-01
last_seen: 2026-03-01
created_at: 2026-04-04T18:15:53
description:
  Prolific RaaS operation. Shared BPH ecosystem (Zservers/AEZA) with state-aligned ops. US/UK/AU joint sanctions on Zservers (Feb 2025) for LockBit hosting. Overlapping financial flows with ALPHV (Chainalysis). Also linked to BL Networks/BitLaunch infrastructure (AS399629).


name: Dragonfly
origin_country: RU
threat_type: state_sponsored
created_at: 2026-06-22 14:43:44
description:
  Dragonfly is a cyber-espionage group attributed to Russia's FSB Center 16, active since at least 2010. It targets defense, aviation, government and especially energy/electric-utility and industrial-control-system operators worldwide, using watering holes, supply-chain trojans and credential theft to pre-position within critical infrastructure.


name: Saint Bear
origin_country: RU
threat_type: state_sponsored
created_at: 2026-06-22 14:43:44
description:
  Saint Bear is a Russian-nexus threat group tracked by MITRE as G1031, active since at least 2021, associated with the SaintBot downloader and OutSteel exfiltration tool. It has overlapping UAC-0056 naming with Ember Bear; available evidence per MITRE suggests these may be distinct activity sets with differing behavioral profiles.


name: Winter Vivern
origin_country: RU
threat_type: state_sponsored
created_at: 2026-06-22 14:43:44
description:
  Winter Vivern is a threat group aligned to Russian and Belarusian interests, active since at least 2020, tracked by MITRE as G1035. It targets European government, military and NGO entities (with sporadic India/US victims), using document phishing and webmail (Roundcube) zero-day exploitation for intelligence collection, credential theft and persistence.


name: TEMP.Veles
origin_country: RU
threat_type: state_sponsored
created_at: 2026-06-22 14:43:44
description:
  TEMP.Veles is a Russia-based threat group (linked by FireEye/Mandiant to the Central Scientific Research Institute of Chemistry and Mechanics, CNIIHM, in Moscow) that targets critical-infrastructure industrial control systems. It is known for the TRITON/TRISIS malware framework, the first malware purpose-built to manipulate safety-instrumented systems, deployed against a petrochemical plant.


name: Indrik Spider
origin_country: RU
threat_type: state_sponsored
created_at: 2026-06-22 14:43:44
description:
  Indrik Spider is a Russia-based cybercriminal group active since at least 2014, originally operating the Dridex banking trojan and later pivoting to big-game ransomware (BitPaymer, WastedLocker, Hades). Sanctioned by the US Treasury (OFAC) as Evil Corp, members have assessed links to the FSB; the group repeatedly rebrands its ransomware to evade sanctions.


name: Wizard Spider
origin_country: RU
threat_type: state_sponsored
created_at: 2026-06-22 14:43:44
description:
  Wizard Spider is a Russia-based financially-motivated cybercrime group active since at least 2016, known for the TrickBot banking trojan and the Ryuk and Conti ransomware operations. It runs a large modular criminal ecosystem (BazarLoader, Diavol, Anchor) conducting big-game-hunting ransomware against enterprises, hospitals and public institutions; leaked Conti chats revealed pro-Russian alignment.


name: Black Basta
origin_country: RU
threat_type: ransomware
created_at: 2026-06-22 14:43:44
description:
  Black Basta is a Russian-speaking ransomware operation that emerged in April 2022 and is widely assessed as a Conti spinoff. It relied heavily on Qakbot for initial access and later pivoted to social-engineering chains (email bombing then Teams/Quick Assist vishing, linked to Storm-1811). Leaked internal chat logs in early 2025 confirmed Russian-language operations and exposed the group's structure.


name: Akira
origin_country: RU
threat_type: ransomware
created_at: 2026-06-22 14:43:44
description:
  Akira is a ransomware operation active since March 2023 with assessed ties to the former Conti ecosystem, based on code overlaps and cryptocurrency flows. It commonly gains access via VPN appliances lacking MFA (notably Cisco ASA) and runs both Windows (C++) and Linux/ESXi (Rust) encryptors. Microsoft tracks an overlapping cluster as Storm-1567.


name: Royal
origin_country: RU
threat_type: ransomware
created_at: 2026-06-22 14:43:44
description:
  Royal is a private (non-affiliate) ransomware crew that emerged in 2022, widely assessed as composed of former Conti 'Team One' members. It used callback phishing and malvertising (DEV-0569) for initial access and a partial-encryption technique. Royal rebranded to BlackSuit in mid-2023.


name: BlackSuit
origin_country: RU
threat_type: ransomware
created_at: 2026-06-22 14:43:44
description:
  BlackSuit is the mid-2023 rebrand of the Royal ransomware crew, sharing significant code overlap with Royal and Conti lineage. CISA updated its Royal advisory to cover BlackSuit. The operation conducts closed-crew double-extortion attacks against critical infrastructure and was disrupted/seized (Operation Checkmate) in 2025.


name: Play
origin_country: unknown
threat_type: ransomware
created_at: 2026-06-22 14:43:44
description:
  Play (PlayCrypt) is a ransomware group active since mid-2022. CISA's 2023 advisory assessed Play as a closed group 'to guarantee the secrecy of deals,' though some reporting points to RaaS-like distribution. It exploits public-facing vulnerabilities (FortiOS, Exchange ProxyNotShell) and uses intermittent encryption plus a custom Grixba info-stealer. Russian-speaking ecosystem ties are reported but attribution is less definitive than for Conti-lineage crews.


name: Medusa
origin_country: unknown
threat_type: ransomware
created_at: 2026-06-22 14:43:44
description:
  Medusa is a RaaS operation active since 2021 (high activity from 2023). CISA's 2025 advisory documents its affiliate model ('Medusa actors'), exploitation of public-facing applications, and BYOVD defense evasion. It is distinct from MedusaLocker and the Medusa Android banking botnet. Origin is assessed as likely Russian-speaking ecosystem but attribution is less firmly established than Conti-lineage crews.


name: Qilin
origin_country: RU
threat_type: ransomware
created_at: 2026-06-22 14:43:44
description:
  Qilin (originally Agenda) is a RaaS operation active since 2022, recruiting affiliates on Russian-language cybercrime forums (e.g. RAMP). It runs Go and later Rust encryptors with customizable per-target builds and ESXi/Linux variants. Qilin gained prominence with the 2024 Synnovis/NHS attack and offers affiliates a high revenue share. Russian-speaking ecosystem ties are documented via forum activity.


name: Phobos
origin_country: RU
threat_type: ransomware
created_at: 2026-06-22 14:43:44
description:
  Phobos is a RaaS active since 2018-2019, descended from the Dharma/CrySIS family, predominantly targeting small and medium businesses via RDP brute-force. CISA's 2024 advisory documents its affiliate structure; the 8Base group is an affiliate/rebrand running Phobos with aggressive double-extortion. An admin (Evgenii Ptitsyn) was extradited to the US in 2024, reinforcing the Russian-speaking attribution.


name: Clop
origin_country: RU
threat_type: ransomware
created_at: 2026-06-22 14:43:44
description:
  Clop (Cl0p) is a Russian-speaking ransomware/extortion operation tied to TA505 and overlapping FIN11. It pioneered large-scale zero-day exploitation of managed file-transfer products (Accellion FTA 2020-21, GoAnywhere and MOVEit Transfer 2023, Cleo 2024) for mass data-theft extortion, frequently skipping encryption entirely. Several members were arrested in Ukraine in 2021, though the core remains active.


name: Sangria Tempest
origin_country: RU
threat_type: ecrime
created_at: 2026-06-22 14:43:44
description:
  Sangria Tempest (FIN7 / Carbon Spider) is a long-running Russian-speaking financially motivated ecrime group, originally known for Carbanak and point-of-sale theft. It pivoted into the ransomware ecosystem, deploying REvil, Maze, DarkSide, ALPHV/BlackCat and Black Basta, and operated sham security firms (Combi Security, Bastion Secure) to recruit unwitting operators. It develops advanced tooling including the AvNeutralizer/AuKill EDR-killer.


name: Storm-0844
origin_country: unknown
threat_type: ransomware
created_at: 2026-06-22 14:43:44
description:
  Storm-0844 is a Microsoft-tracked ransomware activity cluster that has deployed Akira and later Fog ransomware, typically gaining access through internet-facing VPN/edge appliances lacking MFA. As a Microsoft 'Storm' designation it denotes an in-development cluster of unknown final attribution. The Russian-speaking ecosystem tie is via the Akira (Conti-lineage) payloads it deploys; direct origin attribution is UNCONFIRMED.


name: REvil
origin_country: RU
threat_type: ransomware
created_at: 2026-06-22 14:43:44
description:
  REvil (Sodinokibi) was a major Russian-speaking RaaS operated by GOLD SOUTHFIELD / Pinchy Spider, the successor to GandCrab. It ran a large affiliate program, conducted the 2021 Kaseya VSA supply-chain attack and the JBS extortion, and explicitly avoided CIS-region targets. Russian authorities arrested several members in early 2022 (FSB raids), and one affiliate was later convicted in the US.


name: DarkSide
origin_country: RU
threat_type: ransomware
created_at: 2026-06-22 14:43:44
description:
  DarkSide was a Russian-speaking RaaS active 2020-2021, responsible for the May 2021 Colonial Pipeline attack that triggered US fuel-supply disruption and major law-enforcement pressure. It avoided CIS-region victims via a language/locale check and presented a professionalized affiliate operation. It shut down shortly after Colonial Pipeline and reemerged as BlackMatter, with personnel overlapping ALPHV/BlackCat.


name: Hive
origin_country: RU
threat_type: ransomware
created_at: 2026-06-22 14:43:44
description:
  Hive was a prolific RaaS active 2021-2023 with a large affiliate program, encrypting Windows, Linux and ESXi via Go then Rust builds. CISA's advisory documented widespread critical-infrastructure and healthcare impact. The FBI covertly infiltrated Hive for months and disrupted it in January 2023, capturing decryption keys before the takedown. Russian-speaking ecosystem ties documented through affiliate recruitment.


name: BlackByte
origin_country: RU
threat_type: ransomware
created_at: 2026-06-22 14:43:44
description:
  BlackByte is a Russian-speaking ransomware operation assessed as a Conti spinoff, active since 2021. CISA issued a joint advisory after BlackByte attacks on US critical infrastructure. It is known for ProxyShell exploitation, BYOVD defense evasion, a custom ExByte exfiltration tool and, per Microsoft (Storm-0742), exploitation of the VMware ESXi auth-bypass CVE-2024-37085.


name: Cross-Bulletproof TLS-Camouflage Operator (2026-06)
origin_country: RU
threat_type: ecrime
created_at: 2026-06-22 14:43:44
description:
  Russian-speaking ecrime infra-operator running a self-contained bulletproof TLS-camouflage operation; umbrella campaign #110 with per-brand facets.


