# enrichment_results

indicator: 185.100.234.105
indicator_type: ipv4
source: shodan
city: self-signed
queried_at: 2026-04-01T06:01:30.979827
raw_data:
  {"ports": [443, 5986], "vulns": [], "hostnames": [], "tags": ["self-signed"], "cpes": ["cpe:/a:microsoft:internet_information_services:10.0", "cpe:/a:microsoft:internet_information_services", "cpe:/a:microsoft:asp.net", "cpe:/o:microsoft:windows"]}

hosting_provider:
  cpe:/a:microsoft:internet_information_services:10.0,cpe:/a:microsoft:internet_information_services,cpe:/a:microsoft:asp.net,cpe:/o:microsoft:windows


indicator: 45.137.21.10
indicator_type: ipv4
source: shodan
city: eol-product,eol-os
queried_at: 2026-04-01T06:01:32.769585
raw_data:
  {"ports": [80, 443, 8080, 9100], "vulns": ["CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["crm.spaceoffice38.com", "customer-rental.rootlayer.net", "scoreboard.spaceoffice38.com", "socket.spaceoffice38.com", "api.spaceoffice38.com"], "tags": ["eol-product", "eol-os"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:getbootstrap:bootstrap", "cpe:/a:f5:nginx:1.24.0", "cpe:/a:getbootstrap:bootstrap:4.5.2", "cpe:/o:linux:linux_kernel", "cpe:/a:jquery:jquery:3.5.1"]}

reverse_dns:
  crm.spaceoffice38.com,customer-rental.rootlayer.net,scoreboard.spaceoffice38.com,socket.spaceoffice38.com,api.spaceoffice38.com

hosting_provider:
  cpe:/o:canonical:ubuntu_linux,cpe:/a:getbootstrap:bootstrap,cpe:/a:f5:nginx:1.24.0,cpe:/a:getbootstrap:bootstrap:4.5.2,cpe:/o:linux:linux_kernel,cpe:/a:jquery:jquery:3.5.1


indicator: 37.28.153.214
indicator_type: ipv4
source: shodan
city: starttls
reverse_dns: d153214.artnet.gda.pl,server-37-28-153-214.da.direct
hosting_provider: cpe:/a:pureftpd:pure-ftpd,cpe:/a:apache:http_server:2,cpe:/a:exim:exim:4.99.1
queried_at: 2026-04-01T06:01:36.359775
raw_data:
  {"ports": [21, 25, 53, 80, 143, 443, 587, 995, 2222], "vulns": [], "hostnames": ["d153214.artnet.gda.pl", "server-37-28-153-214.da.direct"], "tags": ["starttls"], "cpes": ["cpe:/a:pureftpd:pure-ftpd", "cpe:/a:apache:http_server:2", "cpe:/a:exim:exim:4.99.1"]}


indicator: 185.172.39.230
indicator_type: ipv4
source: shodan
reverse_dns: 230.39.172.185.us.kuroit.com
queried_at: 2026-04-01T06:01:38.130271
raw_data:
  {"ports": [5901, 5915], "vulns": [], "hostnames": ["230.39.172.185.us.kuroit.com"], "tags": [], "cpes": []}


indicator: 172.86.73.187
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: 187.73.86.172.static.cloudzy.com
queried_at: 2026-04-01T06:01:46.958772
raw_data:
  {"ports": [3389], "vulns": [], "hostnames": ["187.73.86.172.static.cloudzy.com"], "tags": ["self-signed"], "cpes": []}


indicator: 175.110.112.221
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: 175-110-112-221.hosted-by-worldstream.net
queried_at: 2026-04-01T06:01:50.541869
raw_data:
  {"ports": [22, 80, 443, 2222], "vulns": [], "hostnames": ["175-110-112-221.hosted-by-worldstream.net"], "tags": ["self-signed"], "cpes": ["cpe:/a:golang:go", "cpe:/a:caddyserver:caddy", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:9.6p1"]}

hosting_provider:
  cpe:/a:golang:go,cpe:/a:caddyserver:caddy,cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:9.6p1


indicator: 92.204.164.50
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/a:apache:http_server:2.2.25
queried_at: 2026-04-01T06:01:54.113482
raw_data:
  {"ports": [8080], "vulns": ["CVE-2022-28614", "CVE-2021-32792", "CVE-2015-0228", "CVE-2016-8612", "CVE-2013-6438", "CVE-2011-2688", "CVE-2021-32785", "CVE-2016-4975", "CVE-2025-49812", "CVE-2013-4365", "CVE-2021-40438", "CVE-2022-29404", "CVE-2022-28615", "CVE-2021-32786", "CVE-2017-9798", "CVE-2021-34798", "CVE-2009-0796", "CVE-2021-44790", "CVE-2017-3169", "CVE-2014-0226", "CVE-2021-39275", "CVE-2022-30556", "CVE-2009-2299", "CVE-2012-4001", "CVE-2022-28330", "CVE-2017-3167", "CVE-2023-38709",


indicator: 175.110.114.9
indicator_type: ipv4
source: shodan
reverse_dns: 175-110-114-9.hosted-by-worldstream.net
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.9p1
queried_at: 2026-04-01T06:02:02.923529
raw_data:
  {"ports": [22, 3000, 3001], "vulns": [], "hostnames": ["175-110-114-9.hosted-by-worldstream.net"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1"]}


indicator: 195.3.220.48
indicator_type: ipv4
source: shodan
city: videogame,self-signed,eol-product
queried_at: 2026-04-01T06:02:13.487955
raw_data:
  {"ports": [22, 80, 443, 4444, 7777, 25565], "vulns": ["CVE-2023-44487", "CVE-2025-23419"], "hostnames": [], "tags": ["videogame", "self-signed", "eol-product"], "cpes": ["cpe:/a:f5:nginx:1.24.0", "cpe:/o:linux:linux_kernel", "cpe:/a:minecraft:minecraft:PeakMe", "cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}

hosting_provider:
  cpe:/a:f5:nginx:1.24.0,cpe:/o:linux:linux_kernel,cpe:/a:minecraft:minecraft:PeakMe,cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux


indicator: 45.61.149.109
indicator_type: ipv4
source: shodan
reverse_dns: 109.149.61.45.static.cloudzy.com
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:9.6p1
queried_at: 2026-04-01T06:02:20.512874
raw_data:
  {"ports": [22, 443], "vulns": [], "hostnames": ["109.149.61.45.static.cloudzy.com"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:9.6p1"]}


indicator: 85.239.52.32
indicator_type: ipv4
source: shodan
city: eol-os
reverse_dns: 6649653-qo825560.twc1.net
queried_at: 2026-04-01T06:02:25.755150
raw_data:
  {"ports": [22, 6379, 8000, 8080], "vulns": [], "hostnames": ["6649653-qo825560.twc1.net"], "tags": ["eol-os"], "cpes": ["cpe:/a:python:python", "cpe:/a:encode:uvicorn", "cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:redislabs:redis:7.4.7"]}

hosting_provider:
  cpe:/a:python:python,cpe:/a:encode:uvicorn,cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux,cpe:/a:redislabs:redis:7.4.7


indicator: 23.254.167.216
indicator_type: ipv4
source: shodan
reverse_dns: hwsrv-1253777.hostwindsdns.com
hosting_provider: cpe:/a:nodejs:node.js,cpe:/a:expressjs:express
queried_at: 2026-04-01T06:02:34.582015
raw_data:
  {"ports": [8000], "vulns": [], "hostnames": ["hwsrv-1253777.hostwindsdns.com"], "tags": [], "cpes": ["cpe:/a:nodejs:node.js", "cpe:/a:expressjs:express"]}


indicator: 185.235.137.163
indicator_type: ipv4
source: otx
country: IR
queried_at: 2026-04-01T06:02:38.893821
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Iran, Islamic Republic of", "country_code": "IR", "city": null, "asn": "AS202391 cooperative afra ertebatat-e-sabet-e rasa co", "indicator": "185.235.137.163", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 194.126.178.8
indicator_type: ipv4
source: otx
country: FR
hosting_provider: amazon02,programdata,june,future,seznam,scroll,slovakia,indonesia,as16509,install
queried_at: 2026-04-01T06:02:43.785634
raw_data:
  {"pulse_count": 50, "reputation": 0, "country": "France", "country_code": "FR", "city": null, "asn": "AS35625 eurafibre sas", "indicator": "194.126.178.8", "tags": ["amazon02", "programdata", "june", "future", "seznam", "scroll", "slovakia", "indonesia", "as16509", "install", "sysupdate", "CERT-UA#8399", "python", "akamaiasn1", "local", "pixpirate", "javascript", "sector", "webdav", "Nextray", "public url", "malware", "ITG05", "tactictechnique", "as8075", "united", "monitor", "tools", "april", "


indicator: 91.202.4.76
indicator_type: ipv4
source: otx
country: PL
reverse_dns: www.revofilstore.com,revofilstore.com
hosting_provider: group,truebot,clop,june,moveit transfer,cl0p,azure sql,sql injection,powershell,ransomware
queried_at: 2026-04-01T06:02:55.595860
raw_data:
  {"pulse_count": 26, "reputation": 0, "country": "Poland", "country_code": "PL", "city": null, "asn": "AS43641 sollutium eu sp z.o.o.", "indicator": "91.202.4.76", "tags": ["group", "truebot", "clop", "june", "moveit transfer", "cl0p", "azure sql", "sql injection", "powershell", "ransomware", "ta505", "tinymet", "movit exploit", "vulnerability", "russia", "random", "suite", "research", "path", "sdbot", "cobalt strike", "panama", "fingerprint", "exploit", "cryptomix"], "pulses": ["#StopRansomware:


indicator: 155.138.252.221
indicator_type: ipv4
source: otx
country: US
queried_at: 2026-04-01T06:03:05.004623
raw_data:
  {"pulse_count": 22, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "155.138.252.221", "tags": ["Gamaredon", "microsoft word", "team", "service", "Exfil", "threatactor.primitivebear", "Trident Ursa", "word", "base64encoded", "armageddon", "ukraine", "Lnk Files", "ip address", "domain", "xorbytes", "threatactor/tridentursa", "vbscript", "powershell", "threatactor/gamaredon", "VBS Script", "Phishin

reverse_dns:
  chatorganizerai.ink,health-newstoday.world,trytopnewstoday.world,uuiekaop.com,corolain.ru,lopasts.ru,sumcld.ru,kurugum.ru,palutas.ru,lopezx.ru

hosting_provider:
  Gamaredon,microsoft word,team,service,Exfil,threatactor.primitivebear,Trident Ursa,word,base64encoded,armageddon


indicator: 162.33.178.129
indicator_type: ipv4
source: otx
country: US
hosting_provider: Gamaredon,msi file,zip archive,VBS Script,Phishing,Powershell,malspam email,Exfil,anna paula,utf8
queried_at: 2026-04-01T06:03:08.843589
raw_data:
  {"pulse_count": 49, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS399629 bl networks", "indicator": "162.33.178.129", "tags": ["Gamaredon", "msi file", "zip archive", "VBS Script", "Phishing", "Powershell", "malspam email", "Exfil", "anna paula", "utf8", "tuesday", "Lnk Files", "associated", "headers", "from email", "currc3adculo"], "pulses": ["Gamaredon APT targets Ukrainian government agencies in new campaign", "test", "test", "test", "te

reverse_dns:
  caipgovaccount.info,winsecupdate.com,retbr.fun,tumnt.top,www.basketballreviews.org,basketballreviews.org,celticso.ru,mitrograd.ru,sheldoni.ru,mishitron.ru


indicator: 168.119.152.19
indicator_type: ipv4
source: otx
country: DE
hosting_provider: execution,restart,service,june,first,kazuar v3,kazuar,strong,ukraine,february
queried_at: 2026-04-01T06:03:21.362616
raw_data:
  {"pulse_count": 6, "reputation": 0, "country": "Germany", "country_code": "DE", "city": null, "asn": "AS24940 hetzner online gmbh", "indicator": "168.119.152.19", "tags": ["execution", "restart", "service", "june", "first", "kazuar v3", "kazuar", "strong", "ukraine", "february", "amadey", "pteropaste", "vbscript", "powershell", "bridge", "persistence", "telegram", "snake", "defense", "c server", "pteroodd", "eset research", "pterographin", "oilrig", "invisimole", "tips", "wordpress site", "third

reverse_dns:
  qemail.ir,bestlisto.com,mahshidmolooki.ir,cultivia.ir,healme.help,www.cultivia.ir.healme.help,www.mylvora.site.healme.help,www.psystore.ir.healme.help,mylvora.site.healme.help,www.mahshidmolooki.ir.healme.help


indicator: 185.118.115.15
indicator_type: ipv4
source: otx
country: PT
hosting_provider: execution,restart,service,pterostew,june,first,kazuar v3,ukraine,kazuar,strong
queried_at: 2026-04-01T06:03:25.228456
raw_data:
  {"pulse_count": 10, "reputation": 0, "country": "Portugal", "country_code": "PT", "city": null, "asn": "AS39384 dream fusion - it services  lda", "indicator": "185.118.115.15", "tags": ["execution", "restart", "service", "pterostew", "june", "first", "kazuar v3", "ukraine", "kazuar", "strong", "february", "amadey", "cyberespionage", "pteropaste", "fsb", "vbscript", "powershell", "bridge", "collaboration", "auto-generated security", "pterolnk", "persistence", "telegram", "russia", "snake", "defen

reverse_dns:
  europrofit.pt,banquetesaduarte.com,dev.gapetec.com,www.dev.gapetec.com,online2.tecnmir.com,sv1.tecnmir.com,help.equirest.com,www.help.equirest.com,intermove.pt,grouplacerent.pt


indicator: 195.62.52.93
indicator_type: ipv4
source: otx
country: RU
reverse_dns: lumenvisit.com,trickradar.net,check-update.ru
queried_at: 2026-04-01T06:03:27.734160
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS44812 ip server llc", "indicator": "195.62.52.93", "tags": [], "pulses": [], "malware_count": 11, "passive_dns_count": 3, "malware_samples": ["6f774e199844e385d6f36666c1c69892da56753bde496fc16199ea86ec2014e1", "5c04aaaa1df23999672e43f11acd8fcb03413c73ce1021aaa3aeb0e964ef82eb", "2a4d48532887bb97e4881cbfd162d87a0f2ad7e0fe9911e6b3e5d7896eb5a2b3", "2d4326409a49b9768733276df9aacebaae1902


indicator: 217.160.0.159
indicator_type: ipv4
source: otx
country: DE
queried_at: 2026-04-01T06:03:45.095617
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Germany", "country_code": "DE", "city": null, "asn": "AS8560 1&1 ionos se", "indicator": "217.160.0.159", "tags": [], "pulses": ["EbeeSep2025 Pt5", "12-30-Sep-25", "Russian Hackers Gamaredon and Turla Deploy Kazuar Backdoor"], "malware_count": 7, "passive_dns_count": 500, "malware_samples": ["3d8657e114a07f6048014b5b50489af4156a1bd946d2b5ffb93d03674fced272", "67b16edf51df4a7cd498f1d0153452edc5bfa79767e928d955c49ab94a289c55", "369b9b0924146e0b7d6afd

reverse_dns:
  www.hannahblossoms.co.uk,www.stamm-lauer.de,kurtenbach-communications.com,ppl-ds.com,duurzaampaleis.com,paddlemoinscher.com,hypnose-langenfeld.de,abada-capoeira.eu,theiss-live.store,auqauneo.store


indicator: 217.160.0.33
indicator_type: ipv4
source: otx
country: DE
hosting_provider: auto-generated security
queried_at: 2026-04-01T06:04:02.176036
raw_data:
  {"pulse_count": 4, "reputation": 0, "country": "Germany", "country_code": "DE", "city": null, "asn": "AS8560 1&1 ionos se", "indicator": "217.160.0.33", "tags": ["auto-generated security"], "pulses": ["EbeeSep2025 Pt5", "12-30-Sep-25", "Russian Hackers Gamaredon and Turla Deploy Kazuar Backdoor", "Auto-generated Pulse"], "malware_count": 7, "passive_dns_count": 500, "malware_samples": ["43bfb06d7ff6d8f9c6aeb84b4e96084a6bf2f2b3ef8de1eca1f75cd38ce6e393", "2e0107288eccaab62de29c9bf6a26e21886ab70114

reverse_dns:
  www.jh-maschinenbau.de,snote.fun,smmartservices.com,franz-kortmann.de,www.zimmermann-mehr-wert-coaching.de,mindthegaps.uk,aliciacrooksod.com,www.therawstories.com,marbi-tech.com,hennairperfumes.com


indicator: 45.77.237.252
indicator_type: ipv4
source: otx
country: AU
city: Alexandria
reverse_dns: sacramentos.ru,dyn-jfqa-591769.lender.fun
queried_at: 2026-04-01T06:04:14.668883
raw_data:
  {"pulse_count": 22, "reputation": 0, "country": "Australia", "country_code": "AU", "city": "Alexandria", "asn": "AS20473 the constant company  llc", "indicator": "45.77.237.252", "tags": ["Gamaredon", "microsoft word", "team", "appdata", "service", "Exfil", "threatactor.primitivebear", "Trident Ursa", "word", "base64encoded", "armageddon", "ukraine", "Lnk Files", "ip address", "domain", "xorbytes", "threatactor/tridentursa", "null", "vbscript", "powershell", "threatactor/gamaredon", "newobject",

hosting_provider:
  Gamaredon,microsoft word,team,appdata,service,Exfil,threatactor.primitivebear,Trident Ursa,word,base64encoded


indicator: 64.176.173.164
indicator_type: ipv4
source: otx
country: US
hosting_provider: execution,restart,service,june,first,kazuar v3,kazuar,strong,ukraine,february
queried_at: 2026-04-01T06:04:31.714863
raw_data:
  {"pulse_count": 6, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "64.176.173.164", "tags": ["execution", "restart", "service", "june", "first", "kazuar v3", "kazuar", "strong", "ukraine", "february", "amadey", "pteropaste", "vbscript", "powershell", "bridge", "persistence", "telegram", "snake", "defense", "c server", "pteroodd", "eset research", "pterographin", "oilrig", "invisimole", "tips", "wordpress site", "third", 


indicator: 77.46.148.242
indicator_type: ipv4
source: otx
country: RS
hosting_provider: execution,restart,service,pterostew,june,first,kazuar v3,ukraine,kazuar,strong
queried_at: 2026-04-01T06:04:39.331617
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Serbia", "country_code": "RS", "city": null, "asn": "AS8400 telekom srbija a.d.", "indicator": "77.46.148.242", "tags": ["execution", "restart", "service", "pterostew", "june", "first", "kazuar v3", "ukraine", "kazuar", "strong", "february", "amadey", "cyberespionage", "pteropaste", "fsb", "vbscript", "powershell", "bridge", "collaboration", "pterolnk", "persistence", "telegram", "russia", "snake", "defense", "c server", "pteroodd", "eset research"

reverse_dns:
  srmagroup.com,vsresidence.rs,aleksamatic.com,new.ingas.rs,www.agroletac.com,goplast.gr,mail.ronex.rs,kazoil.rs,tabakcoop.rs,perlaluxapartmani.com


indicator: 85.13.145.231
indicator_type: ipv4
source: otx
country: DE
city: Loebau
hosting_provider: execution,restart,service,pterostew,june,first,kazuar v3,ukraine,kazuar,strong
queried_at: 2026-04-01T06:04:44.100924
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Loebau", "asn": "AS34788 neue medien muennich", "indicator": "85.13.145.231", "tags": ["execution", "restart", "service", "pterostew", "june", "first", "kazuar v3", "ukraine", "kazuar", "strong", "february", "amadey", "cyberespionage", "pteropaste", "fsb", "vbscript", "powershell", "bridge", "collaboration", "pterolnk", "persistence", "telegram", "russia", "snake", "defense", "c server", "pteroodd", "eset re

reverse_dns:
  www.rwcsports.com,rwcsports.com,www.assets.extrarunde-biathlon.de,assets.extrarunde-biathlon.de,mirjamgerber.de,www.mirjamgerber.de,mrw-mas.com,meshcotic.com,v2.mtv-salzgitter.de,www.v2.mtv-salzgitter.de


indicator: 46.30.188.187
indicator_type: ipv4
source: otx
country: NL
city: Amsterdam
reverse_dns: xmrvsbeast.com
queried_at: 2026-04-01T06:05:00.018482
raw_data:
  {"pulse_count": 36, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": "Amsterdam", "asn": "AS8100 quadranet enterprises llc", "indicator": "46.30.188.187", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "mali

hosting_provider:
  stop,Python Remote Desktop Protocol MITM tool (PyRDP),zero trust,trend vision,protect,service,rogue,ukraine,ip address,indonesia


indicator: 178.255.43.30
indicator_type: ipv4
source: otx
country: PL
queried_at: 2026-04-01T06:05:18.573343
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Poland", "country_code": "PL", "city": null, "asn": "AS197155 artnet sp. z o.o.", "indicator": "178.255.43.30", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "at

hosting_provider:
  stop,Python Remote Desktop Protocol MITM tool (PyRDP),zero trust,trend vision,protect,service,rogue,ukraine,ip address,indonesia


indicator: 104.161.58.10
indicator_type: ipv4
source: otx
country: US
city: Phoenix
reverse_dns: 3vuwn8m.top,us1px68.top,r8te226.top,pin13x8.top,8lt7sdk.top,fangtongban.com
queried_at: 2026-04-01T06:05:29.348521
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Phoenix", "asn": "AS53755 input output flood llc", "indicator": "104.161.58.10", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei

hosting_provider:
  stop,Python Remote Desktop Protocol MITM tool (PyRDP),zero trust,trend vision,protect,service,rogue,ukraine,ip address,indonesia


indicator: 185.187.155.69
indicator_type: ipv4
source: otx
country: GB
queried_at: 2026-04-01T06:05:47.388087
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": null, "asn": "AS62240 clouvider limited", "indicator": "185.187.155.69", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device securit

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 5.187.49.186
indicator_type: ipv4
source: otx
country: PL
queried_at: 2026-04-01T06:05:56.766306
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Poland", "country_code": "PL", "city": null, "asn": "AS197155 artnet sp. z o.o.", "indicator": "5.187.49.186", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "att

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 45.82.66.39
indicator_type: ipv4
source: otx
country: MD
queried_at: 2026-04-01T06:06:00.659030
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": null, "asn": "AS49981 worldstream b.v.", "indicator": "45.82.66.39", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "am

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 141.195.117.129
indicator_type: ipv4
source: otx
country: US
reverse_dns: lg.par-1.fr.radwebhosting.com
queried_at: 2026-04-01T06:06:03.941184
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "141.195.117.129", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "a

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 103.144.139.253
indicator_type: ipv4
source: otx
country: MY
reverse_dns: www.shouye8.com,www.dramahao.com,www.dianyingbay.com,ezshyxx.com,www.ezshyxx.com,www.duokanju.com
queried_at: 2026-04-01T06:06:28.654078
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Malaysia", "country_code": "MY", "city": null, "asn": "AS55720 gigabit hosting sdn bhd", "indicator": "103.144.139.253", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "ama

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 185.177.126.225
indicator_type: ipv4
source: otx
country: NL
queried_at: 2026-04-01T06:06:32.710659
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": null, "asn": "AS49981 worldstream b.v.", "indicator": "185.177.126.225", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon"

reverse_dns:
  preprod.mobilecamsx.com,www.mobilecamsx.com,mobilecamsx.com,staging.olefans.com,preprod.olefans.com,ksadrama.com,startbox.ltd

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 185.100.234.105
indicator_type: ipv4
source: otx
country: NL
city: Haarlem
queried_at: 2026-04-01T06:06:51.873741
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": "Haarlem", "asn": "AS31120 padaco automatisering b.v.", "indicator": "185.100.234.105", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 45.137.21.10
indicator_type: ipv4
source: otx
country: BD
queried_at: 2026-04-01T06:07:10.761701
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Bangladesh", "country_code": "BD", "city": null, "asn": "AS51447 rootlayer web services ltd.", "indicator": "45.137.21.10", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 5.183.95.240
indicator_type: ipv4
source: otx
country: DE
city: Frankfurt am Main
queried_at: 2026-04-01T06:07:14.667390
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS31400 accelerated it services & consulting gmbh", "indicator": "5.183.95.240", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "ear

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 37.28.153.214
indicator_type: ipv4
source: otx
country: PL
queried_at: 2026-04-01T06:07:34.010204
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Poland", "country_code": "PL", "city": null, "asn": "AS197155 artnet sp. z o.o.", "indicator": "37.28.153.214", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "at

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 185.172.39.230
indicator_type: ipv4
source: otx
country: NL
city: Amsterdam
queried_at: 2026-04-01T06:07:37.185309
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": "Amsterdam", "asn": "AS3320 deutsche telekom ag", "indicator": "185.172.39.230", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", 

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 162.216.243.210
indicator_type: ipv4
source: otx
country: US
queried_at: 2026-04-01T06:07:41.838376
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS398019 dynu systems incorporated", "indicator": "162.216.243.210", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshche

reverse_dns:
  porte11.com,magtg.com,topco.shop,simple-feet.net,tse.simple-feet.net,pf-admin.tequenikality.net,server1.tequenikality.net,tequenikality.net,162.216.243.210

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 185.243.112.24
indicator_type: ipv4
source: otx
country: NL
queried_at: 2026-04-01T06:07:58.627724
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": null, "asn": "AS208258 access2.it group b.v.", "indicator": "185.243.112.24", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "am

reverse_dns:
  app.185.243.112.24.sslip.io,185.243.112.24.nip.io,de24.connectv2rayng.biz,www.login.microsoftonline.com.msftsec.com,login.login.microsoftonline.com.msftsec.com

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 185.243.115.124
indicator_type: ipv4
source: otx
country: DE
city: Frankfurt am Main
queried_at: 2026-04-01T06:08:01.771299
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS48314 michael sebastian schinzel trading as ip-projects gmbh & co. kg", "indicator": "185.243.115.124", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing"

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 45.86.162.170
indicator_type: ipv4
source: otx
country: NL
city: Amsterdam
queried_at: 2026-04-01T06:08:05.586241
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": "Amsterdam", "asn": "AS8100 quadranet enterprises llc", "indicator": "45.86.162.170", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws i

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 172.86.73.187
indicator_type: ipv4
source: otx
country: US
city: Los Angeles
queried_at: 2026-04-01T06:08:34.193078
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Los Angeles", "asn": "AS46261 quickpacket  llc", "indicator": "172.86.73.187", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei",

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 46.30.189.91
indicator_type: ipv4
source: otx
country: DE
city: Frankfurt am Main
reverse_dns: brewssh.com
queried_at: 2026-04-01T06:08:37.638429
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS31400 accelerated it services & consulting gmbh", "indicator": "46.30.189.91", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "ear

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 175.110.112.221
indicator_type: ipv4
source: otx
country: GB
queried_at: 2026-04-01T06:08:44.541577
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": null, "asn": "ASNone ", "indicator": "175.110.112.221", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshch

reverse_dns:
  from.dashpoo.xyz,g.dashpoo.xyz,www.dashpoo.xyz,elementweb.dashpoo.xyz,rc.dashpoo.xyz,dashpoo.xyz,element.dashpoo.xyz

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 155.138.238.169
indicator_type: ipv4
source: otx
country: US
city: Atlanta
reverse_dns: cadevsolutions.com
queried_at: 2026-04-01T06:08:48.287571
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Atlanta", "asn": "AS20473 the constant company  llc", "indicator": "155.138.238.169", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth kos

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 92.204.164.50
indicator_type: ipv4
source: otx
queried_at: 2026-04-01T06:08:52.666526
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "", "country_code": "", "city": "", "asn": "AS29066 host europe gmbh", "indicator": "92.204.164.50", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secu

reverse_dns:
  testdashboard.wasaneveri.com,api.saamitradestar.com,www.scsplindia.com,scsplindia.com,www.proeserve.com,proeserve.com,saamitradestar.com,www.saamitradestar.com

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 103.144.139.74
indicator_type: ipv4
source: otx
country: MY
queried_at: 2026-04-01T06:09:10.352129
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Malaysia", "country_code": "MY", "city": null, "asn": "AS55720 gigabit hosting sdn bhd", "indicator": "103.144.139.74", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amaz

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 185.172.39.220
indicator_type: ipv4
source: otx
country: NL
city: Amsterdam
queried_at: 2026-04-01T06:09:13.788644
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": "Amsterdam", "asn": "AS3320 deutsche telekom ag", "indicator": "185.172.39.220", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", 

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 5.183.95.158
indicator_type: ipv4
source: otx
country: DE
city: Frankfurt am Main
queried_at: 2026-04-01T06:09:43.602372
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS31400 accelerated it services & consulting gmbh", "indicator": "5.183.95.158", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "ear

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 193.29.56.221
indicator_type: ipv4
source: otx
country: DE
city: Frankfurt am Main
queried_at: 2026-04-01T06:10:01.708487
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS48314 michael sebastian schinzel trading as ip-projects gmbh & co. kg", "indicator": "193.29.56.221", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", 

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 175.110.114.9
indicator_type: ipv4
source: otx
country: GB
queried_at: 2026-04-01T06:10:20.443489
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": null, "asn": "ASNone ", "indicator": "175.110.114.9", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 45.137.21.11
indicator_type: ipv4
source: otx
country: BD
queried_at: 2026-04-01T06:10:38.389170
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Bangladesh", "country_code": "BD", "city": null, "asn": "AS51447 rootlayer web services ltd.", "indicator": "45.137.21.11", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 66.206.13.130
indicator_type: ipv4
source: otx
country: US
city: New York
queried_at: 2026-04-01T06:10:56.842915
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "New York", "asn": "AS29802 hivelocity  inc.", "indicator": "66.206.13.130", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "a

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 185.243.114.9
indicator_type: ipv4
source: otx
country: DE
city: Frankfurt am Main
queried_at: 2026-04-01T06:11:29.455886
raw_data:
  {"pulse_count": 10, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS48314 michael sebastian schinzel trading as ip-projects gmbh & co. kg", "indicator": "185.243.114.9", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "tsec", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "honeypot", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights

hosting_provider:
  stop,Python Remote Desktop Protocol MITM tool (PyRDP),zero trust,trend vision,protect,service,tsec,rogue,ukraine,ip address


indicator: 46.30.189.62
indicator_type: ipv4
source: otx
country: DE
city: Frankfurt am Main
queried_at: 2026-04-01T06:11:52.181512
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS31400 accelerated it services & consulting gmbh", "indicator": "46.30.189.62", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "ear

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 37.28.157.246
indicator_type: ipv4
source: otx
country: PL
queried_at: 2026-04-01T06:12:03.441218
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Poland", "country_code": "PL", "city": null, "asn": "AS197155 artnet sp. z o.o.", "indicator": "37.28.157.246", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "at

hosting_provider:
[cell repeats an earlier one in this file: 128 characters]


indicator: 103.94.157.5
indicator_type: ipv4
source: otx
country: IN
city: Jalandhar
hosting_provider: GRU,Sandworm,Russia
queried_at: 2026-04-01T06:12:49.181305
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "India", "country_code": "IN", "city": "Jalandhar", "asn": "AS136621 sbp corporation limited", "indicator": "103.94.157.5", "tags": ["GRU", "Sandworm", "Russia"], "pulses": ["Sandworm Exploiting Exim CVE-2019-10149"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 95.216.13.196
indicator_type: ipv4
source: otx
country: FI
city: Helsinki
hosting_provider: GRU,Sandworm,Russia
queried_at: 2026-04-01T06:13:25.467252
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Finland", "country_code": "FI", "city": "Helsinki", "asn": "AS24940 hetzner online gmbh", "indicator": "95.216.13.196", "tags": ["GRU", "Sandworm", "Russia"], "pulses": ["Sandworm Exploiting Exim CVE-2019-10149"], "malware_count": 2, "passive_dns_count": 0, "malware_samples": ["dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730", "0c0817aae0d6956848c20770feb14b0f8a45604953f47f76ac9a9cf3f16d23d9"]}


indicator: 45.61.149.109
indicator_type: ipv4
source: otx
country: US
hosting_provider: service,defender,iocs,bluesky,ip address,february,domain,cyberespionage,window,twitter
queried_at: 2026-04-01T06:13:44.274045
raw_data:
  {"pulse_count": 8, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS46261 quickpacket  llc", "indicator": "45.61.149.109", "tags": ["service", "defender", "iocs", "bluesky", "ip address", "february", "domain", "cyberespionage", "window", "twitter", "moscow", "root certificates", "model", "russia", "snake", "apolloshadow", "secret blizzard", "firefox", "aitm", "asim", "file name", "microsoft", "wraith", "code", "aitm position", "sentinel", "tur


indicator: 65.21.51.58
indicator_type: ipv4
source: otx
country: FI
city: Helsinki
hosting_provider: hashes,mimikatz,execution,ncsc,service,https,stix,powershell,shell,cert polska
queried_at: 2026-04-01T06:14:17.863562
raw_data:
  {"pulse_count": 6, "reputation": 0, "country": "Finland", "country_code": "FI", "city": "Helsinki", "asn": "AS24940 hetzner online gmbh", "indicator": "65.21.51.58", "tags": ["hashes", "mimikatz", "execution", "ncsc", "service", "https", "stix", "powershell", "shell", "cert polska", "ck techniques", "indicator", "fileobj", "wellmail", "svr cyber", "cyber", "persistence", "cisa", "powersploit", "wellmess", "diplomatic orbiter", "simplehashvalue", "cyber actors", "graphicalproton", "mitre att", "t


indicator: 85.239.52.32
indicator_type: ipv4
source: otx
country: RU
city: Moscow
hosting_provider: lostkeys,cti weekly,gtig,coldcopy,clickfix,june,iocs,coldcopy domain,yesrobot c2,mayberobot
queried_at: 2026-04-01T06:14:36.249721
raw_data:
  {"pulse_count": 10, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS62005 bluevps ou", "indicator": "85.239.52.32", "tags": ["lostkeys", "cti weekly", "gtig", "coldcopy", "clickfix", "june", "iocs", "coldcopy domain", "yesrobot c2", "mayberobot", "article", "weekly digest", "powershell", "digest article", "gc3 cti", "norobot", "coldriver", "python", "indicator", "simplefix", "download", "malware", "mayberobot c2", "russian state-sponsored", "zs


indicator: 193.187.148.169
indicator_type: ipv4
source: otx
country: RO
city: Bucharest
reverse_dns: wellnessmedcare.org
hosting_provider: filen,execution,filehashmd5,eu,syria,oper informativ,nato,iocs,prismex,filehashsha1
queried_at: 2026-04-01T06:14:48.288287
raw_data:
  {"pulse_count": 21, "reputation": 0, "country": "Romania", "country_code": "RO", "city": "Bucharest", "asn": "AS35505 pronet solutii it srl", "indicator": "193.187.148.169", "tags": ["filen", "execution", "filehashmd5", "eu", "syria", "oper informativ", "nato", "iocs", "prismex", "filehashsha1", "word", "covenant", "ukraine", "network", "cve-2026-21509", "com hijacking", "notdoor", "ip address", "domains", "windows", "czech republic", "simpleloader", "onedrivehealth", "slovak", "bypass", "fileha


indicator: 23.227.202.14
indicator_type: ipv4
source: otx
country: US
city: Tampa
hosting_provider: filen,execution,filehashmd5,eu,team,syria,oper informativ,nato,iocs,prismex
queried_at: 2026-04-01T06:15:06.962121
raw_data:
  {"pulse_count": 13, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Tampa", "asn": "AS29802 hivelocity  inc.", "indicator": "23.227.202.14", "tags": ["filen", "execution", "filehashmd5", "eu", "team", "syria", "oper informativ", "nato", "iocs", "prismex", "filehashsha1", "programdata", "covenant", "ukraine", "network", "cve-2026-21509", "com hijacking", "notdoor", "ip address", "domains", "windows", "simpleloader", "onedrivehealth", "slovak", "bypass", "fil


indicator: 72.62.185.31
indicator_type: ipv4
source: otx
country: US
city: Phoenix
hosting_provider: execution,filehashmd5,syria,oper informativ,nato,prismex,filehashsha1,covenant,ukraine,network
queried_at: 2026-04-01T06:15:24.967242
raw_data:
  {"pulse_count": 8, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Phoenix", "asn": "AS1239 sprint", "indicator": "72.62.185.31", "tags": ["execution", "filehashmd5", "syria", "oper informativ", "nato", "prismex", "filehashsha1", "covenant", "ukraine", "network", "cve-2026-21509", "ip address", "notdoor", "domains", "simpleloader", "slovak", "bypass", "filehashsha256", "ips domain", "final", "prismexdrop", "ipv6240e", "phishing", "prismexloader", "steganogr


indicator: 142.11.206.73
indicator_type: ipv4
source: otx
country: US
hosting_provider: write,macos,linux python,network,cicd,windows,c2 url,install,vbscript,powershell
queried_at: 2026-04-01T06:15:45.483077
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS54290 hostwinds llc.", "indicator": "142.11.206.73", "tags": ["write", "macos", "linux python", "network", "cicd", "windows", "c2 url", "install", "vbscript", "powershell", "github actions", "python", "malicious", "c2 domain", "stepsecurity", "post body", "kics", "copy", "verify", "linux", "c2 post", "http", "hardenrunner", "c2 ip"], "pulses": ["Axios Package Hijacked to Execu


indicator: 23.254.167.216
indicator_type: ipv4
source: otx
country: US
hosting_provider: APT,BlueNoroff,TA444,Kimsuky,DPRK
queried_at: 2026-04-01T06:16:02.851891
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS54290 hostwinds llc.", "indicator": "23.254.167.216", "tags": ["APT", "BlueNoroff", "TA444", "Kimsuky", "DPRK"], "pulses": ["Twitter Feed - skocherhan - 31-03-2026", "TA444/BlueNoroff Infrastructure"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 195.3.220.48
indicator_type: ipv4
source: abuseipdb
country: PL
city: 0
hosting_provider: MEVSPACE sp. z o.o.
queried_at: 2026-04-01T06:16:03.887559
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "PL", "isp": "MEVSPACE sp. z o.o.", "domain": "mevspace.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 5.255.122.118
indicator_type: ipv4
source: abuseipdb
country: NL
city: 0
hosting_provider: The Infrastructure Group B.V.
queried_at: 2026-04-01T06:16:05.747891
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "NL", "isp": "The Infrastructure Group B.V.", "domain": "theinfrastructure.group", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 45.133.216.15
indicator_type: ipv4
source: abuseipdb
country: LV
city: 0
hosting_provider: FreeNet L.L.C-FZ
queried_at: 2026-04-01T06:16:07.559950
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "LV", "isp": "FreeNet L.L.C-FZ", "domain": "freenetworks.net", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2021-08-18T05:53:31+00:00", "categories": []}


indicator: 185.235.137.163
indicator_type: ipv4
source: abuseipdb
country: DE
city: 0
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-01T06:16:09.389002
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "DE", "isp": "HZ Hosting Ltd", "domain": "hz-hosting.se", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2021-09-30T11:12:04+00:00", "categories": []}


indicator: 194.126.178.8
indicator_type: ipv4
source: abuseipdb
country: FR
city: 0
hosting_provider: Eurofiber France SAS
queried_at: 2026-04-01T06:16:11.251346
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "FR", "isp": "Eurofiber France SAS", "domain": "eurafibre.fr", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2024-07-04T07:22:50+00:00", "categories": []}


indicator: 91.202.4.76
indicator_type: ipv4
source: abuseipdb
country: NL
city: 0
hosting_provider: SOLLUTIUM EU Sp z.o.o.
queried_at: 2026-04-01T06:16:13.126408
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "NL", "isp": "SOLLUTIUM EU Sp z.o.o.", "domain": "sollutium.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 155.138.252.221
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: Vultr Holdings, LLC
queried_at: 2026-04-01T06:16:15.079536
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "Vultr Holdings, LLC", "domain": "vultr.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2024-06-19T11:14:22+00:00", "categories": []}


indicator: 162.33.178.129
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: BL Networks
queried_at: 2026-04-01T06:16:16.800761
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "BL Networks", "domain": "blnwx.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2024-07-04T07:23:34+00:00", "categories": []}


indicator: 168.119.152.19
indicator_type: ipv4
source: abuseipdb
country: DE
city: 0
hosting_provider: Hetzner Online GmbH
queried_at: 2026-04-01T06:16:18.635241
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "DE", "isp": "Hetzner Online GmbH", "domain": "hetzner.de", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2025-02-20T00:13:02+00:00", "categories": []}


indicator: 185.118.115.15
indicator_type: ipv4
source: abuseipdb
country: PT
city: 0
hosting_provider: Dream Fusion - IT Services, Lda
queried_at: 2026-04-01T06:16:20.665464
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "PT", "isp": "Dream Fusion - IT Services, Lda", "domain": "webtuga.pt", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 195.62.52.93
indicator_type: ipv4
source: abuseipdb
country: RU
city: 0
hosting_provider: IP SERVER LLC
queried_at: 2026-04-01T06:16:22.610262
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "RU", "isp": "IP SERVER LLC", "domain": "ipserver.su", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 217.160.0.159
indicator_type: ipv4
source: abuseipdb
country: DE
city: 0
hosting_provider: IONOS SE
queried_at: 2026-04-01T06:16:24.323279
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "DE", "isp": "IONOS SE", "domain": "ionos.com", "usage_type": "Content Delivery Network", "last_reported": "2025-07-13T19:10:59+00:00", "categories": []}


indicator: 217.160.0.33
indicator_type: ipv4
source: abuseipdb
country: DE
city: 0
hosting_provider: IONOS SE
queried_at: 2026-04-01T06:16:26.025592
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "DE", "isp": "IONOS SE", "domain": "ionos.com", "usage_type": "Content Delivery Network", "last_reported": "2023-03-07T09:28:31+00:00", "categories": []}


indicator: 45.77.237.252
indicator_type: ipv4
source: abuseipdb
country: AU
city: 0
hosting_provider: Vultr Holdings, LLC
queried_at: 2026-04-01T06:16:28.198996
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "AU", "isp": "Vultr Holdings, LLC", "domain": "vultr.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 64.176.173.164
indicator_type: ipv4
source: abuseipdb
country: IL
city: 0
hosting_provider: The Constant Company, LLC
queried_at: 2026-04-01T06:16:29.941426
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "IL", "isp": "The Constant Company, LLC", "domain": "constant.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 77.46.148.242
indicator_type: ipv4
source: abuseipdb
country: RS
city: 0
hosting_provider: TIS
queried_at: 2026-04-01T06:16:32.187024
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "RS", "isp": "TIS", "domain": "solution.co.rs", "usage_type": "Fixed Line ISP", "last_reported": null, "categories": []}


indicator: 85.13.145.231
indicator_type: ipv4
source: abuseipdb
country: DE
city: 0
hosting_provider: Neue Medien Muennich GmbH
queried_at: 2026-04-01T06:16:34.034274
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "DE", "isp": "Neue Medien Muennich GmbH", "domain": "all-inkl.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 46.30.188.187
indicator_type: ipv4
source: abuseipdb
country: NL
city: 0
hosting_provider: Crowncloud
queried_at: 2026-04-01T06:16:36.141183
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "NL", "isp": "Crowncloud", "domain": "crowncloud.net", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2025-03-07T08:50:50+00:00", "categories": []}


indicator: 178.255.43.30
indicator_type: ipv4
source: abuseipdb
country: PL
city: 0
hosting_provider: Artnet Sp. z o.o.
queried_at: 2026-04-01T06:16:38.026500
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "PL", "isp": "Artnet Sp. z o.o.", "domain": "artnet.pl", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 185.187.155.69
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: Kuroit Limited
queried_at: 2026-04-01T06:16:41.485358
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "Kuroit Limited", "domain": "kuroit.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 45.82.66.39
indicator_type: ipv4
source: abuseipdb
country: NL
city: 0
hosting_provider: WorldStream B.V.
queried_at: 2026-04-01T06:16:45.233060
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "NL", "isp": "WorldStream B.V.", "domain": "worldstream.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 141.195.117.129
indicator_type: ipv4
source: abuseipdb
country: FR
city: 0
hosting_provider: RadWeb, LLC
queried_at: 2026-04-01T06:16:47.067703
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "FR", "isp": "RadWeb, LLC", "domain": "radwebhosting.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 103.144.139.253
indicator_type: ipv4
source: abuseipdb
country: MY
city: 0
hosting_provider: Casbay Sdn. Bhd.
queried_at: 2026-04-01T06:16:49.051581
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "MY", "isp": "Casbay Sdn. Bhd.", "domain": "casbay.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 45.137.21.10
indicator_type: ipv4
source: abuseipdb
country: NL
city: 0
hosting_provider: RootLayer Web Services Ltd.
queried_at: 2026-04-01T06:16:54.805960
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "NL", "isp": "RootLayer Web Services Ltd.", "domain": "rootlayer.net", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 5.183.95.240
indicator_type: ipv4
source: abuseipdb
country: DE
city: 0
hosting_provider: Crowncloud
queried_at: 2026-04-01T06:16:56.629858
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "DE", "isp": "Crowncloud", "domain": "crowncloud.net", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2025-03-07T08:49:39+00:00", "categories": []}


indicator: 37.28.153.214
indicator_type: ipv4
source: abuseipdb
country: PL
city: 0
hosting_provider: PAWO
queried_at: 2026-04-01T06:16:58.576751
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "PL", "isp": "PAWO", "domain": "pawo.pl", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2025-03-07T08:50:14+00:00", "categories": []}


indicator: 185.172.39.230
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: PakiHosting
queried_at: 2026-04-01T06:17:00.387323
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "PakiHosting", "domain": "pakihosting.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 162.216.243.210
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: Dynu Systems Incorporated
queried_at: 2026-04-01T06:17:02.182383
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "Dynu Systems Incorporated", "domain": "dynu.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 185.243.112.24
indicator_type: ipv4
source: abuseipdb
country: NL
city: 0
hosting_provider: CrownCloud
queried_at: 2026-04-01T06:17:04.003046
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "NL", "isp": "CrownCloud", "domain": "crowncloud.net", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 185.243.115.124
indicator_type: ipv4
source: abuseipdb
country: DE
city: 0
hosting_provider: CrownCloud
queried_at: 2026-04-01T06:17:05.839013
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "DE", "isp": "CrownCloud", "domain": "crowncloud.net", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 45.86.162.170
indicator_type: ipv4
source: abuseipdb
country: NL
city: 0
hosting_provider: Crowncloud
queried_at: 2026-04-01T06:17:07.787749
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "NL", "isp": "Crowncloud", "domain": "crowncloud.net", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2025-03-07T08:51:01+00:00", "categories": []}


indicator: 172.86.73.187
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: RouterHosting LLC
queried_at: 2026-04-01T06:17:09.616446
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "RouterHosting LLC", "domain": "cloudzy.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2025-09-21T17:47:36+00:00", "categories": []}


indicator: 46.30.189.91
indicator_type: ipv4
source: abuseipdb
country: DE
city: 0
hosting_provider: Crowncloud
queried_at: 2026-04-01T06:17:11.457969
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "DE", "isp": "Crowncloud", "domain": "crowncloud.net", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 92.204.164.50
indicator_type: ipv4
source: abuseipdb
country: FR
city: 0
hosting_provider: Yevhen Netiaha
queried_at: 2026-04-01T06:17:17.190466
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "FR", "isp": "Yevhen Netiaha", "domain": "eviks.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 193.29.56.221
indicator_type: ipv4
source: abuseipdb
country: DE
city: 0
hosting_provider: GWY IT PTY LTD
queried_at: 2026-04-01T06:17:25.801336
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "DE", "isp": "GWY IT PTY LTD", "domain": "crowncloud.net", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 37.28.157.246
indicator_type: ipv4
source: abuseipdb
country: PL
city: 0
hosting_provider: Kancelaria Us?ug Ksi?gowych LEX Sp. z o.o.
queried_at: 2026-04-01T06:17:37.057018
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "PL", "isp": "Kancelaria Us?ug Ksi?gowych LEX Sp. z o.o.", "domain": "biuro-lex.pl", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 103.94.157.5
indicator_type: ipv4
source: abuseipdb
country: AU
city: 0
hosting_provider: Asia Pacific Network Information Centre
queried_at: 2026-04-01T06:17:38.803961
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "AU", "isp": "Asia Pacific Network Information Centre", "domain": "apnic.net", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 45.61.149.109
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: RouterHosting LLC
queried_at: 2026-04-01T06:17:42.456871
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "RouterHosting LLC", "domain": "cloudzy.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 85.239.52.32
indicator_type: ipv4
source: abuseipdb
country: RU
city: 0
hosting_provider: JSC TIMEWEB
queried_at: 2026-04-01T06:17:46.129544
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "RU", "isp": "JSC TIMEWEB", "domain": "timeweb.ru", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2025-10-25T21:39:09+00:00", "categories": []}


indicator: 193.187.148.169
indicator_type: ipv4
source: abuseipdb
country: DE
city: 1
hosting_provider: M247 LTD Frankfurt Infrastructure
queried_at: 2026-04-01T06:17:47.845571
raw_data:
  {"abuse_confidence": 0, "total_reports": 1, "is_public": true, "is_tor": false, "country": "DE", "isp": "M247 LTD Frankfurt Infrastructure", "domain": "m247.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2026-02-09T14:29:37+00:00", "categories": [10, 20, 14]}


indicator: 23.227.202.14
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: Hivelocity Ventures Corp
queried_at: 2026-04-01T06:17:49.547013
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "Hivelocity Ventures Corp", "domain": "hivelocity.net", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 72.62.185.31
indicator_type: ipv4
source: abuseipdb
country: FR
city: 0
hosting_provider: Hostinger Operations UAB
queried_at: 2026-04-01T06:17:51.254795
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "FR", "isp": "Hostinger Operations UAB", "domain": "hostinger.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 142.11.206.73
indicator_type: ipv4
source: abuseipdb
country: US
city: 8
hosting_provider: Hostwinds Seattle
queried_at: 2026-04-01T06:17:52.976226
raw_data:
  {"abuse_confidence": 40, "total_reports": 8, "is_public": true, "is_tor": false, "country": "US", "isp": "Hostwinds Seattle", "domain": "hostwinds.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2026-04-01T03:25:45+00:00", "categories": [7, 11, 15, 18, 20, 21]}


indicator: 23.254.167.216
indicator_type: ipv4
source: abuseipdb
country: US
city: 1
hosting_provider: Hostwinds Seattle
queried_at: 2026-04-01T06:17:54.666290
raw_data:
  {"abuse_confidence": 3, "total_reports": 1, "is_public": true, "is_tor": false, "country": "US", "isp": "Hostwinds Seattle", "domain": "hostwinds.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2026-04-01T03:25:45+00:00", "categories": [21, 15]}


indicator: 185.235.137.163
indicator_type: ipv4
source: virustotal
country: DE
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-01T06:17:57.225274
raw_data:
  {"malicious": 0, "suspicious": 0, "harmless": 0, "undetected": 94, "reputation": 0, "country": "DE", "as_owner": "HZ Hosting Ltd", "asn": 59711, "network": "185.235.137.0/24", "last_analysis_date": 1772626032}


indicator: 194.126.178.8
indicator_type: ipv4
source: virustotal
country: FR
hosting_provider: Eurofiber France SAS
queried_at: 2026-04-01T06:18:17.801287
raw_data:
  {"malicious": 16, "suspicious": 0, "harmless": 48, "undetected": 30, "reputation": -59, "country": "FR", "as_owner": "Eurofiber France SAS", "asn": 35625, "network": "194.126.178.0/24", "last_analysis_date": 1774539020}


indicator: 91.202.4.76
indicator_type: ipv4
source: virustotal
country: NL
hosting_provider: SOLLUTIUM EU Sp z.o.o.
queried_at: 2026-04-01T06:18:38.331573
raw_data:
  {"malicious": 11, "suspicious": 2, "harmless": 49, "undetected": 32, "reputation": 0, "country": "NL", "as_owner": "SOLLUTIUM EU Sp z.o.o.", "asn": 43641, "network": "91.202.4.0/23", "last_analysis_date": 1773832007}


indicator: 155.138.252.221
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: The Constant Company, LLC
queried_at: 2026-04-01T06:18:59.049260
raw_data:
  {"malicious": 2, "suspicious": 3, "harmless": 55, "undetected": 34, "reputation": 0, "country": "US", "as_owner": "The Constant Company, LLC", "asn": 20473, "network": "155.138.128.0/17", "last_analysis_date": 1773832356}


indicator: 162.33.178.129
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: BL Networks
queried_at: 2026-04-01T06:19:19.719152
raw_data:
  {"malicious": 2, "suspicious": 1, "harmless": 59, "undetected": 32, "reputation": 0, "country": "US", "as_owner": "BL Networks", "asn": 399629, "network": "162.33.176.0/22", "last_analysis_date": 1773824668}


indicator: 168.119.152.19
indicator_type: ipv4
source: virustotal
country: DE
hosting_provider: Hetzner Online GmbH
queried_at: 2026-04-01T06:19:40.221949
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 57, "undetected": 35, "reputation": 0, "country": "DE", "as_owner": "Hetzner Online GmbH", "asn": 24940, "network": "168.119.0.0/16", "last_analysis_date": 1769643527}


indicator: 185.118.115.15
indicator_type: ipv4
source: virustotal
country: PT
hosting_provider: Dream Fusion - IT Services, Lda
queried_at: 2026-04-01T06:20:00.703317
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 59, "undetected": 33, "reputation": 0, "country": "PT", "as_owner": "Dream Fusion - IT Services, Lda", "asn": 39384, "network": "185.118.112.0/22", "last_analysis_date": 1774640192}


indicator: 195.62.52.93
indicator_type: ipv4
source: virustotal
country: RU
hosting_provider: Ip Server LLC
queried_at: 2026-04-01T06:20:21.381872
raw_data:
  {"malicious": 3, "suspicious": 0, "harmless": 58, "undetected": 33, "reputation": 0, "country": "RU", "as_owner": "Ip Server LLC", "asn": 44812, "network": "195.62.52.0/23", "last_analysis_date": 1773818366}


indicator: 217.160.0.159
indicator_type: ipv4
source: virustotal
country: DE
hosting_provider: IONOS SE
queried_at: 2026-04-01T06:20:41.881730
raw_data:
  {"malicious": 0, "suspicious": 0, "harmless": 58, "undetected": 36, "reputation": -1, "country": "DE", "as_owner": "IONOS SE", "asn": 8560, "network": "217.160.0.0/16", "last_analysis_date": 1774024770}


indicator: 217.160.0.33
indicator_type: ipv4
source: virustotal
country: DE
hosting_provider: IONOS SE
queried_at: 2026-04-01T06:21:02.516439
raw_data:
  {"malicious": 0, "suspicious": 0, "harmless": 59, "undetected": 35, "reputation": 0, "country": "DE", "as_owner": "IONOS SE", "asn": 8560, "network": "217.160.0.0/16", "last_analysis_date": 1774448134}


indicator: 45.77.237.252
indicator_type: ipv4
source: virustotal
country: AU
hosting_provider: The Constant Company, LLC
queried_at: 2026-04-01T06:21:22.994413
raw_data:
  {"malicious": 1, "suspicious": 1, "harmless": 58, "undetected": 34, "reputation": 0, "country": "AU", "as_owner": "The Constant Company, LLC", "asn": 20473, "network": "45.76.0.0/15", "last_analysis_date": 1774983582}


indicator: 64.176.173.164
indicator_type: ipv4
source: virustotal
country: IL
hosting_provider: The Constant Company, LLC
queried_at: 2026-04-01T06:21:43.772811
raw_data:
  {"malicious": 0, "suspicious": 1, "harmless": 58, "undetected": 35, "reputation": 0, "country": "IL", "as_owner": "The Constant Company, LLC", "asn": 20473, "network": "64.176.160.0/19", "last_analysis_date": 1773367286}


indicator: 77.46.148.242
indicator_type: ipv4
source: virustotal
country: RS
hosting_provider: TELEKOM SRBIJA a.d.
queried_at: 2026-04-01T06:22:04.581291
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 58, "undetected": 34, "reputation": 0, "country": "RS", "as_owner": "TELEKOM SRBIJA a.d.", "asn": 8400, "network": "77.46.128.0/17", "last_analysis_date": 1774885005}


indicator: 85.13.145.231
indicator_type: ipv4
source: virustotal
country: DE
hosting_provider: Neue Medien Muennich GmbH
queried_at: 2026-04-01T06:22:25.245426
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 58, "undetected": 34, "reputation": 0, "country": "DE", "as_owner": "Neue Medien Muennich GmbH", "asn": 34788, "network": "85.13.128.0/18", "last_analysis_date": 1774215768}


indicator: 46.30.188.187
indicator_type: ipv4
source: virustotal
country: NL
hosting_provider: Gwy It Pty Ltd
queried_at: 2026-04-01T06:22:45.726954
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 56, "undetected": 36, "reputation": 0, "country": "NL", "as_owner": "Gwy It Pty Ltd", "asn": 199959, "network": "46.30.188.0/22", "last_analysis_date": 1772373516}


indicator: 178.255.43.30
indicator_type: ipv4
source: virustotal
country: PL
hosting_provider: Artnet Sp. z o.o.
queried_at: 2026-04-01T06:23:06.241965
raw_data:
  {"malicious": 0, "suspicious": 0, "harmless": 60, "undetected": 34, "reputation": 0, "country": "PL", "as_owner": "Artnet Sp. z o.o.", "asn": 197155, "network": "178.255.40.0/22", "last_analysis_date": 1773388734}


indicator: 104.161.58.10
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Input Output Flood LLC
queried_at: 2026-04-01T06:23:26.808916
raw_data:
  {"malicious": 4, "suspicious": 0, "harmless": 55, "undetected": 35, "reputation": 0, "country": "US", "as_owner": "Input Output Flood LLC", "asn": 53755, "network": "104.161.32.0/19", "last_analysis_date": 1773586553}


indicator: 185.187.155.69
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Kuroit
queried_at: 2026-04-01T06:23:47.381250
raw_data:
  {"malicious": 3, "suspicious": 0, "harmless": 56, "undetected": 35, "reputation": 0, "country": "US", "as_owner": "Kuroit", "asn": 152586, "network": "185.187.155.0/24", "last_analysis_date": 1773421063}


indicator: 5.187.49.186
indicator_type: ipv4
source: virustotal
country: PL
hosting_provider: Artnet Sp. z o.o.
queried_at: 2026-04-01T06:24:07.968029
raw_data:
  {"malicious": 1, "suspicious": 0, "harmless": 58, "undetected": 35, "reputation": 0, "country": "PL", "as_owner": "Artnet Sp. z o.o.", "asn": 197155, "network": "5.187.48.0/21", "last_analysis_date": 1771420912}


indicator: 45.82.66.39
indicator_type: ipv4
source: virustotal
country: NL
hosting_provider: WorldStream B.V.
queried_at: 2026-04-01T06:24:28.574319
raw_data:
  {"malicious": 3, "suspicious": 0, "harmless": 56, "undetected": 35, "reputation": 0, "country": "NL", "as_owner": "WorldStream B.V.", "asn": 49981, "network": "45.82.64.0/22", "last_analysis_date": 1773280557}


indicator: 141.195.117.129
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Limestone Networks, Inc.
queried_at: 2026-04-01T06:24:49.060583
raw_data:
  {"malicious": 3, "suspicious": 0, "harmless": 56, "undetected": 35, "reputation": 0, "country": "US", "as_owner": "Limestone Networks, Inc.", "asn": 46475, "network": "141.195.116.0/22", "last_analysis_date": 1772251305}


indicator: 103.144.139.253
indicator_type: ipv4
source: virustotal
country: MY
hosting_provider: Gigabit Hosting Sdn Bhd
queried_at: 2026-04-01T06:25:09.716534
raw_data:
  {"malicious": 6, "suspicious": 0, "harmless": 54, "undetected": 34, "reputation": 0, "country": "MY", "as_owner": "Gigabit Hosting Sdn Bhd", "asn": 55720, "network": "103.144.139.0/24", "last_analysis_date": 1774436663}


indicator: 185.177.126.225
indicator_type: ipv4
source: virustotal
country: NL
hosting_provider: WorldStream B.V.
queried_at: 2026-04-01T06:25:30.306874
raw_data:
  {"malicious": 3, "suspicious": 0, "harmless": 55, "undetected": 36, "reputation": 0, "country": "NL", "as_owner": "WorldStream B.V.", "asn": 49981, "network": "185.177.124.0/22", "last_analysis_date": 1772186156}


indicator: 185.100.234.105
indicator_type: ipv4
source: virustotal
country: NL
hosting_provider: WorldStream B.V.
queried_at: 2026-04-01T06:25:50.851468
raw_data:
  {"malicious": 0, "suspicious": 1, "harmless": 59, "undetected": 34, "reputation": 0, "country": "NL", "as_owner": "WorldStream B.V.", "asn": 49981, "network": "185.100.232.0/22", "last_analysis_date": 1773975535}


indicator: 45.137.21.10
indicator_type: ipv4
source: virustotal
country: NL
hosting_provider: RootLayer Web Services Ltd.
queried_at: 2026-04-01T06:26:11.457974
raw_data:
  {"malicious": 3, "suspicious": 0, "harmless": 54, "undetected": 37, "reputation": -1, "country": "NL", "as_owner": "RootLayer Web Services Ltd.", "asn": 51447, "network": "45.137.20.0/22", "last_analysis_date": 1772816198}


indicator: 5.183.95.240
indicator_type: ipv4
source: virustotal
country: DE
hosting_provider: Gwy It Pty Ltd
queried_at: 2026-04-01T06:26:31.971582
raw_data:
  {"malicious": 3, "suspicious": 0, "harmless": 55, "undetected": 36, "reputation": 0, "country": "DE", "as_owner": "Gwy It Pty Ltd", "asn": 199959, "network": "5.183.95.0/24", "last_analysis_date": 1772283265}


indicator: 37.28.153.214
indicator_type: ipv4
source: virustotal
country: PL
hosting_provider: Artnet Sp. z o.o.
queried_at: 2026-04-01T06:26:52.842114
raw_data:
  {"malicious": 3, "suspicious": 0, "harmless": 55, "undetected": 36, "reputation": 0, "country": "PL", "as_owner": "Artnet Sp. z o.o.", "asn": 197155, "network": "37.28.152.0/21", "last_analysis_date": 1774376736}


indicator: 185.172.39.230
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Kuroit
queried_at: 2026-04-01T06:27:13.322077
raw_data:
  {"malicious": 3, "suspicious": 0, "harmless": 56, "undetected": 35, "reputation": 0, "country": "US", "as_owner": "Kuroit", "asn": 152586, "network": "185.172.38.0/23", "last_analysis_date": 1772153857}


indicator: 162.216.243.210
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Dynu Systems Incorporated
queried_at: 2026-04-01T06:27:33.908818
raw_data:
  {"malicious": 2, "suspicious": 1, "harmless": 57, "undetected": 34, "reputation": 0, "country": "US", "as_owner": "Dynu Systems Incorporated", "asn": 398019, "network": "162.216.240.0/22", "last_analysis_date": 1773356142}


indicator: 185.243.112.24
indicator_type: ipv4
source: virustotal
country: NL
hosting_provider: Access2.IT Group B.V.
queried_at: 2026-04-01T06:27:54.623030
raw_data:
  {"malicious": 3, "suspicious": 0, "harmless": 54, "undetected": 37, "reputation": 0, "country": "NL", "as_owner": "Access2.IT Group B.V.", "asn": 208258, "network": "185.243.112.0/23", "last_analysis_date": 1772920542}


indicator: 185.243.115.124
indicator_type: ipv4
source: virustotal
country: DE
hosting_provider: IP-Projects GmbH & Co. KG
queried_at: 2026-04-01T06:28:15.208860
raw_data:
  {"malicious": 2, "suspicious": 1, "harmless": 56, "undetected": 35, "reputation": 0, "country": "DE", "as_owner": "IP-Projects GmbH & Co. KG", "asn": 48314, "network": "185.243.114.0/23", "last_analysis_date": 1773356213}


indicator: 45.86.162.170
indicator_type: ipv4
source: virustotal
country: NL
hosting_provider: Gwy It Pty Ltd
queried_at: 2026-04-01T06:28:35.750091
raw_data:
  {"malicious": 3, "suspicious": 0, "harmless": 57, "undetected": 34, "reputation": 0, "country": "NL", "as_owner": "Gwy It Pty Ltd", "asn": 199959, "network": "45.86.162.0/23", "last_analysis_date": 1773471387}


indicator: 172.86.73.187
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: RouterHosting LLC
queried_at: 2026-04-01T06:28:56.522408
raw_data:
  {"malicious": 3, "suspicious": 0, "harmless": 56, "undetected": 35, "reputation": 0, "country": "US", "as_owner": "RouterHosting LLC", "asn": 14956, "network": "172.86.72.0/23", "last_analysis_date": 1774743574}


indicator: 46.30.189.91
indicator_type: ipv4
source: virustotal
country: DE
hosting_provider: Gwy It Pty Ltd
queried_at: 2026-04-01T06:29:18.377505
raw_data:
  {"malicious": 2, "suspicious": 1, "harmless": 55, "undetected": 36, "reputation": 0, "country": "DE", "as_owner": "Gwy It Pty Ltd", "asn": 199959, "network": "46.30.188.0/22", "last_analysis_date": 1773356213}


indicator: 175.110.112.221
indicator_type: ipv4
source: virustotal
country: NL
hosting_provider: WorldStream B.V.
queried_at: 2026-04-01T06:29:38.884538
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 58, "undetected": 34, "reputation": 0, "country": "NL", "as_owner": "WorldStream B.V.", "asn": 49981, "network": "175.110.112.0/20", "last_analysis_date": 1774022786}


indicator: 155.138.238.169
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: The Constant Company, LLC
queried_at: 2026-04-01T06:29:59.419347
raw_data:
  {"malicious": 5, "suspicious": 0, "harmless": 54, "undetected": 35, "reputation": 0, "country": "US", "as_owner": "The Constant Company, LLC", "asn": 20473, "network": "155.138.128.0/17", "last_analysis_date": 1772218527}


indicator: 92.204.164.50
indicator_type: ipv4
source: virustotal
country: FR
hosting_provider: velia.net Internetdienste GmbH
queried_at: 2026-04-01T06:30:19.974863
raw_data:
  {"malicious": 4, "suspicious": 0, "harmless": 54, "undetected": 36, "reputation": 0, "country": "FR", "as_owner": "velia.net Internetdienste GmbH", "asn": 29066, "network": "92.204.160.0/19", "last_analysis_date": 1772855803}


indicator: 103.144.139.74
indicator_type: ipv4
source: virustotal
country: MY
hosting_provider: Gigabit Hosting Sdn Bhd
queried_at: 2026-04-01T06:30:40.913046
raw_data:
  {"malicious": 1, "suspicious": 1, "harmless": 57, "undetected": 35, "reputation": 0, "country": "MY", "as_owner": "Gigabit Hosting Sdn Bhd", "asn": 55720, "network": "103.144.139.0/24", "last_analysis_date": 1774475761}


indicator: 195.3.220.48
indicator_type: ipv4
source: otx
country: PL
hosting_provider: stop,midnight blizzard,october,spear-phishing,alliance,research,vision one,service,rdp,ukraine
queried_at: 2026-04-01T12:00:55.223977
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Poland", "country_code": "PL", "city": null, "asn": "AS201814 meverywhere sp. z o.o.", "indicator": "195.3.220.48", "tags": ["stop", "midnight blizzard", "october", "spear-phishing", "alliance", "research", "vision one", "service", "rdp", "ukraine", "ip address", "earth koshchei", "trend micro", "rogue", "suomi", "hybrid", "apt & targeted attacks", "koshchei", "Python Remote Desktop Protocol MITM tool (PyRDP)", "threat insights", "iam identity", "l


indicator: 5.255.122.118
indicator_type: ipv4
source: otx
country: NL
hosting_provider: eclecticiq,screen,cyber,alliance,python,rdp,darkcrystal,ukraine,threat,loader
queried_at: 2026-04-01T12:01:12.692194
raw_data:
  {"pulse_count": 4, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": null, "asn": "AS60404 the infrastructure group b.v.", "indicator": "5.255.122.118", "tags": ["eclecticiq", "screen", "cyber", "alliance", "python", "rdp", "darkcrystal", "ukraine", "threat", "loader", "defence", "strong", "backorder", "stealth", "dark crystal", "kms update", "crypto cyber", "virustotal", "tools", "liberty", "monitoring", "april", "protect", "kalambur", "cluster", "dcrat", "kms activation"


indicator: 195.3.220.48
indicator_type: ipv4
source: virustotal
country: PL
hosting_provider: MEVSPACE sp. z o.o.
queried_at: 2026-04-01T12:01:29.531748
raw_data:
  {"malicious": 3, "suspicious": 0, "harmless": 56, "undetected": 35, "reputation": 0, "country": "PL", "as_owner": "MEVSPACE sp. z o.o.", "asn": 201814, "network": "195.3.220.0/22", "last_analysis_date": 1773410725}


indicator: 5.255.122.118
indicator_type: ipv4
source: virustotal
country: NL
hosting_provider: The Infrastructure Group B.V.
queried_at: 2026-04-01T12:01:51.085309
raw_data:
  {"malicious": 7, "suspicious": 0, "harmless": 56, "undetected": 31, "reputation": 0, "country": "NL", "as_owner": "The Infrastructure Group B.V.", "asn": 60404, "network": "5.255.96.0/19", "last_analysis_date": 1773824914}


indicator: 45.133.216.15
indicator_type: ipv4
source: virustotal
country: LV
hosting_provider: WorkTitans B.V.
queried_at: 2026-04-01T12:02:11.560514
raw_data:
  {"malicious": 12, "suspicious": 0, "harmless": 50, "undetected": 32, "reputation": 0, "country": "LV", "as_owner": "WorkTitans B.V.", "asn": 209847, "network": "45.133.216.0/24", "last_analysis_date": 1773824745}


indicator: 195.3.220.48
indicator_type: ipv4
source: censys
country: PL
city: Warsaw
reverse_dns: linux
hosting_provider: MEVSPACE
queried_at: 2026-04-01T12:02:32.572795
raw_data:
  {"ports": [22, 80, 443, 2022, 3306, 4444, 7777, 8080, 25565], "services": ["22/SSH", "80/HTTP", "443/HTTP", "2022/SSH", "3306/MYSQL", "4444/HTTP", "7777/HTTP", "8080/HTTP", "25565/MINECRAFT"], "os": "linux", "os_version": "", "asn": 201814, "as_name": "MEVSPACE", "country": "PL", "city": "Warsaw", "last_updated": "", "labels": []}


indicator: 5.255.122.118
indicator_type: ipv4
source: censys
country: NL
city: Dronten
reverse_dns: linux
hosting_provider: LITESERVER
queried_at: 2026-04-01T12:02:35.972838
raw_data:
  {"ports": [22], "services": ["22/SSH"], "os": "linux", "os_version": "", "asn": 60404, "as_name": "LITESERVER", "country": "NL", "city": "Dronten", "last_updated": "", "labels": []}


indicator: 45.133.216.15
indicator_type: ipv4
source: censys
country: LV
city: Riga
hosting_provider: THE
queried_at: 2026-04-01T12:02:39.490652
raw_data:
  {"ports": [], "services": [], "os": "", "os_version": "", "asn": 209847, "as_name": "THE", "country": "LV", "city": "Riga", "last_updated": "", "labels": [{"value": "BULLETPROOF"}]}


indicator: 195.3.220.48
indicator_type: ipv4
source: dshield
country: PL
reverse_dns: 195.3.220.0/22
hosting_provider: MEVSPACE
queried_at: 2026-04-01T12:02:43.262046
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@skynode.pl", "as": 201814, "asname": "MEVSPACE", "ascountry": "PL", "assource": "", "network": "195.3.220.0/22", "threatfeeds": {"rosti": {"lastseen": "2024-12-20", "firstseen": "2024-12-17"}}}


indicator: 5.255.122.118
indicator_type: ipv4
source: dshield
country: NL
reverse_dns: 5.255.96.0/19
hosting_provider: LITESERVER
queried_at: 2026-04-01T12:02:44.944676
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "ripe@liteserver.nl", "as": 60404, "asname": "LITESERVER", "ascountry": "NL", "assource": "", "network": "5.255.96.0/19", "threatfeeds": {"rosti": {"lastseen": "2025-02-13", "firstseen": "2025-02-13"}}}


indicator: 45.133.216.15
indicator_type: ipv4
source: dshield
country: GB
reverse_dns: 45.133.216.0/24
hosting_provider: STARK-INDUSTRIES
queried_at: 2026-04-01T12:02:46.644775
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "aospan@netup.ru", "as": 44477, "asname": "STARK-INDUSTRIES", "ascountry": "GB", "assource": "", "network": "45.133.216.0/24", "threatfeeds": {}}


indicator: 195.3.220.48
indicator_type: ipv4
source: firehol
queried_at: 2026-04-01T12:02:53.487328
raw_data:
  {"listed": false, "matched_networks": [], "match_count": 0, "lists_checked": 4, "total_networks": 199993}


indicator: 142.11.206.72
indicator_type: ipv4
source: shodan
reverse_dns: hwsrv-1270163.hostwindsdns.com
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.9p1,cpe:/a:apache:http_server:2.4.52
queried_at: 2026-04-02T06:01:05.953391
raw_data:
  {"ports": [22, 80], "vulns": ["CVE-2023-27522", "CVE-2024-24795", "CVE-2023-31122", "CVE-2023-38709", "CVE-2022-28330", "CVE-2024-38473", "CVE-2024-40898", "CVE-2025-59775", "CVE-2022-22721", "CVE-2013-0942", "CVE-2013-4365", "CVE-2024-38476", "CVE-2025-53020", "CVE-2025-65082", "CVE-2012-4360", "CVE-2025-58098", "CVE-2022-28615", "CVE-2024-42516", "CVE-2024-43394", "CVE-2023-25690", "CVE-2013-2765", "CVE-2009-0796", "CVE-2024-27316", "CVE-2007-4723", "CVE-2022-22720", "CVE-2009-2299", "CVE-2012


indicator: 142.11.206.72
indicator_type: ipv4
source: otx
country: US
queried_at: 2026-04-02T06:01:12.253788
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS54290 hostwinds llc.", "indicator": "142.11.206.72", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 12, "malware_samples": [], "passive_dns": ["www.atads.erau-research.net", "avopsinsight.com", "www.avopsinsight.com", "atads.erau-research.net", "www.erau-research.net", "erau-research.net", "adsvergroup.us", "hwsrv-873556.hostwindsdns.com", "jbmtest.jobmarke

reverse_dns:
  www.atads.erau-research.net,avopsinsight.com,www.avopsinsight.com,atads.erau-research.net,www.erau-research.net,erau-research.net,adsvergroup.us,hwsrv-873556.hostwindsdns.com,jbmtest.jobmarket.cc,www.jbmtest.jobmarket.cc


indicator: 142.11.206.72
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: Hostwinds Seattle
queried_at: 2026-04-02T06:01:12.994880
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "Hostwinds Seattle", "domain": "hostwinds.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2021-05-11T13:50:13+00:00", "categories": []}


indicator: 142.11.206.72
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Hostwinds LLC.
queried_at: 2026-04-02T06:01:15.249843
raw_data:
  {"malicious": 1, "suspicious": 0, "harmless": 57, "undetected": 36, "reputation": 0, "country": "US", "as_owner": "Hostwinds LLC.", "asn": 54290, "network": "142.11.192.0/18", "last_analysis_date": 1775103768}


indicator: 142.11.206.72
indicator_type: ipv4
source: censys
country: US
city: Dallas
reverse_dns: linux
hosting_provider: HOSTWINDS - Hostwinds LLC.
queried_at: 2026-04-02T06:01:36.396289
raw_data:
  {"ports": [22, 80], "services": ["22/SSH", "80/HTTP"], "os": "linux", "os_version": "", "asn": 54290, "as_name": "HOSTWINDS - Hostwinds LLC.", "country": "US", "city": "Dallas", "last_updated": "", "labels": []}


indicator: 142.11.206.72
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 142.11.192.0/18
hosting_provider: HOSTWINDS
queried_at: 2026-04-02T06:01:40.114214
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@hostwinds.com", "as": 54290, "asname": "HOSTWINDS", "ascountry": "US", "assource": "", "network": "142.11.192.0/18", "threatfeeds": {}}


indicator: 142.11.206.72
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-02T06:01:43.493054
raw_data:
  {"hostnames_checked": ["www.erau-research.net", "www.jobmarket.cc", "jbmtest.jobmarket.cc", "hwsrv-873556.hostwindsdns.com", "hwsrv-1270163.hostwindsdns.com", "adsvergroup.us", "www.avopsinsight.com", "jobmarket.cc", "www.atads.erau-research.net", "erau-research.net", "avopsinsight.com", "atads.erau-research.net", "www.jbmtest.jobmarket.cc"], "hostnames_count": 13, "matched_domains": [], "match_count": 0, "blocklist_size": 88764}


indicator: 162.159.140.167
indicator_type: ipv4
source: shodan
city: cdn
reverse_dns: mylogin-stgha.broadcom.com
hosting_provider: cpe:/a:cloudflare:cloudflare
queried_at: 2026-04-02T18:02:52.188504
raw_data:
  {"ports": [80, 443, 2052, 2053, 2082, 2083, 2086, 2087, 2095, 2096, 8080, 8443, 8880], "vulns": [], "hostnames": ["mylogin-stgha.broadcom.com"], "tags": ["cdn"], "cpes": ["cpe:/a:cloudflare:cloudflare"]}


indicator: 172.66.0.165
indicator_type: ipv4
source: shodan
city: cdn
reverse_dns: profile-gcpstg.broadcom.com
hosting_provider: cpe:/a:google:cloud_platform,cpe:/a:cloudflare:cloudflare
queried_at: 2026-04-02T18:02:53.811350
raw_data:
  {"ports": [80, 443, 2052, 2053, 2082, 2083, 2086, 2087, 2095, 2096, 8080, 8443, 8880], "vulns": [], "hostnames": ["profile-gcpstg.broadcom.com"], "tags": ["cdn"], "cpes": ["cpe:/a:google:cloud_platform", "cpe:/a:cloudflare:cloudflare"]}


indicator: 162.159.140.167
indicator_type: ipv4
source: otx
queried_at: 2026-04-02T18:03:13.290782
raw_data:
  {"pulse_count": 4, "reputation": 0, "country": "", "country_code": "", "city": "", "asn": "AS13335 cloudflare", "indicator": "162.159.140.167", "tags": ["Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi", "ip address", "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71", "9698f46495ce9401c8bcaf9a2afe1598", "status code", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)", 

hosting_provider:
  Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi,ip address,MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71,9698f46495ce9401c8bcaf9a2afe1598,status code,DocuSign-themed phishing lure Invalid X.509 seal (“Broken Seal”),Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional),Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3,Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link


indicator: 172.66.0.165
indicator_type: ipv4
source: otx
country: US
hosting_provider: next,cape,search otx,as62597 nsone,meta,newprotocol,present sep,443 ma2592000,msie,hostname add
queried_at: 2026-04-02T18:03:30.624342
raw_data:
  {"pulse_count": 6, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "172.66.0.165", "tags": ["next", "cape", "search otx", "as62597 nsone", "meta", "newprotocol", "present sep", "443 ma2592000", "msie", "hostname add", "meta name", "ipv4 add", "formbook cnc", "medium", "america asn", "span p", "level", "aaaa", "write", "accept accept", "url http", "levelblue", "passive dns", "expiro malware", "analysis date", "python", "ja


indicator: 162.159.140.167
indicator_type: ipv4
source: abuseipdb
country: US
city: 3
hosting_provider: Cloudflare, Inc.
queried_at: 2026-04-02T18:03:31.363064
raw_data:
  {"abuse_confidence": 0, "total_reports": 3, "is_public": true, "is_tor": false, "country": "US", "isp": "Cloudflare, Inc.", "domain": "cloudflare.com", "usage_type": "Content Delivery Network", "last_reported": "2026-03-24T15:28:14+00:00", "categories": [14]}


indicator: 172.66.0.165
indicator_type: ipv4
source: abuseipdb
country: US
city: 3
hosting_provider: Cloudflare, Inc.
queried_at: 2026-04-02T18:03:33.070752
raw_data:
  {"abuse_confidence": 0, "total_reports": 3, "is_public": true, "is_tor": false, "country": "US", "isp": "Cloudflare, Inc.", "domain": "cloudflare.com", "usage_type": "Content Delivery Network", "last_reported": "2026-03-22T21:13:06+00:00", "categories": [14]}


indicator: 162.159.140.167
indicator_type: ipv4
source: virustotal
hosting_provider: Cloudflare, Inc.
queried_at: 2026-04-02T18:03:35.171007
raw_data:
  {"malicious": 0, "suspicious": 0, "harmless": 59, "undetected": 35, "reputation": 2, "country": "", "as_owner": "Cloudflare, Inc.", "asn": 13335, "network": "162.159.128.0/19", "last_analysis_date": 1775142478}


indicator: 172.66.0.165
indicator_type: ipv4
source: virustotal
hosting_provider: Cloudflare, Inc.
queried_at: 2026-04-02T18:03:55.665311
raw_data:
  {"malicious": 0, "suspicious": 0, "harmless": 59, "undetected": 35, "reputation": 2, "country": "", "as_owner": "Cloudflare, Inc.", "asn": 13335, "network": "172.66.0.0/22", "last_analysis_date": 1775142478}


indicator: 162.159.140.167
indicator_type: ipv4
source: censys
country: US
city: San Francisco
hosting_provider: CLOUDFLARENET - Cloudflare, Inc.
queried_at: 2026-04-02T18:04:17.070998
raw_data:
  {"ports": [80, 443, 2052, 2053, 2082, 2083, 2086, 2087, 2095, 2096, 8080, 8443, 8880], "services": ["80/HTTP", "443/HTTP", "2052/HTTP", "2053/HTTP", "2082/HTTP", "2083/HTTP", "2086/HTTP", "2087/HTTP", "2095/HTTP", "2096/HTTP", "8080/HTTP", "8443/HTTP", "8880/HTTP"], "os": "", "os_version": "", "asn": 13335, "as_name": "CLOUDFLARENET - Cloudflare, Inc.", "country": "US", "city": "San Francisco", "last_updated": "", "labels": []}


indicator: 162.159.140.167
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 162.159.128.0/19
hosting_provider: CLOUDFLARENET
queried_at: 2026-04-02T18:04:24.817724
raw_data:
  {"count": 10, "attacks": 4, "maxdate": "2026-03-30", "mindate": "2026-02-12", "updated": "2026-03-31 04:47:39", "comment": null, "asabusecontact": "abuse@cloudflare.com", "as": 13335, "asname": "CLOUDFLARENET", "ascountry": "US", "assource": "", "network": "162.159.128.0/19", "threatfeeds": {}}


indicator: 172.66.0.165
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 172.66.0.0/22
hosting_provider: CLOUDFLARENET
queried_at: 2026-04-02T18:04:26.480878
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@cloudflare.com", "as": 13335, "asname": "CLOUDFLARENET", "ascountry": "US", "assource": "", "network": "172.66.0.0/22", "threatfeeds": {}}


indicator: 162.159.140.167
indicator_type: ipv4
source: firehol
queried_at: 2026-04-02T18:04:32.149039
raw_data:
  {"listed": false, "matched_networks": [], "match_count": 0, "lists_checked": 4, "total_networks": 200944}


indicator: 162.159.140.167
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-02T18:04:32.820823
raw_data:
  {"hostnames_checked": ["mylogin-stgha.broadcom.com"], "hostnames_count": 1, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


indicator: 172.66.0.165
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-02T18:04:32.835986
raw_data:
  {"hostnames_checked": ["profile-gcpstg.broadcom.com"], "hostnames_count": 1, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


indicator: 185.163.47.177
indicator_type: ipv4
source: shodan
reverse_dns: 185-163-47-177.mivocloud.com
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:9.6p1
queried_at: 2026-04-02T18:25:31.507152
raw_data:
  {"ports": [22, 80], "vulns": [], "hostnames": ["185-163-47-177.mivocloud.com"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:9.6p1"]}


indicator: 157.20.182.49
indicator_type: ipv4
source: shodan
city: self-signed,open-dir,c2
reverse_dns: mail1.bestnewslettersclub.com
hosting_provider: cpe:/a:python:python:3.12.3,cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-04-02T18:25:33.275243
raw_data:
  {"ports": [22, 443, 4443, 8000, 8888, 31337], "vulns": ["CVE-2009-3720", "CVE-2023-27043", "CVE-2025-12781", "CVE-2025-13837", "CVE-2025-13836", "CVE-2024-7592", "CVE-2025-12084", "CVE-2024-6232", "CVE-2024-9287", "CVE-2020-29396", "CVE-2021-32052", "CVE-2009-2940"], "hostnames": ["mail1.bestnewslettersclub.com"], "tags": ["self-signed", "open-dir", "c2"], "cpes": ["cpe:/a:python:python:3.12.3", "cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 109.234.38.232
indicator_type: ipv4
source: shodan
reverse_dns: whatsapp.net,whatsapp.com,v444379.hosted-by-vdsina.com,wa.me
hosting_provider: cpe:/a:openbsd:openssh:8.4p1,cpe:/o:debian:debian_linux,cpe:/o:linux:linux_kernel
queried_at: 2026-04-02T18:25:49.079201
raw_data:
  {"ports": [22, 443], "vulns": [], "hostnames": ["whatsapp.net", "whatsapp.com", "v444379.hosted-by-vdsina.com", "wa.me"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:8.4p1", "cpe:/o:debian:debian_linux", "cpe:/o:linux:linux_kernel"]}


indicator: 134.122.109.104
indicator_type: ipv4
source: shodan
city: cloud
queried_at: 2026-04-02T18:25:52.569186
raw_data:
  {"ports": [22, 80], "vulns": [], "hostnames": [], "tags": ["cloud"], "cpes": ["cpe:/a:caddyserver:caddy", "cpe:/a:golang:go", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:10.0p2"]}

hosting_provider:
  cpe:/a:caddyserver:caddy,cpe:/a:golang:go,cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:10.0p2


indicator: 138.68.161.53
indicator_type: ipv4
source: shodan
city: cloud
hosting_provider: cpe:/a:openbsd:openssh:10.0p2,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-04-02T18:25:54.319801
raw_data:
  {"ports": [22], "vulns": [], "hostnames": [], "tags": ["cloud"], "cpes": ["cpe:/a:openbsd:openssh:10.0p2", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 140.82.29.65
indicator_type: ipv4
source: shodan
city: eol-product,cloud
reverse_dns: 140.82.29.65.vultrusercontent.com,sincro.armandoqs.com,api.sincro.armandoqs.com
queried_at: 2026-04-02T18:25:56.064890
raw_data:
  {"ports": [22, 80, 443], "vulns": ["CVE-2023-44487", "CVE-2021-23017", "CVE-2025-23419", "CVE-2021-3618"], "hostnames": ["140.82.29.65.vultrusercontent.com", "sincro.armandoqs.com", "api.sincro.armandoqs.com"], "tags": ["eol-product", "cloud"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx:1.18.0", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/o:linux:linux_kernel"]}

hosting_provider:
  cpe:/o:canonical:ubuntu_linux,cpe:/a:f5:nginx:1.18.0,cpe:/a:openbsd:openssh:8.9p1,cpe:/o:linux:linux_kernel


indicator: 141.98.233.17
indicator_type: ipv4
source: shodan
reverse_dns: 117130.ip-ptr.tech
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:9.6p1
queried_at: 2026-04-02T18:25:57.814967
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["117130.ip-ptr.tech"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:9.6p1"]}


indicator: 143.198.160.45
indicator_type: ipv4
source: shodan
city: cloud
reverse_dns: freezerpro.com
queried_at: 2026-04-02T18:25:59.612100
raw_data:
  {"ports": [22, 80, 443], "vulns": [], "hostnames": ["freezerpro.com"], "tags": ["cloud"], "cpes": ["cpe:/a:jquery:jquery:3.6.1", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:getbootstrap:bootstrap", "cpe:/a:f5:nginx", "cpe:/a:openbsd:openssh:8.2p1"]}

hosting_provider:
  cpe:/a:jquery:jquery:3.6.1,cpe:/o:canonical:ubuntu_linux,cpe:/a:getbootstrap:bootstrap,cpe:/a:f5:nginx,cpe:/a:openbsd:openssh:8.2p1


indicator: 151.248.117.250
indicator_type: ipv4
source: shodan
reverse_dns: 151-248-117-250.cloudvps.regruhosting.ru,www.storiesmoscow.ru,storiesmoscow.ru
hosting_provider: cpe:/a:openbsd:openssh:8.4p1,cpe:/o:debian:debian_linux,cpe:/a:f5:nginx,cpe:/o:linux:linux_kernel
queried_at: 2026-04-02T18:26:06.651657
raw_data:
  {"ports": [22, 80, 443], "vulns": [], "hostnames": ["151-248-117-250.cloudvps.regruhosting.ru", "www.storiesmoscow.ru", "storiesmoscow.ru"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:8.4p1", "cpe:/o:debian:debian_linux", "cpe:/a:f5:nginx", "cpe:/o:linux:linux_kernel"]}


indicator: 151.248.121.176
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: api.onlyplanks.ru,onlyplanks.ru,151-248-121-176.cloudvps.regruhosting.ru
queried_at: 2026-04-02T18:26:07.527086
raw_data:
  {"ports": [22, 80, 443, 7090, 8090, 9030], "vulns": ["CVE-2021-3618", "CVE-2021-23017", "CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["api.onlyplanks.ru", "onlyplanks.ru", "151-248-121-176.cloudvps.regruhosting.ru"], "tags": ["eol-product"], "cpes": ["cpe:/a:vercel:next.js", "cpe:/o:linux:linux_kernel", "cpe:/a:facebook:react", "cpe:/a:amazon:elastic_load_balancing", "cpe:/a:f5:nginx:1.18.0", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1"]}

hosting_provider:
  cpe:/a:vercel:next.js,cpe:/o:linux:linux_kernel,cpe:/a:facebook:react,cpe:/a:amazon:elastic_load_balancing,cpe:/a:f5:nginx:1.18.0,cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.9p1


indicator: 155.138.138.195
indicator_type: ipv4
source: shodan
city: cloud
reverse_dns: 155.138.138.195.vultrusercontent.com
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.9p1
queried_at: 2026-04-02T18:26:09.285188
raw_data:
  {"ports": [22, 80], "vulns": [], "hostnames": ["155.138.138.195.vultrusercontent.com"], "tags": ["cloud"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1"]}


indicator: 157.230.108.94
indicator_type: ipv4
source: shodan
city: cloud
queried_at: 2026-04-02T18:26:10.188045
raw_data:
  {"ports": [22, 80], "vulns": [], "hostnames": [], "tags": ["cloud"], "cpes": ["cpe:/a:caddyserver:caddy", "cpe:/a:openbsd:openssh:9.6p1", "cpe:/a:golang:go", "cpe:/o:canonical:ubuntu_linux"]}

hosting_provider:
  cpe:/a:caddyserver:caddy,cpe:/a:openbsd:openssh:9.6p1,cpe:/a:golang:go,cpe:/o:canonical:ubuntu_linux


indicator: 159.203.21.16
indicator_type: ipv4
source: shodan
city: self-signed,eol-product,cloud,starttls
reverse_dns: crm.pardonsandwaivers.com,prd.pardonsandwaivers.com
queried_at: 2026-04-02T18:26:13.702388
raw_data:
  {"ports": [21, 22, 25, 53, 80, 110, 143, 443, 465, 587, 995, 2082, 2083, 2086, 2087, 2095], "vulns": ["CVE-2023-3817", "CVE-2023-0465", "CVE-2019-11358", "CVE-2023-4807", "CVE-2022-31628", "CVE-2020-7068", "CVE-2020-7069", "CVE-2012-4360", "CVE-2022-2097", "CVE-2023-38408", "CVE-2015-9251", "CVE-2025-69420", "CVE-2023-48795", "CVE-2025-55753", "CVE-2024-3566", "CVE-2009-3766", "CVE-2022-0778", "CVE-2020-7070", "CVE-2011-1176", "CVE-2007-3205", "CVE-2017-8923", "CVE-2023-0286", "CVE-2022-37454", 

hosting_provider:
  cpe:/a:php:php:7.4.33,cpe:/a:apache:http_server:2.4.65,cpe:/o:unix:unix,cpe:/a:jquery:jquery,cpe:/a:pureftpd:pure-ftpd,cpe:/a:openssl:openssl:1.1.1k,cpe:/a:jquery:jquery_ui,cpe:/a:php:php:7.2.30,cpe:/a:postfix:postfix,cpe:/a:getbootstrap:bootstrap,cpe:/a:openbsd:openssh:8.0,cpe:/a:control-webpanel:webpanel,cpe:/a:jquery:jquery:1.12.4


indicator: 161.35.185.146
indicator_type: ipv4
source: shodan
city: eol-product,cloud
reverse_dns: edgely.bet
queried_at: 2026-04-02T18:26:18.950060
raw_data:
  {"ports": [22, 80, 443, 3002], "vulns": ["CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["edgely.bet"], "tags": ["eol-product", "cloud"], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:expressjs:express", "cpe:/a:nodejs:node.js", "cpe:/a:openbsd:openssh:9.6p1", "cpe:/a:f5:nginx:1.24.0"]}

hosting_provider:
  cpe:/o:linux:linux_kernel,cpe:/o:canonical:ubuntu_linux,cpe:/a:expressjs:express,cpe:/a:nodejs:node.js,cpe:/a:openbsd:openssh:9.6p1,cpe:/a:f5:nginx:1.24.0


indicator: 164.90.210.128
indicator_type: ipv4
source: shodan
city: cloud,database
reverse_dns: www.immobiliareopla.it,immobiliareopla.it
queried_at: 2026-04-02T18:26:19.825125
raw_data:
  {"ports": [22, 80, 443, 5432, 6379], "vulns": [], "hostnames": ["www.immobiliareopla.it", "immobiliareopla.it"], "tags": ["cloud", "database"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:postgresql:postgresql", "cpe:/a:redislabs:redis:7.4.1", "cpe:/a:microsoft:asp.net", "cpe:/a:openbsd:openssh:8.9p1"]}

hosting_provider:
  cpe:/o:canonical:ubuntu_linux,cpe:/a:postgresql:postgresql,cpe:/a:redislabs:redis:7.4.1,cpe:/a:microsoft:asp.net,cpe:/a:openbsd:openssh:8.9p1


indicator: 165.22.120.122
indicator_type: ipv4
source: shodan
city: cloud,self-signed
hosting_provider: cpe:/a:f5:nginx
queried_at: 2026-04-02T18:26:21.574436
raw_data:
  {"ports": [80, 443, 8080, 8443, 8880], "vulns": [], "hostnames": [], "tags": ["cloud", "self-signed"], "cpes": ["cpe:/a:f5:nginx"]}


indicator: 165.227.208.207
indicator_type: ipv4
source: shodan
city: cloud
reverse_dns: cloudwaysapps.com,1185188.cloudwaysapps.com
hosting_provider: cpe:/a:f5:nginx
queried_at: 2026-04-02T18:26:22.441789
raw_data:
  {"ports": [80, 443], "vulns": [], "hostnames": ["cloudwaysapps.com", "1185188.cloudwaysapps.com"], "tags": ["cloud"], "cpes": ["cpe:/a:f5:nginx"]}


indicator: 165.232.136.224
indicator_type: ipv4
source: shodan
city: eol-product,cloud,database
hosting_provider: cpe:/a:php:php:8.4.1,cpe:/a:mariadb:mariadb:10.11.2-MariaDB,cpe:/a:f5:nginx:1.23.3
queried_at: 2026-04-02T18:26:23.321743
raw_data:
  {"ports": [80, 135, 137, 3306], "vulns": ["CVE-2025-14177", "CVE-2024-3566", "CVE-2025-1734", "CVE-2025-6491", "CVE-2024-11235", "CVE-2025-1736", "CVE-2025-1217", "CVE-2013-2220", "CVE-2025-1861", "CVE-2025-1219", "CVE-2007-3205", "CVE-2025-14180", "CVE-2023-44487", "CVE-2025-1735", "CVE-2025-1220", "CVE-2025-14178", "CVE-2025-23419"], "hostnames": [], "tags": ["eol-product", "cloud", "database"], "cpes": ["cpe:/a:php:php:8.4.1", "cpe:/a:mariadb:mariadb:10.11.2-MariaDB", "cpe:/a:f5:nginx:1.23.3"


indicator: 167.172.74.200
indicator_type: ipv4
source: shodan
city: cloud
hosting_provider: cpe:/a:f5:nginx,cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.2p1
queried_at: 2026-04-02T18:26:25.065719
raw_data:
  {"ports": [22, 80, 443, 8888, 33060], "vulns": [], "hostnames": [], "tags": ["cloud"], "cpes": ["cpe:/a:f5:nginx", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.2p1"]}


indicator: 167.99.127.118
indicator_type: ipv4
source: shodan
city: eol-product,cloud
reverse_dns: api.detailxperts.net
hosting_provider: cpe:/a:f5:nginx:1.18.0,cpe:/o:canonical:ubuntu_linux,cpe:/o:linux:linux_kernel
queried_at: 2026-04-02T18:26:25.941644
raw_data:
  {"ports": [443], "vulns": ["CVE-2021-3618", "CVE-2021-23017", "CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["api.detailxperts.net"], "tags": ["eol-product", "cloud"], "cpes": ["cpe:/a:f5:nginx:1.18.0", "cpe:/o:canonical:ubuntu_linux", "cpe:/o:linux:linux_kernel"]}


indicator: 167.99.138.16
indicator_type: ipv4
source: shodan
city: cloud
reverse_dns: bogozi.com,monitor.bogozi.com,www.bogozi.com
hosting_provider: cpe:/a:f5:nginx
queried_at: 2026-04-02T18:26:26.834610
raw_data:
  {"ports": [80, 443], "vulns": [], "hostnames": ["bogozi.com", "monitor.bogozi.com", "www.bogozi.com"], "tags": ["cloud"], "cpes": ["cpe:/a:f5:nginx"]}


indicator: 178.128.215.84
indicator_type: ipv4
source: shodan
city: eol-product,cloud
queried_at: 2026-04-02T18:26:32.183347
raw_data:
  {"ports": [22, 80, 1025, 1080, 8529, 9000, 9001], "vulns": ["CVE-2023-44487", "CVE-2025-23419"], "hostnames": [], "tags": ["eol-product", "cloud"], "cpes": ["cpe:/a:minio:minio", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx:1.23.4", "cpe:/a:openbsd:openssh:8.9p1"]}

hosting_provider:
  cpe:/a:minio:minio,cpe:/o:canonical:ubuntu_linux,cpe:/a:f5:nginx:1.23.4,cpe:/a:openbsd:openssh:8.9p1


indicator: 185.20.225.35
indicator_type: ipv4
source: shodan
city: self-signed,eol-product,starttls,database
reverse_dns: 185-20-225-35.cloudvps.regruhosting.ru
hosting_provider: cpe:/a:f5:nginx,cpe:/a:exim:exim:4.93,cpe:/a:oracle:mysql,cpe:/a:f5:nginx:1.20.2
queried_at: 2026-04-02T18:26:38.357278
raw_data:
  {"ports": [21, 25, 80, 110, 143, 443, 465, 587, 993, 995, 3306, 7777, 8888], "vulns": ["CVE-2025-67896", "CVE-2020-28024", "CVE-2023-42114", "CVE-2020-28025", "CVE-2024-39929", "CVE-2022-37452", "CVE-2020-28007", "CVE-2020-28013", "CVE-2023-51766", "CVE-2020-28019", "CVE-2020-28021", "CVE-2025-23419", "CVE-2021-38371", "CVE-2020-28008", "CVE-2020-28026", "CVE-2023-42115", "CVE-2020-28011", "CVE-2020-8015", "CVE-2020-28017", "CVE-2022-37451", "CVE-2020-12783", "CVE-2020-28022", "CVE-2023-42117", 


indicator: 185.46.9.173
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: 185-46-9-173.cloudvps.regruhosting.ru,api.fortio.io
queried_at: 2026-04-02T18:26:53.207880
raw_data:
  {"ports": [22, 80, 443, 8065, 8081], "vulns": ["CVE-2021-3618", "CVE-2021-23017", "CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["185-46-9-173.cloudvps.regruhosting.ru", "api.fortio.io"], "tags": ["eol-product"], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/a:facebook:react", "cpe:/a:f5:nginx:1.18.0", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:golang:go", "cpe:/a:jenkins:mattermost", "cpe:/a:openbsd:openssh:8.2p1"]}

hosting_provider:
  cpe:/o:linux:linux_kernel,cpe:/a:facebook:react,cpe:/a:f5:nginx:1.18.0,cpe:/o:canonical:ubuntu_linux,cpe:/a:golang:go,cpe:/a:jenkins:mattermost,cpe:/a:openbsd:openssh:8.2p1


indicator: 188.225.25.132
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:7.6p1
queried_at: 2026-04-02T18:26:56.698875
raw_data:
  {"ports": [22, 80], "vulns": [], "hostnames": [], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:7.6p1"]}


indicator: 188.225.44.181
indicator_type: ipv4
source: shodan
reverse_dns: 1357577-cu17374.tw1.ru
hosting_provider: cpe:/a:apache:http_server:2.4.52,cpe:/a:openbsd:openssh:8.9p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-04-02T18:27:00.235356
raw_data:
  {"ports": [22, 80], "vulns": ["CVE-2006-20001", "CVE-2024-38476", "CVE-2024-24795", "CVE-2023-45802", "CVE-2024-38477", "CVE-2007-4723", "CVE-2022-30556", "CVE-2024-38472", "CVE-2022-29404", "CVE-2009-0796", "CVE-2025-49630", "CVE-2025-53020", "CVE-2025-65082", "CVE-2011-2688", "CVE-2025-58098", "CVE-2024-43204", "CVE-2025-55753", "CVE-2012-4360", "CVE-2023-31122", "CVE-2022-22720", "CVE-2023-25690", "CVE-2025-66200", "CVE-2013-4365", "CVE-2025-49812", "CVE-2022-26377", "CVE-2022-22719", "CVE-20


indicator: 188.225.87.166
indicator_type: ipv4
source: shodan
city: database
hosting_provider: cpe:/a:oracle:mysql:8.0.43-34,cpe:/a:f5:nginx
queried_at: 2026-04-02T18:27:02.930932
raw_data:
  {"ports": [80, 111, 3306], "vulns": [], "hostnames": [], "tags": ["database"], "cpes": ["cpe:/a:oracle:mysql:8.0.43-34", "cpe:/a:f5:nginx"]}


indicator: 193.124.206.128
indicator_type: ipv4
source: shodan
queried_at: 2026-04-02T18:27:04.688972
raw_data:
  {"ports": [443], "vulns": [], "hostnames": ["staticview.microsoft.com", "microsoft.com", "c.s-microsoft.com", "i.s-microsoft.com", "www.microsoft.com", "privacy.microsoft.com", "wwwqa.microsoft.com"], "tags": [], "cpes": []}

reverse_dns:
  staticview.microsoft.com,microsoft.com,c.s-microsoft.com,i.s-microsoft.com,www.microsoft.com,privacy.microsoft.com,wwwqa.microsoft.com


indicator: 193.164.150.111
indicator_type: ipv4
source: shodan
reverse_dns: www.epatagik.com,epatagik.com
hosting_provider: cpe:/a:f5:nginx
queried_at: 2026-04-02T18:27:05.470868
raw_data:
  {"ports": [80, 443], "vulns": [], "hostnames": ["www.epatagik.com", "epatagik.com"], "tags": [], "cpes": ["cpe:/a:f5:nginx"]}


indicator: 193.164.150.121
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: 657799-cg79226.tmweb.ru
queried_at: 2026-04-02T18:27:06.423869
raw_data:
  {"ports": [22, 80, 443, 5672, 10050], "vulns": ["CVE-2023-44487", "CVE-2021-32718", "CVE-2022-31008", "CVE-2021-22116", "CVE-2021-32719", "CVE-2025-23419", "CVE-2023-46118", "CVE-2021-23017", "CVE-2021-3618"], "hostnames": ["657799-cg79226.tmweb.ru"], "tags": ["eol-product"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:vmware:rabbitmq:3.8.3", "cpe:/a:f5:nginx:1.18.0", "cpe:/a:openbsd:openssh:8.2p1", "cpe:/o:linux:linux_kernel"]}

hosting_provider:
  cpe:/o:canonical:ubuntu_linux,cpe:/a:vmware:rabbitmq:3.8.3,cpe:/a:f5:nginx:1.18.0,cpe:/a:openbsd:openssh:8.2p1,cpe:/o:linux:linux_kernel


indicator: 194.180.191.105
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: no-rdns.mivocloud.com
queried_at: 2026-04-02T18:27:08.181999
raw_data:
  {"ports": [135, 445, 3389, 5986], "vulns": [], "hostnames": ["no-rdns.mivocloud.com"], "tags": ["self-signed"], "cpes": []}


indicator: 194.180.191.30
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: no-rdns.mivocloud.com
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:9.6p1
queried_at: 2026-04-02T18:27:08.829394
raw_data:
  {"ports": [22, 3389, 5986], "vulns": [], "hostnames": ["no-rdns.mivocloud.com"], "tags": ["self-signed"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:9.6p1"]}


indicator: 194.58.103.22
indicator_type: ipv4
source: shodan
city: starttls,self-signed
reverse_dns: 800degrees.ru
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.2p1,cpe:/a:exim:exim:4.93
queried_at: 2026-04-02T18:27:09.930391
raw_data:
  {"ports": [21, 22, 25, 53, 110, 465, 587, 993, 995], "vulns": ["CVE-2020-28023", "CVE-2020-28011", "CVE-2020-8015", "CVE-2020-28012", "CVE-2020-28026", "CVE-2020-28008", "CVE-2023-42114", "CVE-2020-28007", "CVE-2020-28013", "CVE-2020-28021", "CVE-2021-27216", "CVE-2020-28022", "CVE-2020-28019", "CVE-2024-39929", "CVE-2023-42116", "CVE-2022-37452", "CVE-2022-37451", "CVE-2020-28024", "CVE-2020-12783", "CVE-2021-38371", "CVE-2023-51766", "CVE-2025-67896", "CVE-2023-42117", "CVE-2023-42115", "CVE-2


indicator: 194.58.108.140
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: 194-58-108-140.cloudvps.regruhosting.ru
queried_at: 2026-04-02T18:27:11.697041
raw_data:
  {"ports": [22, 80, 8443], "vulns": ["CVE-2021-3618", "CVE-2021-23017", "CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["194-58-108-140.cloudvps.regruhosting.ru"], "tags": ["eol-product"], "cpes": ["cpe:/a:f5:nginx:1.18.0", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/o:linux:linux_kernel"]}

hosting_provider:
  cpe:/a:f5:nginx:1.18.0,cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.9p1,cpe:/o:linux:linux_kernel


indicator: 194.58.119.114
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: community.smartholdem.io,194-58-119-114.cloudvps.regruhosting.ru
hosting_provider: cpe:/a:f5:nginx:1.18.0,cpe:/o:canonical:ubuntu_linux,cpe:/a:ntp:ntp:3,cpe:/o:linux:linux_kernel
queried_at: 2026-04-02T18:27:15.193414
raw_data:
  {"ports": [123, 443], "vulns": ["CVE-2021-3618", "CVE-2021-23017", "CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["community.smartholdem.io", "194-58-119-114.cloudvps.regruhosting.ru"], "tags": ["eol-product"], "cpes": ["cpe:/a:f5:nginx:1.18.0", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:ntp:ntp:3", "cpe:/o:linux:linux_kernel"]}


indicator: 194.58.121.225
indicator_type: ipv4
source: shodan
reverse_dns: 194-58-121-225.cloudvps.regruhosting.ru
hosting_provider: cpe:/o:linux:linux_kernel,cpe:/o:debian:debian_linux,cpe:/a:openbsd:openssh:7.4p1
queried_at: 2026-04-02T18:27:17.584465
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["194-58-121-225.cloudvps.regruhosting.ru"], "tags": [], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/o:debian:debian_linux", "cpe:/a:openbsd:openssh:7.4p1"]}


indicator: 194.58.122.212
indicator_type: ipv4
source: shodan
city: self-signed,eol-product,starttls
reverse_dns: korpusnyak.ru,www.korpusnyak.ru,prinfix.ru
hosting_provider: cpe:/a:f5:nginx:1.20.2,cpe:/a:exim:exim:4.95,cpe:/a:openbsd:openssh:7.4
queried_at: 2026-04-02T18:27:20.434394
raw_data:
  {"ports": [21, 22, 25, 53, 110, 143, 443, 465, 587, 993, 995], "vulns": ["CVE-2025-67896", "CVE-2008-3844", "CVE-2023-42114", "CVE-2019-6110", "CVE-2019-6111", "CVE-2018-15473", "CVE-2024-39929", "CVE-2020-15778", "CVE-2023-51766", "CVE-2025-23419", "CVE-2025-26465", "CVE-2023-51385", "CVE-2023-42115", "CVE-2022-37451", "CVE-2007-2768", "CVE-2023-38408", "CVE-2023-42117", "CVE-2022-3620", "CVE-2022-3559", "CVE-2020-14145", "CVE-2021-3618", "CVE-2025-32728", "CVE-2023-42119", "CVE-2023-44487", "C


indicator: 194.58.97.115
indicator_type: ipv4
source: shodan
reverse_dns: cadence.fishing
hosting_provider: cpe:/a:openbsd:openssh:8.4p1,cpe:/o:debian:debian_linux,cpe:/o:linux:linux_kernel
queried_at: 2026-04-02T18:27:24.010620
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["cadence.fishing"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:8.4p1", "cpe:/o:debian:debian_linux", "cpe:/o:linux:linux_kernel"]}


indicator: 194.58.98.215
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: 194-58-98-215.cloudvps.regruhosting.ru
hosting_provider: cpe:/a:openbsd:openssh:7.4,cpe:/a:f5:nginx
queried_at: 2026-04-02T18:27:25.776852
raw_data:
  {"ports": [22, 80, 443, 8070], "vulns": ["CVE-2019-6109", "CVE-2019-6110", "CVE-2023-51385", "CVE-2018-20685", "CVE-2025-32728", "CVE-2023-38408", "CVE-2008-3844", "CVE-2019-6111", "CVE-2021-36368", "CVE-2007-2768", "CVE-2023-48795", "CVE-2018-15919", "CVE-2020-15778", "CVE-2021-41617", "CVE-2017-15906", "CVE-2025-26465", "CVE-2023-51767", "CVE-2018-15473", "CVE-2016-20012", "CVE-2020-14145"], "hostnames": ["194-58-98-215.cloudvps.regruhosting.ru"], "tags": ["self-signed"], "cpes": ["cpe:/a:open


indicator: 194.67.108.168
indicator_type: ipv4
source: shodan
city: eol-product,self-signed,database
reverse_dns: 194-67-108-168.cloudvps.regruhosting.ru
queried_at: 2026-04-02T18:27:27.558975
raw_data:
  {"ports": [22, 80, 5432], "vulns": ["CVE-2023-44487", "CVE-2021-23017", "CVE-2025-23419", "CVE-2021-3618"], "hostnames": ["194-67-108-168.cloudvps.regruhosting.ru"], "tags": ["eol-product", "self-signed", "database"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx:1.18.0", "cpe:/a:postgresql:postgresql:12", "cpe:/a:openbsd:openssh:8.2p1", "cpe:/o:linux:linux_kernel"]}

hosting_provider:
  cpe:/o:canonical:ubuntu_linux,cpe:/a:f5:nginx:1.18.0,cpe:/a:postgresql:postgresql:12,cpe:/a:openbsd:openssh:8.2p1,cpe:/o:linux:linux_kernel


indicator: 194.67.109.14
indicator_type: ipv4
source: shodan
city: starttls,eol-product,self-signed
reverse_dns: 194-67-109-14.cloudvps.regruhosting.ru
queried_at: 2026-04-02T18:27:28.122825
raw_data:
  {"ports": [21, 22, 25, 53, 80, 110, 123, 143, 443, 587, 993, 995, 1500], "vulns": ["CVE-2023-44487", "CVE-2024-39929", "CVE-2023-42116", "CVE-2022-3559", "CVE-2023-51766", "CVE-2025-67896", "CVE-2023-42117", "CVE-2025-23419", "CVE-2023-42115", "CVE-2023-42114", "CVE-2023-42119", "CVE-2021-23017", "CVE-2022-3620", "CVE-2022-37451", "CVE-2021-3618"], "hostnames": ["194-67-109-14.cloudvps.regruhosting.ru"], "tags": ["starttls", "eol-product", "self-signed"], "cpes": ["cpe:/o:canonical:ubuntu_linux"

hosting_provider:
  cpe:/o:canonical:ubuntu_linux,cpe:/a:exim:exim:4.95,cpe:/a:f5:nginx:1.18.0,cpe:/o:linux:linux_kernel,cpe:/a:openbsd:openssh:8.9p1,cpe:/a:ntp:ntp:3


indicator: 194.67.113.186
indicator_type: ipv4
source: shodan
reverse_dns: 194-67-113-186.cloudvps.regruhosting.ru
hosting_provider: cpe:/a:openbsd:openssh:7.4,cpe:/a:pureftpd:pure-ftpd
queried_at: 2026-04-02T18:27:35.104852
raw_data:
  {"ports": [21, 22], "vulns": ["CVE-2019-6109", "CVE-2019-6110", "CVE-2023-51385", "CVE-2018-20685", "CVE-2025-32728", "CVE-2023-38408", "CVE-2008-3844", "CVE-2019-6111", "CVE-2021-36368", "CVE-2007-2768", "CVE-2023-48795", "CVE-2018-15919", "CVE-2020-15778", "CVE-2021-41617", "CVE-2017-15906", "CVE-2025-26465", "CVE-2023-51767", "CVE-2018-15473", "CVE-2016-20012", "CVE-2020-14145"], "hostnames": ["194-67-113-186.cloudvps.regruhosting.ru"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:7.4", "cpe:


indicator: 194.67.113.50
indicator_type: ipv4
source: shodan
reverse_dns: 194-67-113-50.cloudvps.regruhosting.ru,sfmai.ru
hosting_provider: cpe:/a:apache:http_server:2.4.41
queried_at: 2026-04-02T18:27:36.380430
raw_data:
  {"ports": [443], "vulns": ["CVE-2024-24795", "CVE-2020-1934", "CVE-2022-30556", "CVE-2025-53020", "CVE-2024-43204", "CVE-2025-55753", "CVE-2025-66200", "CVE-2021-32786", "CVE-2022-28614", "CVE-2025-59775", "CVE-2020-13938", "CVE-2024-40898", "CVE-2025-23048", "CVE-2011-1176", "CVE-2024-38474", "CVE-2020-35452", "CVE-2013-2765", "CVE-2023-38709", "CVE-2024-47252", "CVE-2021-32792", "CVE-2022-31813", "CVE-2022-23943", "CVE-2023-45802", "CVE-2021-26690", "CVE-2022-29404", "CVE-2021-33193", "CVE-202


indicator: 194.67.116.81
indicator_type: ipv4
source: shodan
city: eol-product,self-signed,database
reverse_dns: 194-67-116-81.cloudvps.regruhosting.ru
queried_at: 2026-04-02T18:27:41.683129
raw_data:
  {"ports": [22, 80, 5432], "vulns": ["CVE-2023-44487", "CVE-2021-23017", "CVE-2025-23419", "CVE-2021-3618"], "hostnames": ["194-67-116-81.cloudvps.regruhosting.ru"], "tags": ["eol-product", "self-signed", "database"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx:1.18.0", "cpe:/a:postgresql:postgresql:12", "cpe:/a:openbsd:openssh:8.2p1", "cpe:/o:linux:linux_kernel"]}

hosting_provider:
  cpe:/o:canonical:ubuntu_linux,cpe:/a:f5:nginx:1.18.0,cpe:/a:postgresql:postgresql:12,cpe:/a:openbsd:openssh:8.2p1,cpe:/o:linux:linux_kernel


indicator: 194.67.86.240
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: 194-67-86-240.cloudvps.regruhosting.ru
hosting_provider: cpe:/a:f5:nginx:1.18.0,cpe:/o:canonical:ubuntu_linux,cpe:/o:linux:linux_kernel
queried_at: 2026-04-02T18:27:45.615252
raw_data:
  {"ports": [80], "vulns": ["CVE-2021-3618", "CVE-2021-23017", "CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["194-67-86-240.cloudvps.regruhosting.ru"], "tags": ["eol-product"], "cpes": ["cpe:/a:f5:nginx:1.18.0", "cpe:/o:canonical:ubuntu_linux", "cpe:/o:linux:linux_kernel"]}


indicator: 194.67.87.29
indicator_type: ipv4
source: shodan
reverse_dns: 194-67-87-29.cloudvps.regruhosting.ru
hosting_provider: cpe:/a:openbsd:openssh:9.2p1,cpe:/o:debian:debian_linux,cpe:/o:linux:linux_kernel
queried_at: 2026-04-02T18:27:46.949028
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["194-67-87-29.cloudvps.regruhosting.ru"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.2p1", "cpe:/o:debian:debian_linux", "cpe:/o:linux:linux_kernel"]}


indicator: 195.133.88.128
indicator_type: ipv4
source: shodan
city: eol-product,starttls
reverse_dns: relay.karlov.family
queried_at: 2026-04-02T18:27:50.993396
raw_data:
  {"ports": [22, 25, 80, 587, 50443], "vulns": ["CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["relay.karlov.family"], "tags": ["eol-product", "starttls"], "cpes": ["cpe:/a:openbsd:openssh:9.2p1", "cpe:/o:linux:linux_kernel", "cpe:/o:debian:debian_linux", "cpe:/a:f5:nginx:1.22.1", "cpe:/a:postfix:postfix"]}

hosting_provider:
  cpe:/a:openbsd:openssh:9.2p1,cpe:/o:linux:linux_kernel,cpe:/o:debian:debian_linux,cpe:/a:f5:nginx:1.22.1,cpe:/a:postfix:postfix


indicator: 206.81.0.182
indicator_type: ipv4
source: shodan
city: eol-product,cloud
reverse_dns: ee.atoztheatrical.com
queried_at: 2026-04-02T18:27:55.804102
raw_data:
  {"ports": [22, 80, 443], "vulns": ["CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["ee.atoztheatrical.com"], "tags": ["eol-product", "cloud"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:phusionpassenger:phusion_passenger:6.0.17", "cpe:/o:linux:linux_kernel", "cpe:/a:f5:nginx:1.22.0", "cpe:/a:openbsd:openssh:9.0p1"]}

hosting_provider:
  cpe:/o:canonical:ubuntu_linux,cpe:/a:phusionpassenger:phusion_passenger:6.0.17,cpe:/o:linux:linux_kernel,cpe:/a:f5:nginx:1.22.0,cpe:/a:openbsd:openssh:9.0p1


indicator: 209.97.165.187
indicator_type: ipv4
source: shodan
city: eol-product,cloud
reverse_dns: pg.api789.work
queried_at: 2026-04-02T18:27:57.570800
raw_data:
  {"ports": [80, 81, 443], "vulns": ["CVE-2024-24795", "CVE-2020-1934", "CVE-2022-30556", "CVE-2025-53020", "CVE-2024-43204", "CVE-2025-55753", "CVE-2025-66200", "CVE-2021-32786", "CVE-2022-28614", "CVE-2025-59775", "CVE-2020-13938", "CVE-2024-40898", "CVE-2025-23048", "CVE-2011-1176", "CVE-2024-38474", "CVE-2020-35452", "CVE-2013-2765", "CVE-2023-38709", "CVE-2024-47252", "CVE-2021-32792", "CVE-2022-31813", "CVE-2022-23943", "CVE-2023-45802", "CVE-2021-26690", "CVE-2022-29404", "CVE-2021-33193", 

hosting_provider:
  cpe:/a:apache:http_server:2.4.41,cpe:/a:f5:nginx:1.18.0,cpe:/o:canonical:ubuntu_linux,cpe:/o:linux:linux_kernel


indicator: 216.238.69.137
indicator_type: ipv4
source: shodan
city: cloud
reverse_dns: 216.238.69.137.vultrusercontent.com
hosting_provider: cpe:/a:openbsd:openssh:10.0p2,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-04-02T18:27:59.752073
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["216.238.69.137.vultrusercontent.com"], "tags": ["cloud"], "cpes": ["cpe:/a:openbsd:openssh:10.0p2", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 23.42.150.172
indicator_type: ipv4
source: shodan
city: cdn
reverse_dns: a23-42-150-172.deploy.static.akamaitechnologies.com,a248.e.akamai.net
queried_at: 2026-04-02T18:28:03.294262
raw_data:
  {"ports": [80, 443], "vulns": [], "hostnames": ["a23-42-150-172.deploy.static.akamaitechnologies.com", "a248.e.akamai.net"], "tags": ["cdn"], "cpes": []}


indicator: 37.140.195.137
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: skud.skladovka.ru
queried_at: 2026-04-02T18:28:08.544353
raw_data:
  {"ports": [22, 80, 443, 3000, 3001], "vulns": [], "hostnames": ["skud.skladovka.ru"], "tags": ["self-signed"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openresty:openresty", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/a:f5:nginx", "cpe:/a:facebook:react"]}

hosting_provider:
  cpe:/o:canonical:ubuntu_linux,cpe:/a:openresty:openresty,cpe:/a:openbsd:openssh:8.9p1,cpe:/a:f5:nginx,cpe:/a:facebook:react


indicator: 5.181.156.109
indicator_type: ipv4
source: shodan
reverse_dns: no-rdns.mivocloud.com
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-04-02T18:28:18.721836
raw_data:
  {"ports": [22, 80], "vulns": [], "hostnames": ["no-rdns.mivocloud.com"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 5.63.154.128
indicator_type: ipv4
source: shodan
city: starttls,eol-product,self-signed
reverse_dns: 5-63-154-128.cloudvps.regruhosting.ru
queried_at: 2026-04-02T18:28:20.874879
raw_data:
  {"ports": [21, 22, 25, 80, 110, 143, 465, 587, 993, 995], "vulns": ["CVE-2020-28023", "CVE-2020-28011", "CVE-2020-8015", "CVE-2020-28012", "CVE-2020-28026", "CVE-2020-28008", "CVE-2023-42114", "CVE-2020-28007", "CVE-2020-28013", "CVE-2020-28021", "CVE-2021-27216", "CVE-2020-28022", "CVE-2020-28019", "CVE-2024-39929", "CVE-2023-42116", "CVE-2025-23419", "CVE-2022-37452", "CVE-2022-37451", "CVE-2021-3618", "CVE-2023-44487", "CVE-2020-28024", "CVE-2020-12783", "CVE-2021-38371", "CVE-2023-51766", "C

hosting_provider:
  cpe:/a:f5:nginx:1.20.2,cpe:/a:openbsd:openssh:8.2p1,cpe:/o:canonical:ubuntu_linux,cpe:/a:exim:exim:4.93


indicator: 62.133.62.73
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: saberx.tech,116762.ip-ptr.tech
queried_at: 2026-04-02T18:28:25.757284
raw_data:
  {"ports": [21, 22, 25, 80, 443, 465, 587, 993, 995, 8888], "vulns": ["CVE-2025-67896", "CVE-2022-3559", "CVE-2023-42114", "CVE-2023-42115", "CVE-2024-39929", "CVE-2023-42119", "CVE-2022-37451", "CVE-2023-51766", "CVE-2023-42116", "CVE-2023-42117", "CVE-2022-3620"], "hostnames": ["saberx.tech", "116762.ip-ptr.tech"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx:1.28.0", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx", "cpe:/a:exim:exim:4.95", "cpe:/a:openbsd:openssh:8.9p1"]}

hosting_provider:
  cpe:/a:f5:nginx:1.28.0,cpe:/o:canonical:ubuntu_linux,cpe:/a:f5:nginx,cpe:/a:exim:exim:4.95,cpe:/a:openbsd:openssh:8.9p1


indicator: 64.227.172.243
indicator_type: ipv4
source: shodan
city: devops,cloud,self-signed
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:10.0p2
queried_at: 2026-04-02T18:28:27.510033
raw_data:
  {"ports": [22, 443, 10250], "vulns": [], "hostnames": [], "tags": ["devops", "cloud", "self-signed"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:10.0p2"]}


indicator: 67.205.160.237
indicator_type: ipv4
source: shodan
city: cloud
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.9p1
queried_at: 2026-04-02T18:28:27.858846
raw_data:
  {"ports": [22, 7946], "vulns": [], "hostnames": [], "tags": ["cloud"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1"]}


indicator: 68.183.2.92
indicator_type: ipv4
source: shodan
city: cloud,self-signed,database
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.9p1,cpe:/a:postgresql:postgresql
queried_at: 2026-04-02T18:28:29.266055
raw_data:
  {"ports": [22, 5432], "vulns": [], "hostnames": [], "tags": ["cloud", "self-signed", "database"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/a:postgresql:postgresql"]}


indicator: 70.34.194.123
indicator_type: ipv4
source: shodan
city: cloud
reverse_dns: koncept62yearplan.tempurl.host,wpmudev.host
hosting_provider: cpe:/a:f5:nginx
queried_at: 2026-04-02T18:28:29.623816
raw_data:
  {"ports": [80, 443], "vulns": [], "hostnames": ["koncept62yearplan.tempurl.host", "wpmudev.host"], "tags": ["cloud"], "cpes": ["cpe:/a:f5:nginx"]}


indicator: 70.34.197.185
indicator_type: ipv4
source: shodan
city: cloud
reverse_dns: www.hilex.se,hilex.se,70.34.197.185.vultrusercontent.com
hosting_provider: cpe:/a:f5:nginx,cpe:/a:ntp:ntp:3
queried_at: 2026-04-02T18:28:32.826999
raw_data:
  {"ports": [80, 123, 443, 22222], "vulns": [], "hostnames": ["www.hilex.se", "hilex.se", "70.34.197.185.vultrusercontent.com"], "tags": ["cloud"], "cpes": ["cpe:/a:f5:nginx", "cpe:/a:ntp:ntp:3"]}


indicator: 70.34.204.141
indicator_type: ipv4
source: shodan
city: cloud
reverse_dns: 70.34.204.141.vultrusercontent.com
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.9p1
queried_at: 2026-04-02T18:28:36.343171
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["70.34.204.141.vultrusercontent.com"], "tags": ["cloud"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1"]}


indicator: 70.34.208.32
indicator_type: ipv4
source: shodan
city: cloud
reverse_dns: 70.34.208.32.vultrusercontent.com
hosting_provider: cpe:/a:f5:nginx
queried_at: 2026-04-02T18:28:38.141359
raw_data:
  {"ports": [80], "vulns": [], "hostnames": ["70.34.208.32.vultrusercontent.com"], "tags": ["cloud"], "cpes": ["cpe:/a:f5:nginx"]}


indicator: 80.78.240.210
indicator_type: ipv4
source: shodan
reverse_dns: 80.78.240.210
hosting_provider: cpe:/a:openbsd:openssh:8.4p1,cpe:/o:debian:debian_linux,cpe:/o:linux:linux_kernel
queried_at: 2026-04-02T18:28:39.849948
raw_data:
  {"ports": [4172], "vulns": [], "hostnames": ["80.78.240.210"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:8.4p1", "cpe:/o:debian:debian_linux", "cpe:/o:linux:linux_kernel"]}


indicator: 80.78.241.253
indicator_type: ipv4
source: shodan
reverse_dns: vbahelpers.ru,80-78-241-253.cloudvps.regruhosting.ru
queried_at: 2026-04-02T18:28:41.647904
raw_data:
  {"ports": [80, 443, 2008, 3001, 3004], "vulns": ["CVE-2023-27522", "CVE-2020-11984", "CVE-2024-38476", "CVE-2020-1927", "CVE-2012-4360", "CVE-2020-13950", "CVE-2024-43394", "CVE-2023-25690", "CVE-2019-17567", "CVE-2024-27316", "CVE-2021-33193", "CVE-2025-23048", "CVE-2020-1934", "CVE-2024-47252", "CVE-2025-55753", "CVE-2020-13938", "CVE-2021-32791", "CVE-2022-22719", "CVE-2021-44224", "CVE-2024-43204", "CVE-2022-37436", "CVE-2011-1176", "CVE-2023-31122", "CVE-2020-9490", "CVE-2023-38709", "CVE-2

hosting_provider:
  cpe:/o:canonical:ubuntu_linux,cpe:/a:expressjs:express,cpe:/a:nodejs:node.js,cpe:/a:apache:http_server:2.4.41,cpe:/a:openbsd:openssh:8.2p1


indicator: 80.78.244.199
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: 80-78-244-199.cloudvps.regruhosting.ru,009.am
hosting_provider: cpe:/a:f5:nginx:1.18.0
queried_at: 2026-04-02T18:28:46.992817
raw_data:
  {"ports": [443], "vulns": ["CVE-2023-44487", "CVE-2021-23017", "CVE-2025-23419", "CVE-2021-3618"], "hostnames": ["80-78-244-199.cloudvps.regruhosting.ru", "009.am"], "tags": ["eol-product"], "cpes": ["cpe:/a:f5:nginx:1.18.0"]}


indicator: 80.78.245.223
indicator_type: ipv4
source: shodan
city: starttls,eol-product,self-signed
reverse_dns: 80-78-245-223.cloudvps.regruhosting.ru
queried_at: 2026-04-02T18:28:48.813131
raw_data:
  {"ports": [21, 22, 53, 80, 110, 123, 143, 465, 587, 993, 995], "vulns": ["CVE-2023-44487", "CVE-2024-39929", "CVE-2023-42116", "CVE-2022-3559", "CVE-2023-51766", "CVE-2025-67896", "CVE-2023-42117", "CVE-2025-23419", "CVE-2023-42115", "CVE-2023-42114", "CVE-2023-42119", "CVE-2021-23017", "CVE-2022-3620", "CVE-2022-37451", "CVE-2021-3618"], "hostnames": ["80-78-245-223.cloudvps.regruhosting.ru"], "tags": ["starttls", "eol-product", "self-signed"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:

hosting_provider:
  cpe:/o:canonical:ubuntu_linux,cpe:/a:exim:exim:4.95,cpe:/a:f5:nginx:1.18.0,cpe:/o:linux:linux_kernel,cpe:/a:openbsd:openssh:8.9p1,cpe:/a:ntp:ntp:3


indicator: 80.78.248.222
indicator_type: ipv4
source: shodan
city: self-signed,eol-product,starttls
reverse_dns: profdom.ru
queried_at: 2026-04-02T18:28:58.119468
raw_data:
  {"ports": [21, 22, 25, 53, 80, 110, 123, 443, 465, 587, 993, 995], "vulns": ["CVE-2025-67896", "CVE-2022-3620", "CVE-2022-3559", "CVE-2021-23017", "CVE-2023-42114", "CVE-2023-42115", "CVE-2024-39929", "CVE-2021-3618", "CVE-2023-42119", "CVE-2023-44487", "CVE-2022-37451", "CVE-2023-51766", "CVE-2023-42116", "CVE-2023-42117", "CVE-2025-23419"], "hostnames": ["profdom.ru"], "tags": ["self-signed", "eol-product", "starttls"], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/a:f5:nginx:1.18.0", "cpe:/o:ca

hosting_provider:
  cpe:/o:linux:linux_kernel,cpe:/a:f5:nginx:1.18.0,cpe:/o:canonical:ubuntu_linux,cpe:/a:exim:exim:4.95,cpe:/a:openbsd:openssh:8.9p1,cpe:/a:ntp:ntp:3


indicator: 80.78.251.231
indicator_type: ipv4
source: shodan
reverse_dns: tamos.ru,80-78-251-231.cloudvps.regruhosting.ru,www.tamos.ru
queried_at: 2026-04-02T18:29:01.661382
raw_data:
  {"ports": [22, 80, 443], "vulns": ["CVE-2025-65082", "CVE-2011-2688", "CVE-2025-59775", "CVE-2025-58098", "CVE-2013-0942", "CVE-2025-55753", "CVE-2013-2765", "CVE-2012-4360", "CVE-2009-2299", "CVE-2007-4723", "CVE-2013-0941", "CVE-2012-4001", "CVE-2009-0796", "CVE-2025-66200", "CVE-2013-4365", "CVE-2011-1176", "CVE-2012-3526"], "hostnames": ["tamos.ru", "80-78-251-231.cloudvps.regruhosting.ru", "www.tamos.ru"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:8.4p1", "cpe:/o:debian:debian_linux", "c

hosting_provider:
  cpe:/a:openbsd:openssh:8.4p1,cpe:/o:debian:debian_linux,cpe:/a:apache:http_server:2.4.65,cpe:/o:linux:linux_kernel


indicator: 80.78.254.238
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: www.esdgroup.ru,80-78-254-238.cloudvps.regruhosting.ru,red55188.rdock.ru,esdgroup.ru
hosting_provider: cpe:/a:f5:nginx,cpe:/a:openbsd:openssh:7.4
queried_at: 2026-04-02T18:29:10.643111
raw_data:
  {"ports": [21, 22, 25, 53, 110, 443, 465, 587, 993, 995, 1500], "vulns": ["CVE-2008-3844", "CVE-2019-6110", "CVE-2019-6111", "CVE-2018-15473", "CVE-2020-15778", "CVE-2025-26465", "CVE-2023-51385", "CVE-2007-2768", "CVE-2023-38408", "CVE-2020-14145", "CVE-2025-32728", "CVE-2017-15906", "CVE-2023-48795", "CVE-2021-36368", "CVE-2018-15919", "CVE-2023-51767", "CVE-2021-41617", "CVE-2019-6109", "CVE-2018-20685", "CVE-2016-20012"], "hostnames": ["www.esdgroup.ru", "80-78-254-238.cloudvps.regruhosting.


indicator: 87.249.49.103
indicator_type: ipv4
source: shodan
city: eol-product,starttls
reverse_dns: info24servisplus.ru,www.info24servisplus.ru
queried_at: 2026-04-02T18:29:23.212139
raw_data:
  {"ports": [22, 80, 143, 443, 587, 993], "vulns": ["CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["info24servisplus.ru", "www.info24servisplus.ru"], "tags": ["eol-product", "starttls"], "cpes": ["cpe:/a:openbsd:openssh:9.2p1", "cpe:/o:debian:debian_linux", "cpe:/a:f5:nginx:1.22.1", "cpe:/o:linux:linux_kernel"]}

hosting_provider:
  cpe:/a:openbsd:openssh:9.2p1,cpe:/o:debian:debian_linux,cpe:/a:f5:nginx:1.22.1,cpe:/o:linux:linux_kernel


indicator: 89.108.115.235
indicator_type: ipv4
source: shodan
city: self-signed,eol-product,starttls
reverse_dns: 89-108-115-235.cloudvps.regruhosting.ru
queried_at: 2026-04-02T18:29:37.487782
raw_data:
  {"ports": [21, 22, 25, 53, 80, 110, 465, 993, 995, 1500], "vulns": ["CVE-2025-67896", "CVE-2020-28024", "CVE-2023-42114", "CVE-2020-28025", "CVE-2024-39929", "CVE-2022-37452", "CVE-2020-28007", "CVE-2020-28013", "CVE-2023-51766", "CVE-2020-28019", "CVE-2020-28021", "CVE-2025-23419", "CVE-2021-38371", "CVE-2020-28008", "CVE-2020-28026", "CVE-2023-42115", "CVE-2020-28011", "CVE-2020-8015", "CVE-2020-28017", "CVE-2022-37451", "CVE-2020-12783", "CVE-2020-28022", "CVE-2023-42117", "CVE-2020-28012", "

hosting_provider:
  cpe:/o:linux:linux_kernel,cpe:/a:f5:nginx:1.18.0,cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.2p1,cpe:/a:exim:exim:4.93


indicator: 89.108.65.157
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: 89-108-65-157.cloudvps.regruhosting.ru
queried_at: 2026-04-02T18:29:42.869210
raw_data:
  {"ports": [80, 2202], "vulns": ["CVE-2021-3618", "CVE-2021-23017", "CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["89-108-65-157.cloudvps.regruhosting.ru"], "tags": ["eol-product"], "cpes": ["cpe:/a:openbsd:openssh:8.2p1", "cpe:/a:f5:nginx:1.18.0", "cpe:/o:canonical:ubuntu_linux", "cpe:/o:linux:linux_kernel"]}

hosting_provider:
  cpe:/a:openbsd:openssh:8.2p1,cpe:/a:f5:nginx:1.18.0,cpe:/o:canonical:ubuntu_linux,cpe:/o:linux:linux_kernel


indicator: 89.108.76.226
indicator_type: ipv4
source: shodan
city: self-signed,eol-product,starttls
reverse_dns: 89-108-76-226.cloudvps.regruhosting.ru
queried_at: 2026-04-02T18:29:51.837159
raw_data:
  {"ports": [22, 25, 80, 143, 443, 465, 587, 993, 7777, 8888], "vulns": ["CVE-2025-67896", "CVE-2019-16928", "CVE-2020-28024", "CVE-2023-42114", "CVE-2020-28025", "CVE-2024-39929", "CVE-2022-37452", "CVE-2020-28007", "CVE-2020-28013", "CVE-2019-13917", "CVE-2023-51766", "CVE-2020-28019", "CVE-2020-28021", "CVE-2025-23419", "CVE-2021-38371", "CVE-2020-28008", "CVE-2020-28026", "CVE-2023-42115", "CVE-2020-28011", "CVE-2020-8015", "CVE-2020-28017", "CVE-2022-37451", "CVE-2020-12783", "CVE-2020-28022"

hosting_provider:
  cpe:/o:linux:linux_kernel,cpe:/a:f5:nginx:1.20.2,cpe:/o:debian:debian_linux,cpe:/a:f5:nginx,cpe:/a:exim:exim:4.92,cpe:/a:openbsd:openssh:7.9p1


indicator: 89.108.76.246
indicator_type: ipv4
source: shodan
reverse_dns: 89-108-76-246.cloudvps.regruhosting.ru
hosting_provider: cpe:/a:f5:nginx
queried_at: 2026-04-02T18:29:53.612689
raw_data:
  {"ports": [80, 8888], "vulns": [], "hostnames": ["89-108-76-246.cloudvps.regruhosting.ru"], "tags": [], "cpes": ["cpe:/a:f5:nginx"]}


indicator: 89.108.79.13
indicator_type: ipv4
source: shodan
reverse_dns: 89-108-79-13.cloudvps.regruhosting.ru
hosting_provider: cpe:/a:openbsd:openssh:7.4
queried_at: 2026-04-02T18:30:12.204704
raw_data:
  {"ports": [22], "vulns": ["CVE-2019-6109", "CVE-2019-6110", "CVE-2023-51385", "CVE-2018-20685", "CVE-2025-32728", "CVE-2023-38408", "CVE-2008-3844", "CVE-2019-6111", "CVE-2021-36368", "CVE-2007-2768", "CVE-2023-48795", "CVE-2018-15919", "CVE-2020-15778", "CVE-2021-41617", "CVE-2017-15906", "CVE-2025-26465", "CVE-2023-51767", "CVE-2018-15473", "CVE-2016-20012", "CVE-2020-14145"], "hostnames": ["89-108-79-13.cloudvps.regruhosting.ru"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:7.4"]}


indicator: 89.108.81.30
indicator_type: ipv4
source: shodan
reverse_dns: 89-108-81-30.cloudvps.regruhosting.ru
queried_at: 2026-04-02T18:30:21.682826
raw_data:
  {"ports": [1883], "vulns": [], "hostnames": ["89-108-81-30.cloudvps.regruhosting.ru"], "tags": [], "cpes": []}


indicator: 89.108.81.77
indicator_type: ipv4
source: shodan
reverse_dns: 89-108-81-77.cloudvps.regruhosting.ru
hosting_provider: cpe:/a:f5:nginx
queried_at: 2026-04-02T18:30:23.566232
raw_data:
  {"ports": [80], "vulns": [], "hostnames": ["89-108-81-77.cloudvps.regruhosting.ru"], "tags": [], "cpes": ["cpe:/a:f5:nginx"]}


indicator: 89.108.81.8
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: ensaving.ru
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.2p1
queried_at: 2026-04-02T18:30:25.484788
raw_data:
  {"ports": [22, 53, 995], "vulns": [], "hostnames": ["ensaving.ru"], "tags": ["self-signed"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.2p1"]}


indicator: 89.108.88.6
indicator_type: ipv4
source: shodan
reverse_dns: 89-108-88-6.cloudvps.regruhosting.ru
hosting_provider: cpe:/a:openbsd:openssh:8.4p1,cpe:/o:debian:debian_linux,cpe:/o:linux:linux_kernel
queried_at: 2026-04-02T18:30:34.739845
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["89-108-88-6.cloudvps.regruhosting.ru"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:8.4p1", "cpe:/o:debian:debian_linux", "cpe:/o:linux:linux_kernel"]}


indicator: 89.185.84.204
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: 28450.ip-ptr.tech,london5.chebak.pro
queried_at: 2026-04-02T18:30:47.757986
raw_data:
  {"ports": [22, 80, 443], "vulns": ["CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["28450.ip-ptr.tech", "london5.chebak.pro"], "tags": ["eol-product"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx:1.24.0", "cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:linux:linux_kernel"]}

hosting_provider:
  cpe:/o:canonical:ubuntu_linux,cpe:/a:f5:nginx:1.24.0,cpe:/a:openbsd:openssh:9.6p1,cpe:/o:linux:linux_kernel


indicator: 89.19.209.154
indicator_type: ipv4
source: shodan
reverse_dns: 2038305-cv46851.twc1.net
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.9p1
queried_at: 2026-04-02T18:30:49.702670
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["2038305-cv46851.twc1.net"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1"]}


indicator: 89.23.107.188
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/a:openbsd:openssh:9.2p1,cpe:/o:debian:debian_linux,cpe:/o:linux:linux_kernel
queried_at: 2026-04-02T18:30:53.472319
raw_data:
  {"ports": [22, 443], "vulns": [], "hostnames": ["edgeflow.aero.abe2c2f23-frontier.amazon.de", "amazon.com.au", "origin-www.amazon.co.uk", "amazon.com", "huddles.amazon.com", "uedata.amazon.co.uk", "amzn.com", "uedata.amazon.com", "edgeflow-dp.aero.47cf2c8c9-frontier.amazon.com", "edgeflow.aero.47cf2c8c9-frontier.amazon.com", "buckeye-retail-website.amazon.com", "www.amzn.com", "www.amazon.jp", "edgeflow-dp.aero.04f01a85e-frontier.amazon.com.au", "www.amazon.com.au", "shop.business.amazon.com", "

reverse_dns:
  edgeflow.aero.abe2c2f23-frontier.amazon.de,amazon.com.au,origin-www.amazon.co.uk,amazon.com,huddles.amazon.com,uedata.amazon.co.uk,amzn.com,uedata.amazon.com,edgeflow-dp.aero.47cf2c8c9-frontier.amazon.com,edgeflow.aero.47cf2c8c9-frontier.amazon.com,buckeye-retail-website.amazon.com,www.amzn.com,www.amazon.jp,edgeflow-dp.aero.04f01a85e-frontier.amazon.com.au,www.amazon.com.au,shop.business.amazon.com,edgeflow.aero.04f01a85e-frontier.amazon.com.au,www.amazon.de,amazon.co.jp,34834.ip-ptr.tech,origi


indicator: 92.242.62.112
indicator_type: ipv4
source: shodan
city: eol-product
queried_at: 2026-04-02T18:30:59.056976
raw_data:
  {"ports": [22, 80], "vulns": ["CVE-2023-44487", "CVE-2025-23419"], "hostnames": [], "tags": ["eol-product"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx:1.24.0", "cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:linux:linux_kernel"]}

hosting_provider:
  cpe:/o:canonical:ubuntu_linux,cpe:/a:f5:nginx:1.24.0,cpe:/a:openbsd:openssh:9.6p1,cpe:/o:linux:linux_kernel


indicator: 92.255.76.169
indicator_type: ipv4
source: shodan
city: eol-product,self-signed
reverse_dns: devpanel.beautyone.me,dev.beautyone.me
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:f5:nginx:1.24.0,cpe:/o:linux:linux_kernel
queried_at: 2026-04-02T18:31:12.310564
raw_data:
  {"ports": [443, 8090, 8443, 8880], "vulns": ["CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["devpanel.beautyone.me", "dev.beautyone.me"], "tags": ["eol-product", "self-signed"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx:1.24.0", "cpe:/o:linux:linux_kernel"]}


indicator: 95.179.221.114
indicator_type: ipv4
source: shodan
city: eol-product,cloud
reverse_dns: argus-radio.ovh,95.179.221.114.vultrusercontent.com,www.argus-radio.ovh
queried_at: 2026-04-02T18:31:21.580485
raw_data:
  {"ports": [22, 80, 443, 3000, 4000, 5005, 8080, 9000, 9100], "vulns": ["CVE-2023-44487", "CVE-2021-23017", "CVE-2025-23419", "CVE-2021-3618"], "hostnames": ["argus-radio.ovh", "95.179.221.114.vultrusercontent.com", "www.argus-radio.ovh"], "tags": ["eol-product", "cloud"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.4p1", "cpe:/a:f5:nginx:1.18.0", "cpe:/o:linux:linux_kernel"]}

hosting_provider:
  cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.4p1,cpe:/a:f5:nginx:1.18.0,cpe:/o:linux:linux_kernel


indicator: 95.179.221.147
indicator_type: ipv4
source: shodan
city: eol-product,cloud
reverse_dns: 95.179.221.147.vultrusercontent.com
queried_at: 2026-04-02T18:31:23.465207
raw_data:
  {"ports": [22, 80, 443], "vulns": ["CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["95.179.221.147.vultrusercontent.com"], "tags": ["eol-product", "cloud"], "cpes": ["cpe:/o:debian:debian_linux", "cpe:/a:f5:nginx:1.22.1", "cpe:/a:expressjs:express", "cpe:/o:linux:linux_kernel", "cpe:/a:openbsd:openssh:9.2p1", "cpe:/a:nodejs:node.js"]}

hosting_provider:
  cpe:/o:debian:debian_linux,cpe:/a:f5:nginx:1.22.1,cpe:/a:expressjs:express,cpe:/o:linux:linux_kernel,cpe:/a:openbsd:openssh:9.2p1,cpe:/a:nodejs:node.js


indicator: 106.51.89.49
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: 106.51.89.49.actcorp.in
queried_at: 2026-04-02T18:31:30.627361
raw_data:
  {"ports": [80, 443, 445, 4443], "vulns": ["CVE-2020-0796"], "hostnames": ["106.51.89.49.actcorp.in"], "tags": ["self-signed"], "cpes": ["cpe:/a:getbootstrap:bootstrap", "cpe:/o:paloaltonetworks:pan-os", "cpe:/a:lodash:lodash", "cpe:/a:jquery:jquery"]}

hosting_provider:
  cpe:/a:getbootstrap:bootstrap,cpe:/o:paloaltonetworks:pan-os,cpe:/a:lodash:lodash,cpe:/a:jquery:jquery


indicator: 130.61.233.105
indicator_type: ipv4
source: shodan
city: cdn,cloud,self-signed
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:9.6p1
queried_at: 2026-04-02T18:31:34.675176
raw_data:
  {"ports": [22, 443, 6001, 6002], "vulns": [], "hostnames": [], "tags": ["cdn", "cloud", "self-signed"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:9.6p1"]}


indicator: 184.95.51.172
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: liruiheng.com,pumadventuresperu.com,www.liruiheng.com,mta-sts.liruiheng.com
hosting_provider: cpe:/a:getbootstrap:bootstrap,cpe:/a:php:php:7.4.33,cpe:/a:f5:nginx,cpe:/a:jquery:jquery
queried_at: 2026-04-02T18:31:42.379589
raw_data:
  {"ports": [443], "vulns": ["CVE-2024-3566", "CVE-2024-25117", "CVE-2024-5458", "CVE-2013-2220", "CVE-2007-3205", "CVE-2022-4900"], "hostnames": ["liruiheng.com", "pumadventuresperu.com", "www.liruiheng.com", "mta-sts.liruiheng.com"], "tags": ["eol-product"], "cpes": ["cpe:/a:getbootstrap:bootstrap", "cpe:/a:php:php:7.4.33", "cpe:/a:f5:nginx", "cpe:/a:jquery:jquery"]}


indicator: 185.236.25.119
indicator_type: ipv4
source: shodan
city: self-signed,eol-product
hosting_provider: cpe:/a:vercel:next.js,cpe:/a:f5:nginx:1.27.4,cpe:/a:facebook:react
queried_at: 2026-04-02T18:31:46.016381
raw_data:
  {"ports": [80, 135, 3000, 3001, 3389, 5985], "vulns": [], "hostnames": [], "tags": ["self-signed", "eol-product"], "cpes": ["cpe:/a:vercel:next.js", "cpe:/a:f5:nginx:1.27.4", "cpe:/a:facebook:react"]}


indicator: 185.76.79.125
indicator_type: ipv4
source: shodan
reverse_dns: girlsbags.shop,125.79.76.185.in-addr.arpa,ntcx.pro,retseptik.info,justweb.click,lecturegenieltd.pro
queried_at: 2026-04-02T18:31:52.772032
raw_data:
  {"ports": [443], "vulns": [], "hostnames": ["girlsbags.shop", "125.79.76.185.in-addr.arpa", "ntcx.pro", "retseptik.info", "justweb.click", "lecturegenieltd.pro"], "tags": [], "cpes": []}


indicator: 2.58.15.158
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: summerfieldstudy.com
queried_at: 2026-04-02T18:31:56.268455
raw_data:
  {"ports": [22, 443], "vulns": ["CVE-2021-3618", "CVE-2021-23017", "CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["summerfieldstudy.com"], "tags": ["eol-product"], "cpes": ["cpe:/a:f5:nginx:1.18.0", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/o:linux:linux_kernel"]}

hosting_provider:
  cpe:/a:f5:nginx:1.18.0,cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.9p1,cpe:/o:linux:linux_kernel


indicator: 203.161.50.145
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: docs.goog1e.com.spreadsheets.d.1ipevana4hglaeksstshboujdk.zhblz.com,mail.zhblz.com,zhblz.com
hosting_provider: cpe:/a:f5:nginx:1.18.0,cpe:/o:canonical:ubuntu_linux,cpe:/o:linux:linux_kernel
queried_at: 2026-04-02T18:31:58.116908
raw_data:
  {"ports": [111, 443, 5000], "vulns": ["CVE-2021-3618", "CVE-2021-23017", "CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["docs.goog1e.com.spreadsheets.d.1ipevana4hglaeksstshboujdk.zhblz.com", "mail.zhblz.com", "zhblz.com"], "tags": ["eol-product"], "cpes": ["cpe:/a:f5:nginx:1.18.0", "cpe:/o:canonical:ubuntu_linux", "cpe:/o:linux:linux_kernel"]}


indicator: 209.74.87.100
indicator_type: ipv4
source: shodan
reverse_dns: whup-spurlet.vpsrdns.web-hosting.com
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:9.6p1
queried_at: 2026-04-02T18:31:59.886234
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["whup-spurlet.vpsrdns.web-hosting.com"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:9.6p1"]}


indicator: 217.146.67.241
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: uvn-67-241.tll01.zonevs.eu,backend.keevitusboss.ee
queried_at: 2026-04-02T18:32:03.459412
raw_data:
  {"ports": [22, 80, 443, 4242], "vulns": ["CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["uvn-67-241.tll01.zonevs.eu", "backend.keevitusboss.ee"], "tags": ["eol-product"], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/a:f5:nginx:1.24.0", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:9.6p1"]}

hosting_provider:
  cpe:/o:linux:linux_kernel,cpe:/a:f5:nginx:1.24.0,cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:9.6p1


indicator: 3.20.6.1
indicator_type: ipv4
source: shodan
city: cloud
reverse_dns: api.deepvue.com,ec2-3-20-6-1.us-east-2.compute.amazonaws.com
hosting_provider: cpe:/a:amazon:elastic_load_balancing,cpe:/a:nodejs:node.js,cpe:/a:expressjs:express
queried_at: 2026-04-02T18:32:05.337297
raw_data:
  {"ports": [80, 443], "vulns": [], "hostnames": ["api.deepvue.com", "ec2-3-20-6-1.us-east-2.compute.amazonaws.com"], "tags": ["cloud"], "cpes": ["cpe:/a:amazon:elastic_load_balancing", "cpe:/a:nodejs:node.js", "cpe:/a:expressjs:express"]}


indicator: 38.180.206.61
indicator_type: ipv4
source: shodan
city: eol-product,vpn
hosting_provider: cpe:/a:f5:nginx:1.20.1
queried_at: 2026-04-02T18:32:08.951890
raw_data:
  {"ports": [500, 1701, 50000], "vulns": ["CVE-2023-44487", "CVE-2025-23419", "CVE-2021-3618"], "hostnames": [], "tags": ["eol-product", "vpn"], "cpes": ["cpe:/a:f5:nginx:1.20.1"]}


indicator: 38.180.239.161
indicator_type: ipv4
source: shodan
queried_at: 2026-04-02T18:32:12.492306
raw_data:
  {"ports": [443], "vulns": [], "hostnames": ["musiclivetrack.website", "web14.info", "stone110.store", "footballfans.asia", "cside.site", "menclub.lt", "anythingshere.shop"], "tags": [], "cpes": []}

reverse_dns:
  musiclivetrack.website,web14.info,stone110.store,footballfans.asia,cside.site,menclub.lt,anythingshere.shop


indicator: 92.243.65.243
indicator_type: ipv4
source: shodan
queried_at: 2026-04-02T18:32:23.402267
raw_data:
  {"ports": [443], "vulns": [], "hostnames": ["formacja.info", "243.65.243.92.in-addr.arpa", "cywofio2.pro", "footballclub.sbs", "mancpr.icu", "phoneaccessory.site", "luckywavez.shop", "findbesthotels.info", "fashionmodels.site", "garbagecollector.site"], "tags": [], "cpes": []}

reverse_dns:
  formacja.info,243.65.243.92.in-addr.arpa,cywofio2.pro,footballclub.sbs,mancpr.icu,phoneaccessory.site,luckywavez.shop,findbesthotels.info,fashionmodels.site,garbagecollector.site


indicator: 94.131.121.56
indicator_type: ipv4
source: shodan
city: self-signed,proxy,starttls
reverse_dns: vm15467373.example.com
queried_at: 2026-04-02T18:32:25.301647
raw_data:
  {"ports": [21, 53, 123, 465, 587, 993, 995, 1234, 24442], "vulns": ["CVE-2025-67896", "CVE-2022-3559", "CVE-2023-42114", "CVE-2023-42115", "CVE-2024-39929", "CVE-2025-30232", "CVE-2023-42119", "CVE-2023-51766", "CVE-2023-42116", "CVE-2023-42117", "CVE-2022-3620"], "hostnames": ["vm15467373.example.com"], "tags": ["self-signed", "proxy", "starttls"], "cpes": ["cpe:/a:openbsd:openssh:9.2p1", "cpe:/o:linux:linux_kernel", "cpe:/o:debian:debian_linux", "cpe:/a:exim:exim:4.96", "cpe:/a:ntp:ntp:3"]}

hosting_provider:
  cpe:/a:openbsd:openssh:9.2p1,cpe:/o:linux:linux_kernel,cpe:/o:debian:debian_linux,cpe:/a:exim:exim:4.96,cpe:/a:ntp:ntp:3


indicator: 185.163.45.5
indicator_type: ipv4
source: otx
country: MD
city: Chisinau
hosting_provider: backdoors,vbscript,malicious,gamaredon,options,word template,stealers,apt,sample hashes,pterosteal
queried_at: 2026-04-02T18:32:31.594044
raw_data:
  {"pulse_count": 4, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS39798 mivocloud srl", "indicator": "185.163.45.5", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "urlhaus 

reverse_dns:
  logtochase.online,logchase.online,bantamchickens.xyz,bakingsupplies.xyz,barnplans.xyz,6385data925.xyz,sverset.pl,koperst.pl


indicator: 185.163.47.177
indicator_type: ipv4
source: otx
country: MD
city: Chisinau
reverse_dns: thermicplastic.uk,www.thermicplastic.uk,process-client-issuance.online
queried_at: 2026-04-02T18:32:41.149195
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS39798 mivocloud srl", "indicator": "185.163.47.177", "tags": ["welivesecurity", "sample hashes", "backdoors", "apt", "malicious", "pterolnk", "pteropshell", "word template", "stealers", "office macro", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP

hosting_provider:
  welivesecurity,sample hashes,backdoors,apt,malicious,pterolnk,pteropshell,word template,stealers,office macro


indicator: 157.20.182.49
indicator_type: ipv4
source: otx
reverse_dns: maistgroup.com,backondswitch.com
queried_at: 2026-04-02T18:32:46.243065
raw_data:
  {"pulse_count": 10, "reputation": 0, "country": "", "country_code": "", "city": "", "asn": "ASNone ", "indicator": "157.20.182.49", "tags": ["remember", "february", "foudre", "reconnaissance", "proactive defense", "filehashsha256", "apt", "iranian apt", "epmm", "arenac2", "cve-2025-54068", "cve-2025-34291", "geopolitical tensions", "cve-2026-1281", "tonnerre", "http response", "iranian", "antsword", "filehashmd5", "time", "generatedbotid", "fmapp.dll", "command and control", "cve-2025-55182", "e

hosting_provider:
  remember,february,foudre,reconnaissance,proactive defense,filehashsha256,apt,iranian apt,epmm,arenac2


indicator: 2.2.2.6
indicator_type: ipv4
source: otx
country: FR
reverse_dns: nathanyao.shop,magas.bslrpg.com
queried_at: 2026-04-02T18:32:48.463650
raw_data:
  {"pulse_count": 4, "reputation": 0, "country": "France", "country_code": "FR", "city": null, "asn": "AS3215 orange s.a.", "indicator": "2.2.2.6", "tags": ["as852", "#supportsitewebsiteabuse #rootcertificatefailure #cryptographicf", "win64", "public url", "as8075", "telecom", "facebook", "proton", "seznam", "mexico", "google", "level3", "as15169", "indonesia", "vta", "lateral-movement", "ukraine", "credential-access", "twitter", "as3359", "privilege-escalation", "mini", "as20940", "geoip", "as165

hosting_provider:
  as852,#supportsitewebsiteabuse #rootcertificatefailure #cryptographicf,win64,public url,as8075,telecom,facebook,proton,seznam,mexico


indicator: 2.2.3.6
indicator_type: ipv4
source: otx
country: FR
reverse_dns: www.dns-exercise.dev
hosting_provider: win32,seznam,ukraine,credential-access,as20940,as16509,threat-intelligence,media,level3,twitter
queried_at: 2026-04-02T18:32:50.712361
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "France", "country_code": "FR", "city": null, "asn": "AS3215 orange s.a.", "indicator": "2.2.3.6", "tags": ["win32", "seznam", "ukraine", "credential-access", "as20940", "as16509", "threat-intelligence", "media", "level3", "twitter", "akamaiasn1", "telecom", "win64", "facebook", "lateral-movement", "high", "mini", "indonesia", "geoip", "#supportsitewebsiteabuse #rootcertificatefailure #cryptographicf", "as8075", "cuba", "mexico", "T1557.001", "publi


indicator: 65.20.97.203
indicator_type: ipv4
source: otx
country: US
reverse_dns: mongo.licitador.es
hosting_provider: powersploit,ck techniques,fileobj,https,svr cyber,encrypt,persistence,powershell,hashes,cert polska
queried_at: 2026-04-02T18:32:53.910282
raw_data:
  {"pulse_count": 6, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "65.20.97.203", "tags": ["powersploit", "ck techniques", "fileobj", "https", "svr cyber", "encrypt", "persistence", "powershell", "hashes", "cert polska", "april", "service", "stix", "sorefang", "title", "simplehashvalue", "wellmail", "behavior", "mimikatz", "mitre att", "graphicalproton", "technique title", "attackpatterns", "dip


indicator: 141.105.130.237
indicator_type: ipv4
source: otx
country: UA
city: Vinnytsia
reverse_dns: sqwas.shapelie.com,sertyki.com,line24.sbs
queried_at: 2026-04-02T18:32:56.129061
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Ukraine", "country_code": "UA", "city": "Vinnytsia", "asn": "AS49223 everest broadcasting company ltd", "indicator": "141.105.130.237", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["sqwas.shapelie.com", "sertyki.com", "line24.sbs"]}


indicator: 1.0.1.1
indicator_type: ipv4
source: otx
country: CN
hosting_provider: securitytrails,pulses otx,bazaar,erlangen,Palantir,cf f4,follow,suspicious,gmtn,url age
queried_at: 2026-04-02T18:32:58.850595
raw_data:
  {"pulse_count": 50, "reputation": 0, "country": "China", "country_code": "CN", "city": null, "asn": "ASNone ", "indicator": "1.0.1.1", "tags": ["securitytrails", "pulses otx", "bazaar", "erlangen", "Palantir", "cf f4", "follow", "suspicious", "gmtn", "url age", "de note", "http", "search", "filehashsha1", "sha3384", "iana id", "wow64", "secure server", "calls", "zur foerderung", "form", "as680", "zip forward", "route", "cloudflare", "local", "february", "ck id", "tls web", "zip code", "contacted

reverse_dns:
  kituo.dpdns.org,ha.dataedgelabs.online,home.dataedgelabs.online,jodoky.com,vpn.dev.rjpalombo.com,vpn.london.murrayweb.ca,www.kevinolson.com,deathegg.win,vpn.int.sysad.dev,apmac.us


indicator: 104.238.189.186
indicator_type: ipv4
source: otx
country: FR
city: Aubervilliers
hosting_provider: qakbot,WhisperGate,slapstick,remcom,powgoop,armageddon,lazagne,crackmapexec,shuckworm,vbscript b
queried_at: 2026-04-02T18:33:05.643913
raw_data:
  {"pulse_count": 25, "reputation": 0, "country": "France", "country_code": "FR", "city": "Aubervilliers", "asn": "AS20473 the constant company  llc", "indicator": "104.238.189.186", "tags": ["qakbot", "WhisperGate", "slapstick", "remcom", "powgoop", "armageddon", "lazagne", "crackmapexec", "shuckworm", "vbscript b", "tsunami", "ghostwriter", "malware", "sha256", "symantec", "wildfire", "Gamardeon", "defender", "alertinfo", "domain", "deviceid", "Cyclops", "ip address", "palo alto", "ddos", "steal


indicator: 104.248.36.191
indicator_type: ipv4
source: otx
country: DE
city: Frankfurt am Main
queried_at: 2026-04-02T18:33:07.745420
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS14061 digitalocean  llc", "indicator": "104.248.36.191", "tags": ["cybersecurity", "november", "ck information", "url https", "powershell", "gamaredon", "threatactor/tridentursa", "telegram scheme", "gamaredon group", "summary", "telegram", "primary article", "Gamaredon", "sample", "mitre att", "threatactor/gamaredon", "crimea", "Gamaredon Group", "Trident Ursa", "domain", "thre

reverse_dns:
  delicious71.kolopartor.ru,jonas71.bushiko.ru,jacket71.sikoshi.ru,aaa.stratist.ru,visible.agaricuso.ru,each.metallicas.ru,71department.silvicolas.ru,deceptive.alabarda.ru,deceptive1.alabarda.ru

hosting_provider:
  cybersecurity,november,ck information,url https,powershell,gamaredon,threatactor/tridentursa,telegram scheme,gamaredon group,summary


indicator: 109.200.159.45
indicator_type: ipv4
source: otx
country: UA
city: Simferopol
reverse_dns: ip45-159-200-109.crelcom.ru
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:33:17.940877
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Ukraine", "country_code": "UA", "city": "Simferopol", "asn": "AS6789 crelcom llc", "indicator": "109.200.159.45", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerst


indicator: 109.234.38.232
indicator_type: ipv4
source: otx
country: NL
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:33:23.307485
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": null, "asn": "AS207651 total security group  inc.", "indicator": "109.234.38.232", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc11

reverse_dns:
  elektroraduga.direct.quickconnect.to,www.riga-escort.com,riga-escort.com,www.pensacolamassagecenter.com,pensacolamassagecenter.com,7noch.ru,www.7noch.ru,backtohealthmassage.org,www.backtohealthmassage.org,nehaindependentescort.com


indicator: 134.0.112.117
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:33:28.943830
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "134.0.112.117", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon 

reverse_dns:
  api.goodtap.pw,goodtap.pw,www.goodtap.pw,zoom-project.pw,www.zoom-project.pw,www.equlent.pw,equlent.pw,xn----7sbabc6bog4clj8c.xn--p1ai,www.xn----7sbabc6bog4clj8c.xn--p1ai,www.aidev.fun


indicator: 134.122.109.104
indicator_type: ipv4
source: otx
country: GB
city: London
hosting_provider: malicious,Nextray,ioc,phishing,cyber security
queried_at: 2026-04-02T18:33:31.558378
raw_data:
  {"pulse_count": 29, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS14061 digitalocean  llc", "indicator": "134.122.109.104", "tags": ["malicious", "Nextray", "ioc", "phishing", "cyber security"], "pulses": ["IOC Records Provided by @NextRayAI", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOC Records \u2192Provided by @NextRayAI", "HIVE           (Pulse created by RVS_i_

reverse_dns:
  v83glmjhjsw.c.updraftclone.com,scambaiting2020.3cx.co.uk,www.wellsfargoverify.qhigh.com,wellsfargoverify.qhigh.com,wellsfargoverify.mymom.info,www.wellsfargoverify.mymom.info,www.wellsfargoverifyssssssss.fartit.com,wellsfargoverifyssssssss.fartit.com,www.134-122-109-104.cprapid.com,mail.auguryanalytics.club


indicator: 137.184.116.179
indicator_type: ipv4
source: otx
country: US
reverse_dns: test.ojrek.com,rimsamerica.com
hosting_provider: fatt,Bruteforce,apt,mailoney,powershell,Honeypot,dionaea,LAMP,telnet,2026-02
queried_at: 2026-04-02T18:33:38.278848
raw_data:
  {"pulse_count": 10, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS14061 digitalocean  llc", "indicator": "137.184.116.179", "tags": ["fatt", "Bruteforce", "apt", "mailoney", "powershell", "Honeypot", "dionaea", "LAMP", "telnet", "2026-02", "cloudflare tunnels", "malicious", "suricata", "sftp", "p0f", "Brute-Force", "honeypot", "cowrie", "tpot", "spearphishing", "sensor-tagged", "honeytrap", "tanner", "Automated", "sentrypeer", "OpenCTI", "s


indicator: 138.68.161.53
indicator_type: ipv4
source: otx
country: GB
city: London
hosting_provider: apt,scanners,vultr,honeypot,cloudflare tunnels,portscan,powershell,spearphishing
queried_at: 2026-04-02T18:33:38.571926
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS14061 digitalocean  llc", "indicator": "138.68.161.53", "tags": ["apt", "scanners", "vultr", "honeypot", "cloudflare tunnels", "portscan", "powershell", "spearphishing"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-03-11", 

reverse_dns:
  e2e-dbaas-mongodb-lqx53-e5ca1bd7.mongo.ondigitalocean.com,138-68-161-53.ipv4.nknlabs.io,dev-tests.psychiatry-uk.com


indicator: 139.59.85.26
indicator_type: ipv4
source: otx
country: IN
city: Bengaluru
hosting_provider: ,attack,malicious,webscanner, bruteforce, web app attack,SSH,webscan,login,honeypot,Nextray,ssh
queried_at: 2026-04-02T18:33:50.824619
raw_data:
  {"pulse_count": 50, "reputation": 0, "country": "India", "country_code": "IN", "city": "Bengaluru", "asn": "AS14061 digitalocean  llc", "indicator": "139.59.85.26", "tags": ["", "attack", "malicious", "webscanner, bruteforce, web app attack", "SSH", "webscan", "login", "honeypot", "Nextray", "ssh", "ioc", "Telnet", "phishing", "cyber security", "scanner", "cowrie", "probing", "scanning"], "pulses": ["Webscanners 2018-02-09  thru current day", "PurpleSynapz", "Ka's Honeypot visitors", "Ghosty", "

reverse_dns:
  aviupbombon.com,c6pto6csbotwyyqp362.cleavrdev.space,yo7k31vuq6vywz6v362.cleavrdev.space,krrish.cleavrdev.space,dipak.cleavrdev.space,www.travellershome.in,flowkana.bloomstack.io,demo.bloomstack.io,manufacturing.bloomstack.io,signals.in


indicator: 140.82.29.65
indicator_type: ipv4
source: otx
country: US
city: Miami
hosting_provider: domain,meduza,exmatter,lockbit,leverage,telegram,february,blackcat,psexec,threatactor/tridentursa
queried_at: 2026-04-02T18:33:54.944441
raw_data:
  {"pulse_count": 11, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Miami", "asn": "AS20473 the constant company  llc", "indicator": "140.82.29.65", "tags": ["domain", "meduza", "exmatter", "lockbit", "leverage", "telegram", "february", "blackcat", "psexec", "threatactor/tridentursa", "august", "mega", "desktop", "lazagne", "mandiant", "pingcastle", "crimea", "trojan", "mitre att", "adrecon", "Gamaredon Group", "powershell", "gamaredon", "url https", "novem

reverse_dns:
  festiva.tech,ntx.tshsuport.ml,destroy.asierdo.ru,fishitor.ru,bahirdo.ru,vagif.shop,salary48.minhizo.ru,bike.intercourse20.cavalierso.ru,intercourse20.cavalierso.ru,penknife59.quyenzo.ru


indicator: 141.164.45.200
indicator_type: ipv4
source: otx
country: KR
city: Seoul
queried_at: 2026-04-02T18:33:57.240767
raw_data:
  {"pulse_count": 4, "reputation": 0, "country": "Korea, Republic of", "country_code": "KR", "city": "Seoul", "asn": "AS20473 the constant company  llc", "indicator": "141.164.45.200", "tags": ["url https", "Gamaredon", "Gamaredon Group", "sample", "threatactor.primitivebear", "Trident Ursa", "domain", "threatactor/actinium", "threatactor/gamaredon", "threatactor/tridentursa", "ip address"], "pulses": ["Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invas

reverse_dns:
  despite.lotorgas.ru,jonas71.bushiko.ru,growind.ru,shivati.ru,stratist.ru,sikoshi.ru,jacket71.sikoshi.ru,postrif.ru,aaa.stratist.ru,matsuro.ru

hosting_provider:
  url https,Gamaredon,Gamaredon Group,sample,threatactor.primitivebear,Trident Ursa,domain,threatactor/actinium,threatactor/gamaredon,threatactor/tridentursa


indicator: 141.98.233.17
indicator_type: ipv4
source: otx
country: RU
reverse_dns: gesul-ba.pro,www.gesul-ba.pro
queried_at: 2026-04-02T18:34:06.468922
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS26636 quickpacket  llc", "indicator": "141.98.233.17", "tags": ["welivesecurity", "sample hashes", "backdoors", "apt", "malicious", "pterolnk", "pteropshell", "word template", "stealers", "office macro", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List"

hosting_provider:
  welivesecurity,sample hashes,backdoors,apt,malicious,pterolnk,pteropshell,word template,stealers,office macro


indicator: 143.110.168.51
indicator_type: ipv4
source: otx
country: GB
city: London
hosting_provider: apt,powershell,spearphishing,cloudflare tunnels
queried_at: 2026-04-02T18:34:09.730978
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS14061 digitalocean  llc", "indicator": "143.110.168.51", "tags": ["apt", "powershell", "spearphishing", "cloudflare tunnels"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 18,

reverse_dns:
  gitops.ryanwelch.co.uk,staging.ryanwelch.co.uk,www.ryanwelch.co.uk,www.ryanwelch.me,local.ryanwelch.co.uk,ryantwr-transaction-sync-frontend-staging.ci.ryanwelch.co.uk,le-22489223.ci.ryanwelch.co.uk,ryanwelch.co.uk,ryanwelch.me,lyre-group-bitflo-frontend.ci.ryanwelch.co.uk


indicator: 143.198.160.45
indicator_type: ipv4
source: otx
country: US
city: North Bergen
reverse_dns: libenet.online,143-198-160-45.ipv4.nknlabs.io
queried_at: 2026-04-02T18:34:12.407209
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "North Bergen", "asn": "AS14061 digitalocean  llc", "indicator": "143.198.160.45", "tags": ["welivesecurity", "sample hashes", "backdoors", "apt", "malicious", "pterolnk", "pteropshell", "word template", "stealers", "office macro", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 20

hosting_provider:
  welivesecurity,sample hashes,backdoors,apt,malicious,pterolnk,pteropshell,word template,stealers,office macro


indicator: 143.198.216.105
indicator_type: ipv4
source: otx
country: SG
city: Singapore
reverse_dns: enroll-be.kantipurinfotech.com,www.enroll-be.kantipurinfotech.com,match.vldtt.com
hosting_provider: apt,powershell,spearphishing,cloudflare tunnels
queried_at: 2026-04-02T18:34:16.510014
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Singapore", "country_code": "SG", "city": "Singapore", "asn": "AS14061 digitalocean  llc", "indicator": "143.198.216.105", "tags": ["apt", "powershell", "spearphishing", "cloudflare tunnels"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": [


indicator: 143.244.134.188
indicator_type: ipv4
source: otx
country: IN
city: Bengaluru
reverse_dns: hrm.mistert.lk,mistert.lk,aswathywrites.com,mcapi.mehar.io
queried_at: 2026-04-02T18:34:29.398869
raw_data:
  {"pulse_count": 43, "reputation": 0, "country": "India", "country_code": "IN", "city": "Bengaluru", "asn": "AS14061 digitalocean  llc", "indicator": "143.244.134.188", "tags": ["badrequest", "bruteforce", "attack", "webscanner", "webscanner, bruteforce, web app attack", "SSH", "webscan", "login", "honeypot", "ssh", "Telnet", "scanner", "cowrie", "probing", "scanning"], "pulses": ["Webscanners 2018-02-09  thru current day", "PurpleSynapz", "Webscanners with Bad Requests - HTTP Status 400 - 1/20/2

hosting_provider:
  badrequest,bruteforce,attack,webscanner,webscanner, bruteforce, web app attack,SSH,webscan,login,honeypot,ssh


indicator: 144.126.218.218
indicator_type: ipv4
source: otx
country: US
city: Santa Clara
reverse_dns: lesson.classest.com,trezrstart.com
queried_at: 2026-04-02T18:34:31.962579
raw_data:
  {"pulse_count": 34, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Santa Clara", "asn": "AS14061 digitalocean  llc", "indicator": "144.126.218.218", "tags": ["welivesecurity", "sample hashes", "malicious", "pterolnk", "pteropshell", "cyber security", "word template", "Nextray", "office macro", "ioc", "phishing", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukrai

hosting_provider:
  welivesecurity,sample hashes,malicious,pterolnk,pteropshell,cyber security,word template,Nextray,office macro,ioc


indicator: 146.190.74.132
indicator_type: ipv4
source: otx
country: US
reverse_dns: remote21.apk-online.fr
hosting_provider: apt,powershell,spearphishing,cloudflare tunnels
queried_at: 2026-04-02T18:34:35.018163
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "146.190.74.132", "tags": ["apt", "powershell", "spearphishing", "cloudflare tunnels"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["remote21.a


indicator: 151.248.114.67
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T18:34:41.808475
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "151.248.114.67", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group

reverse_dns:
  marmosettoken.com,acetobacter.online,mamberis.ru,maniola.online,ariuma.ru,coleopteras.online,debarys.ru,limenitidinae.online,fusari.ru,lovers.semara.ru


indicator: 151.248.114.88
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:34:46.833629
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "151.248.114.88", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon

reverse_dns:
  showroom.preyai.site,preyai.site,support2.rbs-net.ru,www.support2.rbs-net.ru,support2.yvgrishin.ru,my.yvgrishin.ru,tubercur.ru,kilogar.ru,lovers.semara.ru,alloy.vadilops.ru


indicator: 151.248.116.243
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:34:52.220461
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "151.248.116.243", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredo

reverse_dns:
  3dlocator.ru,www.3dlocator.ru,www.3dlokator.ru,3dlokator.ru,myces.ru,teroba.ru,krashand.ru,libertyeducation.ru,xn--80aaah3ajhdqggh1e5b.xn--p1ai,chainoftrust.space


indicator: 151.248.117.250
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:35:03.211023
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "151.248.117.250", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon"

reverse_dns:
  www.storiesmoscow.ru,storiesmoscow.ru,cholerd.ru,biblidinae.online,acrididae.online,shermano.ru,mamberis.ru,haromo.ru,megatos.online,debarys.ru


indicator: 151.248.125.140
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T18:35:10.098863
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "151.248.125.140", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon grou

reverse_dns:
  voranfi.ru,jipitor.ru,bokujanai.ru,alvarados.ru,salt.utrado.ru,kozikra.ru,akunir.ru,salmon12.perfume.warau.ru,go9.regret.warau.ru,country77.salary.nemoiti.ru


indicator: 151.248.121.176
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:35:10.675582
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "151.248.121.176", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon"

reverse_dns:
  cdn.onlyplanks.fun,api.onlyplanks.fun,onlyplanks.fun,blaberidae.online,acetobacter.online,oderas.ru,cholerd.ru,dahmke.ru,shermano.ru,apidaet.online


indicator: 155.138.138.195
indicator_type: ipv4
source: otx
country: CA
city: Toronto
reverse_dns: www.maiar.biz,bgaccountinggroup.com,myaccountec.com,www2.becoya.com
queried_at: 2026-04-02T18:35:12.504975
raw_data:
  {"pulse_count": 4, "reputation": 0, "country": "Canada", "country_code": "CA", "city": "Toronto", "asn": "AS20473 the constant company  llc", "indicator": "155.138.138.195", "tags": ["Gamaredon", "domain", "Trident Ursa", "url https", "threatactor.primitivebear", "threatactor/tridentursa", "Gamaredon Group", "threatactor/actinium", "sample", "ip address", "threatactor/gamaredon"], "pulses": ["Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Uk

hosting_provider:
  Gamaredon,domain,Trident Ursa,url https,threatactor.primitivebear,threatactor/tridentursa,Gamaredon Group,threatactor/actinium,sample,ip address


indicator: 157.230.94.134
indicator_type: ipv4
source: otx
country: US
city: North Bergen
reverse_dns: holdmyguns.org,skuudle-shopify.thegenielab.com,dev.knightsquad2server.com,nc.thepauler.me
hosting_provider: spearphishing,webscan,cloudflare tunnels,powershell,badrequest,bruteforce,webscanner,probing,apt
queried_at: 2026-04-02T18:35:22.589831
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "North Bergen", "asn": "AS14061 digitalocean  llc", "indicator": "157.230.94.134", "tags": ["spearphishing", "webscan", "cloudflare tunnels", "powershell", "badrequest", "bruteforce", "webscanner", "probing", "apt"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "Webscanners with Bad Requests - HTTP Status 400 - 1/20/2018 thru cu


indicator: 157.230.108.94
indicator_type: ipv4
source: otx
country: DE
city: Frankfurt am Main
hosting_provider: apt,powershell,spearphishing,cloudflare tunnels
queried_at: 2026-04-02T18:35:30.203536
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS14061 digitalocean  llc", "indicator": "157.230.108.94", "tags": ["apt", "powershell", "spearphishing", "cloudflare tunnels"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 157.245.201.196
indicator_type: ipv4
source: otx
country: SG
city: Singapore
hosting_provider: spearphishing,apt,cloudflare tunnels,powershell
queried_at: 2026-04-02T18:35:41.027925
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Singapore", "country_code": "SG", "city": "Singapore", "asn": "AS14061 digitalocean  llc", "indicator": "157.245.201.196", "tags": ["spearphishing", "apt", "cloudflare tunnels", "powershell"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 2, "passive_dns_count": 0, "malware_samples": ["5d8a245273a6b7f8ff


indicator: 159.203.14.8
indicator_type: ipv4
source: otx
country: CA
city: Toronto
queried_at: 2026-04-02T18:35:55.794427
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Canada", "country_code": "CA", "city": "Toronto", "asn": "AS14061 digitalocean  llc", "indicator": "159.203.14.8", "tags": ["welivesecurity", "sample hashes", "malicious", "pterolnk", "pteropshell", "word template", "office macro", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 0, "passive_dns_count": 0, "malwar

hosting_provider:
  welivesecurity,sample hashes,malicious,pterolnk,pteropshell,word template,office macro,vbscript,gamaredon,pterosteal


indicator: 159.203.21.16
indicator_type: ipv4
source: otx
country: CA
city: Toronto
hosting_provider: spearphishing,apt,cloudflare tunnels,powershell
queried_at: 2026-04-02T18:36:12.105184
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Canada", "country_code": "CA", "city": "Toronto", "asn": "AS14061 digitalocean  llc", "indicator": "159.203.21.16", "tags": ["spearphishing", "apt", "cloudflare tunnels", "powershell"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 159.223.152.63
indicator_type: ipv4
source: otx
country: US
hosting_provider: backdoors,vbscript,malicious,gamaredon,options,word template,stealers,apt,sample hashes,pterosteal
queried_at: 2026-04-02T18:36:29.820381
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS14061 digitalocean  llc", "indicator": "159.223.152.63", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-


indicator: 159.223.226.57
indicator_type: ipv4
source: otx
country: US
hosting_provider: spearphishing,cloudflare tunnels,powershell,notice,info,Bruteforce,apt,SSH,Brute-Force
queried_at: 2026-04-02T18:36:47.477138
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS14061 digitalocean  llc", "indicator": "159.223.226.57", "tags": ["spearphishing", "cloudflare tunnels", "powershell", "notice", "info", "Bruteforce", "apt", "SSH", "Brute-Force"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "SSH Brute-Force IPs from fail2ban 2025-12-22", "IOC - Gamaredon in 2024: Cranking out s


indicator: 161.35.106.28
indicator_type: ipv4
source: otx
country: US
city: North Bergen
hosting_provider: backdoors,vbscript,malicious,gamaredon,options,word template,stealers,apt,sample hashes,pterosteal
queried_at: 2026-04-02T18:36:54.322357
raw_data:
  {"pulse_count": 4, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "North Bergen", "asn": "AS14061 digitalocean  llc", "indicator": "161.35.106.28", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 202

reverse_dns:
  captain.development.datasource.r8rite.com,connect.detechtiva.com,pusher.detechtiva.com,www.secure08b-verify.duckdns.org,secure08b-verify.duckdns.org,7-ph.com


indicator: 159.89.31.49
indicator_type: ipv4
source: otx
country: DE
city: Frankfurt am Main
queried_at: 2026-04-02T18:36:54.430286
raw_data:
  {"pulse_count": 10, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS14061 digitalocean  llc", "indicator": "159.89.31.49", "tags": ["cybersecurity", "november", "ck information", "url https", "powershell", "gamaredon", "threatactor/tridentursa", "telegram scheme", "gamaredon group", "trident ursa", "summary", "telegram", "ukraine", "primary article", "dns flux", "apt", "Gamaredon", "russia", "sample", "mitre att", "threatactor/gamaredon", "crim

hosting_provider:
  cybersecurity,november,ck information,url https,powershell,gamaredon,threatactor/tridentursa,telegram scheme,gamaredon group,trident ursa


indicator: 161.35.185.146
indicator_type: ipv4
source: otx
country: US
city: Clifton
reverse_dns: com-secofs.info,actsm.online
hosting_provider: apt,powershell,spearphishing,cloudflare tunnels
queried_at: 2026-04-02T18:37:00.773632
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Clifton", "asn": "AS14061 digitalocean  llc", "indicator": "161.35.185.146", "tags": ["apt", "powershell", "spearphishing", "cloudflare tunnels"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "pas


indicator: 164.90.210.128
indicator_type: ipv4
source: otx
country: DE
city: Frankfurt am Main
reverse_dns: memo.dev.bsx.co.il,mrs-bot.dev.bsx.co.il,baby.dev.bsx.co.il
hosting_provider: apt,powershell,spearphishing,cloudflare tunnels
queried_at: 2026-04-02T18:37:05.100877
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS14061 digitalocean  llc", "indicator": "164.90.210.128", "tags": ["apt", "powershell", "spearphishing", "cloudflare tunnels"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dn


indicator: 161.35.169.180
indicator_type: ipv4
source: otx
country: GB
city: London
hosting_provider: spearphishing,apt,cloudflare tunnels,powershell
queried_at: 2026-04-02T18:37:12.402608
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS14061 digitalocean  llc", "indicator": "161.35.169.180", "tags": ["spearphishing", "apt", "cloudflare tunnels", "powershell"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 0, 


indicator: 164.92.115.188
indicator_type: ipv4
source: otx
country: US
queried_at: 2026-04-02T18:37:23.137460
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS14061 digitalocean  llc", "indicator": "164.92.115.188", "tags": ["welivesecurity", "sample hashes", "backdoors", "apt", "malicious", "pterolnk", "pteropshell", "word template", "stealers", "office macro", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-

hosting_provider:
[cell repeats an earlier one in this file: 109 characters]


indicator: 165.227.208.207
indicator_type: ipv4
source: otx
country: US
city: Clifton
hosting_provider: backdoors,vbscript,malicious,gamaredon,options,word template,stealers,apt,sample hashes,pterosteal
queried_at: 2026-04-02T18:37:40.097045
raw_data:
  {"pulse_count": 4, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Clifton", "asn": "AS14061 digitalocean  llc", "indicator": "165.227.208.207", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023",

reverse_dns:
  chayellerose.com,staging-smart.web-experto.com.ar,www.serrageral.net.br,serrageral.net.br,www.supersaversguide.com,supersaversguide.com


indicator: 165.22.120.122
indicator_type: ipv4
source: otx
country: GB
city: London
hosting_provider: apt,powershell,spearphishing,cloudflare tunnels
queried_at: 2026-04-02T18:37:41.962350
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS14061 digitalocean  llc", "indicator": "165.22.120.122", "tags": ["apt", "powershell", "spearphishing", "cloudflare tunnels"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 0, 


indicator: 165.232.136.224
indicator_type: ipv4
source: otx
country: US
city: Santa Clara
hosting_provider: spearphishing,apt,cloudflare tunnels,powershell
queried_at: 2026-04-02T18:37:46.642670
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Santa Clara", "asn": "AS14061 digitalocean  llc", "indicator": "165.232.136.224", "tags": ["spearphishing", "apt", "cloudflare tunnels", "powershell"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns", "CI Army List"], "malware_count": 0, "passive_dns_count": 8, "malwa

reverse_dns:
  spotlightgrowth.com,manage.dungeonbuds.com,recipecoupons.ml,play.dungeonbuds.com,monitor.dungeonbuds.com,165-232-136-224.cprapid.com,www.165-232-136-224.cprapid.com,puianase.oazoas.com


indicator: 167.172.139.39
indicator_type: ipv4
source: otx
country: US
city: North Bergen
reverse_dns: ccubeacademy.com,bitplusvpn.net,masterb.net
hosting_provider: backdoors,vbscript,malicious,gamaredon,options,word template,stealers,apt,sample hashes,pterosteal
queried_at: 2026-04-02T18:37:49.484758
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "North Bergen", "asn": "AS14061 digitalocean  llc", "indicator": "167.172.139.39", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 20


indicator: 167.172.74.200
indicator_type: ipv4
source: otx
country: SG
city: Singapore
hosting_provider: apt,powershell,spearphishing,cloudflare tunnels
queried_at: 2026-04-02T18:38:07.803219
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Singapore", "country_code": "SG", "city": "Singapore", "asn": "AS14061 digitalocean  llc", "indicator": "167.172.74.200", "tags": ["apt", "powershell", "spearphishing", "cloudflare tunnels"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 167.99.127.118
indicator_type: ipv4
source: otx
country: US
city: Clifton
reverse_dns: www.growyourgiftmusic.com,growyourgiftmusic.com,oprisks.com,www.oprisks.com
hosting_provider: spearphishing,apt,cloudflare tunnels,powershell
queried_at: 2026-04-02T18:38:12.587528
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Clifton", "asn": "AS14061 digitalocean  llc", "indicator": "167.99.127.118", "tags": ["spearphishing", "apt", "cloudflare tunnels", "powershell"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 4, "passive_dns": ["www.growyo


indicator: 167.99.138.16
indicator_type: ipv4
source: otx
country: DE
city: Frankfurt am Main
queried_at: 2026-04-02T18:38:15.861045
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS14061 digitalocean  llc", "indicator": "167.99.138.16", "tags": ["domain", "ukraine", "threatactor/tridentursa", "apt", "Gamaredon Group", "dns flux", "gamaredon", "url https", "threatactor.primitivebear", "phishing", "maldocs", "Gamaredon", "russia", "Trident Ursa", "threatactor/actinium", "sample", "trident ursa", "ip address", "threatactor/gamaredon"], "pulses": ["Russia\u201

reverse_dns:
  www.bogozi.com,bogozi.com,delicious71.kolopartor.ru,james.joke.artisola.ru,bihitras.ru,molodosto.ru,defiant71.kolopartor.ru,despise71.kolopartor.ru,kolopartor.ru,despite.lotorgas.ru

hosting_provider:
  domain,ukraine,threatactor/tridentursa,apt,Gamaredon Group,dns flux,gamaredon,url https,threatactor.primitivebear,phishing


indicator: 176.118.164.124
indicator_type: ipv4
source: otx
country: RU
city: Moscow
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:38:36.753224
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS43830 digital energy llc", "indicator": "176.118.164.124", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "p


indicator: 176.118.164.187
indicator_type: ipv4
source: otx
country: RU
city: Moscow
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:38:55.064257
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS43830 digital energy llc", "indicator": "176.118.164.187", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "un

reverse_dns:
  sparkasse-verwaltung.com,raiffeisen-verwaltung.com,alert-volksbank.com,codes-nordea.com,bestsign-verwaltung.com,bestsign-alert.com,securego-vr.com,lovers.semara.ru,tubercur.ru,kilogar.ru


indicator: 176.118.164.159
indicator_type: ipv4
source: otx
country: RU
city: Moscow
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:38:57.646933
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS43830 digital energy llc", "indicator": "176.118.164.159", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "p


indicator: 176.118.165.76
indicator_type: ipv4
source: otx
country: RU
city: Moscow
hosting_provider: qakbot,WhisperGate,slapstick,remcom,powgoop,armageddon,lazagne,crackmapexec,shuckworm,vbscript b
queried_at: 2026-04-02T18:39:16.197042
raw_data:
  {"pulse_count": 25, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS43830 digital energy llc", "indicator": "176.118.165.76", "tags": ["qakbot", "WhisperGate", "slapstick", "remcom", "powgoop", "armageddon", "lazagne", "crackmapexec", "shuckworm", "vbscript b", "tsunami", "ghostwriter", "malware", "sha256", "symantec", "wildfire", "Gamardeon", "defender", "alertinfo", "domain", "deviceid", "Cyclops", "ip address", "palo alto", "ddos", "stealer"


indicator: 176.57.208.203
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:39:21.239190
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "176.57.208.203", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "pow

reverse_dns:
  allikesneakers.com,www.sneakersafe.us,www.allikesneakers.com,sneakersafe.us,ddtxlmya.2woik27n0xly.ch,www.booccca.com,booccca.com,humobot.tk,www.humobot.tk,l3af685e.justinstalledpanel.com


indicator: 178.128.215.84
indicator_type: ipv4
source: otx
country: SG
city: Singapore
reverse_dns: stag-api.mynzuni.com
hosting_provider: spearphishing,apt,cloudflare tunnels,powershell
queried_at: 2026-04-02T18:39:33.775119
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Singapore", "country_code": "SG", "city": "Singapore", "asn": "AS14061 digitalocean  llc", "indicator": "178.128.215.84", "tags": ["spearphishing", "apt", "cloudflare tunnels", "powershell"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["


indicator: 178.20.44.214
indicator_type: ipv4
source: otx
country: RU
reverse_dns: simtech.bitwolff.com
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:39:38.688760
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS48282 hosting technology ltd", "indicator": "178.20.44.214", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "pri


indicator: 178.21.11.23
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:39:49.851405
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "178.21.11.23", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon g

reverse_dns:
  arkphys.online,port.maxiark.ru,wp.maxiark.ru,static.maxiark.ru,post-ch.site,www.post-ch.site,dmitry-bondarenko.xyz,autocraft-sakh.ru,via-ceramics.ru


indicator: 185.193.143.11
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:40:09.656954
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS43830 digital energy llc", "indicator": "185.193.143.11", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primit


indicator: 185.193.143.70
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:40:29.743563
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS43830 digital energy llc", "indicator": "185.193.143.70", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primit


indicator: 185.20.224.168
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,copy,main,explore,cyclopsblink c,footer,ukraine,PartyTicket,IsaacWiper,stealer
queried_at: 2026-04-02T18:40:47.404692
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.20.224.168", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon"


indicator: 185.20.225.35
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T18:41:00.646553
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.20.225.35", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group"

reverse_dns:
  www.pzles.ru,pzles.ru,l11fc91a.justinstalledpanel.com,neat.trobona.ru,luxury.clank.nomukou.ru,delusion.teasagaki.ru,navigation33.countries.hibigaru.ru,wokoras.ru,deluge.degrade.teasagaki.ru,stopped95.famous.filorta.ru


indicator: 185.20.224.218
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:41:07.251798
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.20.224.218", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon",


indicator: 185.20.226.9
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:41:07.674962
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.20.226.9", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc

reverse_dns:
  debarys.ru,hurama.ru,chelicerata.ru,merostomata.ru,ovinus.ru,nematoceras.ru,anisoptera.ru,morphon.online,megascolias.online,noctuidaes.online


indicator: 185.225.19.16
indicator_type: ipv4
source: otx
country: RO
city: Iasi
queried_at: 2026-04-02T18:41:25.434390
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Romania", "country_code": "RO", "city": "Iasi", "asn": "AS39798 mivocloud srl", "indicator": "185.225.19.16", "tags": ["welivesecurity", "sample hashes", "backdoors", "apt", "malicious", "pterolnk", "pteropshell", "word template", "stealers", "office macro", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespi

hosting_provider:
[cell repeats an earlier one in this file: 109 characters]


indicator: 185.251.91.137
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:41:45.984717
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS35278 sprint", "indicator": "185.251.91.137", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "s


indicator: 185.46.10.17
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T18:41:56.777365
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.10.17", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group",

reverse_dns:
  185-46-10-17.cloudvps.regruhosting.ru,secure-coplogic.com,coliadinae.online,arachnidas.online,cholerd.ru,limulusa.online,apidaet.online,maniola.online,apaturinae.online,cerambycidae.online


indicator: 185.46.10.143
indicator_type: ipv4
source: otx
country: RU
reverse_dns: learnms.ru,myces.ru,teroba.ru,krashand.ru
hosting_provider: scanning host,nsyt,vj99,ursnif,asnone,lockbit,attack,then brothers sabey,worm,media
queried_at: 2026-04-02T18:41:59.294752
raw_data:
  {"pulse_count": 50, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.10.143", "tags": ["scanning host", "nsyt", "vj99", "ursnif", "asnone", "lockbit", "attack", "then brothers sabey", "worm", "media", "suspicious", "gmtn", "pragma", "comspec", "http", "view", "starizona", "search", "as16625 akamai", "rticon neutral", "filehashsha1", "historical", "dynamic_function_loading", "amazon02",


indicator: 185.46.10.230
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,copy,main,explore,cyclopsblink c,footer,ukraine,PartyTicket,IsaacWiper,stealer
queried_at: 2026-04-02T18:42:17.897621
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.10.230", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon",


indicator: 185.46.10.250
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:42:37.929279
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.10.250", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 


indicator: 185.46.10.28
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:42:45.938036
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.10.28", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon g

reverse_dns:
  tubercur.ru,brachycera.online,sporog.ru,megatos.online,fortias.ru,baryo.ru,mucora.ru,nematoceras.online,coliadinae.ru,metcalfas.online


indicator: 185.46.10.73
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:42:51.611184
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.10.73", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon g

reverse_dns:
  ez-up.fun,alloy.vadilops.ru,hurama.ru,fusari.ru,fortias.ru,mucora.ru,baryo.ru,libellulat.ru,nematoceras.ru,lepidopteras.ru


indicator: 185.46.10.86
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T18:43:07.096270
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.10.86", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group",

reverse_dns:
  avezaim.ru,xn--b1afa1aggq.xn--p1ai,www.xn--b1afa1aggq.xn--p1ai,www.alfaspace.xyz,alfaspace.xyz,tubercur.ru,lovers.semara.ru,kilogar.ru,alloy.vadilops.ru,hurama.ru


indicator: 185.46.11.115
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:43:27.287495
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.11.115", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "un


indicator: 185.46.11.71
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,copy,main,explore,cyclopsblink c,footer,ukraine,PartyTicket,IsaacWiper,stealer
queried_at: 2026-04-02T18:43:34.248836
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.11.71", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", 


indicator: 185.46.11.72
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:43:39.350375
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.11.72", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "

reverse_dns:
  pronice.ru,www.pronice.ru,niceexpert.ru,www.niceexpert.ru,www.nicecentr.ru,nicecentr.ru,daynice.ru,www.daynice.ru,www.niceonline.ru,niceonline.ru


indicator: 185.46.8.12
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:43:53.034263
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.8.12", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "m

reverse_dns:
  kallima.online,limulusa.online,lophacris.online,haromo.ru,papiliot.online,cyrestinae.online,megatos.online,false.grafitto.ru,cholerd.ru,arachnidas.online


indicator: 185.46.9.133
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:43:59.263820
raw_data:
  {"pulse_count": 26, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.9.133", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "

reverse_dns:
  lexer.fountcore.tech,www.fountcore.tech,fountcore.tech,askogr.ru,www.askogr.ru,git.askogr.ru,nematoceras.online,blaberidae.online,oderas.ru,lepidopteras.online


indicator: 185.46.11.79
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:43:59.530915
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.11.79", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc


indicator: 185.46.9.173
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T18:44:17.056779
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.9.173", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group",


indicator: 185.46.9.81
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:44:31.985523
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.9.81", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon gr

reverse_dns:
  crypto-webtg.ddnsking.com,dersagers.com,box.dersagers.com,apidaet.online,putrif.ru,hamadryas.online,biblidinae.online,cerambycidae.online,chelicerata.online,cholerd.ru


indicator: 188.166.247.34
indicator_type: ipv4
source: otx
country: SG
city: Singapore
hosting_provider: backdoors,vbscript,malicious,gamaredon,options,word template,stealers,apt,sample hashes,pterosteal
queried_at: 2026-04-02T18:44:54.735942
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Singapore", "country_code": "SG", "city": "Singapore", "asn": "AS14061 digitalocean  llc", "indicator": "188.166.247.34", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List"


indicator: 188.166.43.183
indicator_type: ipv4
source: otx
country: NL
city: Amsterdam
queried_at: 2026-04-02T18:45:08.055665
raw_data:
  {"pulse_count": 8, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": "Amsterdam", "asn": "AS14061 digitalocean  llc", "indicator": "188.166.43.183", "tags": ["url https", "2026-02", "gamaredon", "threatactor/tridentursa", "Automated", "trident ursa", "OpenCTI", "ukraine", "Gamaredon", "dns flux", "apt", "sample", "russia", "threatactor/gamaredon", "Gamaredon Group", "Trident Ursa", "domain", "threatactor/actinium", "phishing", "maldocs", "threatactor.primitivebear", "ip ad

hosting_provider:
  url https,2026-02,gamaredon,threatactor/tridentursa,Automated,trident ursa,OpenCTI,ukraine,Gamaredon,dns flux


indicator: 188.225.25.132
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:45:22.198702
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "188.225.25.132", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "

reverse_dns:
  orientalschool.uz,www.orientalschool.uz,www.albukhariuniversity.uz,albukhariuniversity.uz,krashand.ru,l5bc7a82.justinstalledpanel.com,www.glecbu.ru,glecbu.ru,www.winsbu.ru,winsbu.ru


indicator: 188.225.42.206
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,powgoop,PartyTicket,IsaacWiper,stealer,APT,gafgyt
queried_at: 2026-04-02T18:45:41.074209
raw_data:
  {"pulse_count": 26, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "188.225.42.206", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256"


indicator: 188.225.44.138
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:45:58.084831
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "188.225.44.138", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "

reverse_dns:
  firasto.ru,circulas.ru,coleopteras.ru,phymateus.ru,bacilluse.ru,danainae.ru,ophisaurusis.xyz,blockpost.space,apusa.xyz,myrrhan.xyz


indicator: 188.225.43.174
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:46:01.371906
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "188.225.43.174", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear


indicator: 188.225.44.181
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:46:07.126068
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "188.225.44.181", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear


indicator: 188.225.44.76
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:46:27.541497
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "188.225.44.76", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear"


indicator: 188.225.58.233
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,powgoop,PartyTicket,IsaacWiper,stealer,APT,gafgyt
queried_at: 2026-04-02T18:46:33.197264
raw_data:
  {"pulse_count": 26, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "188.225.58.233", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256"

reverse_dns:
  emd.d.grb.agency,fourth.d.grb.agency,api.emd.d.grb.agency,la.d.grb.agency,s.d.grb.agency,test.d.grb.agency,first.d.grb.agency,etc.d.grb.agency,traefik.d.grb.agency,crmfastrans.ru


indicator: 188.225.87.166
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,powgoop,PartyTicket,IsaacWiper,stealer,APT,gafgyt
queried_at: 2026-04-02T18:46:49.627136
raw_data:
  {"pulse_count": 26, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "188.225.87.166", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256"

reverse_dns:
  www.erp.bbrc.ru,erp.bbrc.ru,www.market.exam-z.ru,market.exam-z.ru,exam-z.ru,www.exam-z.ru,krashand.ru,teroba.ru,myces.ru,apusa.xyz


indicator: 188.93.210.54
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:46:57.729802
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "188.93.210.54", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "un


indicator: 193.124.206.128
indicator_type: ipv4
source: otx
country: CZ
hosting_provider: domain,copy,main,explore,cyclopsblink c,footer,ukraine,PartyTicket,IsaacWiper,stealer
queried_at: 2026-04-02T18:47:00.689867
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Czechia", "country_code": "CZ", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "193.124.206.128", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script"

reverse_dns:
  l9dff363.justinstalledpanel.com,geografteach.ru,api.geografteach.ru,mantidae.online,limenitidinae.online,gonepteryx.online,cyrestinae.online,nematoceras.online,hamadryas.online,morphinaes.online


indicator: 193.164.150.111
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,powgoop,PartyTicket,IsaacWiper,stealer,APT,gafgyt
queried_at: 2026-04-02T18:47:15.747004
raw_data:
  {"pulse_count": 26, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "193.164.150.111", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256

reverse_dns:
  epatagik.com,www.epatagik.com,royls.ru,www.royls.ru,myces.ru,teroba.ru,ophisaurusis.xyz,apusa.xyz,myrrhan.xyz


indicator: 193.164.150.121
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-04-02T18:47:27.547623
raw_data:
  {"pulse_count": 29, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "193.164.150.121", "tags": ["powersploit", "qakbot", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "gamaredon", "razy", "wiper", "armageddon", "APT", "lazagne", "crackmapexec", "gamaredon group", "powerstats", "pupyrat", "tsunami", "g0047", "asyncrat", "poshc2", "muddywater", "russia", "p

hosting_provider:
  powersploit,qakbot,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom,primitive bear,powgoop


indicator: 194.180.174.46
indicator_type: ipv4
source: otx
country: MD
city: Chisinau
hosting_provider: vnc client,august,gafgyt,HermeticWiper,wiper,appdata,runprogram,russia,poshc2,alliance
queried_at: 2026-04-02T18:47:35.816684
raw_data:
  {"pulse_count": 25, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS39798 mivocloud srl", "indicator": "194.180.174.46", "tags": ["vnc client", "august", "gafgyt", "HermeticWiper", "wiper", "appdata", "runprogram", "russia", "poshc2", "alliance", "Gamardeon", "symantec", "asyncrat", "raccoon", "geopolitical conflict", "2022", "defender", "s0147", "palo alto", "alertinfo", "ukraine", "powgoop", "APT", "lazagne", "pupyrat", "primitivebear", "

reverse_dns:
  www.naughty-payne.194-180-174-46.plesk.page,naughty-payne.194-180-174-46.plesk.page,lucid-lumiere.194-180-174-46.plesk.page,ecstatic-babbage.194-180-174-46.plesk.page,tender-dhawan.194-180-174-46.plesk.page,civitacastellana.live,n-etflix.com,roundcherry.com


indicator: 194.180.191.105
indicator_type: ipv4
source: otx
country: MD
city: Chisinau
queried_at: 2026-04-02T18:47:52.592595
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS39798 mivocloud srl", "indicator": "194.180.191.105", "tags": ["domain", "microsoft word", "ukraine", "threatactor/tridentursa", "Gamaredon Group", "word", "powershell", "gamaredon", "url https", "threatactor.primitivebear", "Gamaredon", "Military", "Trident Ursa", "armageddon", "garmaredon", "Government", "cybersecurity", "threatactor/actinium", "sample", "base64encoded", "

hosting_provider:
  domain,microsoft word,ukraine,threatactor/tridentursa,Gamaredon Group,word,powershell,gamaredon,url https,threatactor.primitivebear


indicator: 194.180.191.30
indicator_type: ipv4
source: otx
country: MD
city: Chisinau
hosting_provider: as14061,gamaredon,welivesecurity,backdoors,pterolnk,options,as207713,malicious,apt,as212189
queried_at: 2026-04-02T18:48:08.853078
raw_data:
  {"pulse_count": 8, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS39798 mivocloud srl", "indicator": "194.180.191.30", "tags": ["as14061", "gamaredon", "welivesecurity", "backdoors", "pterolnk", "options", "as207713", "malicious", "apt", "as212189", "pteropshell", "as39798", "word template", "stealers", "as207651", "sample hashes", "as211211", "vbscript", "pterosteal", "office macro", "first"], "pulses": ["Cyberespionage the Gamaredon way:


indicator: 194.58.103.22
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:48:29.459708
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.103.22", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon 


indicator: 194.58.108.140
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,copy,main,explore,cyclopsblink c,footer,ukraine,PartyTicket,IsaacWiper,stealer
queried_at: 2026-04-02T18:48:39.347244
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.108.140", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon"

reverse_dns:
  disco.r2-x2.ru,meandrusas.online,papiliot.online,acrididae.online,acetobacter.online,apidaet.online,mesant.online,fusari.ru,mantodeas.online,nematoceras.online


indicator: 194.58.108.14
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T18:48:47.324654
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.108.14", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group"


indicator: 194.58.111.215
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:48:59.536962
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.111.215", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon",


indicator: 194.58.111.54
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-04-02T18:49:19.393944
raw_data:
  {"pulse_count": 50, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.111.54", "tags": [], "pulses": ["BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "InQuest - 28-08-2023", "InQuest - 27-08-2023", "InQuest - 26-08-2023", "InQuest - 25-08-2023", "InQuest -


indicator: 194.58.118.14
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T18:49:25.390476
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.118.14", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group"

reverse_dns:
  www.osher.tech,osher.tech,dipteran.online,dahmke.ru,nymphalidaes.online,coleopteras.online,erati.ru,arachnidas.online,mamberis.ru,metcalfas.online


indicator: 194.58.119.114
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,copy,main,explore,cyclopsblink c,footer,ukraine,PartyTicket,IsaacWiper,stealer
queried_at: 2026-04-02T18:49:42.020635
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.119.114", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon"


indicator: 194.58.119.99
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:49:48.847957
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.119.99", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 

reverse_dns:
  oldys3.xyz,oderas.ru,brachycera.online,cholerd.ru,cyrestinae.online,fanniidae.online,debarys.ru,limenitidinae.online,megatos.online,hierodula.online


indicator: 194.58.120.207
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:50:06.350564
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.120.207", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon


indicator: 194.58.121.225
indicator_type: ipv4
source: otx
country: RU
reverse_dns: furyboost.net,www.furyboost.net,test.thair.ru
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:50:16.503090
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.121.225", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon",


indicator: 194.58.122.110
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,copy,main,explore,cyclopsblink c,footer,ukraine,PartyTicket,IsaacWiper,stealer
queried_at: 2026-04-02T18:50:32.958243
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.122.110", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon"

reverse_dns:
  erp.norbekov.online,crm.norbekov.online,api.norbekov.online,norbekov.ru,nrb.ayurvedarussia.online,criocash.fun,api.norbekov.ru,libellulat.online,biblidinae.online,coliadinae.online


indicator: 194.58.121.94
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:50:33.515011
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.121.94", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon 

reverse_dns:
  dev.dokfilm24.ru,www.dev.dokfilm24.ru,kukuha.ru,www.kukuha.ru,www.dokfilm24.ru,dokfilm24.ru,publicsoft.ru,www.publicsoft.ru,ivilica.pro,www.ivilica.pro


indicator: 194.58.122.212
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:50:40.200296
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.122.212", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon",

reverse_dns:
  prinfix.ru,www.mparadiso.ru,mparadiso.ru,www.korpusnyak.ru,korpusnyak.ru,worx.am,api.davmar.am,davmar.am,www.davmar.am,hierodula.online


indicator: 194.58.123.47
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:50:47.408570
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.123.47", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 

reverse_dns:
  www.ssl.autoserviscrm.ru,ssl.autoserviscrm.ru,autoserviscrm.ru,www.autoserviscrm.ru,194-58-123-47.cloudvps.regruhosting.ru,telegrme.ru,hurama.ru,nematoceras.ru,gromphadorhina.ru,heteroptera.ru


indicator: 194.58.90.120
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:51:02.864773
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.90.120", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 

reverse_dns:
  test2.tpopractice.online,194-58-90-120.cloudvps.regruhosting.ru,btrx.tpopractice.online,miragenails.ru,apaturinae.online,megatos.online,hamadryas.online,blattodea.ru,blattodea.online,kallima.online


indicator: 194.58.92.102
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:51:10.088332
raw_data:
  {"pulse_count": 26, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.92.102", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 

reverse_dns:
  esports-team.com,0xiBtLLmqln.jolotras.ru,wWXnv7N2g4Eat.jolotras.ru,TFVLWjyu.jolotras.ru,5QcVPxsBtJ2tHeBu.jolotras.ru,ef0LVJOVzZdnZ.jolotras.ru,P6eyuf3YckPVnegci.jolotras.ru,5x6tMCEsKJFA.jolotras.ru,8Sh7SSIK1ICsFkqDm13Ja.jolotras.ru,tpjLJ6WdW.jolotras.ru


indicator: 194.58.97.115
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,copy,main,explore,cyclopsblink c,footer,ukraine,PartyTicket,IsaacWiper,stealer
queried_at: 2026-04-02T18:51:16.699455
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.97.115", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon",

reverse_dns:
  www.cadence.fishing,cadence.fishing,www.watchsports.ru,watchsports.ru,www.xn--e1ajpfcja6ek.xn--p1ai,owa.xn--e1ajpfcja6ek.xn--p1ai,bestcourse.pro,xn--e1ajpfcja6ek.xn--p1ai,promo.bestcourse.pro,www.nviot.space


indicator: 194.58.97.245
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:51:37.150928
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.97.245", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 


indicator: 194.58.98.215
indicator_type: ipv4
source: otx
country: RU
reverse_dns: vrn.vasha-voda.ru,vasha-voda.ru,www.vasha-voda.ru,s5.cdntv.online,teroba.ru,myces.ru,dfpfnen.su
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:51:42.607051
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.98.215", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 


indicator: 194.67.108.168
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:51:57.037254
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.108.168", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon

reverse_dns:
  apidaet.online,apaturinae.online,blattodea.online,arachnidas.online,oldys4.xyz,zxzbabe.ru,zxzdroch.ru,linkmedia.digital,www.linkmedia.digital,bonusfix.ru


indicator: 194.67.104.232
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,copy,main,explore,cyclopsblink c,footer,ukraine,PartyTicket,IsaacWiper,stealer
queried_at: 2026-04-02T18:52:00.537287
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.104.232", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon"


indicator: 194.67.109.14
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:52:04.723184
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.109.14", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon 

reverse_dns:
  www.babushkinskaya.olimpic-fit.ru,babushkinskaya.olimpic-fit.ru,www.medvedkovo.olimpic-fit.ru,medvedkovo.olimpic-fit.ru,informpanton.space,informpanton.site,informpanton.online,forvpsult.online,megatos.online,haromo.ru


indicator: 194.67.109.164
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:52:29.827958
raw_data:
  {"pulse_count": 26, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.109.164", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon",

reverse_dns:
  MiEEmMRgL.moolin.ru,1lEVnZEe.moolin.ru,ZGSaBTlUkNPApo.moolin.ru,ngXlREX.moolin.ru,eukkx9CNSogIh.moolin.ru,RynCM4Q.moolin.ru,rpRsZzqep6hTj.moolin.ru,6HHBhqt.moolin.ru,ml5gll.moolin.ru,xfqfmo.moolin.ru


indicator: 194.67.109.76
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:52:42.130221
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.109.76", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 

reverse_dns:
  startap.space,oderas.ru,haromo.ru,lophacris.online,acetobacter.online,mamberis.ru,tomond.ru,alloy.vadilops.ru,lepidopteras.online,cholerd.ru


indicator: 194.67.109.191
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T18:52:43.557208
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.109.191", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group


indicator: 194.67.109.90
indicator_type: ipv4
source: otx
country: RU
hosting_provider: url https,WhisperGate,explore,fedotov,samples,ripe database,registrant,armageddon,copy,filtered
queried_at: 2026-04-02T18:53:00.571143
raw_data:
  {"pulse_count": 10, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.109.90", "tags": ["url https", "WhisperGate", "explore", "fedotov", "samples", "ripe database", "registrant", "armageddon", "copy", "filtered", "ghostwriter", "conditions", "reload", "role", "Primitive Bear", "sha256", "enterprise", "Gamardeon", "wildfire", "star", "khersonskaya", "meta", "domain", "path", "dbf3ripe",

reverse_dns:
  bishbody.com,sozodanie.ru,www.sozodanie.ru,didux.ru,l9a956e5.justinstalledpanel.com,coliadinae.online,empusidae.online,putrif.ru,meandrusas.online,tomond.ru


indicator: 194.67.110.89
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:53:22.992127
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.110.89", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 


indicator: 194.67.111.121
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:53:28.498659
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.111.121", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon",

reverse_dns:
  blag.vitahit.ru,alex.vitahit.ru,franchise.vitahit.ru,uss.vitahit.ru,vitahit.ru,khv.vitahit.ru,irk.vitahit.ru,www.vitahit.ru,nn.vitahit.ru,opt.vitahit.ru


indicator: 194.67.113.120
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,copy,main,explore,cyclopsblink c,footer,ukraine,PartyTicket,IsaacWiper,stealer
queried_at: 2026-04-02T18:53:35.998652
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.113.120", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon"

reverse_dns:
  mx.ipmbisultanova.ru,dahmke.ru,lophacris.online,apaturinae.online,limenitidinae.online,haromo.ru,dipteran.online,limulusa.online,apidaet.online,graphiuma.online


indicator: 194.67.113.186
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:53:41.210120
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.113.186", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon",

reverse_dns:
  zarkino.online,www.primextula.ru,primextula.ru,dionysi.online,blaberidae.online,morphinaes.online,graphiuma.online,tomond.ru,dahmke.ru,asilidae.online


indicator: 194.67.113.99
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:53:54.188559
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.113.99", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 

reverse_dns:
  nymphalidaes.online,brachycera.online,debarys.ru,lepidopteras.online,putrif.ru,sporog.ru,apoxipodes.online,acetobacter.online,shermano.ru,cholerd.ru


indicator: 194.67.113.50
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T18:53:59.058726
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.113.50", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group"


indicator: 194.67.116.180
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:54:14.765287
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.116.180", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon",


indicator: 194.67.116.250
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:54:28.069837
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.116.250", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon


indicator: 194.67.116.51
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T18:54:30.723254
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.116.51", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group"

reverse_dns:
  sporog.ru,oderas.ru,acetobacter.online,coliadinae.online,dipteran.online,gorimana.site,cerambycidae.online,false.grafitto.ru,debarys.ru,apoxipodes.online


indicator: 194.67.116.67
indicator_type: ipv4
source: otx
country: RU
reverse_dns: www.glebm.xyz,glebm.xyz,hellyheyner.space,www.hellyheyner.space
hosting_provider: qakbot,WhisperGate,slapstick,remcom,powgoop,armageddon,lazagne,crackmapexec,shuckworm,vbscript b
queried_at: 2026-04-02T18:54:36.336013
raw_data:
  {"pulse_count": 25, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.116.67", "tags": ["qakbot", "WhisperGate", "slapstick", "remcom", "powgoop", "armageddon", "lazagne", "crackmapexec", "shuckworm", "vbscript b", "tsunami", "ghostwriter", "malware", "sha256", "symantec", "wildfire", "Gamardeon", "defender", "alertinfo", "domain", "deviceid", "Cyclops", "ip address", "palo alto", "ddos


indicator: 194.67.116.81
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:54:56.837304
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.116.81", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "un


indicator: 194.67.71.4
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,copy,main,explore,cyclopsblink c,footer,ukraine,PartyTicket,IsaacWiper,stealer
queried_at: 2026-04-02T18:55:13.782836
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.71.4", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "


indicator: 194.67.71.55
indicator_type: ipv4
source: otx
country: RU
hosting_provider: WhisperGate,explore,samples,redline stealer,armageddon,copy,blog,ghostwriter,reload,Primitive Bear
queried_at: 2026-04-02T18:55:28.445083
raw_data:
  {"pulse_count": 12, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.71.55", "tags": ["WhisperGate", "explore", "samples", "redline stealer", "armageddon", "copy", "blog", "ghostwriter", "reload", "Primitive Bear", "sha256", "enterprise", "Gamardeon", "wildfire", "star", "meta", "domain", "path", "Cyclops", "ip address", "palo alto", "ddos", "stealer", "span", "knowledge", "ip addresse


indicator: 194.67.86.167
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:55:35.983216
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.86.167", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon 

reverse_dns:
  tomond.ru,kilogar.ru,proteug.ru,blattodea.ru,aerogenosa.ru,lovers.semara.ru,mycodar.ru,tubercur.ru,mesant.online,erati.ru


indicator: 194.67.86.169
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:56:06.016596
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.86.169", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 


indicator: 194.67.86.240
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:56:19.593153
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.86.240", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon 


indicator: 194.67.87.29
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:56:42.070692
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.87.29", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "


indicator: 194.67.90.15
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:56:56.948668
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.90.15", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon g


indicator: 194.67.90.215
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:57:05.617308
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.90.215", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 

reverse_dns:
  lb96aeac.justinstalledpanel.com,www.testzakaz.ru,testzakaz.ru,ur-time.ru,www.ur-time.ru,gakhramanov.site,deshar.ishkola.com,bbb.ishkola.com,www.nikecontractor.xyz,nikecontractor.xyz


indicator: 194.67.90.78
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:57:24.027395
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.90.78", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon g


indicator: 194.67.93.85
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T18:57:41.525403
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.93.85", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group",


indicator: 195.133.88.128
indicator_type: ipv4
source: otx
country: PL
hosting_provider: backdoors,vbscript,malicious,gamaredon,options,word template,stealers,apt,sample hashes,pterosteal
queried_at: 2026-04-02T18:57:50.254664
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Poland", "country_code": "PL", "city": null, "asn": "ASNone ", "indicator": "195.133.88.128", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamare


indicator: 195.140.146.128
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T18:58:10.277192
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS29182 jsc iot", "indicator": "195.140.146.128", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", 


indicator: 195.62.53.63
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:58:20.588226
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS44812 ip server llc", "indicator": "195.62.53.63", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "pow

reverse_dns:
  crm.semena-baza.ru,www.semena-baza.ru,semena-baza.ru,blockpost.space,ophisaurusis.xyz,blockpost.site,adblocked.space,fionar.xyz,apusa.xyz,myrrhan.xyz


indicator: 199.247.14.64
indicator_type: ipv4
source: otx
country: FR
city: Aubervilliers
queried_at: 2026-04-02T18:58:37.349921
raw_data:
  {"pulse_count": 4, "reputation": 0, "country": "France", "country_code": "FR", "city": "Aubervilliers", "asn": "AS20473 the constant company  llc", "indicator": "199.247.14.64", "tags": ["url https", "Gamaredon", "Gamaredon Group", "sample", "threatactor.primitivebear", "Trident Ursa", "domain", "threatactor/actinium", "threatactor/gamaredon", "threatactor/tridentursa", "ip address"], "pulses": ["Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion o

hosting_provider:
  url https,Gamaredon,Gamaredon Group,sample,threatactor.primitivebear,Trident Ursa,domain,threatactor/actinium,threatactor/gamaredon,threatactor/tridentursa


indicator: 206.172.194.0
indicator_type: ipv4
source: otx
country: CA
city: Victoriaville
queried_at: 2026-04-02T18:58:54.072843
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Canada", "country_code": "CA", "city": "Victoriaville", "asn": "AS577 bell canada", "indicator": "206.172.194.0", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 206.81.0.182
indicator_type: ipv4
source: otx
country: US
city: North Bergen
queried_at: 2026-04-02T18:58:54.102418
raw_data:
  {"pulse_count": 4, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "North Bergen", "asn": "AS14061 digitalocean  llc", "indicator": "206.81.0.182", "tags": ["Gamaredon", "domain", "Trident Ursa", "url https", "threatactor.primitivebear", "threatactor/tridentursa", "Gamaredon Group", "threatactor/actinium", "sample", "ip address", "threatactor/gamaredon"], "pulses": ["Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since In

reverse_dns:
  ee.atoztheatrical.com,obatnabikintunduh.jadiwehsyaree.tunduhteukuat.com,gesbeakdeui.kuduradadiseutokeun.gelasbelahtilu.com,tapunyacintauntuk.nyamamatgoberkeun.podlalengitan.com,www.xn--bbanetcashs-uhb.com,www.blbvanetcahs.com,turbov.internetdigital.xyz,meq12.brtwer.xyz

hosting_provider:
  Gamaredon,domain,Trident Ursa,url https,threatactor.primitivebear,threatactor/tridentursa,Gamaredon Group,threatactor/actinium,sample,ip address


indicator: 209.38.97.36
indicator_type: ipv4
source: otx
country: US
hosting_provider: spearphishing,cloudflare tunnels,powershell,scanners,ssh,apt,honeypot,RimbaSiber
queried_at: 2026-04-02T18:59:12.398178
raw_data:
  {"pulse_count": 4, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "209.38.97.36", "tags": ["spearphishing", "cloudflare tunnels", "powershell", "scanners", "ssh", "apt", "honeypot", "RimbaSiber"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "Malware Filter - Botnet List - 11-10-2025", "Rimba Siber (Malaysia) SSH Attacker Hosts for 2025-10-10", "IOC - Gamar


indicator: 209.97.165.187
indicator_type: ipv4
source: otx
country: SG
city: Singapore
hosting_provider: backdoors,vbscript,malicious,gamaredon,options,word template,stealers,apt,sample hashes,pterosteal
queried_at: 2026-04-02T18:59:15.297718
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Singapore", "country_code": "SG", "city": "Singapore", "asn": "AS14061 digitalocean  llc", "indicator": "209.97.165.187", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List"


indicator: 212.18.104.56
indicator_type: ipv4
source: otx
hosting_provider: backdoors,vbscript,malicious,gamaredon,options,word template,stealers,apt,sample hashes,pterosteal
queried_at: 2026-04-02T18:59:18.292884
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "", "country_code": "", "city": "", "asn": "AS211119 anas firas flayyih al-qaysi", "indicator": "212.18.104.56", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberes


indicator: 213.182.204.71
indicator_type: ipv4
source: otx
country: ES
hosting_provider: apt,powershell,spearphishing,cloudflare tunnels
queried_at: 2026-04-02T18:59:21.810038
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Spain", "country_code": "ES", "city": null, "asn": "AS9009 m247 ltd", "indicator": "213.182.204.71", "tags": ["apt", "powershell", "spearphishing", "cloudflare tunnels"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 216.238.69.137
indicator_type: ipv4
source: otx
country: US
city: Philadelphia
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T18:59:41.956583
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Philadelphia", "asn": "AS20473 the constant company  llc", "indicator": "216.238.69.137", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gam


indicator: 217.25.89.191
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:00:02.398151
raw_data:
  {"pulse_count": 26, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "217.25.89.191", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "p


indicator: 217.69.0.35
indicator_type: ipv4
source: otx
country: FR
city: Aubervilliers
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,powgoop,PartyTicket,IsaacWiper,gafgyt,HermeticWiper,lazagne
queried_at: 2026-04-02T19:00:02.807519
raw_data:
  {"pulse_count": 15, "reputation": 0, "country": "France", "country_code": "FR", "city": "Aubervilliers", "asn": "AS20473 the constant company  llc", "indicator": "217.69.0.35", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "powgoop", "PartyTicket", "IsaacWiper", "gafgyt", "HermeticWiper", "lazagne", "redrum", "filehashmd5", "pupyrat", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghost

reverse_dns:
  babacoach.fr,www.babacoach.fr,backoffice.babacoach.com,www.babacoach.com,visio.babacoach.com,babacoach.com,api.babacoach.com


indicator: 23.42.150.172
indicator_type: ipv4
source: otx
country: US
city: San Jose
queried_at: 2026-04-02T19:00:18.134748
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "San Jose", "asn": "AS16625 akamai technologies  inc.", "indicator": "23.42.150.172", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 217.69.4.51
indicator_type: ipv4
source: otx
country: FR
city: Aubervilliers
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:00:23.334631
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "France", "country_code": "FR", "city": "Aubervilliers", "asn": "AS20473 the constant company  llc", "indicator": "217.69.4.51", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1


indicator: 31.31.203.17
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:00:33.193803
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "31.31.203.17", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon g

reverse_dns:
  allqlt.online,allqrt.space,rosgradusnik.ru,allqrt.site,klarasita.ru,31-31-203-17.cloudvps.regruhosting.ru,ariuma.ru,maniola.online,debarys.ru,papiliot.online


indicator: 31.31.203.219
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:00:43.751079
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "31.31.203.219", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon 

reverse_dns:
  xn----etb1b.xn--p1ai,www.xn----etb1b.xn--p1ai,lb130473.justinstalledpanel.com,31-31-203-219.cloudvps.regruhosting.ru,proguru.space,shelbycompany.space,keitaro.shelbycompany.space,acrididae.online,kilogar.ru,lovers.semara.ru


indicator: 31.31.203.71
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,copy,main,explore,cyclopsblink c,footer,ukraine,PartyTicket,IsaacWiper,stealer
queried_at: 2026-04-02T19:00:49.847059
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "31.31.203.71", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", 


indicator: 31.40.251.145
indicator_type: ipv4
source: otx
country: RU
city: Moscow
reverse_dns: royalapproach.ru
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:00:55.410119
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS43830 digital energy llc", "indicator": "31.40.251.145", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "pri


indicator: 31.40.251.171
indicator_type: ipv4
source: otx
country: RU
city: Moscow
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:01:04.841912
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS43830 digital energy llc", "indicator": "31.40.251.171", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "pri

reverse_dns:
  wtv23.6822931.xyz,device-client-actions.com,device-confirm-client.com,device-client-history.com,device-history-client.com,device-approve-client.com,device-client-approve.com,device-client-action.com,device-client-warn.com,device-client-verify.com


indicator: 37.140.195.137
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:01:18.365804
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "37.140.195.137", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon",

reverse_dns:
  skud.skladovka.ru,37-140-195-137.xs.vps.regruhosting.ru,37-140-195-137.xen.vps.regruhosting.ru,37-140-195-137.ovz.vps.regruhosting.ru,lepist.ru,lepist.space,37-140-195-137.cloudvps.regruhosting.ru,counter.podloka.ru,kilogar.ru,lovers.semara.ru


indicator: 37.140.197.55
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T19:01:33.741066
raw_data:
  {"pulse_count": 10, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "37.140.197.55", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group

reverse_dns:
  37-140-197-55.cloudvps.regruhosting.ru,mx.ipakachaeva.ru,wnw02.sectorfinancierociti.com,lovers.semara.ru,tubercur.ru,kilogar.ru,alloy.vadilops.ru,hurama.ru,libellulat.ru,libellulidae.ru


indicator: 37.140.197.206
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:01:37.445811
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "37.140.197.206", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon",

reverse_dns:
  neural.photophone.site,37-140-197-206.cloudvps.regruhosting.ru,apaturinae.online,cyrestinae.online,cholerd.ru,libellulidae.online,tubercur.ru,brachycera.online,apidaet.online,gonepteryx.online


indicator: 37.140.199.20
indicator_type: ipv4
source: otx
country: RU
reverse_dns: 37-140-199-20.cloudvps.regruhosting.ru,pvh-lodki.ru
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:01:52.577512
raw_data:
  {"pulse_count": 26, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "37.140.199.20", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 


indicator: 37.140.199.224
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:02:14.720946
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "37.140.199.224", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon


indicator: 45.134.255.131
indicator_type: ipv4
source: otx
country: RU
city: Moscow
hosting_provider: domain,copy,main,explore,cyclopsblink c,footer,ukraine,PartyTicket,IsaacWiper,stealer
queried_at: 2026-04-02T19:02:30.168217
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS43830 digital energy llc", "indicator": "45.134.255.131", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "

reverse_dns:
  www.gholam.ru,gholam.ru,zeinare.ru,principles.vositra.ru,sand.striman.ru,gloomy.striman.ru,clap.vositra.ru,claimed.striman.ru,nearly.striman.ru,bicyclelist.baldasha.ru


indicator: 38.54.12.3
indicator_type: ipv4
source: otx
country: US
hosting_provider: apt,powershell,spearphishing,cloudflare tunnels
queried_at: 2026-04-02T19:02:32.320761
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS138915 kaopu cloud hk limited", "indicator": "38.54.12.3", "tags": ["apt", "powershell", "spearphishing", "cloudflare tunnels"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 45.32.149.8
indicator_type: ipv4
source: otx
country: FR
city: Aubervilliers
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,powgoop,PartyTicket,IsaacWiper,gafgyt,HermeticWiper,lazagne
queried_at: 2026-04-02T19:02:32.610294
raw_data:
  {"pulse_count": 4, "reputation": 0, "country": "France", "country_code": "FR", "city": "Aubervilliers", "asn": "AS20473 the constant company  llc", "indicator": "45.32.149.8", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "powgoop", "PartyTicket", "IsaacWiper", "gafgyt", "HermeticWiper", "lazagne", "redrum", "filehashmd5", "pupyrat", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostw


indicator: 45.77.11.107
indicator_type: ipv4
source: otx
country: JP
city: Heiwajima
queried_at: 2026-04-02T19:02:49.514534
raw_data:
  {"pulse_count": 4, "reputation": 0, "country": "Japan", "country_code": "JP", "city": "Heiwajima", "asn": "AS20473 the constant company  llc", "indicator": "45.77.11.107", "tags": ["url https", "Gamaredon", "Gamaredon Group", "sample", "threatactor.primitivebear", "Trident Ursa", "domain", "threatactor/actinium", "threatactor/gamaredon", "threatactor/tridentursa", "ip address"], "pulses": ["Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukra

hosting_provider:
  url https,Gamaredon,Gamaredon Group,sample,threatactor.primitivebear,Trident Ursa,domain,threatactor/actinium,threatactor/gamaredon,threatactor/tridentursa


indicator: 45.77.229.187
indicator_type: ipv4
source: otx
country: GB
city: London
queried_at: 2026-04-02T19:02:54.526950
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS20473 the constant company  llc", "indicator": "45.77.229.187", "tags": ["domain", "ukraine", "threatactor/tridentursa", "apt", "Gamaredon Group", "dns flux", "gamaredon", "url https", "threatactor.primitivebear", "phishing", "maldocs", "Gamaredon", "russia", "Trident Ursa", "threatactor/actinium", "sample", "trident ursa", "ip address", "threat

hosting_provider:
  domain,ukraine,threatactor/tridentursa,apt,Gamaredon Group,dns flux,gamaredon,url https,threatactor.primitivebear,phishing


indicator: 46.29.234.46
indicator_type: ipv4
source: otx
country: RU
city: Volzhskiy
reverse_dns: alphanetsphere.com
hosting_provider: backdoors,vbscript,malicious,gamaredon,options,word template,stealers,apt,sample hashes,pterosteal
queried_at: 2026-04-02T19:02:57.757749
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Volzhskiy", "asn": "AS34804 jsc eurotelecom", "indicator": "46.29.234.46", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-


indicator: 5.181.156.109
indicator_type: ipv4
source: otx
country: MD
city: Chisinau
reverse_dns: cm-loginprivate.com,www.cm-loginprivate.com
queried_at: 2026-04-02T19:03:01.306589
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS39798 mivocloud srl", "indicator": "5.181.156.109", "tags": ["welivesecurity", "sample hashes", "backdoors", "apt", "malicious", "pterolnk", "pteropshell", "word template", "stealers", "office macro", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-

hosting_provider:
[cell repeats an earlier one in this file: 109 characters]


indicator: 5.252.178.140
indicator_type: ipv4
source: otx
country: RO
city: Iasi
reverse_dns: nr.globalirishdating.com
hosting_provider: backdoors,vbscript,malicious,gamaredon,options,word template,stealers,apt,sample hashes,pterosteal
queried_at: 2026-04-02T19:03:09.218139
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Romania", "country_code": "RO", "city": "Iasi", "asn": "AS39798 mivocloud srl", "indicator": "5.252.178.140", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespi


indicator: 5.63.152.233
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,copy,main,explore,cyclopsblink c,footer,ukraine,PartyTicket,IsaacWiper,stealer
queried_at: 2026-04-02T19:03:18.403295
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "5.63.152.233", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", 

reverse_dns:
  status.wgnet.work,nmon.wgnet.work,5-63-152-233.cloudvps.regruhosting.ru,alloy.vadilops.ru,vostilo.ru,warau.ru,vosita.ru,vidarri.ru,vodagi.ru,wokoras.ru


indicator: 5.63.154.128
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:03:38.953063
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "5.63.154.128", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "


indicator: 5.63.158.179
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:03:55.801682
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "5.63.158.179", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon g

reverse_dns:
  autofides.ru,baikalcdn.ru,www.baikalcdn.ru,5-63-158-179.cloudvps.regruhosting.ru,glorious.nonima.ru,kilogar.ru,tubercur.ru,lovers.semara.ru,alloy.vadilops.ru,hurama.ru


indicator: 5.63.154.19
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:03:58.830279
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "5.63.154.19", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "m

reverse_dns:
  btc-worm.ru,www.btc-worm.ru,dotsatoshi.ru,www.dotsatoshi.ru,www.smart-obmen.ru,smart-obmen.ru,www.exchange-key.com,exchange-key.com,www.x-rates.ru,x-rates.ru


indicator: 5.63.158.233
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:04:03.967808
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "5.63.158.233", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "

reverse_dns:
  api.tringle.work,www.api.tringle.work,www.nskiphone-crm.this-is-web.ru,nskiphone-crm.this-is-web.ru,api.nskiphone-crm.this-is-web.ru,www.api.nskiphone-crm.this-is-web.ru,www.nskiphone.this-is-web.ru,nskiphone.this-is-web.ru,api.nskiphone.this-is-web.ru,www.api.nskiphone.this-is-web.ru


indicator: 5.63.158.238
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:04:14.215307
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "5.63.158.238", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "

reverse_dns:
  promokotikbot.ru,www.promokotikbot.ru,5-63-158-238.cloudvps.regruhosting.ru,noctuidaes.online,mantidae.online,libellulat.online,hymenoptera.online,false.grafitto.ru,apoxipodes.online,fanniidae.online


indicator: 62.133.62.73
indicator_type: ipv4
source: otx
country: RU
reverse_dns: smtp.saberx.tech
hosting_provider: backdoors,vbscript,malicious,gamaredon,options,word template,stealers,apt,sample hashes,pterosteal
queried_at: 2026-04-02T19:04:21.414159
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS48430 perviy tsod llc", "indicator": "62.133.62.73", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", 


indicator: 64.227.139.249
indicator_type: ipv4
source: otx
country: US
city: Atlanta
hosting_provider: spearphishing,apt,cloudflare tunnels,powershell
queried_at: 2026-04-02T19:04:24.207469
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Atlanta", "asn": "AS14061 digitalocean  llc", "indicator": "64.227.139.249", "tags": ["spearphishing", "apt", "cloudflare tunnels", "powershell"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "pas


indicator: 64.227.172.243
indicator_type: ipv4
source: otx
country: US
city: Atlanta
hosting_provider: apt,powershell,spearphishing,cloudflare tunnels
queried_at: 2026-04-02T19:04:29.840786
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Atlanta", "asn": "AS14061 digitalocean  llc", "indicator": "64.227.172.243", "tags": ["apt", "powershell", "spearphishing", "cloudflare tunnels"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 7, "malware_samples": [], "pas

reverse_dns:
  beauty-domain.autos,vobuehcip.com,munshak.ca.3cx.us,www.makkaldaily.xyz,makkaldaily.xyz,api.makkaldaily.xyz,goldenbricks.3cx.in


indicator: 67.205.160.237
indicator_type: ipv4
source: otx
country: US
city: North Bergen
hosting_provider: iran,gamaredon,canada,welivesecurity,mexico,backdoors,singapore,pterolnk,china,netherlands
queried_at: 2026-04-02T19:04:33.219743
raw_data:
  {"pulse_count": 4, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "North Bergen", "asn": "AS14061 digitalocean  llc", "indicator": "67.205.160.237", "tags": ["iran", "gamaredon", "canada", "welivesecurity", "mexico", "backdoors", "singapore", "pterolnk", "china", "netherlands", "germany", "options", "malicious", "apt", "brazil", "pteropshell", "word template", "stealers", "india", "united", "sample hashes", "vbscript", "pterosteal", "office macro", "first",

reverse_dns:
  ejgmve.easypanel.host,upcatalogo-evolution.ejgmve.easypanel.host,reozf.net,testftp.statenweb.com,baq360.com,cherrygirl.us


indicator: 68.183.2.92
indicator_type: ipv4
source: otx
country: NL
city: Amsterdam
queried_at: 2026-04-02T19:04:51.000303
raw_data:
  {"pulse_count": 5, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": "Amsterdam", "asn": "AS14061 digitalocean  llc", "indicator": "68.183.2.92", "tags": ["welivesecurity", "sample hashes", "backdoors", "apt", "malicious", "pterolnk", "pteropshell", "word template", "stealers", "office macro", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List",

hosting_provider:
[cell repeats an earlier one in this file: 109 characters]


indicator: 70.34.194.123
indicator_type: ipv4
source: otx
country: US
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:05:11.775845
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "70.34.194.123", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mir


indicator: 70.34.194.31
indicator_type: ipv4
source: otx
country: US
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:05:31.753289
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "70.34.194.31", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group


indicator: 70.34.195.75
indicator_type: ipv4
source: otx
country: US
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:05:51.785599
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "70.34.195.75", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group


indicator: 70.34.197.185
indicator_type: ipv4
source: otx
country: US
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:06:11.919521
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "70.34.197.185", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon grou


indicator: 70.34.199.214
indicator_type: ipv4
source: otx
country: US
reverse_dns: 856393-icloud.com,teroba.ru,myces.ru,krashand.ru,www.anyboard.xyz,anyboard.xyz
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:06:27.799952
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "70.34.199.214", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mir


indicator: 70.34.198.226
indicator_type: ipv4
source: otx
country: US
hosting_provider: qakbot,WhisperGate,slapstick,remcom,powgoop,armageddon,lazagne,crackmapexec,shuckworm,vbscript b
queried_at: 2026-04-02T19:06:32.702871
raw_data:
  {"pulse_count": 25, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "70.34.198.226", "tags": ["qakbot", "WhisperGate", "slapstick", "remcom", "powgoop", "armageddon", "lazagne", "crackmapexec", "shuckworm", "vbscript b", "tsunami", "ghostwriter", "malware", "sha256", "symantec", "wildfire", "Gamardeon", "defender", "alertinfo", "domain", "deviceid", "Cyclops", "ip address", "palo alto", "ddos", "


indicator: 70.34.202.55
indicator_type: ipv4
source: otx
country: US
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:06:39.269981
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "70.34.202.55", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group


indicator: 70.34.204.141
indicator_type: ipv4
source: otx
country: US
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:06:44.951966
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "70.34.204.141", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon grou


indicator: 70.34.204.74
indicator_type: ipv4
source: otx
country: US
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:07:05.718169
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "70.34.204.74", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group


indicator: 70.34.208.32
indicator_type: ipv4
source: otx
country: US
reverse_dns: penpen.wavy.ws
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:07:11.757258
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "70.34.208.32", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group


indicator: 80.78.240.210
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:07:32.466683
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.240.210", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 


indicator: 80.78.241.253
indicator_type: ipv4
source: otx
country: RU
hosting_provider: qakbot,WhisperGate,slapstick,remcom,powgoop,armageddon,lazagne,crackmapexec,shuckworm,vbscript b
queried_at: 2026-04-02T19:07:53.891426
raw_data:
  {"pulse_count": 25, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.241.253", "tags": ["qakbot", "WhisperGate", "slapstick", "remcom", "powgoop", "armageddon", "lazagne", "crackmapexec", "shuckworm", "vbscript b", "tsunami", "ghostwriter", "malware", "sha256", "symantec", "wildfire", "Gamardeon", "defender", "alertinfo", "domain", "deviceid", "Cyclops", "ip address", "palo alto", "ddos


indicator: 80.78.241.88
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:08:00.535519
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.241.88", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "

reverse_dns:
  tubercur.ru,kilogar.ru,lovers.semara.ru,alloy.vadilops.ru,fortias.ru,agaricusa.ru,arachnidas.ru,cyrestinae.ru,coliadinae.ru,apaturinae.ru


indicator: 80.78.244.124
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:08:42.964962
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.244.124", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon 


indicator: 80.78.244.199
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:08:49.905557
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.244.199", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "un

reverse_dns:
  80-78-244-199.cloudvps.regruhosting.ru,work-craft.ru,www.work-craft.ru,mesant.online,melitaeas.online,metcalfas.online,nymphalidaes.online,putrif.ru,anisoptera.online,lycaenidae.online


indicator: 80.78.245.223
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:09:11.996615
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.245.223", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 


indicator: 80.78.245.254
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T19:09:27.768080
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.245.254", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group"


indicator: 80.78.245.89
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:09:48.009004
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.245.89", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon g


indicator: 80.78.248.167
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T19:10:05.906002
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.248.167", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group"


indicator: 80.78.248.22
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:10:31.789036
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.248.22", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "


indicator: 80.78.251.191
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:10:50.046361
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.251.191", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 

reverse_dns:
  korovin.site,www.ddps-csr.ru,ddps-csr.ru,80-78-251-191.cloudvps.regruhosting.ru,shermano.ru,limulusa.online,limenitidinae.online,ariuma.ru,apaturinae.online,lycaenidae.online


indicator: 80.78.248.222
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:10:53.623736
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.248.222", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon 


indicator: 80.78.251.231
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:11:28.822301
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.251.231", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon 


indicator: 80.78.251.4
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:11:45.355467
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.251.4", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon gr

reverse_dns:
  alexandr-demchenko.ru,www.alexandr-demchenko.ru,80-78-251-4.cloudvps.regruhosting.ru,npp-trigla.ru,acetobacter.online,hamadryas.online,dipteran.online,kallima.online,tomond.ru,false.grafitto.ru


indicator: 80.78.253.196
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T19:12:05.376329
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.253.196", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group"

reverse_dns:
  www.ust-land.ru,ust-land.ru,crm.ust-land.ru,www.crm.ust-land.ru,web.ust-land.ru,www.web.ust-land.ru,www.ad.ust-land.ru,ad.ust-land.ru,widget.xrbh.ru,www.widget.xrbh.ru


indicator: 80.78.253.26
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T19:12:23.318164
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.253.26", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group",


indicator: 80.78.253.86
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:12:31.878138
raw_data:
  {"pulse_count": 25, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.253.86", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc

reverse_dns:
  tc.yeel.studio,01.fastpostsender.ru,smtp.telegrambotshopsodax64.site,td-ledavto.ru,telegrambotshopsodax64.site,80-78-253-86.cloudvps.regruhosting.ru,acrididae.online,coliadinae.online,shermano.ru,mamberis.ru


indicator: 80.78.254.238
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:12:42.709216
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.254.238", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 

reverse_dns:
  esdgroup.ru,www.esdgroup.ru,80-78-254-238.ovz.vps.regruhosting.ru,alono.ru,sousourcelink.online,80-78-254-238.cloudvps.regruhosting.ru


indicator: 80.90.181.107
indicator_type: ipv4
source: otx
country: RU
hosting_provider: backdoors,vbscript,malicious,gamaredon,options,word template,stealers,apt,sample hashes,pterosteal
queried_at: 2026-04-02T19:13:00.515863
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS207967 anton mamaev", "indicator": "80.90.181.107", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "


indicator: 82.146.39.104
indicator_type: ipv4
source: otx
country: RU
city: Moscow
queried_at: 2026-04-02T19:13:12.773119
raw_data:
  {"pulse_count": 7, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS29182 jsc iot", "indicator": "82.146.39.104", "tags": ["domain", "ukraine", "threatactor/tridentursa", "apt", "Gamaredon Group", "dns flux", "gamaredon", "url https", "threatactor.primitivebear", "phishing", "maldocs", "Gamaredon", "russia", "Trident Ursa", "threatactor/actinium", "sample", "trident ursa", "ip address", "threatactor/gamaredon"], "pulses": ["Russia\u2019s Trident

reverse_dns:
  psklg-dom.ru,www.psklg-dom.ru,ezambiablog.click,techmaster.makeup,webengincs.com,kolizey78.ru,www.kolizey78.ru,l11bb0d2.justinstalledpanel.com

hosting_provider:
  domain,ukraine,threatactor/tridentursa,apt,Gamaredon Group,dns flux,gamaredon,url https,threatactor.primitivebear,phishing


indicator: 83.166.247.110
indicator_type: ipv4
source: otx
country: RU
city: Moscow
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:13:24.857846
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS24936 llc management company svyaz", "indicator": "83.166.247.110", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "m


indicator: 83.166.242.108
indicator_type: ipv4
source: otx
country: RU
city: Moscow
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:13:28.249140
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS24936 llc management company svyaz", "indicator": "83.166.242.108", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon gr


indicator: 83.166.247.185
indicator_type: ipv4
source: otx
country: RU
city: Moscow
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:13:38.564478
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS24936 llc management company svyaz", "indicator": "83.166.247.185", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "m

reverse_dns:
  www.xn----8sbfcuhnlliceeigh0be5o7b.xn--p1ai,xn----8sbfcuhnlliceeigh0be5o7b.xn--p1ai,ophisaurusis.xyz,blockpost.space,apusa.xyz,myrrhan.xyz


indicator: 83.166.250.21
indicator_type: ipv4
source: otx
country: RU
city: Moscow
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:13:44.130481
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS24936 llc management company svyaz", "indicator": "83.166.250.21", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mi


indicator: 87.249.49.103
indicator_type: ipv4
source: otx
country: RU
city: St Petersburg
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:14:06.190329
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "St Petersburg", "asn": "AS9123 timeweb ltd.", "indicator": "87.249.49.103", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "pri


indicator: 89.108.102.37
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:14:12.055222
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.102.37", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 

reverse_dns:
  blattodea.online,limulusa.online,sporog.ru,brachycera.online,false.grafitto.ru,mamberis.ru,lovers.semara.ru,aerogenosa.ru,fusari.ru,tubercur.ru


indicator: 89.108.102.57
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:14:25.128311
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.102.57", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon 

reverse_dns:
  stamina-online.com,gromphadorhina.ru,limenitis.ru,fortias.ru,baryo.ru,chelicerata.ru,oderas.ru,dionysi.online,acrididae.online,libellulat.online


indicator: 89.108.115.206
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T19:14:33.168953
raw_data:
  {"pulse_count": 10, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.115.206", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon grou

reverse_dns:
  www.diler.online,diler.online,www.bash-apteka.ru,bash-apteka.ru,www.thewiz.ru,thewiz.ru,acrididae.online


indicator: 89.108.114.11
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,copy,main,explore,cyclopsblink c,footer,ukraine,PartyTicket,IsaacWiper,stealer
queried_at: 2026-04-02T19:14:34.691097
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.114.11", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon",

reverse_dns:
  tubercur.ru,mucora.ru,baryo.ru,apidaet.ru,blaberidae.ru,gromphadorhina.online,lepidopteras.ru,libellulidae.ru,libellulat.ru,xiphosura.online


indicator: 89.108.115.225
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:14:45.916075
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.115.225", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon

reverse_dns:
  yourfavorite.property,travel.endwork.today,postnet-dev.selftech.ru,postamates.spatiality.website,business.spatiality.website,property.spatiality.website,dit.spatiality.website,wiki.clevertec.ru,www.myfoodforum.ru,myfoodforum.ru


indicator: 89.108.115.232
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:14:54.103054
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.115.232", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon

reverse_dns:
  webinar.reutdent.ru,shermano.ru,papiliot.online,amid89.luxury.clank.nomukou.ru,luxury.clank.nomukou.ru,stoop13.performed.pride.nomukou.ru,kallima.online,hesperiidae.online,biblidinae.online,dahmke.ru


indicator: 89.108.115.234
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,copy,main,explore,cyclopsblink c,footer,ukraine,PartyTicket,IsaacWiper,stealer
queried_at: 2026-04-02T19:15:00.298621
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.115.234", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon"

reverse_dns:
  www.dipteran.online,clostri.ru,kallima.online,papiliot.online,maniola.online,ariuma.ru,acetobacter.online,mamberis.ru,cyrestinae.online,blattodea.online


indicator: 89.108.115.235
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:15:08.305157
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.115.235", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon

reverse_dns:
  www.lk.kfsamara.store,lk.kfsamara.store,www.lk.kfsamara.com,lk.kfsamara.com,www.povar.kukme.ru,povar.kukme.ru,www.nobug.store,www.kfsamara.com,kfsamara.com,kfbiz.online


indicator: 89.108.115.241
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:15:28.704084
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.115.241", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon

reverse_dns:
  analyticselmikeev.ru,deep-settled.ssinapa.ru,zamaniwa.ru,percent.volotras.ru,deep-rootedness.ssinapa.ru,ending.amieteku.ru,naughty.volotras.ru,deerstalkers.ssinapa.ru,jean.zamaniwa.ru,jessie.zamaniwa.ru


indicator: 89.108.115.236
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:15:29.562276
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.115.236", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon",


indicator: 89.108.65.157
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:15:41.234635
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.65.157", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon 

reverse_dns:
  schastye.com,devsite-lst.online,metoshi.site,noctuidaes.online,oderas.ru,blattodea.online,coliadinae.online,putrif.ru,ariuma.ru,apoxipodes.online


indicator: 89.108.70.22
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:15:47.412996
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.70.22", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon g

reverse_dns:
  www.resumeone.ru,api.resumeone.ru,resumeone.ru,www.staging.getcode.tech,staging.getcode.tech,getcode.tech,www.getcode.tech,www.getcodedev.ru,getcodedev.ru,lortova.ru


indicator: 89.108.70.223
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:16:02.058917
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.70.223", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 

reverse_dns:
  room.megainvest.space,just-portfolio.com,www.just-portfolio.com,89-108-70-223.cloudvps.regruhosting.ru,megatos.online,mycodar.ru,maniola.online,mamberis.ru,hierodula.online,lophacris.online


indicator: 89.108.71.205
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:16:08.394148
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.71.205", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 

reverse_dns:
  moneyear.site,acrididae.online,shermano.ru,ariuma.ru,blattodea.online,apidaet.online,megatos.online,mamberis.ru,hierodula.online,limulusa.online


indicator: 89.108.76.135
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:16:15.216817
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.76.135", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 

reverse_dns:
  elastic.panampizza.ru,mantidae.online,nymphalidaes.online,erati.ru,metcalfas.online,mesant.online,maniola.online,ariuma.ru,mantodeas.online,libellulidae.online


indicator: 89.108.76.226
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:16:26.785699
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.76.226", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 

reverse_dns:
  oderas.ru,tubercur.ru,fusari.ru,fortias.ru,baryo.ru,mucora.ru,acrididae.ru,apaturinae.ru,limenitis.ru,lepidopteras.ru


indicator: 89.108.76.246
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T19:16:41.585157
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.76.246", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group"

reverse_dns:
  www.zongri.cn,zongri.cn,corolain.ru,goloser.ru,bhack.simplex-software.ru,mantodeas.online,graphiuma.online,eurypterida.online,hymenoptera.online,dahmke.ru


indicator: 89.108.76.95
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T19:16:44.327450
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.76.95", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group",

reverse_dns:
  1spaceapi.ru,www.1spaceapi.ru,hyundai-gkmir.ru,www.hyundai-gkmir.ru,fusari.ru,proteug.ru,blattodea.ru,aerogenosa.ru,lovers.semara.ru,tomond.ru


indicator: 89.108.77.133
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:17:05.055751
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.77.133", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon 


indicator: 89.108.77.204
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:17:20.933424
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.77.204", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 

reverse_dns:
  www.ruwordie.site,ruwordie.site,interest7.navigation.holotran.ru,megatos.online,cerambycidae.online,lophacris.online,hymenoptera.online,acrididae.online,oderas.ru,blaberidae.online


indicator: 89.108.77.202
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:17:26.838126
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.77.202", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon 

reverse_dns:
  www.artemmanicureshop.ru,artemmanicureshop.ru,manikureshop.online,www.manikureshop.online,manikureshop.ru,www.manikureshop.ru,sand79.navy.mudarist.ru,fanniidae.online,hierodula.online,maniola.online


indicator: 89.108.78.126
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:17:41.209827
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.78.126", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 


indicator: 89.108.78.128
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:18:02.653674
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.78.128", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 


indicator: 89.108.78.247
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:18:22.965781
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.78.247", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 


indicator: 89.108.78.252
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:18:43.739261
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.78.252", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 


indicator: 89.108.78.82
indicator_type: ipv4
source: otx
country: RU
hosting_provider: vnc client,august,gafgyt,HermeticWiper,wiper,appdata,runprogram,russia,poshc2,alliance
queried_at: 2026-04-02T19:19:04.169497
raw_data:
  {"pulse_count": 25, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.78.82", "tags": ["vnc client", "august", "gafgyt", "HermeticWiper", "wiper", "appdata", "runprogram", "russia", "poshc2", "alliance", "Gamardeon", "symantec", "asyncrat", "raccoon", "geopolitical conflict", "2022", "defender", "s0147", "palo alto", "alertinfo", "ukraine", "powgoop", "APT", "lazagne", "pupyrat", "primi


indicator: 89.108.79.13
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:19:04.492706
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.79.13", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc

reverse_dns:
  devrm.ru,mvrm.ru,www.devctl.ru,devctl.ru,devctl.online,www.devicectl.online,devicectl.online,alloy.vadilops.ru,false.grafitto.ru,coleopteras.online


indicator: 89.108.79.91
indicator_type: ipv4
source: otx
country: RU
reverse_dns: www.nitkiplus.ru,nitkiplus.ru,ty.bvoltaa.ru,bigtraff.tech
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:19:10.730928
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.79.91", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon g


indicator: 89.108.81.106
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:19:30.783014
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.81.106", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon 


indicator: 89.108.81.201
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T19:19:48.524863
raw_data:
  {"pulse_count": 10, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.81.201", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group


indicator: 89.108.81.210
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T19:19:53.906154
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.81.210", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group"

reverse_dns:
  89-108-81-210.cloudvps.regruhosting.ru,alloy.vadilops.ru,hurama.ru,nematoceras.ru,ovinus.ru,merostomata.ru,heteroptera.ru,gromphadorhina.ru,polyphemus.ru,dipteran.ru


indicator: 89.108.81.30
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:20:13.941065
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.81.30", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "


indicator: 89.108.81.77
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:20:34.274059
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.81.77", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "


indicator: 89.108.81.8
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,copy,main,explore,cyclopsblink c,footer,ukraine,PartyTicket,IsaacWiper,stealer
queried_at: 2026-04-02T19:20:53.201889
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.81.8", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "


indicator: 89.108.83.23
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:21:13.741455
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.83.23", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "


indicator: 89.108.83.235
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:21:34.337200
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.83.235", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 


indicator: 89.108.88.15
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,copy,main,explore,cyclopsblink c,footer,ukraine,PartyTicket,IsaacWiper,stealer
queried_at: 2026-04-02T19:21:37.027206
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.88.15", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", 

reverse_dns:
  ws.yourhotelapp.ru,static.yourhotelapp.ru,media.yourhotelapp.ru,lovers.semara.ru,kilogar.ru,alloy.vadilops.ru,graphosoma.ru,apaturinae.ru,cyrestinae.ru,scorpiones.online


indicator: 89.108.88.174
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,copy,main,explore,cyclopsblink c,footer,ukraine,PartyTicket,IsaacWiper,stealer
queried_at: 2026-04-02T19:21:55.041414
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.88.174", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon",


indicator: 89.108.88.6
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,copy,main,explore,cyclopsblink c,footer,ukraine,PartyTicket,IsaacWiper,stealer
queried_at: 2026-04-02T19:22:22.337022
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.88.6", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "


indicator: 89.108.98.101
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T19:22:47.414543
raw_data:
  {"pulse_count": 13, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.98.101", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "Bruteforce", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "g

reverse_dns:
  kilogar.ru,lovers.semara.ru,tubercur.ru,alloy.vadilops.ru,hurama.ru,libellulidae.ru,mucora.ru,arctiidae.ru,libellulat.ru,nematoceras.ru


indicator: 89.108.88.67
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:22:47.715448
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.88.67", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "


indicator: 89.108.98.113
indicator_type: ipv4
source: otx
country: RU
hosting_provider: palo alto,WhisperGate,vnc samples,alliance,ddos,stealer,span,explore,runprogram,samples
queried_at: 2026-04-02T19:23:05.260608
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.98.113", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group"


indicator: 89.108.98.124
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:23:25.504355
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.98.124", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "un


indicator: 89.108.98.125
indicator_type: ipv4
source: otx
country: RU
reverse_dns: l706de22.justinstalledpanel.com,b.clkey.com
hosting_provider: qakbot,WhisperGate,slapstick,remcom,powgoop,armageddon,lazagne,crackmapexec,shuckworm,vbscript b
queried_at: 2026-04-02T19:23:30.997783
raw_data:
  {"pulse_count": 25, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.98.125", "tags": ["qakbot", "WhisperGate", "slapstick", "remcom", "powgoop", "armageddon", "lazagne", "crackmapexec", "shuckworm", "vbscript b", "tsunami", "ghostwriter", "malware", "sha256", "symantec", "wildfire", "Gamardeon", "defender", "alertinfo", "domain", "deviceid", "Cyclops", "ip address", "palo alto", "ddos


indicator: 89.185.84.141
indicator_type: ipv4
source: otx
country: RU
hosting_provider: as207713,as14061,as211211,backdoors,apt,as212189,as39798,stealers,as207651
queried_at: 2026-04-02T19:23:50.119670
raw_data:
  {"pulse_count": 6, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS207713 tim windelschmidt", "indicator": "89.185.84.141", "tags": ["as207713", "as14061", "as211211", "backdoors", "apt", "as212189", "as39798", "stealers", "as207651"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Gamaredon's Rapid Data Exfiltration Tactics Following Initial Compromise", "Summary informat


indicator: 89.185.84.204
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-04-02T19:24:04.107919
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS207713 tim windelschmidt", "indicator": "89.185.84.204", "tags": ["welivesecurity", "sample hashes", "backdoors", "apt", "malicious", "pterolnk", "pteropshell", "word template", "stealers", "office macro", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-Lis

hosting_provider:
[cell repeats an earlier one in this file: 109 characters]


indicator: 89.19.209.154
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-04-02T19:24:33.149785
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS41465 limited liability company volgogaztelecom", "indicator": "89.19.209.154", "tags": ["welivesecurity", "sample hashes", "backdoors", "apt", "malicious", "pterolnk", "pteropshell", "word template", "stealers", "office macro", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022

hosting_provider:
[cell repeats an earlier one in this file: 109 characters]


indicator: 89.223.123.121
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:24:53.542928
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "89.223.123.121", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "


indicator: 89.23.107.188
indicator_type: ipv4
source: otx
country: RU
city: Yekaterinburg
reverse_dns: nl.atlanta-internet.ru,lesnoygaff.ru,sekabeting.com,vz99betvn.com,footballbet18.com,ufaclubs.com
hosting_provider: backdoors,vbscript,malicious,gamaredon,options,word template,stealers,apt,sample hashes,pterosteal
queried_at: 2026-04-02T19:25:05.960118
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Yekaterinburg", "asn": "AS48687 noviton ltd", "indicator": "89.23.107.188", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP


indicator: 91.188.222.50
indicator_type: ipv4
source: otx
country: RU
city: Moscow
reverse_dns: mail.bitsbfree.com,bitsbfree.com,la6c6a02.justinstalledpanel.com
queried_at: 2026-04-02T19:25:21.814322
raw_data:
  {"pulse_count": 6, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS208626 servtech ltd", "indicator": "91.188.222.50", "tags": ["Gamaredon", "domain", "jazi", "Trident Ursa", "gamaredon", "tweet see", "url https", "threatactor.primitivebear", "threatactor/tridentursa", "apt sfx", "Gamaredon Group", "threatactor/actinium", "sample", "ip address", "threatactor/gamaredon"], "pulses": ["Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict 

hosting_provider:
  Gamaredon,domain,jazi,Trident Ursa,gamaredon,tweet see,url https,threatactor.primitivebear,threatactor/tridentursa,apt sfx


indicator: 91.200.148.232
indicator_type: ipv4
source: otx
country: GB
city: Bromley
hosting_provider: backdoors,vbscript,malicious,gamaredon,options,word template,stealers,apt,sample hashes,pterosteal
queried_at: 2026-04-02T19:25:39.560153
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "Bromley", "asn": "AS26636 quickpacket  llc", "indicator": "91.200.148.232", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on 


indicator: 92.242.62.112
indicator_type: ipv4
source: otx
country: US
city: Redwood City
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:25:59.816959
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Redwood City", "asn": "AS201192 dilmax corporation", "indicator": "92.242.62.112", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 

reverse_dns:
  newsihundred.site,rfitarmail.online,myces.ru,teroba.ru,krashand.ru,youthful-fermat.92-242-62-112.plesk.page,mysussdtc.com,mypoloekrese.com,myreditreskres.com,myakshhpp.com


indicator: 92.242.62.132
indicator_type: ipv4
source: otx
country: US
city: Redwood City
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:26:03.566014
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Redwood City", "asn": "AS201192 dilmax corporation", "indicator": "92.242.62.132", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "un

reverse_dns:
  signinaccountscoinbase.com,webdisk.scirelinks.top,managerupdate.top,www.payple.com.managerupdate.top,payple.com.managerupdate.top,amzn.com.managerupdate.top,www.amzn.com.managerupdate.top,servicesectorupdate.com,www.noreplyservice0009.top,noreplyservice0009.top


indicator: 92.242.62.186
indicator_type: ipv4
source: otx
country: US
city: Redwood City
reverse_dns: offerfollowing.life,onlinenewshot.pro,monexelent.shop,myces.ru,teroba.ru,krashand.ru,stefany.club
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:26:33.629135
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Redwood City", "asn": "AS201192 dilmax corporation", "indicator": "92.242.62.186", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon 


indicator: 92.242.62.181
indicator_type: ipv4
source: otx
country: US
city: Redwood City
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:26:35.630940
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Redwood City", "asn": "AS201192 dilmax corporation", "indicator": "92.242.62.181", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 


indicator: 92.242.62.254
indicator_type: ipv4
source: otx
country: US
city: Redwood City
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:26:45.015127
raw_data:
  {"pulse_count": 25, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Redwood City", "asn": "AS201192 dilmax corporation", "indicator": "92.242.62.254", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", 

reverse_dns:
  regisedmade.monster,bestdomain.click,makedell.yachts,makedell.xyz,tralosp.shop,myces.ru,teroba.ru,krashand.ru,microsoftware.net


indicator: 92.242.62.45
indicator_type: ipv4
source: otx
country: US
city: Redwood City
reverse_dns: andcaster.lat,vaudevilless.live,mushroomlilly.com
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:26:57.943362
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Redwood City", "asn": "AS201192 dilmax corporation", "indicator": "92.242.62.45", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon g


indicator: 92.242.62.96
indicator_type: ipv4
source: otx
country: US
city: Redwood City
hosting_provider: qakbot,WhisperGate,slapstick,remcom,powgoop,armageddon,lazagne,crackmapexec,shuckworm,vbscript b
queried_at: 2026-04-02T19:27:11.668771
raw_data:
  {"pulse_count": 25, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Redwood City", "asn": "AS201192 dilmax corporation", "indicator": "92.242.62.96", "tags": ["qakbot", "WhisperGate", "slapstick", "remcom", "powgoop", "armageddon", "lazagne", "crackmapexec", "shuckworm", "vbscript b", "tsunami", "ghostwriter", "malware", "sha256", "symantec", "wildfire", "Gamardeon", "defender", "alertinfo", "domain", "deviceid", "Cyclops", "ip address", "palo alto", "ddos"

reverse_dns:
  doilyrete.site,payple.com.manage-srvicse-updateds.com,manage-srvicse-updateds.com,verfiyupdte-mngeraccount.com,secureupdte-accnt.com,redytrcg.com,paypled.com.manage-auths-securdes.com,manage-auths-securdes.com,payple.com.verfiyupdte-mngeraccount.com,www.payple.com.verfiyupdte-mngeraccount.com


indicator: 92.255.76.169
indicator_type: ipv4
source: otx
country: RU
reverse_dns: howtosl.com,icecream.jokyprod.com,anna.jokyprod.com,www.jokyprod.com,jokyprod.com
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:27:22.375507
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "92.255.76.169", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powe


indicator: 92.53.97.145
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-04-02T19:27:43.139883
raw_data:
  {"pulse_count": 29, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "92.53.97.145", "tags": ["powersploit", "qakbot", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "gamaredon", "razy", "wiper", "armageddon", "APT", "lazagne", "crackmapexec", "gamaredon group", "powerstats", "pupyrat", "tsunami", "g0047", "asyncrat", "poshc2", "muddywater", "russia", "pter

hosting_provider:
  powersploit,qakbot,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom,primitive bear,powgoop


indicator: 94.228.120.181
indicator_type: ipv4
source: otx
country: RU
reverse_dns: l61eb776.justinstalledpanel.com
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:27:48.724237
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "94.228.120.181", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "pow


indicator: 94.250.251.39
indicator_type: ipv4
source: otx
country: RU
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:28:09.320801
raw_data:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS29182 jsc iot", "indicator": "94.250.251.39", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyr


indicator: 95.179.216.77
indicator_type: ipv4
source: otx
country: FR
city: Aubervilliers
queried_at: 2026-04-02T19:28:26.057046
raw_data:
  {"pulse_count": 4, "reputation": 0, "country": "France", "country_code": "FR", "city": "Aubervilliers", "asn": "AS20473 the constant company  llc", "indicator": "95.179.216.77", "tags": ["url https", "Gamaredon", "Gamaredon Group", "sample", "threatactor.primitivebear", "Trident Ursa", "domain", "threatactor/actinium", "threatactor/gamaredon", "threatactor/tridentursa", "ip address"], "pulses": ["Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion o

hosting_provider:
[cell repeats an earlier one in this file: 155 characters]


indicator: 95.179.221.114
indicator_type: ipv4
source: otx
country: FR
city: Aubervilliers
hosting_provider: domain,mimikatz,cyclopsblink c,formbook,ukraine,powgoop,PartyTicket,IsaacWiper,stealer,APT
queried_at: 2026-04-02T19:28:40.324208
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "France", "country_code": "FR", "city": "Aubervilliers", "asn": "AS20473 the constant company  llc", "indicator": "95.179.221.114", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "


indicator: 95.179.221.147
indicator_type: ipv4
source: otx
country: FR
city: Aubervilliers
hosting_provider: mimikatz,formbook,powgoop,PartyTicket,IsaacWiper,stealer,APT,gafgyt,lazagne,redrum
queried_at: 2026-04-02T19:28:54.936944
raw_data:
  {"pulse_count": 30, "reputation": 0, "country": "France", "country_code": "FR", "city": "Aubervilliers", "asn": "AS20473 the constant company  llc", "indicator": "95.179.221.147", "tags": ["mimikatz", "formbook", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "muddywater", "powersploit", "wiper", "VPN", "gamaredon", "crackmapexec", "pteranodon", "mirai", "tsunami", "powerstats", "mori backdoor", "gamaredon group", "russia", "w

reverse_dns:
  animesamadlapk.xyz,street-hypnose.fr,www.street-hypnose.fr,hangout.street-hypnose.fr,formations.preprod.hunkaar.fr,formations.hunkaar.fr,jec.hunkaar.fr,preprod.hunkaar.fr,hunkaar.fr,www.hunkaar.fr


indicator: 1.53.11.141
indicator_type: ipv4
source: otx
country: VN
city: Ho Chi Minh City
queried_at: 2026-04-02T19:29:13.845179
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Viet Nam", "country_code": "VN", "city": "Ho Chi Minh City", "asn": "AS18403 fpt telecom company", "indicator": "1.53.11.141", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 106.51.89.49
indicator_type: ipv4
source: otx
country: IN
city: Bengaluru
queried_at: 2026-04-02T19:29:17.056523
raw_data:
  {"pulse_count": 4, "reputation": 0, "country": "India", "country_code": "IN", "city": "Bengaluru", "asn": "AS24309 atria convergence technologies", "indicator": "106.51.89.49", "tags": ["fancy bear", "credential theft", "spypress.roundish", "ukraine", "roundcube", "webmail", "xdsfeerdfbn", "chlg url", "government", "filehashsha256", "email", "css injection", "xss", "apt28", "go implant", "httd", "filehashmd5", "filehashsha1"], "pulses": ["Operation Roundish: Uncovering an APT28 Roundcube Exploit

hosting_provider:
  fancy bear,credential theft,spypress.roundish,ukraine,roundcube,webmail,xdsfeerdfbn,chlg url,government,filehashsha256


indicator: 95.179.223.56
indicator_type: ipv4
source: otx
country: FR
city: Aubervilliers
hosting_provider: powersploit,qakbot,WhisperGate,ddos,stealer,gafgyt,august stealer,mori backdoor,slapstick,remcom
queried_at: 2026-04-02T19:29:17.098502
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "France", "country_code": "FR", "city": "Aubervilliers", "asn": "AS20473 the constant company  llc", "indicator": "95.179.223.56", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "un


indicator: 109.169.15.73
indicator_type: ipv4
source: otx
country: GB
city: Stockport
hosting_provider: apt28,gru,fancy bear,sofacy
queried_at: 2026-04-02T19:29:34.793672
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "Stockport", "asn": "AS20860 iomart cloud services limited", "indicator": "109.169.15.73", "tags": ["apt28", "gru", "fancy bear", "sofacy"], "pulses": ["US firm says Russia hacked company at heart of Trump impeachment"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 130.61.233.105
indicator_type: ipv4
source: otx
country: DE
city: Frankfurt am Main
reverse_dns: web-glow.online
queried_at: 2026-04-02T19:29:41.716654
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS31898 oracle corporation", "indicator": "130.61.233.105", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["web-glow.online"]}


indicator: 121.127.232.250
indicator_type: ipv4
source: otx
country: HK
reverse_dns: us-binance.net,cntdg.com,vsinapp.com,ww.hk200.wsdns.cc,jinsupermars.hk200.wshost.cc
hosting_provider: ioc,malicious,cyber security,phishing,Nextray
queried_at: 2026-04-02T19:29:44.753490
raw_data:
  {"pulse_count": 29, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS64050 bgpnet global asn", "indicator": "121.127.232.250", "tags": ["ioc", "malicious", "cyber security", "phishing", "Nextray"], "pulses": ["IOC Records Provided by @NextRayAI", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOC Records \u2192Provided by @NextRayAI", "HIVE           (Pulse created by RVS_i_am)", "HIVE           (Pulse created by RVS_i_a


indicator: 144.126.202.227
indicator_type: ipv4
source: otx
country: GB
city: London
hosting_provider: apt28,forensics,info,openai,control,win64,command line,certua,investigation,enabled
queried_at: 2026-04-02T19:30:02.508417
raw_data:
  {"pulse_count": 12, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS14061 digitalocean  llc", "indicator": "144.126.202.227", "tags": ["apt28", "forensics", "info", "openai", "control", "win64", "command line", "certua", "investigation", "enabled", "o365", "falconshield", "fancy bear", "pawn storm", "clfs", "graphic", "path dropped", "linkedin", "windows nt", "sednit", "llms", "sofacy", "download", "command", "


