# enrichment_results

indicator: 79.141.173.70
indicator_type: ipv4
source: otx
country: BG
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:23:54.411897
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.70", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 79.141.173.96
indicator_type: ipv4
source: otx
country: BG
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:23:56.885614
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.96", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 19, "malware_samples": [], "passive_dns": ["taddeocos.com", "nfmjarusioke.com", "fatimanorthyuul.com", "xasawosting.com", "salacercamarvyuaiman.com", "muchouitelebria.com", "lakerad

reverse_dns:
  taddeocos.com,nfmjarusioke.com,fatimanorthyuul.com,xasawosting.com,salacercamarvyuaiman.com,muchouitelebria.com,lakeradomit.com,horsaspafcar.com,hearcatbook.com,resuolyertteqeoin.com


indicator: 79.141.173.97
indicator_type: ipv4
source: otx
country: BG
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:23:59.064344
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.97", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 20, "malware_samples": [], "passive_dns": ["samechelneluytremen.com", "fatimanohyuul.com", "faraamblo.com", "fatimanoul.com", "muchocoiltelebria.com", "muchocoilouitelebria.com", "f

reverse_dns:
  samechelneluytremen.com,fatimanohyuul.com,faraamblo.com,fatimanoul.com,muchocoiltelebria.com,muchocoilouitelebria.com,filonasusaroltisdp.com,horsaspafcap.com,www.mishayeonoy.nl,mishayeonoy.nl


indicator: 79.141.173.98
indicator_type: ipv4
source: otx
country: BG
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:24:03.560825
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.98", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 22, "malware_samples": [], "passive_dns": ["sintyiroiylire.com", "samechelneluytre.com", "vaflasarp.com", "salacercamaiman.com", "hodergkaj.com", "pyloseulonutul.com", "kiolosalacer

reverse_dns:
  sintyiroiylire.com,samechelneluytre.com,vaflasarp.com,salacercamaiman.com,hodergkaj.com,pyloseulonutul.com,kiolosalacerciman.com,ahtstyrlonrtio.com,sluverxergrotoe.nl,nishyhonoy.nl


indicator: 79.141.173.103
indicator_type: ipv4
source: otx
country: BG
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:24:06.843777
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.103", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 22, "malware_samples": [], "passive_dns": ["samechelneluy.com", "guhihono.com", "relrirasai.com", "xodergkaj.com", "calyizionzinpo.com", "sodergkaj.com", "muchocoiltbria.com", "hou

reverse_dns:
  samechelneluy.com,guhihono.com,relrirasai.com,xodergkaj.com,calyizionzinpo.com,sodergkaj.com,muchocoiltbria.com,hourbastfuct.com,hexacatbook.com,favowykeopen.com


indicator: 79.141.173.119
indicator_type: ipv4
source: otx
country: BG
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:24:08.965536
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.119", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 79.141.173.120
indicator_type: ipv4
source: otx
country: BG
reverse_dns: gphosting.de
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:24:21.162749
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.120", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["gphosting.de"]}


indicator: 79.141.173.121
indicator_type: ipv4
source: otx
country: BG
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:24:23.763591
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.121", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 79.141.173.122
indicator_type: ipv4
source: otx
country: BG
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:24:27.720613
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.122", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 13, "malware_samples": [], "passive_dns": ["wertasoerianaa.com", "tanralruan.com", "seralruan.com", "poiwertasuia.com", "aramahgamyuch.com", "solowerwaleerty.com", "salacerciman.co

reverse_dns:
  wertasoerianaa.com,tanralruan.com,seralruan.com,poiwertasuia.com,aramahgamyuch.com,solowerwaleerty.com,salacerciman.com,kiokiolosalace.com,horsaspafcal.com,www.solchekloas.nl


indicator: 79.141.173.211
indicator_type: ipv4
source: otx
country: BG
hosting_provider: july,ip address,middle vps,sept,dns hijacking,march
queried_at: 2026-04-08T06:24:33.349353
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.211", "tags": ["july", "ip address", "middle vps", "sept", "dns hijacking", "march"], "pulses": ["IOC - FrostArmada: All thriller, no (malware) filler", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 79.141.173.231
indicator_type: ipv4
source: otx
country: BG
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:24:47.964989
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.231", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 17, "malware_samples": [], "passive_dns": ["mfarmturan.com", "lottyiryioiylire.com", "gugtuno.com", "opreteerianaa.com", "oerianaa.com", "activetu.com", "tarewiolovaraviubx.com", "

reverse_dns:
  mfarmturan.com,lottyiryioiylire.com,gugtuno.com,opreteerianaa.com,oerianaa.com,activetu.com,tarewiolovaraviubx.com,poidarsamonov.com,eretomimik.com,registeranus.com


indicator: 79.141.173.232
indicator_type: ipv4
source: otx
country: BG
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:24:50.109616
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.232", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 8, "malware_samples": [], "passive_dns": ["baronertresuolin.com", "casawosting.com", "sasawosting.com", "pyloatanoul.com", "poidardsamonov.com", "faeraaebria.com", "proverkag.nl", 

reverse_dns:
  baronertresuolin.com,casawosting.com,sasawosting.com,pyloatanoul.com,poidardsamonov.com,faeraaebria.com,proverkag.nl,www.proverkag.nl


indicator: 79.141.173.233
indicator_type: ipv4
source: otx
country: BG
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:24:52.434171
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.233", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 8, "malware_samples": [], "passive_dns": ["opreteryuerianaa.com", "sauloeraaebria.com", "saulogetoeraaebria.com", "pyloanoul.com", "www.mishonoy.nl", "mishonoy.nl", "reerarasai.nl"

reverse_dns:
  opreteryuerianaa.com,sauloeraaebria.com,saulogetoeraaebria.com,pyloanoul.com,www.mishonoy.nl,mishonoy.nl,reerarasai.nl,www.reerarasai.nl


indicator: 185.117.88.22
indicator_type: ipv4
source: otx
country: SE
city: Stockholm
reverse_dns: chooseform.com
hosting_provider: windows,ip address,honeypot,blacklist,admin,win,dns hijacking,tcp,scan,botnet
queried_at: 2026-04-08T06:24:54.606747
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Sweden", "country_code": "SE", "city": "Stockholm", "asn": "AS42708 glesys ab", "indicator": "185.117.88.22", "tags": ["windows", "ip address", "honeypot", "blacklist", "admin", "win", "dns hijacking", "tcp", "scan", "botnet", "Malicious IP", "mirai", "Honeypot", "RDP"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations", "Lion Team_Honeypots_RDP_IP 2023/03/26", "Scan port 3389 RDP (S3#)"], "malware_count": 0, "passive_dns_


indicator: 185.117.88.28
indicator_type: ipv4
source: otx
country: SE
city: Stockholm
reverse_dns: fuckingyoung.org,www.fuckingyoung.org,blacksexmix.com,www.blacksexmix.com
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:24:57.955637
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Sweden", "country_code": "SE", "city": "Stockholm", "asn": "AS42708 glesys ab", "indicator": "185.117.88.28", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["fuckingyoung.org", "www.fuckingyoung.org", "blacksexmix.com", "www.blacksexmix.com"]}


indicator: 185.117.88.30
indicator_type: ipv4
source: otx
country: SE
city: Stockholm
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:25:05.527237
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Sweden", "country_code": "SE", "city": "Stockholm", "asn": "AS42708 glesys ab", "indicator": "185.117.88.30", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 7, "malware_samples": [], "passive_dns": ["ftoury.com", "www.momspost.com", "momspost.com", "ns1.fuckedblackgirls.com", "ns2.fuckedblackgirls.com", "fuckedblackgirls.com", "www.fucke

reverse_dns:
  ftoury.com,www.momspost.com,momspost.com,ns1.fuckedblackgirls.com,ns2.fuckedblackgirls.com,fuckedblackgirls.com,www.fuckedblackgirls.com


indicator: 185.117.88.31
indicator_type: ipv4
source: otx
country: SE
city: Stockholm
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:25:22.914673
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Sweden", "country_code": "SE", "city": "Stockholm", "asn": "AS42708 glesys ab", "indicator": "185.117.88.31", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 185.117.88.50
indicator_type: ipv4
source: otx
country: SE
city: Stockholm
reverse_dns: www.yambler.net,yamdex.net,yambler.net,firstsputnik.ru,www.yamdex.net
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:25:27.718284
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Sweden", "country_code": "SE", "city": "Stockholm", "asn": "AS42708 glesys ab", "indicator": "185.117.88.50", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 5, "malware_samples": [], "passive_dns": ["www.yambler.net", "yamdex.net", "yambler.net", "firstsputnik.ru", "www.yamdex.net"]}


indicator: 185.117.88.60
indicator_type: ipv4
source: otx
country: SE
city: Stockholm
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:25:30.767328
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Sweden", "country_code": "SE", "city": "Stockholm", "asn": "AS42708 glesys ab", "indicator": "185.117.88.60", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.117.88.61
indicator_type: ipv4
source: otx
country: SE
city: Stockholm
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:25:48.034520
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Sweden", "country_code": "SE", "city": "Stockholm", "asn": "AS42708 glesys ab", "indicator": "185.117.88.61", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 185.117.88.62
indicator_type: ipv4
source: otx
country: SE
city: Stockholm
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:25:51.561079
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Sweden", "country_code": "SE", "city": "Stockholm", "asn": "AS42708 glesys ab", "indicator": "185.117.88.62", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.117.89.32
indicator_type: ipv4
source: otx
country: SE
city: Stockholm
reverse_dns: booksbord.net
hosting_provider: july,ip address,middle vps,sept,dns hijacking,march
queried_at: 2026-04-08T06:26:01.684567
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Sweden", "country_code": "SE", "city": "Stockholm", "asn": "AS42708 glesys ab", "indicator": "185.117.89.32", "tags": ["july", "ip address", "middle vps", "sept", "dns hijacking", "march"], "pulses": ["IOC - FrostArmada: All thriller, no (malware) filler", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["booksbord.net"]}


indicator: 185.117.89.46
indicator_type: ipv4
source: otx
country: SE
city: Stockholm
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:26:04.743951
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Sweden", "country_code": "SE", "city": "Stockholm", "asn": "AS42708 glesys ab", "indicator": "185.117.89.46", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.117.89.47
indicator_type: ipv4
source: otx
country: SE
city: Stockholm
reverse_dns: emorymediaconsulting.org
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:26:07.671152
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Sweden", "country_code": "SE", "city": "Stockholm", "asn": "AS42708 glesys ab", "indicator": "185.117.89.47", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations", "Compromised IPs 1"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["emorymediaconsulting.org"]}


indicator: 185.237.166.55
indicator_type: ipv4
source: otx
country: HK
hosting_provider: july,ip address,middle vps,sept,dns hijacking,march
queried_at: 2026-04-08T06:26:10.092895
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.55", "tags": ["july", "ip address", "middle vps", "sept", "dns hijacking", "march"], "pulses": ["IOC - FrostArmada: All thriller, no (malware) filler", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.56
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:26:13.365402
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.56", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.57
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:26:30.409542
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.57", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 185.237.166.58
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:26:47.575727
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.58", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "passive_dns": []}


indicator: 185.237.166.59
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:26:50.532794
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.59", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.60
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:26:55.673130
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.60", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.61
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:26:58.012706
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.61", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.63
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:27:30.613656
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.63", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 185.237.166.64
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:27:32.971559
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.64", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.65
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:27:52.233238
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.65", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 185.237.166.66
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:28:09.232288
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.66", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 185.237.166.67
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:28:14.591303
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.67", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.68
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:28:24.805204
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.68", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.69
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:28:41.884919
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.69", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 185.237.166.70
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:28:47.056256
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.70", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.71
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:28:49.999782
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.71", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["a32a244969eb549bfe7664785917babf4bedf532787ef9206644f95ca62f434a"], "passive_dns": []}


indicator: 185.237.166.72
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:28:52.257166
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.72", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["c9c90f2e01e32e5c00332f2a93ebb0ac692ed3ce2d55c6f729a3bddde03cdedc"], "passive_dns": []}


indicator: 185.237.166.73
indicator_type: ipv4
source: otx
country: HK
reverse_dns: taniaruosentien.net
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:29:00.105628
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.73", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["taniaruosentien.net"]}


indicator: 185.237.166.75
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:29:33.142368
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.75", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 185.237.166.224
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:29:54.148757
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.224", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 185.237.166.225
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:30:26.080623
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.225", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0}


indicator: 185.237.166.226
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:30:31.724902
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.226", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 185.237.166.227
indicator_type: ipv4
source: otx
country: HK
hosting_provider: dns hijacking,ip address
queried_at: 2026-04-08T06:30:49.109752
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.227", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 64.120.31.98
indicator_type: ipv4
source: otx
country: US
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:03:04.291608
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS396362 leaseweb usa  inc.", "indicator": "64.120.31.98", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 64.120.31.100
indicator_type: ipv4
source: otx
country: US
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:03:21.273238
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS396362 leaseweb usa  inc.", "indicator": "64.120.31.100", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 77.83.197.38
indicator_type: ipv4
source: otx
country: GB
city: London
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:03:36.725044
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS61046 hz hosting ltd", "indicator": "77.83.197.38", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 77.83.197.39
indicator_type: ipv4
source: otx
country: GB
city: London
reverse_dns: amcuce.com
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:03:44.907413
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS61046 hz hosting ltd", "indicator": "77.83.197.39", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["amcuce.com"]}


indicator: 77.83.197.43
indicator_type: ipv4
source: otx
country: GB
city: London
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:03:54.068084
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS61046 hz hosting ltd", "indicator": "77.83.197.43", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 77.83.197.44
indicator_type: ipv4
source: otx
country: GB
city: London
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:03:57.739346
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS61046 hz hosting ltd", "indicator": "77.83.197.44", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 24, "malware_samples": [], "passive_dns": ["cd483.name300.sbs", "ns1.fg6jkds8hhvd1.site", "obshee-delo.biz", "finpb.org", "amazinginvez

reverse_dns:
  cd483.name300.sbs,ns1.fg6jkds8hhvd1.site,obshee-delo.biz,finpb.org,amazinginvezt.org,investgas.net,crypt-invezt.net,btc-es.org,success-finance.org,btcbill.org


indicator: 77.83.197.46
indicator_type: ipv4
source: otx
country: GB
city: London
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:04:03.419378
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS61046 hz hosting ltd", "indicator": "77.83.197.46", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 77.83.197.58
indicator_type: ipv4
source: otx
country: GB
city: London
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:04:06.878482
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS61046 hz hosting ltd", "indicator": "77.83.197.58", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.117.88.29
indicator_type: ipv4
source: otx
country: SE
city: Stockholm
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:04:09.660252
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Sweden", "country_code": "SE", "city": "Stockholm", "asn": "AS42708 glesys ab", "indicator": "185.117.88.29", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 7, "malware_samples": [], "passive_dns": ["schwepes.com", "www.ebonygirlsnaked.net", "ebonygirlsnaked.net", "www.nudebabe.pictures", "nudebabe.pictures", "www.youngpussynaked.com", "

reverse_dns:
  schwepes.com,www.ebonygirlsnaked.net,ebonygirlsnaked.net,www.nudebabe.pictures,nudebabe.pictures,www.youngpussynaked.com,youngpussynaked.com


indicator: 185.237.166.62
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:04:29.802066
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.62", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 185.237.166.74
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:04:33.823200
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.74", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.228
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:04:38.547494
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.228", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.229
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:04:42.007147
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.229", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.230
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:04:46.058803
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.230", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.231
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:04:50.274489
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.231", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.232
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:05:06.564236
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.232", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.233
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:05:17.510927
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.233", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.234
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:05:22.181669
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.234", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.235
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:05:27.665954
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.235", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["8b00c266794f7afff154d6e9555f28d9c48b3508


indicator: 185.237.166.236
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:05:45.506972
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.236", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.237
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:05:50.099658
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.237", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.238
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:05:57.464711
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.238", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.239
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:06:01.448011
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.239", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.240
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:06:19.979511
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.240", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 185.237.166.241
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:06:23.298988
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.241", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.242
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:06:28.192206
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.242", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.243
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:06:43.528360
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.243", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.244
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:07:01.337127
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.244", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 185.237.166.245
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:07:05.199212
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.245", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.246
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:07:26.895402
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.246", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 185.237.166.247
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:07:45.178941
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.247", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 185.237.166.248
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:07:49.563686
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.248", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 185.237.166.249
indicator_type: ipv4
source: otx
country: HK
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:08:00.355677
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.249", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 64.44.154.227
indicator_type: ipv4
source: otx
country: US
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:08:08.253334
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20278 nexeon technologies  inc.", "indicator": "64.44.154.227", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 64.44.154.237
indicator_type: ipv4
source: otx
country: US
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:08:12.482905
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20278 nexeon technologies  inc.", "indicator": "64.44.154.237", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 64.44.154.238
indicator_type: ipv4
source: otx
country: US
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:08:32.801981
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20278 nexeon technologies  inc.", "indicator": "64.44.154.238", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 64.44.154.239
indicator_type: ipv4
source: otx
country: US
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:08:36.689900
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20278 nexeon technologies  inc.", "indicator": "64.44.154.239", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 64.44.154.240
indicator_type: ipv4
source: otx
country: US
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:08:54.689987
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20278 nexeon technologies  inc.", "indicator": "64.44.154.240", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["60a17a0c5a24f901a9b8c


indicator: 77.83.198.39
indicator_type: ipv4
source: otx
country: EE
city: Tallinn
reverse_dns: sharedfilep90.sytes.net
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:08:57.157573
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Estonia", "country_code": "EE", "city": "Tallinn", "asn": "AS59711 hz hosting ltd", "indicator": "77.83.198.39", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["sharedfilep90.sytes.net"]}


indicator: 79.141.173.123
indicator_type: ipv4
source: otx
country: BG
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:08:59.985691
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.123", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 14, "malware_samples": [], "passive_dns": ["seralrmtlkuan.com", "poisyuwertasuia.com", "aramahgamych.com", "headcatbook.com", "lorhkingvox.com", "letstyrlonrtio.com", "titfualirgfh

reverse_dns:
  seralrmtlkuan.com,poisyuwertasuia.com,aramahgamych.com,headcatbook.com,lorhkingvox.com,letstyrlonrtio.com,titfualirgfhtyhy.nl,www.titfualirgfhtyhy.nl,www.zalopsluvfagrotoe.nl,zalopsluvfagrotoe.nl


indicator: 79.141.173.200
indicator_type: ipv4
source: otx
country: BG
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:09:07.603044
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.200", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 79.141.173.210
indicator_type: ipv4
source: otx
country: BG
hosting_provider: ip address,dns hijacking,iocs https
queried_at: 2026-04-08T12:09:11.658591
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.210", "tags": ["ip address", "dns hijacking", "iocs https"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations", "DOH IP & URL IOC"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 79.141.173.246
indicator_type: ipv4
source: otx
country: BG
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:09:14.091654
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.246", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 79.141.173.248
indicator_type: ipv4
source: otx
country: BG
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:09:32.547381
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.248", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 79.141.173.249
indicator_type: ipv4
source: otx
country: BG
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:09:50.059543
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.249", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 79.141.173.250
indicator_type: ipv4
source: otx
country: BG
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:10:07.334003
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.250", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 79.141.173.251
indicator_type: ipv4
source: otx
country: BG
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:10:24.369592
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.251", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 79.141.173.252
indicator_type: ipv4
source: otx
country: BG
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:10:41.500264
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.252", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 2, "passive_dns_count": 0, "malware_samples": ["c94233d242c3d39cd3f8a822886e07d30049ea1d00f931ae4d0eea11f9262db8", "ab90058bd9f04e488cb76ec1e52ef8fd995066c77b0fdd3233f90026afc05fb3"]}


indicator: 79.141.173.253
indicator_type: ipv4
source: otx
country: BG
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:11:10.284270
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.253", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "passive_dns": []}


indicator: 79.141.173.254
indicator_type: ipv4
source: otx
country: BG
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:11:28.059809
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.254", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 79.143.87.229
indicator_type: ipv4
source: otx
country: GB
city: Manchester
reverse_dns: mumboskyward.com
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:11:45.241403
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "Manchester", "asn": "AS25369 hydra communications ltd", "indicator": "79.143.87.229", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 1, "passive_dns": ["mumboskyward.com"]}


indicator: 79.143.87.232
indicator_type: ipv4
source: otx
country: GB
city: Manchester
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:12:02.718967
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "Manchester", "asn": "AS25369 hydra communications ltd", "indicator": "79.143.87.232", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 79.143.87.243
indicator_type: ipv4
source: otx
country: GB
city: Manchester
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:12:20.945090
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "Manchester", "asn": "AS25369 hydra communications ltd", "indicator": "79.143.87.243", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 79.143.87.249
indicator_type: ipv4
source: otx
country: GB
city: Manchester
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:12:50.665517
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "Manchester", "asn": "AS25369 hydra communications ltd", "indicator": "79.143.87.249", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations", "2024-01-09 Fail2Ban 493ac41c-6205-4baf-906f-638e3c68b36b"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 88.80.148.49
indicator_type: ipv4
source: otx
country: BG
city: Sofia
reverse_dns: v1.rustforall.net
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:13:03.545005
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Sofia", "asn": "AS44901 belcloud ltd", "indicator": "88.80.148.49", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["v1.rustforall.net"]}


indicator: 89.150.40.43
indicator_type: ipv4
source: otx
country: IT
city: Orzinuovi
queried_at: 2026-04-08T12:13:38.520038
raw_data:
  {"pulse_count": 8, "reputation": 0, "country": "Italy", "country_code": "IT", "city": "Orzinuovi", "asn": "AS28716 reti telematiche italiane s.p.a. (retelit s.p.a.)", "indicator": "89.150.40.43", "tags": ["targeted", "research", "cybersecurity", "infrastructure", "cylanceendpoint", "maritime", "pdns", "cve-2017-0199", "urls", "javascript", "vulnerability", "ip address", "cve-2017-11882", "sidewinder", "appendix", "sri lanka", "hashes", "classification", "nation-state", "stage", "phishing", "dns 

reverse_dns:
  salary-cutting.session-out.com,session-out.com,policy.session-out.com,investigation04.session-out.com

hosting_provider:
  targeted,research,cybersecurity,infrastructure,cylanceendpoint,maritime,pdns,cve-2017-0199,urls,javascript


indicator: 89.150.40.86
indicator_type: ipv4
source: otx
country: IT
city: Orzinuovi
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T12:14:00.423672
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Italy", "country_code": "IT", "city": "Orzinuovi", "asn": "AS28716 reti telematiche italiane s.p.a. (retelit s.p.a.)", "indicator": "89.150.40.86", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "passive_dns": []}


indicator: 103.140.186.148
indicator_type: ipv4
source: otx
country: SG
city: Ulu Bedok
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:14:33.522046
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Singapore", "country_code": "SG", "city": "Ulu Bedok", "asn": "AS206804 estnoc oy", "indicator": "103.140.186.148", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0}


indicator: 185.234.73.61
indicator_type: ipv4
source: otx
country: PL
city: Poznan
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:15:39.696627
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Poland", "country_code": "PL", "city": "Poznan", "asn": "AS206804 estnoc oy", "indicator": "185.234.73.61", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["b20b90dc82fb4254ebf893c377dce753e3048ccec9d77026c1


indicator: 185.234.73.62
indicator_type: ipv4
source: otx
country: PL
city: Poznan
hosting_provider: russia,apt28,dns hijacking,exploit,oauth,ip address,tp-link
queried_at: 2026-04-08T12:15:57.914256
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Poland", "country_code": "PL", "city": "Poznan", "asn": "AS206804 estnoc oy", "indicator": "185.234.73.62", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 37.221.64.131
indicator_type: ipv4
source: abuseipdb
country: BG
city: 0
hosting_provider: ALEXHOST SRL
queried_at: 2026-04-08T12:16:07.690294
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "BG", "isp": "ALEXHOST SRL", "domain": "alexhost.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2024-08-25T20:36:33+00:00", "categories": []}


indicator: 37.221.64.150
indicator_type: ipv4
source: abuseipdb
country: BG
city: 0
hosting_provider: ALEXHOST SRL
queried_at: 2026-04-08T12:16:12.904589
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "BG", "isp": "ALEXHOST SRL", "domain": "alexhost.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2024-05-30T02:47:59+00:00", "categories": []}


indicator: 37.221.64.163
indicator_type: ipv4
source: abuseipdb
country: BG
city: 0
hosting_provider: ALEXHOST SRL
queried_at: 2026-04-08T12:16:16.377275
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "BG", "isp": "ALEXHOST SRL", "domain": "alexhost.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2024-11-07T16:26:45+00:00", "categories": []}


indicator: 37.221.64.173
indicator_type: ipv4
source: abuseipdb
country: BG
city: 0
hosting_provider: ALEXHOST SRL
queried_at: 2026-04-08T12:16:18.098538
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "BG", "isp": "ALEXHOST SRL", "domain": "alexhost.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2024-01-16T09:57:36+00:00", "categories": []}


indicator: 37.221.64.199
indicator_type: ipv4
source: abuseipdb
country: BG
city: 0
hosting_provider: ALEXHOST SRL
queried_at: 2026-04-08T12:16:19.877552
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "BG", "isp": "ALEXHOST SRL", "domain": "alexhost.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2021-11-15T02:39:08+00:00", "categories": []}


indicator: 37.221.64.224
indicator_type: ipv4
source: abuseipdb
country: BG
city: 0
hosting_provider: ALEXHOST SRL
queried_at: 2026-04-08T12:16:23.377620
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "BG", "isp": "ALEXHOST SRL", "domain": "alexhost.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2024-05-21T15:14:32+00:00", "categories": []}


indicator: 79.141.173.247
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-08T12:16:26.798825
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "HZ Hosting Ltd", "domain": "hz-hosting.se", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 79.143.87.240
indicator_type: ipv4
source: abuseipdb
country: GB
city: 0
hosting_provider: aminserve.com
queried_at: 2026-04-08T12:16:28.532560
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "GB", "isp": "aminserve.com", "domain": "aminserve.com", "usage_type": "Fixed Line ISP", "last_reported": null, "categories": []}


indicator: 88.80.148.53
indicator_type: ipv4
source: abuseipdb
country: BG
city: 0
hosting_provider: Belcloud LTD
queried_at: 2026-04-08T12:16:30.273493
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "BG", "isp": "Belcloud LTD", "domain": "belcloud.net", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 103.140.186.149
indicator_type: ipv4
source: abuseipdb
country: SG
city: 0
hosting_provider: EstNOC-GLOBAL
queried_at: 2026-04-08T12:16:32.061421
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "SG", "isp": "EstNOC-GLOBAL", "domain": "estnoc.ee", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 185.234.73.58
indicator_type: ipv4
source: abuseipdb
country: PL
city: 0
hosting_provider: EstNOC-Global
queried_at: 2026-04-08T12:16:35.517237
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "PL", "isp": "EstNOC-Global", "domain": "estnoc.ee", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2024-06-27T02:50:06+00:00", "categories": []}


indicator: 5.226.137.151
indicator_type: ipv4
source: abuseipdb
country: GB
city: 0
hosting_provider: Hydra Communications Ltd
queried_at: 2026-04-08T12:16:37.232075
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "GB", "isp": "Hydra Communications Ltd", "domain": "hydracom.co.uk", "usage_type": "Fixed Line ISP", "last_reported": "2023-08-10T14:28:13+00:00", "categories": []}


indicator: 5.226.137.230
indicator_type: ipv4
source: abuseipdb
country: GB
city: 0
hosting_provider: Hydra Communications Ltd
queried_at: 2026-04-08T12:16:38.942601
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "GB", "isp": "Hydra Communications Ltd", "domain": "hydracom.co.uk", "usage_type": "Fixed Line ISP", "last_reported": null, "categories": []}


indicator: 5.226.137.243
indicator_type: ipv4
source: abuseipdb
country: GB
city: 0
hosting_provider: Hydra Communications Ltd
queried_at: 2026-04-08T12:16:49.303359
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "GB", "isp": "Hydra Communications Ltd", "domain": "hydracom.co.uk", "usage_type": "Fixed Line ISP", "last_reported": "2022-09-27T11:50:06+00:00", "categories": []}


indicator: 23.106.120.119
indicator_type: ipv4
source: abuseipdb
country: SG
city: 0
hosting_provider: Leaseweb Asia Pacific Pte. Ltd.
queried_at: 2026-04-08T12:16:54.502635
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "SG", "isp": "Leaseweb Asia Pacific Pte. Ltd.", "domain": "leaseweb.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 64.120.31.96
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: LeaseWeb USA, Inc. New York
queried_at: 2026-04-08T12:16:56.230256
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "LeaseWeb USA, Inc. New York", "domain": "leaseweb.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 77.83.197.37
indicator_type: ipv4
source: abuseipdb
country: SE
city: 0
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-08T12:17:05.038704
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "SE", "isp": "HZ Hosting Ltd", "domain": "hz-hosting.se", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 77.83.197.51
indicator_type: ipv4
source: abuseipdb
country: SE
city: 0
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-08T12:17:29.285272
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "SE", "isp": "HZ Hosting Ltd", "domain": "hz-hosting.se", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2021-05-23T08:40:52+00:00", "categories": []}


indicator: 77.83.197.53
indicator_type: ipv4
source: abuseipdb
country: SE
city: 0
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-08T12:17:32.756387
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "SE", "isp": "HZ Hosting Ltd", "domain": "hz-hosting.se", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2023-02-23T01:43:03+00:00", "categories": []}


indicator: 185.117.88.22
indicator_type: ipv4
source: abuseipdb
country: SE
city: 0
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-08T12:18:45.389988
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "SE", "isp": "HZ Hosting Ltd", "domain": "hz-hosting.se", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2023-04-01T00:10:05+00:00", "categories": []}


indicator: 185.117.89.46
indicator_type: ipv4
source: abuseipdb
country: SE
city: 0
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-08T12:19:02.639326
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "SE", "isp": "HZ Hosting Ltd", "domain": "hz-hosting.se", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2021-09-01T19:25:18+00:00", "categories": []}


indicator: 185.117.89.47
indicator_type: ipv4
source: abuseipdb
country: SE
city: 0
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-08T12:19:04.352368
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "SE", "isp": "HZ Hosting Ltd", "domain": "hz-hosting.se", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2023-12-26T01:19:02+00:00", "categories": []}


indicator: 185.237.166.55
indicator_type: ipv4
source: abuseipdb
country: UA
city: 0
hosting_provider: Hosting Company VIKHOST
queried_at: 2026-04-08T12:19:06.081077
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "UA", "isp": "Hosting Company VIKHOST", "domain": "vikhost.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 64.44.154.227
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: Nexeon Technologies, Inc.
queried_at: 2026-04-08T12:20:28.553300
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "Nexeon Technologies, Inc.", "domain": "nexeon.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 77.83.198.39
indicator_type: ipv4
source: abuseipdb
country: EE
city: 0
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-08T12:20:37.414572
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "EE", "isp": "HZ Hosting Ltd", "domain": "hz-hosting.se", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2023-05-16T09:20:57+00:00", "categories": []}


indicator: 79.143.87.249
indicator_type: ipv4
source: abuseipdb
country: GB
city: 0
hosting_provider: aminserve.com
queried_at: 2026-04-08T12:21:04.012721
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "GB", "isp": "aminserve.com", "domain": "aminserve.com", "usage_type": "Fixed Line ISP", "last_reported": "2024-05-09T01:06:49+00:00", "categories": []}


indicator: 89.150.40.43
indicator_type: ipv4
source: abuseipdb
country: EE
city: 0
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-08T12:21:07.571038
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "EE", "isp": "HZ Hosting Ltd", "domain": "hz-hosting.se", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 185.234.73.61
indicator_type: ipv4
source: abuseipdb
country: PL
city: 0
hosting_provider: EstNOC-Global
queried_at: 2026-04-08T12:21:12.884233
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "PL", "isp": "EstNOC-Global", "domain": "estnoc.ee", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 37.221.64.77
indicator_type: ipv4
source: virustotal
country: BG
hosting_provider: Alexhost Srl
queried_at: 2026-04-08T12:21:16.875552
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 56, "undetected": 36, "reputation": 0, "country": "BG", "as_owner": "Alexhost Srl", "asn": 200019, "network": "37.221.64.0/23", "last_analysis_date": 1775645060}


indicator: 37.221.64.78
indicator_type: ipv4
source: virustotal
country: BG
hosting_provider: Alexhost Srl
queried_at: 2026-04-08T12:21:37.349467
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 56, "undetected": 36, "reputation": 0, "country": "BG", "as_owner": "Alexhost Srl", "asn": 200019, "network": "37.221.64.0/23", "last_analysis_date": 1775645266}


indicator: 37.221.64.93
indicator_type: ipv4
source: virustotal
country: BG
hosting_provider: Alexhost Srl
queried_at: 2026-04-08T12:21:58.088588
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 55, "undetected": 37, "reputation": 0, "country": "BG", "as_owner": "Alexhost Srl", "asn": 200019, "network": "37.221.64.0/23", "last_analysis_date": 1775645597}


indicator: 37.221.64.101
indicator_type: ipv4
source: virustotal
country: BG
hosting_provider: Alexhost Srl
queried_at: 2026-04-08T12:22:18.560412
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 56, "undetected": 36, "reputation": 0, "country": "BG", "as_owner": "Alexhost Srl", "asn": 200019, "network": "37.221.64.0/23", "last_analysis_date": 1775645025}


indicator: 37.221.64.116
indicator_type: ipv4
source: virustotal
country: BG
hosting_provider: Alexhost Srl
queried_at: 2026-04-08T12:22:39.066970
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 55, "undetected": 37, "reputation": 0, "country": "BG", "as_owner": "Alexhost Srl", "asn": 200019, "network": "37.221.64.0/23", "last_analysis_date": 1775645606}


indicator: 37.221.64.131
indicator_type: ipv4
source: virustotal
country: BG
hosting_provider: Alexhost Srl
queried_at: 2026-04-08T12:22:59.585449
raw_data:
  {"malicious": 3, "suspicious": 1, "harmless": 55, "undetected": 35, "reputation": 0, "country": "BG", "as_owner": "Alexhost Srl", "asn": 200019, "network": "37.221.64.0/23", "last_analysis_date": 1775645596}


indicator: 37.221.64.148
indicator_type: ipv4
source: virustotal
country: BG
hosting_provider: Alexhost Srl
queried_at: 2026-04-08T12:23:20.207300
raw_data:
  {"malicious": 1, "suspicious": 0, "harmless": 58, "undetected": 35, "reputation": 0, "country": "BG", "as_owner": "Alexhost Srl", "asn": 200019, "network": "37.221.64.0/23", "last_analysis_date": 1775632076}


indicator: 37.221.64.149
indicator_type: ipv4
source: virustotal
country: BG
hosting_provider: Alexhost Srl
queried_at: 2026-04-08T12:23:40.689334
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 56, "undetected": 36, "reputation": 0, "country": "BG", "as_owner": "Alexhost Srl", "asn": 200019, "network": "37.221.64.0/23", "last_analysis_date": 1775645484}


indicator: 37.221.64.151
indicator_type: ipv4
source: virustotal
country: BG
hosting_provider: Alexhost Srl
queried_at: 2026-04-08T12:24:21.670787
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 56, "undetected": 36, "reputation": 0, "country": "BG", "as_owner": "Alexhost Srl", "asn": 200019, "network": "37.221.64.0/23", "last_analysis_date": 1775645408}


indicator: 37.221.64.163
indicator_type: ipv4
source: virustotal
country: BG
hosting_provider: Alexhost Srl
queried_at: 2026-04-08T12:24:42.278835
raw_data:
  {"malicious": 1, "suspicious": 0, "harmless": 55, "undetected": 38, "reputation": 0, "country": "BG", "as_owner": "Alexhost Srl", "asn": 200019, "network": "37.221.64.0/23", "last_analysis_date": 1775630769}


indicator: 37.221.64.173
indicator_type: ipv4
source: virustotal
country: BG
hosting_provider: Alexhost Srl
queried_at: 2026-04-08T12:25:02.878078
raw_data:
  {"malicious": 1, "suspicious": 0, "harmless": 58, "undetected": 35, "reputation": 0, "country": "BG", "as_owner": "Alexhost Srl", "asn": 200019, "network": "37.221.64.0/23", "last_analysis_date": 1775632079}


indicator: 37.221.64.199
indicator_type: ipv4
source: virustotal
country: BG
hosting_provider: Alexhost Srl
queried_at: 2026-04-08T12:25:23.345336
raw_data:
  {"malicious": 1, "suspicious": 0, "harmless": 56, "undetected": 37, "reputation": 0, "country": "BG", "as_owner": "Alexhost Srl", "asn": 200019, "network": "37.221.64.0/23", "last_analysis_date": 1775630795}


indicator: 37.221.64.208
indicator_type: ipv4
source: virustotal
country: BG
hosting_provider: Alexhost Srl
queried_at: 2026-04-08T12:25:43.825120
raw_data:
  {"malicious": 1, "suspicious": 0, "harmless": 57, "undetected": 36, "reputation": 0, "country": "BG", "as_owner": "Alexhost Srl", "asn": 200019, "network": "37.221.64.0/23", "last_analysis_date": 1775630807}


indicator: 37.221.64.224
indicator_type: ipv4
source: virustotal
country: BG
hosting_provider: Alexhost Srl
queried_at: 2026-04-08T12:26:04.368491
raw_data:
  {"malicious": 1, "suspicious": 0, "harmless": 55, "undetected": 38, "reputation": -12, "country": "BG", "as_owner": "Alexhost Srl", "asn": 200019, "network": "37.221.64.0/23", "last_analysis_date": 1775630817}


indicator: 37.221.64.254
indicator_type: ipv4
source: virustotal
country: BG
hosting_provider: Alexhost Srl
queried_at: 2026-04-08T12:26:24.939483
raw_data:
  {"malicious": 1, "suspicious": 0, "harmless": 57, "undetected": 36, "reputation": 0, "country": "BG", "as_owner": "Alexhost Srl", "asn": 200019, "network": "37.221.64.0/23", "last_analysis_date": 1775632088}


indicator: 5.226.137.151
indicator_type: ipv4
source: virustotal
country: GB
hosting_provider: Hydra Communications Ltd
queried_at: 2026-04-08T12:26:45.424927
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 56, "undetected": 36, "reputation": 0, "country": "GB", "as_owner": "Hydra Communications Ltd", "asn": 25369, "network": "5.226.136.0/23", "last_analysis_date": 1775645060}


indicator: 5.226.137.231
indicator_type: ipv4
source: virustotal
country: GB
hosting_provider: Hydra Communications Ltd
queried_at: 2026-04-08T12:27:26.970687
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 56, "undetected": 36, "reputation": 0, "country": "GB", "as_owner": "Hydra Communications Ltd", "asn": 25369, "network": "5.226.136.0/23", "last_analysis_date": 1775645322}


indicator: 5.226.137.235
indicator_type: ipv4
source: virustotal
country: GB
hosting_provider: Hydra Communications Ltd
queried_at: 2026-04-08T12:28:29.550886
raw_data:
  {"malicious": 1, "suspicious": 0, "harmless": 58, "undetected": 35, "reputation": 0, "country": "GB", "as_owner": "Hydra Communications Ltd", "asn": 25369, "network": "5.226.136.0/23", "last_analysis_date": 1775630772}


indicator: 5.226.137.242
indicator_type: ipv4
source: virustotal
country: GB
hosting_provider: Hydra Communications Ltd
queried_at: 2026-04-08T12:28:50.037724
raw_data:
  {"malicious": 1, "suspicious": 0, "harmless": 58, "undetected": 35, "reputation": 0, "country": "GB", "as_owner": "Hydra Communications Ltd", "asn": 25369, "network": "5.226.136.0/23", "last_analysis_date": 1775632053}


indicator: 5.226.137.243
indicator_type: ipv4
source: virustotal
country: GB
hosting_provider: Hydra Communications Ltd
queried_at: 2026-04-08T12:29:10.662240
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 56, "undetected": 36, "reputation": 0, "country": "GB", "as_owner": "Hydra Communications Ltd", "asn": 25369, "network": "5.226.136.0/23", "last_analysis_date": 1775645269}


indicator: 5.226.137.244
indicator_type: ipv4
source: virustotal
country: GB
hosting_provider: Hydra Communications Ltd
queried_at: 2026-04-08T12:29:31.143773
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 56, "undetected": 36, "reputation": 0, "country": "GB", "as_owner": "Hydra Communications Ltd", "asn": 25369, "network": "5.226.136.0/23", "last_analysis_date": 1775645407}


indicator: 5.226.137.245
indicator_type: ipv4
source: virustotal
country: GB
hosting_provider: Hydra Communications Ltd
queried_at: 2026-04-08T12:29:51.735086
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 56, "undetected": 36, "reputation": 0, "country": "GB", "as_owner": "Hydra Communications Ltd", "asn": 25369, "network": "5.226.136.0/23", "last_analysis_date": 1775645007}


indicator: 23.106.120.119
indicator_type: ipv4
source: virustotal
country: SG
hosting_provider: LEASEWEB SINGAPORE PTE. LTD.
queried_at: 2026-04-08T12:30:12.265355
raw_data:
  {"malicious": 3, "suspicious": 0, "harmless": 55, "undetected": 36, "reputation": 0, "country": "SG", "as_owner": "LEASEWEB SINGAPORE PTE. LTD.", "asn": 59253, "network": "23.106.120.0/21", "last_analysis_date": 1775645060}


indicator: 64.120.31.96
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Leaseweb USA, Inc.
queried_at: 2026-04-08T12:30:32.772736
raw_data:
  {"malicious": 5, "suspicious": 0, "harmless": 53, "undetected": 36, "reputation": 0, "country": "US", "as_owner": "Leaseweb USA, Inc.", "asn": 396362, "network": "64.120.28.0/22", "last_analysis_date": 1775645025}


indicator: 64.120.31.97
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Leaseweb USA, Inc.
queried_at: 2026-04-08T12:30:53.320522
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 56, "undetected": 36, "reputation": 0, "country": "US", "as_owner": "Leaseweb USA, Inc.", "asn": 396362, "network": "64.120.28.0/22", "last_analysis_date": 1775645268}


indicator: 64.120.31.98
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Leaseweb USA, Inc.
queried_at: 2026-04-08T12:31:14.534922
raw_data:
  {"malicious": 1, "suspicious": 0, "harmless": 57, "undetected": 36, "reputation": 0, "country": "US", "as_owner": "Leaseweb USA, Inc.", "asn": 396362, "network": "64.120.28.0/22", "last_analysis_date": 1775631931}


indicator: 64.120.31.99
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Leaseweb USA, Inc.
queried_at: 2026-04-08T12:31:35.318766
raw_data:
  {"malicious": 1, "suspicious": 0, "harmless": 56, "undetected": 37, "reputation": 0, "country": "US", "as_owner": "Leaseweb USA, Inc.", "asn": 396362, "network": "64.120.28.0/22", "last_analysis_date": 1775630693}


indicator: 64.120.31.100
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Leaseweb USA, Inc.
queried_at: 2026-04-08T12:31:55.815549
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 56, "undetected": 36, "reputation": 0, "country": "US", "as_owner": "Leaseweb USA, Inc.", "asn": 396362, "network": "64.120.28.0/22", "last_analysis_date": 1775645408}


indicator: 77.83.197.37
indicator_type: ipv4
source: virustotal
country: SE
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-08T12:32:16.334926
raw_data:
  {"malicious": 1, "suspicious": 0, "harmless": 58, "undetected": 35, "reputation": 0, "country": "SE", "as_owner": "HZ Hosting Ltd", "asn": 59711, "network": "77.83.196.0/23", "last_analysis_date": 1775632098}


indicator: 77.83.197.38
indicator_type: ipv4
source: virustotal
country: SE
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-08T12:32:36.779120
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 56, "undetected": 36, "reputation": 0, "country": "SE", "as_owner": "HZ Hosting Ltd", "asn": 59711, "network": "77.83.196.0/23", "last_analysis_date": 1775645269}


indicator: 77.83.197.39
indicator_type: ipv4
source: virustotal
country: SE
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-08T12:32:57.249367
raw_data:
  {"malicious": 1, "suspicious": 0, "harmless": 58, "undetected": 35, "reputation": 0, "country": "SE", "as_owner": "HZ Hosting Ltd", "asn": 59711, "network": "77.83.196.0/23", "last_analysis_date": 1775631935}


indicator: 79.141.173.247
indicator_type: ipv4
source: otx
country: BG
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T18:05:19.124144
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.247", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 79.143.87.240
indicator_type: ipv4
source: otx
country: GB
city: Manchester
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T18:05:36.393575
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "Manchester", "asn": "AS25369 hydra communications ltd", "indicator": "79.143.87.240", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 88.80.148.53
indicator_type: ipv4
source: otx
country: BG
city: Sofia
hosting_provider: ip address,dns hijacking
queried_at: 2026-04-08T18:05:39.275602
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Sofia", "asn": "AS44901 belcloud ltd", "indicator": "88.80.148.53", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 103.140.186.149
indicator_type: ipv4
source: otx
country: SG
city: Ulu Bedok
hosting_provider: exploit,apt28,russia,oauth,ip address,dns hijacking,tp-link
queried_at: 2026-04-08T18:05:57.213533
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Singapore", "country_code": "SG", "city": "Ulu Bedok", "asn": "AS206804 estnoc oy", "indicator": "103.140.186.149", "tags": ["exploit", "apt28", "russia", "oauth", "ip address", "dns hijacking", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["1736d4c724074d5a8e58b10cfa84dd7e3492ddbdff


indicator: 103.140.186.155
indicator_type: ipv4
source: otx
country: SG
city: Ulu Bedok
hosting_provider: field,ip address,feeds malicious,china,censys,oauth,info,feed malware,ssh host,exploit
queried_at: 2026-04-08T18:06:15.323223
raw_data:
  {"pulse_count": 5, "reputation": 0, "country": "Singapore", "country_code": "SG", "city": "Ulu Bedok", "asn": "AS206804 estnoc oy", "indicator": "103.140.186.155", "tags": ["field", "ip address", "feeds malicious", "china", "censys", "oauth", "info", "feed malware", "ssh host", "exploit", "feeds agent", "apt28", "malicious ip", "domain feed", "cobalt", "feed", "watermark", "tp-link", "precisionsec", "cobalt strike", "russia", "country", "october", "virus total", "iocs", "strong", "dns hijacking"


indicator: 185.234.73.58
indicator_type: ipv4
source: otx
country: PL
city: Poznan
reverse_dns: plazadarlowo.pl
hosting_provider: exploit,apt28,russia,oauth,ip address,dns hijacking,tp-link
queried_at: 2026-04-08T18:06:21.111691
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Poland", "country_code": "PL", "city": "Poznan", "asn": "AS206804 estnoc oy", "indicator": "185.234.73.58", "tags": ["exploit", "apt28", "russia", "oauth", "ip address", "dns hijacking", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["plazadarlowo.pl"]}


indicator: 79.141.173.247
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-08T18:06:22.314781
raw_data:
  {"malicious": 6, "suspicious": 0, "harmless": 54, "undetected": 34, "reputation": 0, "country": "US", "as_owner": "HZ Hosting Ltd", "asn": 202015, "network": "79.141.172.0/23", "last_analysis_date": 1775666923}


indicator: 79.143.87.240
indicator_type: ipv4
source: virustotal
country: IR
hosting_provider: Hydra Communications Ltd
queried_at: 2026-04-08T18:06:42.855668
raw_data:
  {"malicious": 1, "suspicious": 0, "harmless": 57, "undetected": 36, "reputation": 0, "country": "IR", "as_owner": "Hydra Communications Ltd", "asn": 25369, "network": "79.143.87.0/24", "last_analysis_date": 1775630784}


indicator: 88.80.148.53
indicator_type: ipv4
source: virustotal
country: BG
hosting_provider: Belcloud LTD
queried_at: 2026-04-08T18:07:03.670625
raw_data:
  {"malicious": 1, "suspicious": 0, "harmless": 56, "undetected": 37, "reputation": 0, "country": "BG", "as_owner": "Belcloud LTD", "asn": 44901, "network": "88.80.148.0/24", "last_analysis_date": 1775630777}


indicator: 103.140.186.149
indicator_type: ipv4
source: virustotal
country: SG
hosting_provider: EstNOC OU
queried_at: 2026-04-08T18:07:24.126615
raw_data:
  {"malicious": 4, "suspicious": 0, "harmless": 58, "undetected": 32, "reputation": 0, "country": "SG", "as_owner": "EstNOC OU", "asn": 206804, "network": "103.140.186.0/23", "last_analysis_date": 1775666922}


indicator: 103.140.186.155
indicator_type: ipv4
source: virustotal
country: SG
hosting_provider: EstNOC OU
queried_at: 2026-04-08T18:07:44.605170
raw_data:
  {"malicious": 3, "suspicious": 0, "harmless": 57, "undetected": 34, "reputation": -1, "country": "SG", "as_owner": "EstNOC OU", "asn": 206804, "network": "103.140.186.0/23", "last_analysis_date": 1775645743}


indicator: 185.234.73.58
indicator_type: ipv4
source: virustotal
country: PL
hosting_provider: EstNOC OU
queried_at: 2026-04-08T18:08:05.075974
raw_data:
  {"malicious": 1, "suspicious": 0, "harmless": 58, "undetected": 35, "reputation": 0, "country": "PL", "as_owner": "EstNOC OU", "asn": 206804, "network": "185.234.73.0/24", "last_analysis_date": 1775632033}


indicator: 79.141.173.247
indicator_type: ipv4
source: censys
country: US
city: Dallas
hosting_provider: HZ-US-AS
queried_at: 2026-04-08T18:08:25.961246
raw_data:
  {"ports": [35681], "services": ["35681/SSH"], "os": "", "os_version": "", "asn": 202015, "as_name": "HZ-US-AS", "country": "US", "city": "Dallas", "last_updated": "", "labels": []}


indicator: 79.143.87.240
indicator_type: ipv4
source: censys
country: GB
city: London
hosting_provider: BANDWIDTH-AS
queried_at: 2026-04-08T18:08:29.440902
raw_data:
  {"ports": [53, 35681], "services": ["53/DNS", "35681/SSH"], "os": "", "os_version": "", "asn": 25369, "as_name": "BANDWIDTH-AS", "country": "GB", "city": "London", "last_updated": "", "labels": []}


indicator: 88.80.148.53
indicator_type: ipv4
source: censys
country: BG
city: Sofia
reverse_dns: linux
hosting_provider: BELCLOUD Premium IP transit network
queried_at: 2026-04-08T18:08:32.987010
raw_data:
  {"ports": [22, 80, 443], "services": ["22/SSH", "80/HTTP", "443/HTTP"], "os": "linux", "os_version": "", "asn": 44901, "as_name": "BELCLOUD Premium IP transit network", "country": "BG", "city": "Sofia", "last_updated": "", "labels": []}


indicator: 103.140.186.149
indicator_type: ipv4
source: censys
country: SG
city: Singapore
hosting_provider: ESTNOC-GLOBAL
queried_at: 2026-04-08T18:08:36.410875
raw_data:
  {"ports": [], "services": [], "os": "", "os_version": "", "asn": 206804, "as_name": "ESTNOC-GLOBAL", "country": "SG", "city": "Singapore", "last_updated": "", "labels": []}


indicator: 185.234.73.58
indicator_type: ipv4
source: censys
country: PL
city: Poznań
hosting_provider: ESTNOC-GLOBAL
queried_at: 2026-04-08T18:08:43.341768
raw_data:
  {"ports": [], "services": [], "os": "", "os_version": "", "asn": 206804, "as_name": "ESTNOC-GLOBAL", "country": "PL", "city": "Pozna\u0144", "last_updated": "", "labels": []}


indicator: 79.141.173.247
indicator_type: ipv4
source: dshield
country: BG
reverse_dns: 79.141.173.0/24
hosting_provider: HZ-US-AS
queried_at: 2026-04-08T18:08:47.062463
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@hostzealot.com", "as": 202015, "asname": "HZ-US-AS", "ascountry": "BG", "assource": "", "network": "79.141.173.0/24", "threatfeeds": {}}


indicator: 79.143.87.240
indicator_type: ipv4
source: dshield
country: GB
reverse_dns: 79.143.87.0/24
hosting_provider: BANDWIDTH-AS
queried_at: 2026-04-08T18:08:48.753817
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@zare.com", "as": 25369, "asname": "BANDWIDTH-AS", "ascountry": "GB", "assource": "", "network": "79.143.87.0/24", "threatfeeds": {}}


indicator: 88.80.148.53
indicator_type: ipv4
source: dshield
country: BG
reverse_dns: 88.80.148.0/24
hosting_provider: BELCLOUD
queried_at: 2026-04-08T18:08:50.487512
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@belcloud.net", "as": 44901, "asname": "BELCLOUD", "ascountry": "BG", "assource": "", "network": "88.80.148.0/24", "threatfeeds": {}}


indicator: 103.140.186.149
indicator_type: ipv4
source: dshield
country: EE
reverse_dns: 103.140.186.0/24
hosting_provider: ESTNOC-GLOBAL
queried_at: 2026-04-08T18:08:52.191117
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@estnoc.ee", "as": 206804, "asname": "ESTNOC-GLOBAL", "ascountry": "EE", "assource": "", "network": "103.140.186.0/24", "threatfeeds": {}}


indicator: 185.234.73.58
indicator_type: ipv4
source: dshield
country: EE
reverse_dns: 185.234.73.0/24
hosting_provider: ESTNOC-GLOBAL
queried_at: 2026-04-08T18:08:55.549285
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@estnoc.ee", "as": 206804, "asname": "ESTNOC-GLOBAL", "ascountry": "EE", "assource": "", "network": "185.234.73.0/24", "threatfeeds": {}}


indicator: 79.141.173.247
indicator_type: ipv4
source: firehol
queried_at: 2026-04-08T18:09:03.862039
raw_data:
  {"listed": false, "matched_networks": [], "match_count": 0, "lists_checked": 2, "total_networks": 25671}


indicator: 185.234.73.58
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-08T18:09:04.853385
raw_data:
  {"hostnames_checked": ["plazadarlowo.pl"], "hostnames_count": 1, "matched_domains": [], "match_count": 0, "blocklist_size": 92277}


indicator: 146.185.233.99
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: vm14980.hyper.hosting
queried_at: 2026-04-17T18:02:51.396573
raw_data:
  {"ports": [22, 80], "vulns": ["CVE-2021-23017", "CVE-2021-3618", "CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["vm14980.hyper.hosting"], "tags": ["eol-product"], "cpes": ["cpe:/a:openbsd:openssh:8.2p1", "cpe:/o:linux:linux_kernel", "cpe:/a:f5:nginx:1.18.0", "cpe:/o:canonical:ubuntu_linux"]}

hosting_provider:
  cpe:/a:openbsd:openssh:8.2p1,cpe:/o:linux:linux_kernel,cpe:/a:f5:nginx:1.18.0,cpe:/o:canonical:ubuntu_linux


indicator: 146.185.239.33
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: kaz.test
queried_at: 2026-04-17T18:02:53.147026
raw_data:
  {"ports": [22, 80, 8080, 9191], "vulns": ["CVE-2025-23419", "CVE-2021-3618", "CVE-2021-23017", "CVE-2023-44487"], "hostnames": ["kaz.test"], "tags": ["eol-product"], "cpes": ["cpe:/a:f5:nginx:1.18.0", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/o:linux:linux_kernel", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:nodejs:node.js", "cpe:/a:expressjs:express"]}

hosting_provider:
  cpe:/a:f5:nginx:1.18.0,cpe:/a:openbsd:openssh:8.9p1,cpe:/o:linux:linux_kernel,cpe:/o:canonical:ubuntu_linux,cpe:/a:nodejs:node.js,cpe:/a:expressjs:express


indicator: 146.185.239.45
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: vm39876.hyper.hosting
hosting_provider: cpe:/a:f5:nginx:1.22.1
queried_at: 2026-04-17T18:02:54.903301
raw_data:
  {"ports": [80], "vulns": ["CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["vm39876.hyper.hosting"], "tags": ["eol-product"], "cpes": ["cpe:/a:f5:nginx:1.22.1"]}


indicator: 146.185.239.47
indicator_type: ipv4
source: shodan
reverse_dns: vm40019.hyper.hosting
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.9p1
queried_at: 2026-04-17T18:02:56.683991
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["vm40019.hyper.hosting"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1"]}


indicator: 146.185.239.51
indicator_type: ipv4
source: shodan
reverse_dns: vm40871.hyper.hosting
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.9p1
queried_at: 2026-04-17T18:02:58.442177
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["vm40871.hyper.hosting"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1"]}


indicator: 146.185.239.60
indicator_type: ipv4
source: shodan
reverse_dns: vm41181.hyper.hosting
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-04-17T18:03:01.993958
raw_data:
  {"ports": [22, 443], "vulns": [], "hostnames": ["vm41181.hyper.hosting"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 80.66.79.159
indicator_type: ipv4
source: shodan
reverse_dns: vm14159.hyper.hosting
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.2p1
queried_at: 2026-04-17T18:03:05.520043
raw_data:
  {"ports": [2222], "vulns": [], "hostnames": ["vm14159.hyper.hosting"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.2p1"]}


indicator: 23.94.207.116
indicator_type: ipv4
source: shodan
reverse_dns: mail.pimestars.com
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.2p1
queried_at: 2026-04-17T18:03:14.407899
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["mail.pimestars.com"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.2p1"]}


indicator: 192.227.190.127
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: ergonomic-station.ru,192-227-190-127-host.colocrossing.com
hosting_provider: cpe:/o:linux:linux_kernel,cpe:/a:f5:nginx:1.18.0,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-04-17T18:03:17.989152
raw_data:
  {"ports": [80, 443], "vulns": ["CVE-2021-23017", "CVE-2021-3618", "CVE-2023-44487", "CVE-2025-23419"], "hostnames": ["ergonomic-station.ru", "192-227-190-127-host.colocrossing.com"], "tags": ["eol-product"], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/a:f5:nginx:1.18.0", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 146.185.233.101
indicator_type: ipv4
source: otx
country: RU
hosting_provider: toymaker,russia,zip file,path,button,close,link,cisco secure,star,copy
queried_at: 2026-04-17T18:03:50.054835
raw_data:
  {"pulse_count": 11, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS41390 rn data sia", "indicator": "146.185.233.101", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powershell", "


indicator: 146.185.233.79
indicator_type: ipv4
source: otx
country: RU
hosting_provider: toymaker,path,button,close,link,star,copy,small,open,main
queried_at: 2026-04-17T18:04:14.066896
raw_data:
  {"pulse_count": 6, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS41390 rn data sia", "indicator": "146.185.233.79", "tags": ["toymaker", "path", "button", "close", "link", "star", "copy", "small", "open", "main", "code", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "script", "footer", "powershell", "ukraine", "cactus", "download", "span", "enterprise", "body", "tetraloader", "find", "cobaltstr


indicator: 146.185.233.90
indicator_type: ipv4
source: otx
country: RU
reverse_dns: id-39d4a.online,lordseriala.uno
hosting_provider: toymaker,russia,zip file,path,button,close,link,cisco secure,star,copy
queried_at: 2026-04-17T18:04:25.472880
raw_data:
  {"pulse_count": 12, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS41390 rn data sia", "indicator": "146.185.233.90", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powershell", "u


indicator: 146.185.233.96
indicator_type: ipv4
source: otx
country: RU
hosting_provider: toymaker,russia,zip file,path,button,close,link,cisco secure,star,copy
queried_at: 2026-04-17T18:04:42.503465
raw_data:
  {"pulse_count": 12, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS41390 rn data sia", "indicator": "146.185.233.96", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powershell", "u


indicator: 146.185.233.98
indicator_type: ipv4
source: otx
country: RU
hosting_provider: toymaker,russia,zip file,path,button,close,link,cisco secure,star,copy
queried_at: 2026-04-17T18:05:15.389743
raw_data:
  {"pulse_count": 11, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS41390 rn data sia", "indicator": "146.185.233.98", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powershell", "u


indicator: 146.185.233.99
indicator_type: ipv4
source: otx
country: RU
hosting_provider: toymaker,path,button,close,link,star,copy,small,open,main
queried_at: 2026-04-17T18:05:42.273859
raw_data:
  {"pulse_count": 6, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS41390 rn data sia", "indicator": "146.185.233.99", "tags": ["toymaker", "path", "button", "close", "link", "star", "copy", "small", "open", "main", "code", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "script", "footer", "powershell", "ukraine", "cactus", "download", "span", "enterprise", "body", "tetraloader", "find", "cobaltstr


indicator: 146.185.239.33
indicator_type: ipv4
source: otx
country: RU
hosting_provider: toymaker,russia,zip file,path,button,close,link,cisco secure,star,copy
queried_at: 2026-04-17T18:06:15.042772
raw_data:
  {"pulse_count": 12, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS212496 good sia", "indicator": "146.185.239.33", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powershell", "ukr


indicator: 146.185.239.45
indicator_type: ipv4
source: otx
country: RU
hosting_provider: toymaker,russia,zip file,path,button,close,link,cisco secure,star,copy
queried_at: 2026-04-17T18:06:48.308879
raw_data:
  {"pulse_count": 12, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS212496 good sia", "indicator": "146.185.239.45", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powershell", "ukr


indicator: 146.185.239.56
indicator_type: ipv4
source: otx
country: RU
hosting_provider: toymaker,russia,zip file,path,button,close,link,cisco secure,star,copy
queried_at: 2026-04-17T18:07:58.681333
raw_data:
  {"pulse_count": 12, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS212496 good sia", "indicator": "146.185.239.56", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powershell", "ukr


indicator: 146.185.239.60
indicator_type: ipv4
source: otx
country: RU
hosting_provider: toymaker,russia,zip file,path,button,close,link,cisco secure,star,copy
queried_at: 2026-04-17T18:08:31.576710
raw_data:
  {"pulse_count": 12, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS212496 good sia", "indicator": "146.185.239.60", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powershell", "ukr


indicator: 80.66.79.155
indicator_type: ipv4
source: otx
country: RU
hosting_provider: toymaker,russia,zip file,path,button,close,link,cisco secure,star,copy
queried_at: 2026-04-17T18:08:49.593116
raw_data:
  {"pulse_count": 11, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS206336 grzegorz nagorka efiber", "indicator": "80.66.79.155", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powe


indicator: 80.66.79.159
indicator_type: ipv4
source: otx
country: RU
hosting_provider: toymaker,russia,zip file,path,button,close,link,cisco secure,star,copy
queried_at: 2026-04-17T18:09:07.243801
raw_data:
  {"pulse_count": 11, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS206336 grzegorz nagorka efiber", "indicator": "80.66.79.159", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powe


indicator: 80.66.79.195
indicator_type: ipv4
source: otx
country: RU
hosting_provider: toymaker,russia,zip file,path,button,close,link,cisco secure,star,copy
queried_at: 2026-04-17T18:09:40.492542
raw_data:
  {"pulse_count": 11, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS206336 grzegorz nagorka efiber", "indicator": "80.66.79.195", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powe


indicator: 80.66.79.91
indicator_type: ipv4
source: otx
country: RU
hosting_provider: toymaker,russia,SPAM-ITA,zip file,close,x86-64,link,by,bitbucket,open
queried_at: 2026-04-17T18:10:01.872760
raw_data:
  {"pulse_count": 12, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS206336 grzegorz nagorka efiber", "indicator": "80.66.79.91", "tags": ["toymaker", "russia", "SPAM-ITA", "zip file", "close", "x86-64", "link", "by", "bitbucket", "open", "LummaStealer", "main", "rat", "mips", "90775886812", "network iocs", "pw-90775886812", "footer", "zip", "ua-wget", "censys", "bitter", "hyperhosting", "metasploit", "gthost", "phishing", "elf", "SocGholish", "cisc

reverse_dns:
  lordwomanfilm.mom,internet-seite.com,gonzalonina.com,blockedinparking.net,travisbyrne.com,cryptoriano.com,shopeexcommerce.com,hrazy.com,filesnow.org,ksa-cab.com


indicator: 213.139.205.23
indicator_type: ipv4
source: otx
country: GB
city: London
reverse_dns: apisolving.com
hosting_provider: russia,system,apt,port,meltingclaw,cisco secure,time,rustclaw,cyber,open
queried_at: 2026-04-17T18:10:06.214261
raw_data:
  {"pulse_count": 10, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS395092 shock hosting llc", "indicator": "213.139.205.23", "tags": ["russia", "system", "apt", "port", "meltingclaw", "cisco secure", "time", "rustclaw", "cyber", "open", "landing page top story", "ipaddress", "ipv4", "rust", "rustyclaw", "umbrella", "crypto cyber", "shadyhammock", "poland", "romcom", "hashes", "dustyhammock", "top story", "plin


indicator: 23.94.207.116
indicator_type: ipv4
source: otx
country: US
hosting_provider: russia,system,apt,port,meltingclaw,cisco secure,time,cyber,open,landing page top story
queried_at: 2026-04-17T18:10:08.995603
raw_data:
  {"pulse_count": 14, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS36352 colocrossing", "indicator": "23.94.207.116", "tags": ["russia", "system", "apt", "port", "meltingclaw", "cisco secure", "time", "cyber", "open", "landing page top story", "ipaddress", "ipv4", "rust", "rustyclaw", "umbrella", "crypto cyber", "shadyhammock", "romcom", "hashes", "top story", "dustyhammock", "plink", "october", "ukraine", "threat", "malware", "polish", "phi

reverse_dns:
  pimestars.com,aisagift.com,giftofasia.com,www.easternglow.top,easternglow.top,rdcservice.org,elk-t1nett.cyou,elk-t1nett.xyz,elk-t1nett.icu


indicator: 91.92.242.87
indicator_type: ipv4
source: otx
country: BG
city: Sistov
reverse_dns: simnl-info.net,simnl-info.com,webtimeapi.com,dns-msn.com
queried_at: 2026-04-17T18:10:16.801162
raw_data:
  {"pulse_count": 39, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Sistov", "asn": "ASNone ", "indicator": "91.92.242.87", "tags": ["russia", "osint-volley", "DugganUSA", "infostealer", "c2-infrastructure", "meltingclaw", "auto-updated", "rhadamanthys", "rustclaw", "blocked-ips", "asyncrat", "dragonforce", "dugganusa", "stealc", "rustyclaw", "commodity-rat", "shadyhammock", "stix-2.1", "supply-chain", "poland", "snipbot", "auto-generated", "romcom", "github", "clearfake",

hosting_provider:
  russia,osint-volley,DugganUSA,infostealer,c2-infrastructure,meltingclaw,auto-updated,rhadamanthys,rustclaw,blocked-ips


indicator: 192.227.190.127
indicator_type: ipv4
source: otx
country: US
hosting_provider: russia,system,apt,port,meltingclaw,cisco secure,time,cyber,open,landing page top story
queried_at: 2026-04-17T18:10:19.492554
raw_data:
  {"pulse_count": 9, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS36352 colocrossing", "indicator": "192.227.190.127", "tags": ["russia", "system", "apt", "port", "meltingclaw", "cisco secure", "time", "cyber", "open", "landing page top story", "ipaddress", "ipv4", "rust", "rustyclaw", "umbrella", "crypto cyber", "shadyhammock", "romcom", "hashes", "top story", "dustyhammock", "plink", "october", "ukraine", "threat", "malware", "polish", "do

reverse_dns:
  ergonomic-station.ru,wirelesszone.top,cypruspoxx.top,correoargentinox.top,tellmmcn.top,dlhde-de.top,adla1.top,pos-st.top,tellmmcb.top,dhlzc.top


indicator: 91.92.254.218
indicator_type: ipv4
source: otx
country: BG
city: Sistov
hosting_provider: russia,system,apt,botnet,port,meltingclaw,cisco secure,time,rustclaw,cyber
queried_at: 2026-04-17T18:10:25.858091
raw_data:
  {"pulse_count": 31, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Sistov", "asn": "ASNone ", "indicator": "91.92.254.218", "tags": ["russia", "system", "apt", "botnet", "port", "meltingclaw", "cisco secure", "time", "rustclaw", "cyber", "open", "scanner", "attack", "landing page top story", "ipaddress", "ipv4", "rust", "rustyclaw", "umbrella", "login", "crypto cyber", "shadyhammock", "poland", "romcom", "Telnet", "port 23", "hashes", "dustyhammock", "top story", "plink",

reverse_dns:
  devhubs.dev,nebula.baby,hgffdds.buzz,splonloine.one,postnordodk.xyz,postnordodk.one,bgpost1.icu,dhl-dee.xyz,dhl9de.one,ptt4gov.one


indicator: 91.92.248.75
indicator_type: ipv4
source: otx
country: BG
city: Sistov
hosting_provider: russia,system,apt,port,meltingclaw,cisco secure,time,rustclaw,cyber,open
queried_at: 2026-04-17T18:10:37.497676
raw_data:
  {"pulse_count": 10, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Sistov", "asn": "AS34368 zonata - natskovi & sie ltd.", "indicator": "91.92.248.75", "tags": ["russia", "system", "apt", "port", "meltingclaw", "cisco secure", "time", "rustclaw", "cyber", "open", "landing page top story", "ipaddress", "ipv4", "rust", "rustyclaw", "umbrella", "crypto cyber", "shadyhammock", "poland", "romcom", "hashes", "dustyhammock", "top story", "plink", "october", "ukraine", "threat", 

reverse_dns:
  adcreative.pictures,maisonsdumonde.buzz,meccanotecnicaveneta.buzz,skilledcareers.buzz,splicegroup.buzz,angusmackinnon.buzz,lathamconstruction.buzz,comptoir-etancheite.buzz,shannoncoiledsprings.buzz,stockstotrade.buzz


indicator: 94.156.68.216
indicator_type: ipv4
source: otx
country: BG
city: Karlovo
hosting_provider: russia,system,apt,port,meltingclaw,cisco secure,time,rustclaw,cyber,open
queried_at: 2026-04-17T18:10:43.086002
raw_data:
  {"pulse_count": 11, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Karlovo", "asn": "AS31420 terasyst ltd", "indicator": "94.156.68.216", "tags": ["russia", "system", "apt", "port", "meltingclaw", "cisco secure", "time", "rustclaw", "cyber", "open", "landing page top story", "ipaddress", "ipv4", "rust", "rustyclaw", "umbrella", "crypto cyber", "shadyhammock", "poland", "romcom", "hashes", "dustyhammock", "top story", "plink", "october", "ukraine", "threat", "malware", "po

reverse_dns:
  creativeadb.com,israeisost.xyz,israeisost.pro,israeisost.online,copdaemi.top,lorenzibo.top,corrabos.life,corrabodesigns.life,bepoat.life,bepoat.top


indicator: 193.42.36.131
indicator_type: ipv4
source: otx
country: PL
city: Warsaw
reverse_dns: akamaiedgekey.com
hosting_provider: russia,system,apt,port,meltingclaw,cisco secure,time,cyber,open,landing page top story
queried_at: 2026-04-17T18:10:45.686998
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Poland", "country_code": "PL", "city": "Warsaw", "asn": "AS59711 hz hosting ltd", "indicator": "193.42.36.131", "tags": ["russia", "system", "apt", "port", "meltingclaw", "cisco secure", "time", "cyber", "open", "landing page top story", "ipaddress", "ipv4", "rust", "rustyclaw", "umbrella", "crypto cyber", "shadyhammock", "romcom", "hashes", "top story", "dustyhammock", "plink", "october", "ukraine", "threat", "malware", "polish", "domains", "singl


indicator: 23.137.253.43
indicator_type: ipv4
source: otx
reverse_dns: adbefnts.dev
hosting_provider: russia,system,apt,port,meltingclaw,cisco secure,time,rustclaw,cyber,open
queried_at: 2026-04-17T18:10:49.725881
raw_data:
  {"pulse_count": 10, "reputation": 0, "country": "", "country_code": "", "city": "", "asn": "ASNone ", "indicator": "23.137.253.43", "tags": ["russia", "system", "apt", "port", "meltingclaw", "cisco secure", "time", "rustclaw", "cyber", "open", "landing page top story", "ipaddress", "ipv4", "rust", "rustyclaw", "umbrella", "crypto cyber", "shadyhammock", "poland", "romcom", "hashes", "dustyhammock", "top story", "plink", "october", "ukraine", "threat", "malware", "polish", "domains", "singlecampe


indicator: 193.42.36.132
indicator_type: ipv4
source: otx
country: PL
city: Warsaw
reverse_dns: pjbprope.com,dishamg.com,store-images.org,onmipackonline.com
hosting_provider: russia,system,apt,port,meltingclaw,cisco secure,time,cyber,open,landing page top story
queried_at: 2026-04-17T18:10:52.436339
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Poland", "country_code": "PL", "city": "Warsaw", "asn": "AS59711 hz hosting ltd", "indicator": "193.42.36.132", "tags": ["russia", "system", "apt", "port", "meltingclaw", "cisco secure", "time", "cyber", "open", "landing page top story", "ipaddress", "ipv4", "rust", "rustyclaw", "umbrella", "crypto cyber", "shadyhammock", "romcom", "hashes", "top story", "dustyhammock", "plink", "october", "ukraine", "threat", "malware", "polish", "domains", "singl


indicator: 91.193.18.120
indicator_type: ipv4
source: otx
country: PL
city: Warsaw
hosting_provider: cyber espionage,apt,backdoor,media,file,tinyturla,cisco secure,turla,threats,secure endpoint
queried_at: 2026-04-17T18:10:58.077087
raw_data:
  {"pulse_count": 11, "reputation": 0, "country": "Poland", "country_code": "PL", "city": "Warsaw", "asn": "AS59711 hz hosting ltd", "indicator": "91.193.18.120", "tags": ["cyber espionage", "apt", "backdoor", "media", "file", "tinyturla", "cisco secure", "turla", "threats", "secure endpoint", "c2 server", "back", "tinyturlang", "landing page top story", "ttng", "c2 script", "Windows Remote Management (WinRM)", "threat spotlight", "appliance", "umbrella", "Windows service container", "center", "ti


indicator: 146.185.239.47
indicator_type: ipv4
source: abuseipdb
country: ES
city: 0
hosting_provider: Petersburg Internet Network ltd.
queried_at: 2026-04-17T18:10:58.945105
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "ES", "isp": "Petersburg Internet Network ltd.", "domain": "pindc.ru", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2021-12-05T09:02:46+00:00", "categories": []}


indicator: 146.185.239.51
indicator_type: ipv4
source: abuseipdb
country: ES
city: 0
hosting_provider: Petersburg Internet Network ltd.
queried_at: 2026-04-17T18:11:00.828067
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "ES", "isp": "Petersburg Internet Network ltd.", "domain": "pindc.ru", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 80.66.79.200
indicator_type: ipv4
source: abuseipdb
country: MD
city: 0
hosting_provider: HyperHosting
queried_at: 2026-04-17T18:11:02.686319
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "MD", "isp": "HyperHosting", "domain": "hyper.hosting", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 146.185.233.101
indicator_type: ipv4
source: abuseipdb
country: DE
city: 0
hosting_provider: Petersburg Internet Network ltd.
queried_at: 2026-04-17T18:11:04.528574
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "DE", "isp": "Petersburg Internet Network ltd.", "domain": "pindc.ru", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 146.185.239.33
indicator_type: ipv4
source: abuseipdb
country: ES
city: 0
hosting_provider: Petersburg Internet Network ltd.
queried_at: 2026-04-17T18:11:15.761212
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "ES", "isp": "Petersburg Internet Network ltd.", "domain": "pindc.ru", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2022-05-20T04:13:23+00:00", "categories": []}


indicator: 80.66.79.155
indicator_type: ipv4
source: abuseipdb
country: MD
city: 0
hosting_provider: HyperHosting
queried_at: 2026-04-17T18:11:23.135148
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "MD", "isp": "HyperHosting", "domain": "hyper.hosting", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2023-06-16T16:14:03+00:00", "categories": []}


indicator: 80.66.79.159
indicator_type: ipv4
source: abuseipdb
country: MD
city: 0
hosting_provider: HyperHosting
queried_at: 2026-04-17T18:11:25.068748
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "MD", "isp": "HyperHosting", "domain": "hyper.hosting", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2024-01-09T20:24:31+00:00", "categories": []}


indicator: 80.66.79.195
indicator_type: ipv4
source: abuseipdb
country: MD
city: 0
hosting_provider: HyperHosting
queried_at: 2026-04-17T18:11:26.895748
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "MD", "isp": "HyperHosting", "domain": "hyper.hosting", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2023-08-03T22:04:23+00:00", "categories": []}


indicator: 80.66.79.91
indicator_type: ipv4
source: abuseipdb
country: MD
city: 0
hosting_provider: HyperHosting
queried_at: 2026-04-17T18:11:28.738098
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "MD", "isp": "HyperHosting", "domain": "hyper.hosting", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2024-07-01T11:01:17+00:00", "categories": []}


indicator: 213.139.205.23
indicator_type: ipv4
source: abuseipdb
country: DE
city: 0
hosting_provider: Shock Hosting LLC
queried_at: 2026-04-17T18:11:30.576822
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "DE", "isp": "Shock Hosting LLC", "domain": "shockhosting.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2025-03-07T08:49:42+00:00", "categories": []}


indicator: 23.94.207.116
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: RackNerd LLC
queried_at: 2026-04-17T18:11:32.365155
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "RackNerd LLC", "domain": "racknerd.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2025-07-03T22:59:14+00:00", "categories": []}


indicator: 91.92.242.87
indicator_type: ipv4
source: abuseipdb
country: NL
city: 0
hosting_provider: OMEGATECH
queried_at: 2026-04-17T18:11:34.113356
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "NL", "isp": "OMEGATECH", "domain": "omegatech.sc", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 192.227.190.127
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: RackNerd LLC
queried_at: 2026-04-17T18:11:35.873191
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "RackNerd LLC", "domain": "racknerd.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2025-03-07T08:50:10+00:00", "categories": []}


indicator: 91.92.254.218
indicator_type: ipv4
source: abuseipdb
country: BG
city: 0
hosting_provider: E-CARD LTD.
queried_at: 2026-04-17T18:11:37.665721
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "BG", "isp": "E-CARD LTD.", "domain": "e-card.bg", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2025-03-07T08:50:21+00:00", "categories": []}


indicator: 91.92.248.75
indicator_type: ipv4
source: abuseipdb
country: FR
city: 0
hosting_provider: HOSTERS 005
queried_at: 2026-04-17T18:11:39.674830
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "FR", "isp": "HOSTERS 005", "domain": "cloud.eus", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2025-03-07T08:50:33+00:00", "categories": []}


indicator: 94.156.68.216
indicator_type: ipv4
source: abuseipdb
country: BG
city: 0
hosting_provider: METER.AC (C.lab)
queried_at: 2026-04-17T18:11:41.446442
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "BG", "isp": "METER.AC (C.lab)", "domain": "uni-plovdiv.bg", "usage_type": "University/College/School", "last_reported": "2025-03-07T08:50:07+00:00", "categories": []}


indicator: 193.42.36.131
indicator_type: ipv4
source: abuseipdb
country: PL
city: 0
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-17T18:11:43.320712
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "PL", "isp": "HZ Hosting Ltd", "domain": "hz-hosting.se", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2025-03-07T08:50:00+00:00", "categories": []}


indicator: 23.137.253.43
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: IncogNET LLC
queried_at: 2026-04-17T18:11:45.217308
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "IncogNET LLC", "domain": "incognet.io", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 193.42.36.132
indicator_type: ipv4
source: abuseipdb
country: PL
city: 0
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-17T18:11:47.033320
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "PL", "isp": "HZ Hosting Ltd", "domain": "hz-hosting.se", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2025-03-07T08:50:04+00:00", "categories": []}


indicator: 91.193.18.120
indicator_type: ipv4
source: abuseipdb
country: PL
city: 0
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-17T18:11:48.865555
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "PL", "isp": "HZ Hosting Ltd", "domain": "hz-hosting.se", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2024-10-07T05:54:46+00:00", "categories": []}


indicator: 146.185.233.101
indicator_type: ipv4
source: virustotal
country: DE
hosting_provider: GTHost
queried_at: 2026-04-17T18:11:51.105000
raw_data:
  {"malicious": 8, "suspicious": 1, "harmless": 53, "undetected": 32, "reputation": -1, "country": "DE", "as_owner": "GTHost", "asn": 63023, "network": "146.185.233.0/24", "last_analysis_date": 1774331318}


indicator: 146.185.233.79
indicator_type: ipv4
source: virustotal
country: DE
hosting_provider: GTHost
queried_at: 2026-04-17T18:12:11.553133
raw_data:
  {"malicious": 6, "suspicious": 1, "harmless": 54, "undetected": 33, "reputation": 0, "country": "DE", "as_owner": "GTHost", "asn": 63023, "network": "146.185.233.0/24", "last_analysis_date": 1774331318}


indicator: 146.185.233.90
indicator_type: ipv4
source: virustotal
country: DE
hosting_provider: GTHost
queried_at: 2026-04-17T18:12:32.606201
raw_data:
  {"malicious": 7, "suspicious": 1, "harmless": 53, "undetected": 33, "reputation": 0, "country": "DE", "as_owner": "GTHost", "asn": 63023, "network": "146.185.233.0/24", "last_analysis_date": 1776210908}


indicator: 146.185.233.96
indicator_type: ipv4
source: virustotal
country: DE
hosting_provider: GTHost
queried_at: 2026-04-17T18:12:53.282339
raw_data:
  {"malicious": 10, "suspicious": 1, "harmless": 52, "undetected": 31, "reputation": -58, "country": "DE", "as_owner": "GTHost", "asn": 63023, "network": "146.185.233.0/24", "last_analysis_date": 1774331318}


indicator: 146.185.233.98
indicator_type: ipv4
source: virustotal
country: DE
hosting_provider: GTHost
queried_at: 2026-04-17T18:13:13.745567
raw_data:
  {"malicious": 6, "suspicious": 1, "harmless": 53, "undetected": 34, "reputation": 0, "country": "DE", "as_owner": "GTHost", "asn": 63023, "network": "146.185.233.0/24", "last_analysis_date": 1774331318}


indicator: 146.185.239.33
indicator_type: ipv4
source: virustotal
country: ES
hosting_provider: GTHost
queried_at: 2026-04-17T18:13:54.796046
raw_data:
  {"malicious": 11, "suspicious": 1, "harmless": 50, "undetected": 32, "reputation": -12, "country": "ES", "as_owner": "GTHost", "asn": 63023, "network": "146.185.239.0/24", "last_analysis_date": 1773608421}


indicator: 146.185.239.45
indicator_type: ipv4
source: virustotal
country: ES
hosting_provider: GTHost
queried_at: 2026-04-17T18:14:15.246600
raw_data:
  {"malicious": 11, "suspicious": 0, "harmless": 51, "undetected": 32, "reputation": -1, "country": "ES", "as_owner": "GTHost", "asn": 63023, "network": "146.185.239.0/24", "last_analysis_date": 1774260373}


indicator: 146.185.239.47
indicator_type: ipv4
source: virustotal
country: ES
hosting_provider: GTHost
queried_at: 2026-04-17T18:14:35.973043
raw_data:
  {"malicious": 10, "suspicious": 1, "harmless": 49, "undetected": 34, "reputation": 0, "country": "ES", "as_owner": "GTHost", "asn": 63023, "network": "146.185.239.0/24", "last_analysis_date": 1771781438}


indicator: 146.185.239.51
indicator_type: ipv4
source: virustotal
country: ES
hosting_provider: GTHost
queried_at: 2026-04-17T18:14:56.477781
raw_data:
  {"malicious": 12, "suspicious": 0, "harmless": 49, "undetected": 33, "reputation": 0, "country": "ES", "as_owner": "GTHost", "asn": 63023, "network": "146.185.239.0/24", "last_analysis_date": 1774260498}


indicator: 146.185.239.56
indicator_type: ipv4
source: virustotal
country: ES
hosting_provider: GTHost
queried_at: 2026-04-17T18:15:17.211262
raw_data:
  {"malicious": 11, "suspicious": 1, "harmless": 50, "undetected": 32, "reputation": 0, "country": "ES", "as_owner": "GTHost", "asn": 63023, "network": "146.185.239.0/24", "last_analysis_date": 1774260378}


indicator: 146.185.239.60
indicator_type: ipv4
source: virustotal
country: ES
hosting_provider: GTHost
queried_at: 2026-04-17T18:15:37.679594
raw_data:
  {"malicious": 9, "suspicious": 1, "harmless": 51, "undetected": 33, "reputation": 0, "country": "ES", "as_owner": "GTHost", "asn": 63023, "network": "146.185.239.0/24", "last_analysis_date": 1774260499}


indicator: 80.66.79.155
indicator_type: ipv4
source: virustotal
country: MD
hosting_provider: Inovare-Prim SRL
queried_at: 2026-04-17T18:15:58.292886
raw_data:
  {"malicious": 9, "suspicious": 1, "harmless": 52, "undetected": 32, "reputation": 0, "country": "MD", "as_owner": "Inovare-Prim SRL", "asn": 60602, "network": "80.66.79.0/24", "last_analysis_date": 1774331318}


indicator: 80.66.79.159
indicator_type: ipv4
source: virustotal
country: MD
hosting_provider: Inovare-Prim SRL
queried_at: 2026-04-17T18:16:18.791043
raw_data:
  {"malicious": 13, "suspicious": 0, "harmless": 48, "undetected": 33, "reputation": -58, "country": "MD", "as_owner": "Inovare-Prim SRL", "asn": 60602, "network": "80.66.79.0/24", "last_analysis_date": 1774331318}


indicator: 80.66.79.195
indicator_type: ipv4
source: virustotal
country: MD
hosting_provider: Inovare-Prim SRL
queried_at: 2026-04-17T18:16:39.266799
raw_data:
  {"malicious": 8, "suspicious": 1, "harmless": 53, "undetected": 32, "reputation": 0, "country": "MD", "as_owner": "Inovare-Prim SRL", "asn": 60602, "network": "80.66.79.0/24", "last_analysis_date": 1775548573}


indicator: 80.66.79.200
indicator_type: ipv4
source: virustotal
country: MD
hosting_provider: Inovare-Prim SRL
queried_at: 2026-04-17T18:17:00.291886
raw_data:
  {"malicious": 11, "suspicious": 0, "harmless": 49, "undetected": 34, "reputation": -58, "country": "MD", "as_owner": "Inovare-Prim SRL", "asn": 60602, "network": "80.66.79.0/24", "last_analysis_date": 1774331318}


indicator: 80.66.79.91
indicator_type: ipv4
source: virustotal
country: MD
hosting_provider: Inovare-Prim SRL
queried_at: 2026-04-17T18:17:20.762577
raw_data:
  {"malicious": 9, "suspicious": 0, "harmless": 53, "undetected": 32, "reputation": 0, "country": "MD", "as_owner": "Inovare-Prim SRL", "asn": 60602, "network": "80.66.79.0/24", "last_analysis_date": 1774331318}


indicator: 213.139.205.23
indicator_type: ipv4
source: virustotal
country: DE
hosting_provider: Shock Hosting LLC
queried_at: 2026-04-17T18:17:41.303347
raw_data:
  {"malicious": 3, "suspicious": 0, "harmless": 56, "undetected": 35, "reputation": 0, "country": "DE", "as_owner": "Shock Hosting LLC", "asn": 395092, "network": "213.139.204.0/22", "last_analysis_date": 1773161879}


indicator: 23.94.207.116
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: HostPapa
queried_at: 2026-04-17T18:18:01.994408
raw_data:
  {"malicious": 7, "suspicious": 0, "harmless": 53, "undetected": 34, "reputation": 0, "country": "US", "as_owner": "HostPapa", "asn": 36352, "network": "23.94.200.0/21", "last_analysis_date": 1773950193}


indicator: 91.92.242.87
indicator_type: ipv4
source: virustotal
country: NL
hosting_provider: Omegatech LTD
queried_at: 2026-04-17T18:18:22.475574
raw_data:
  {"malicious": 14, "suspicious": 0, "harmless": 50, "undetected": 30, "reputation": -12, "country": "NL", "as_owner": "Omegatech LTD", "asn": 202412, "network": "91.92.240.0/22", "last_analysis_date": 1774951429}


indicator: 192.227.190.127
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: HostPapa
queried_at: 2026-04-17T18:18:43.063792
raw_data:
  {"malicious": 9, "suspicious": 0, "harmless": 51, "undetected": 34, "reputation": 0, "country": "US", "as_owner": "HostPapa", "asn": 36352, "network": "192.227.190.0/23", "last_analysis_date": 1774166356}


indicator: 91.92.254.218
indicator_type: ipv4
source: virustotal
country: BG
queried_at: 2026-04-17T18:19:04.798966
raw_data:
  {"malicious": 3, "suspicious": 0, "harmless": 58, "undetected": 33, "reputation": 0, "country": "BG", "as_owner": "", "asn": 0, "network": "", "last_analysis_date": 1774367905}


indicator: 91.92.248.75
indicator_type: ipv4
source: virustotal
country: ES
hosting_provider: Cloudeus Sl
queried_at: 2026-04-17T18:19:25.350642
raw_data:
  {"malicious": 3, "suspicious": 0, "harmless": 56, "undetected": 35, "reputation": 0, "country": "ES", "as_owner": "Cloudeus Sl", "asn": 62033, "network": "91.92.248.0/23", "last_analysis_date": 1772747802}


indicator: 94.156.68.216
indicator_type: ipv4
source: virustotal
country: BG
hosting_provider: University of Plovdiv Paisiy Hilendarski
queried_at: 2026-04-17T18:19:45.830189
raw_data:
  {"malicious": 6, "suspicious": 0, "harmless": 56, "undetected": 32, "reputation": 0, "country": "BG", "as_owner": "University of Plovdiv Paisiy Hilendarski", "asn": 212023, "network": "94.156.68.0/24", "last_analysis_date": 1773410677}


indicator: 193.42.36.131
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-17T18:20:06.434002
raw_data:
  {"malicious": 2, "suspicious": 1, "harmless": 56, "undetected": 35, "reputation": 0, "country": "US", "as_owner": "HZ Hosting Ltd", "asn": 59711, "network": "193.42.36.0/24", "last_analysis_date": 1768859666}


indicator: 23.137.253.43
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: IncogNet LLC
queried_at: 2026-04-17T18:20:26.979402
raw_data:
  {"malicious": 3, "suspicious": 0, "harmless": 56, "undetected": 35, "reputation": 0, "country": "US", "as_owner": "IncogNet LLC", "asn": 40663, "network": "23.137.248.0/21", "last_analysis_date": 1773705783}


indicator: 193.42.36.132
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-17T18:20:47.579112
raw_data:
  {"malicious": 6, "suspicious": 0, "harmless": 55, "undetected": 33, "reputation": 0, "country": "US", "as_owner": "HZ Hosting Ltd", "asn": 59711, "network": "193.42.36.0/24", "last_analysis_date": 1774015570}


indicator: 91.193.18.120
indicator_type: ipv4
source: virustotal
country: PL
hosting_provider: HZ Hosting Ltd
queried_at: 2026-04-17T18:21:08.114290
raw_data:
  {"malicious": 7, "suspicious": 0, "harmless": 51, "undetected": 36, "reputation": 0, "country": "PL", "as_owner": "HZ Hosting Ltd", "asn": 59711, "network": "91.193.18.0/24", "last_analysis_date": 1773828306}


indicator: 146.185.233.101
indicator_type: ipv4
source: censys
country: DE
city: Frankfurt am Main
hosting_provider: AS-GLOBALTELEHOST - GTHost
queried_at: 2026-04-17T18:21:29.000288
raw_data:
  {"ports": [], "services": [], "os": "", "os_version": "", "asn": 63023, "as_name": "AS-GLOBALTELEHOST - GTHost", "country": "DE", "city": "Frankfurt am Main", "last_updated": "", "labels": []}


indicator: 146.185.233.99
indicator_type: ipv4
source: censys
country: DE
city: Frankfurt am Main
reverse_dns: linux
hosting_provider: AS-GLOBALTELEHOST - GTHost
queried_at: 2026-04-17T18:21:47.041635
raw_data:
  {"ports": [22, 80], "services": ["22/SSH", "80/HTTP"], "os": "linux", "os_version": "", "asn": 63023, "as_name": "AS-GLOBALTELEHOST - GTHost", "country": "DE", "city": "Frankfurt am Main", "last_updated": "", "labels": []}


indicator: 146.185.239.33
indicator_type: ipv4
source: censys
country: ES
city: Madrid
reverse_dns: linux
hosting_provider: AS-GLOBALTELEHOST - GTHost
queried_at: 2026-04-17T18:21:50.768648
raw_data:
  {"ports": [22, 80, 3000, 8080], "services": ["22/SSH", "80/HTTP", "3000/HTTP", "8080/HTTP"], "os": "linux", "os_version": "", "asn": 63023, "as_name": "AS-GLOBALTELEHOST - GTHost", "country": "ES", "city": "Madrid", "last_updated": "", "labels": []}


indicator: 146.185.239.45
indicator_type: ipv4
source: censys
country: ES
city: Madrid
reverse_dns: linux
hosting_provider: AS-GLOBALTELEHOST - GTHost
queried_at: 2026-04-17T18:21:54.117030
raw_data:
  {"ports": [22, 80], "services": ["22/SSH", "80/HTTP"], "os": "linux", "os_version": "", "asn": 63023, "as_name": "AS-GLOBALTELEHOST - GTHost", "country": "ES", "city": "Madrid", "last_updated": "", "labels": []}


indicator: 146.185.239.47
indicator_type: ipv4
source: censys
country: ES
city: Madrid
reverse_dns: linux
hosting_provider: AS-GLOBALTELEHOST - GTHost
queried_at: 2026-04-17T18:21:57.925581
raw_data:
  {"ports": [22, 443], "services": ["22/SSH", "443/HTTP"], "os": "linux", "os_version": "", "asn": 63023, "as_name": "AS-GLOBALTELEHOST - GTHost", "country": "ES", "city": "Madrid", "last_updated": "", "labels": []}


indicator: 146.185.239.51
indicator_type: ipv4
source: censys
country: ES
city: Madrid
reverse_dns: linux
hosting_provider: AS-GLOBALTELEHOST - GTHost
queried_at: 2026-04-17T18:22:01.939271
raw_data:
  {"ports": [22], "services": ["22/SSH"], "os": "linux", "os_version": "", "asn": 63023, "as_name": "AS-GLOBALTELEHOST - GTHost", "country": "ES", "city": "Madrid", "last_updated": "", "labels": []}


indicator: 146.185.233.101
indicator_type: ipv4
source: dshield
country: LV
reverse_dns: 146.185.233.0/24
hosting_provider: RN-DATA-
queried_at: 2026-04-17T18:22:02.782135
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "rndata.abuse@altnet.lv", "as": 41390, "asname": "RN-DATA-", "ascountry": "LV", "assource": "", "network": "146.185.233.0/24", "threatfeeds": {"rosti": {"lastseen": "2025-03-28", "firstseen": "2025-03-28"}}}


indicator: 146.185.239.33
indicator_type: ipv4
source: dshield
country: LV
reverse_dns: 146.185.239.0/24
hosting_provider: GOODTEC
queried_at: 2026-04-17T18:22:13.468051
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": ">>UNKNOWN<<", "as": 212496, "asname": "GOODTEC", "ascountry": "LV", "assource": "", "network": "146.185.239.0/24", "threatfeeds": {"rosti": {"lastseen": "2025-03-28", "firstseen": "2025-03-28"}}}


indicator: 146.185.239.45
indicator_type: ipv4
source: dshield
country: LV
reverse_dns: 146.185.239.0/24
hosting_provider: GOODTEC
queried_at: 2026-04-17T18:22:15.262146
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": ">>UNKNOWN<<", "as": 212496, "asname": "GOODTEC", "ascountry": "LV", "assource": "", "network": "146.185.239.0/24", "threatfeeds": {"blocklistde22": {"lastseen": "2015-11-05", "firstseen": "2015-10-31"}, "openbl_ssh": {"lastseen": "2017-04-17", "firstseen": "2015-11-05"}, "rosti": {"lastseen": "2025-03-28", "firstseen": "2025-03-28"}}}


indicator: 146.185.239.51
indicator_type: ipv4
source: dshield
country: LV
reverse_dns: 146.185.239.0/24
hosting_provider: GOODTEC
queried_at: 2026-04-17T18:22:18.894256
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": ">>UNKNOWN<<", "as": 212496, "asname": "GOODTEC", "ascountry": "LV", "assource": "", "network": "146.185.239.0/24", "threatfeeds": {"rosti": {"lastseen": "2025-03-28", "firstseen": "2025-03-28"}, "threatview": {"lastseen": "2025-02-28", "firstseen": "2025-02-28"}}}


indicator: 80.66.79.155
indicator_type: ipv4
source: dshield
country: MD
reverse_dns: 80.66.79.0/24
hosting_provider: INOVARE-AS str. Uzinelor 21 of. 37
queried_at: 2026-04-17T18:22:24.297610
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@iphost.md", "as": 60602, "asname": "INOVARE-AS str. Uzinelor 21 of. 37", "ascountry": "MD", "assource": "", "network": "80.66.79.0/24", "threatfeeds": {"rosti": {"lastseen": "2025-03-28", "firstseen": "2025-03-28"}}}


indicator: 213.139.205.23
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 213.139.204.0/22
hosting_provider: SHOCK-1
queried_at: 2026-04-17T18:22:33.446558
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": null, "as": 395092, "asname": "SHOCK-1", "ascountry": "US", "assource": "", "network": "213.139.204.0/22", "threatfeeds": {"rosti": {"lastseen": "2024-10-21", "firstseen": "2024-10-17"}}}


indicator: 23.94.207.116
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 23.94.207.0/24
hosting_provider: AS-COLOCROSSING
queried_at: 2026-04-17T18:22:35.209560
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@colocrossing.com", "as": 36352, "asname": "AS-COLOCROSSING", "ascountry": "US", "assource": "", "network": "23.94.207.0/24", "threatfeeds": {"ciarmy": {"lastseen": "2025-07-02", "firstseen": "2024-07-02"}, "rosti": {"lastseen": "2025-07-02", "firstseen": "2024-10-17"}}}


indicator: 91.92.242.87
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 91.92.242.0/24
hosting_provider: LIMENET
queried_at: 2026-04-17T18:22:36.996710
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": null, "as": 394711, "asname": "LIMENET", "ascountry": "US", "assource": "", "network": "91.92.242.0/24", "threatfeeds": {"rosti": {"lastseen": "2024-10-21", "firstseen": "2024-09-25"}}}


indicator: 192.227.190.127
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 192.227.190.0/23
hosting_provider: AS-COLOCROSSING
queried_at: 2026-04-17T18:22:38.776987
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@colocrossing.com", "as": 36352, "asname": "AS-COLOCROSSING", "ascountry": "US", "assource": "", "network": "192.227.190.0/23", "threatfeeds": {"rosti": {"lastseen": "2024-10-21", "firstseen": "2024-10-17"}}}


indicator: 91.92.254.218
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 91.92.254.0/24
hosting_provider: LIMENET
queried_at: 2026-04-17T18:22:40.577398
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": null, "as": 394711, "asname": "LIMENET", "ascountry": "US", "assource": "", "network": "91.92.254.0/24", "threatfeeds": {"rosti": {"lastseen": "2025-05-09", "firstseen": "2024-10-17"}}}


indicator: 91.92.248.75
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 91.92.248.0/24
hosting_provider: LIMENET
queried_at: 2026-04-17T18:22:42.344397
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": null, "as": 394711, "asname": "LIMENET", "ascountry": "US", "assource": "", "network": "91.92.248.0/24", "threatfeeds": {"rosti": {"lastseen": "2024-10-21", "firstseen": "2024-10-17"}}}


indicator: 94.156.68.216
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 94.156.68.0/24
hosting_provider: LIMENET
queried_at: 2026-04-17T18:22:44.184148
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": null, "as": 394711, "asname": "LIMENET", "ascountry": "US", "assource": "", "network": "94.156.68.0/24", "threatfeeds": {"rosti": {"lastseen": "2024-10-21", "firstseen": "2024-10-17"}}}


indicator: 193.42.36.131
indicator_type: ipv4
source: dshield
country: BG
reverse_dns: 193.42.36.0/24
hosting_provider: HZ-EU-AS
queried_at: 2026-04-17T18:22:45.978005
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@hostzealot.com", "as": 59711, "asname": "HZ-EU-AS", "ascountry": "BG", "assource": "", "network": "193.42.36.0/24", "threatfeeds": {"rosti": {"lastseen": "2024-10-21", "firstseen": "2024-10-17"}}}


indicator: 23.137.253.43
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 23.137.253.0/24
hosting_provider: INCOGNET
queried_at: 2026-04-17T18:22:47.749239
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": ">>UNKNOWN<<", "as": 210630, "asname": "INCOGNET", "ascountry": "US", "assource": "", "network": "23.137.253.0/24", "threatfeeds": {"rosti": {"lastseen": "2024-10-21", "firstseen": "2024-10-17"}}}


indicator: 91.193.18.120
indicator_type: ipv4
source: dshield
country: BG
reverse_dns: 91.193.18.0/24
hosting_provider: HZ-EU-AS
queried_at: 2026-04-17T18:22:51.359237
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@hostzealot.com", "as": 59711, "asname": "HZ-EU-AS", "ascountry": "BG", "assource": "", "network": "91.193.18.0/24", "threatfeeds": {"rosti": {"lastseen": "2024-04-10", "firstseen": "2024-02-22"}}}


indicator: 146.185.233.101
indicator_type: ipv4
source: firehol
queried_at: 2026-04-17T18:23:21.803176
raw_data:
  {"listed": false, "matched_networks": [], "match_count": 0, "lists_checked": 2, "total_networks": 11006}


indicator: 91.92.242.87
indicator_type: ipv4
source: firehol
reverse_dns: 91.92.240.0/22
queried_at: 2026-04-17T18:23:22.429394
raw_data:
  {"listed": true, "matched_networks": ["91.92.240.0/22"], "match_count": 1, "lists_checked": 2, "total_networks": 11006}


indicator: 146.185.233.101
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-17T18:23:23.400400
raw_data:
  {"hostnames_checked": [], "hostnames_count": 0, "matched_domains": [], "match_count": 0, "blocklist_size": 87771}


indicator: 146.185.233.90
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-17T18:23:23.441641
raw_data:
  {"hostnames_checked": ["id-39d4a.online", "lordseriala.uno"], "hostnames_count": 2, "matched_domains": [], "match_count": 0, "blocklist_size": 87771}


indicator: 146.185.233.99
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-17T18:23:23.522435
raw_data:
  {"hostnames_checked": ["vm14980.hyper.hosting"], "hostnames_count": 1, "matched_domains": [], "match_count": 0, "blocklist_size": 87771}


indicator: 146.185.239.33
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-17T18:23:23.543130
raw_data:
  {"hostnames_checked": ["kaz.test"], "hostnames_count": 1, "matched_domains": [], "match_count": 0, "blocklist_size": 87771}


indicator: 146.185.239.45
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-17T18:23:23.567261
raw_data:
  {"hostnames_checked": ["vm39876.hyper.hosting"], "hostnames_count": 1, "matched_domains": [], "match_count": 0, "blocklist_size": 87771}


indicator: 146.185.239.47
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-17T18:23:23.585331
raw_data:
  {"hostnames_checked": ["vm40019.hyper.hosting"], "hostnames_count": 1, "matched_domains": [], "match_count": 0, "blocklist_size": 87771}


indicator: 146.185.239.51
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-17T18:23:23.608392
raw_data:
  {"hostnames_checked": ["vm40871.hyper.hosting"], "hostnames_count": 1, "matched_domains": [], "match_count": 0, "blocklist_size": 87771}


indicator: 146.185.239.60
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-17T18:23:23.648594
raw_data:
  {"hostnames_checked": ["vm41181.hyper.hosting"], "hostnames_count": 1, "matched_domains": [], "match_count": 0, "blocklist_size": 87771}


indicator: 80.66.79.159
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-17T18:23:23.684909
raw_data:
  {"hostnames_checked": ["vm14159.hyper.hosting"], "hostnames_count": 1, "matched_domains": [], "match_count": 0, "blocklist_size": 87771}


indicator: 80.66.79.91
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-17T18:23:23.736754
raw_data:
  {"hostnames_checked": ["spiritvid.com", "bigbarksmalldog.org", "cryptoriano.com", "gonzalonina.com", "design-reg.org", "tbgfilm.com", "filesnow.org", "internet-seite.com", "greenmx.com", "lordwomanfilm.mom", "ksa-cab.com", "getbrandaid.com", "mikeolie.com", "msotrends.com", "travisbyrne.com", "shopeexcommerce.com", "blockedinparking.net", "nutrl.com", "hrazy.com", "filyze.net"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 87771}


indicator: 213.139.205.23
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-17T18:23:23.755630
raw_data:
  {"hostnames_checked": ["apisolving.com"], "hostnames_count": 1, "matched_domains": [], "match_count": 0, "blocklist_size": 87771}


indicator: 23.94.207.116
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-17T18:23:23.776320
raw_data:
  {"hostnames_checked": ["www.easternglow.top", "rdcservice.org", "elk-t1nett.xyz", "giftofasia.com", "aisagift.com", "elk-t1nett.icu", "easternglow.top", "pimestars.com", "mail.pimestars.com", "elk-t1nett.cyou"], "hostnames_count": 10, "matched_domains": [], "match_count": 0, "blocklist_size": 87771}


indicator: 91.92.242.87
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-17T18:23:23.794129
raw_data:
  {"hostnames_checked": ["webtimeapi.com", "dns-msn.com", "simnl-info.net", "simnl-info.com"], "hostnames_count": 4, "matched_domains": [], "match_count": 0, "blocklist_size": 87771}


indicator: 192.227.190.127
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-17T18:23:23.812569
raw_data:
  {"hostnames_checked": ["ergonomic-station.ru", "smartcca.com", "192-227-190-127-host.colocrossing.com", "tellmmxz.top", "posax.top", "tellmmcn.top", "dhlzc.top", "adla1.top", "pos-st.top", "tellmmwc.top", "claroxx.top", "dlhde-de.top", "tellmmcv.top", "estafexx.top", "tepcoxx.top", "tellmmcb.top", "tellmmxc.top", "correoargentinox.top", "cypruspoxx.top", "wirelesszone.top", "telkomselxx.top"], "hostnames_count": 21, "matched_domains": [], "match_count": 0, "blocklist_size": 87771}


indicator: 91.92.254.218
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-17T18:23:23.831768
raw_data:
  {"hostnames_checked": ["postnordodk.one", "qatarpost1qa.one", "splonloine.one", "postnordodk.xyz", "pos-my7.one", "posten9no.one", "devhubs.dev", "bgpost1.icu", "dhl-dee.xyz", "nebula.baby", "dhl9de.one", "new-bgpost-bg.top", "ptt4gov.one", "dhl5de.lat", "postnord7se.one", "dhl6de.one", "hgffdds.buzz"], "hostnames_count": 17, "matched_domains": [], "match_count": 0, "blocklist_size": 87771}


indicator: 91.92.248.75
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-17T18:23:23.851602
raw_data:
  {"hostnames_checked": ["lathamconstruction.buzz", "skilledcareers.buzz", "meccanotecnicaveneta.buzz", "shannoncoiledsprings.buzz", "maisonsdumonde.buzz", "stockstotrade.buzz", "splicegroup.buzz", "comptoir-etancheite.buzz", "sweeneymcgann.buzz", "adcreative.pictures", "angusmackinnon.buzz"], "hostnames_count": 11, "matched_domains": [], "match_count": 0, "blocklist_size": 87771}


indicator: 94.156.68.216
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-17T18:23:23.874559
raw_data:
  {"hostnames_checked": ["lorenzibo.top", "coraema.xyz", "cocktailsb.life", "israeisost.xyz", "corksm.top", "coraeo.lat", "copdaems.life", "copdaemi.top", "grupodirectorio.life", "corrabodesigns.life", "diccionario.top", "israeisost.online", "coraeos.xyz", "creativeadb.com", "carreo.skin", "bepoat.life", "corrabos.life", "bepoat.top", "israeisost.pro", "coraeo.monster"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 87771}


indicator: 193.42.36.131
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-17T18:23:23.897101
raw_data:
  {"hostnames_checked": ["akamaiedgekey.com"], "hostnames_count": 1, "matched_domains": [], "match_count": 0, "blocklist_size": 87771}


indicator: 23.137.253.43
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-17T18:23:23.920365
raw_data:
  {"hostnames_checked": ["adbefnts.dev"], "hostnames_count": 1, "matched_domains": [], "match_count": 0, "blocklist_size": 87771}


indicator: 193.42.36.132
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-17T18:23:23.940693
raw_data:
  {"hostnames_checked": ["onmipackonline.com", "pjbprope.com", "dishamg.com", "store-images.org"], "hostnames_count": 4, "matched_domains": [], "match_count": 0, "blocklist_size": 87771}


indicator: 194.33.45.167
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:9.6p1
queried_at: 2026-04-30T00:02:12.633269
raw_data:
  {"ports": [22, 3001], "vulns": [], "hostnames": [], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:9.6p1"]}


indicator: 194.33.45.167
indicator_type: ipv4
source: otx
country: GB
city: London
reverse_dns: www.ildizimvakfi.com,www.texatron.com
hosting_provider: threat,october,compromise,classification,time,crypto cyber,defence,sha1,hashes,cyber
queried_at: 2026-04-30T00:02:20.342814
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS62240 clouvider limited", "indicator": "194.33.45.167", "tags": ["threat", "october", "compromise", "classification", "time", "crypto cyber", "defence", "sha1", "hashes", "cyber"], "pulses": ["Akira Ransomware Compilation", "Fog Ransomware Targets SonicWall VPNs"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns":


indicator: 64.44.102.190
indicator_type: ipv4
source: otx
country: US
queried_at: 2026-04-30T00:02:23.183207
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20278 nexeon technologies  inc.", "indicator": "64.44.102.190", "tags": [], "pulses": [], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["3221de492e436a79655b4a82b72830a28de3aa417300fdf06e0b28202053ff3e"], "passive_dns": []}


indicator: 184.107.5.46
indicator_type: ipv4
source: otx
country: CA
hosting_provider: threat,october,compromise,classification,time,crypto cyber,defence,sha1,hashes,cyber
queried_at: 2026-04-30T00:02:40.568849
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Canada", "country_code": "CA", "city": null, "asn": "AS32613 iweb technologies inc.", "indicator": "184.107.5.46", "tags": ["threat", "october", "compromise", "classification", "time", "crypto cyber", "defence", "sha1", "hashes", "cyber"], "pulses": ["Akira Ransomware Compilation", "Fog Ransomware Targets SonicWall VPNs", "Increased Ransomware Activity Exploiting SonicWall SSL VPN"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []


indicator: 194.33.45.167
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: New Jersey Network
queried_at: 2026-04-30T00:02:41.439054
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "New Jersey Network", "domain": "cnjn.org", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2025-03-07T08:49:42+00:00", "categories": []}


indicator: 64.44.102.190
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: Nexeon Technologies, Inc.
queried_at: 2026-04-30T00:02:43.166961
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "Nexeon Technologies, Inc.", "domain": "nexeon.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2024-07-04T07:09:54+00:00", "categories": []}


indicator: 184.107.5.46
indicator_type: ipv4
source: abuseipdb
country: CA
city: 0
hosting_provider: Leaseweb Canada Inc.
queried_at: 2026-04-30T00:02:45.110998
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "CA", "isp": "Leaseweb Canada Inc.", "domain": "leaseweb.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 194.33.45.167
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Clouvider Limited
queried_at: 2026-04-30T00:02:47.214547
raw_data:
  {"malicious": 4, "suspicious": 1, "harmless": 52, "undetected": 34, "reputation": 0, "country": "US", "as_owner": "Clouvider Limited", "asn": 62240, "network": "194.33.44.0/22", "last_analysis_date": 1776884450}


indicator: 64.44.102.190
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Nexeon Technologies, Inc.
queried_at: 2026-04-30T00:03:07.874475
raw_data:
  {"malicious": 13, "suspicious": 0, "harmless": 44, "undetected": 34, "reputation": 0, "country": "US", "as_owner": "Nexeon Technologies, Inc.", "asn": 20278, "network": "64.44.102.0/23", "last_analysis_date": 1772555685}


indicator: 184.107.5.46
indicator_type: ipv4
source: virustotal
country: CA
hosting_provider: Leaseweb Canada Inc.
queried_at: 2026-04-30T00:03:28.368386
raw_data:
  {"malicious": 5, "suspicious": 1, "harmless": 51, "undetected": 34, "reputation": 0, "country": "CA", "as_owner": "Leaseweb Canada Inc.", "asn": 32613, "network": "184.107.0.0/16", "last_analysis_date": 1770330654}


indicator: 194.33.45.167
indicator_type: ipv4
source: censys
country: US
city: New York City
reverse_dns: linux
hosting_provider: CLOUVIDER Clouvider - Global ASN
queried_at: 2026-04-30T00:03:49.366393
raw_data:
  {"ports": [22, 3001], "services": ["22/SSH", "3001/HTTP"], "os": "linux", "os_version": "", "asn": 62240, "as_name": "CLOUVIDER Clouvider - Global ASN", "country": "US", "city": "New York City", "last_updated": "", "labels": []}


indicator: 64.44.102.190
indicator_type: ipv4
source: censys
country: US
city: Chicago
hosting_provider: NEXEON - Nexeon Technologies, Inc.
queried_at: 2026-04-30T00:03:52.761790
raw_data:
  {"ports": [], "services": [], "os": "", "os_version": "", "asn": 20278, "as_name": "NEXEON - Nexeon Technologies, Inc.", "country": "US", "city": "Chicago", "last_updated": "", "labels": []}


indicator: 184.107.5.46
indicator_type: ipv4
source: censys
country: CA
city: Montréal
hosting_provider: IWEB-AS - Leaseweb Canada Inc.
queried_at: 2026-04-30T00:03:56.141524
raw_data:
  {"ports": [], "services": [], "os": "", "os_version": "", "asn": 32613, "as_name": "IWEB-AS - Leaseweb Canada Inc.", "country": "CA", "city": "Montr\u00e9al", "last_updated": "", "labels": []}


indicator: 194.33.45.167
indicator_type: ipv4
source: dshield
country: GB
reverse_dns: 194.33.45.0/24
hosting_provider: CLOUVIDER Clouvider - Global ASN
queried_at: 2026-04-30T00:03:59.979159
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@clouvider.net", "as": 62240, "asname": "CLOUVIDER Clouvider - Global ASN", "ascountry": "GB", "assource": "", "network": "194.33.45.0/24", "threatfeeds": {"rosti": {"lastseen": "2024-10-24", "firstseen": "2024-10-24"}}}


indicator: 64.44.102.190
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 64.44.0.0/16
hosting_provider: NEXEON
queried_at: 2026-04-30T00:04:01.906451
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@nexeontech.com", "as": 20278, "asname": "NEXEON", "ascountry": "US", "assource": "", "network": "64.44.0.0/16", "threatfeeds": {"rosti": {"lastseen": "2024-06-19", "firstseen": "2024-06-18"}, "threatview": {"lastseen": "2024-04-07", "firstseen": "2024-04-06"}}}


indicator: 184.107.5.46
indicator_type: ipv4
source: dshield
country: CA
reverse_dns: 184.107.0.0/16
hosting_provider: IWEB-AS
queried_at: 2026-04-30T00:04:03.704720
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@iweb.com", "as": 32613, "asname": "IWEB-AS", "ascountry": "CA", "assource": "", "network": "184.107.0.0/16", "threatfeeds": {"rosti": {"lastseen": "2024-10-24", "firstseen": "2024-10-24"}}}


indicator: 194.33.45.167
indicator_type: ipv4
source: firehol
queried_at: 2026-04-30T00:04:08.919671
raw_data:
  {"listed": false, "matched_networks": [], "match_count": 0, "lists_checked": 2, "total_networks": 21115}


indicator: 194.33.45.167
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-30T00:04:09.540056
raw_data:
  {"hostnames_checked": ["www.texatron.com", "www.ildizimvakfi.com"], "hostnames_count": 2, "matched_domains": [], "match_count": 0, "blocklist_size": 83107}


indicator: 64.44.102.190
indicator_type: ipv4
source: stevenblack
queried_at: 2026-04-30T00:04:09.559273
raw_data:
  {"hostnames_checked": [], "hostnames_count": 0, "matched_domains": [], "match_count": 0, "blocklist_size": 83107}


indicator: 159.253.120.2
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: vps32.com
hosting_provider: cpe:/a:f5:nginx:1.30.0,cpe:/a:exim:exim:4.95,cpe:/a:f5:nginx
queried_at: 2026-05-09T00:04:02.439190
raw_data:
  {"ports": [25, 110, 143, 443, 7777], "vulns": ["CVE-2025-67896", "CVE-2023-42119", "CVE-2022-3559", "CVE-2023-42115", "CVE-2022-37451", "CVE-2023-42116", "CVE-2024-39929", "CVE-2023-42114", "CVE-2023-42117", "CVE-2023-51766", "CVE-2022-3620"], "hostnames": ["vps32.com"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx:1.30.0", "cpe:/a:exim:exim:4.95", "cpe:/a:f5:nginx"]}


indicator: 162.220.232.57
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/o:linux:linux_kernel,cpe:/o:debian:debian_linux,cpe:/a:openbsd:openssh:9.2p1
queried_at: 2026-05-09T00:04:07.929189
raw_data:
  {"ports": [22], "vulns": [], "hostnames": [], "tags": [], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/o:debian:debian_linux", "cpe:/a:openbsd:openssh:9.2p1"]}


indicator: 159.253.120.2
indicator_type: ipv4
source: otx
country: RU
hosting_provider: com hijacking,default,urls,filehashmd5,filen,proton,redacted,pgp fingerprint,office,programdata
queried_at: 2026-05-09T00:04:13.620307
raw_data:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "ASNone ", "indicator": "159.253.120.2", "tags": ["com hijacking", "default", "urls", "filehashmd5", "filen", "proton", "redacted", "pgp fingerprint", "office", "programdata", "inprocserver32", "ips domain", "notdoor", "bypass", "outlook", "ipv6240e", "brute force", "yara", "beardshell", "uac0001", "compromise", "slovak", "simpleloader", "#supportsitewebsiteabuse #rootcertificatefailu

reverse_dns:
  publicshare.chickenkiller.com,www.freefoodaid.com,documentsstorage.chickenkiller.com,freefoodaid.com,likitrading.art,chancevoiturelens.com,scotiabank-secure.info,electricite-retour.com,smtracking.web_hassinezarrat.swp23.com,dbdfbd.xyz


indicator: 162.220.234.41
indicator_type: ipv4
source: otx
country: US
city: Anderson
hosting_provider: february,huntress,download,form,sharepoint,sentinel,railway,cloudflare,microsoft,service
queried_at: 2026-05-09T00:04:16.307956
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Anderson", "asn": "AS26296 clearlink", "indicator": "162.220.234.41", "tags": ["february", "huntress", "download", "form", "sharepoint", "sentinel", "railway", "cloudflare", "microsoft", "service", "noirlegacy", "first", "ipaddress", "hunt", "telegram", "device code", "capture link", "trend micro", "win11", "phishing", "voice"], "pulses": ["IOC - Riding the Rails: Threat Actors Abuse Railway


indicator: 162.220.234.66
indicator_type: ipv4
source: otx
country: US
city: Anderson
hosting_provider: february,huntress,download,form,sharepoint,sentinel,railway,cloudflare,microsoft,service
queried_at: 2026-05-09T00:04:18.871541
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Anderson", "asn": "AS26296 clearlink", "indicator": "162.220.234.66", "tags": ["february", "huntress", "download", "form", "sharepoint", "sentinel", "railway", "cloudflare", "microsoft", "service", "noirlegacy", "first", "ipaddress", "hunt", "telegram", "device code", "capture link", "trend micro", "win11", "phishing", "voice"], "pulses": ["IOC - Riding the Rails: Threat Actors Abuse Railway


indicator: 162.220.232.57
indicator_type: ipv4
source: otx
country: US
city: Anderson
hosting_provider: february,huntress,download,form,sharepoint,sentinel,railway,cloudflare,microsoft,service
queried_at: 2026-05-09T00:04:24.313162
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Anderson", "asn": "AS26296 clearlink", "indicator": "162.220.232.57", "tags": ["february", "huntress", "download", "form", "sharepoint", "sentinel", "railway", "cloudflare", "microsoft", "service", "noirlegacy", "first", "ipaddress", "hunt", "telegram", "device code", "capture link", "trend micro", "win11", "phishing", "voice"], "pulses": ["IOC - Riding the Rails: Threat Actors Abuse Railway


indicator: 159.253.120.2
indicator_type: ipv4
source: abuseipdb
country: MD
city: 0
hosting_provider: ALEXHOST SRL
queried_at: 2026-05-09T00:04:25.219434
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "MD", "isp": "ALEXHOST SRL", "domain": "alexhost.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2026-02-09T14:27:32+00:00", "categories": []}


indicator: 162.220.234.41
indicator_type: ipv4
source: abuseipdb
country: US
city: 1
hosting_provider: Railway
queried_at: 2026-05-09T00:04:27.021775
raw_data:
  {"abuse_confidence": 0, "total_reports": 1, "is_public": true, "is_tor": false, "country": "US", "isp": "Railway", "domain": "railway.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2026-03-26T14:22:23+00:00", "categories": [21]}


indicator: 162.220.234.66
indicator_type: ipv4
source: abuseipdb
country: US
city: 2
hosting_provider: Railway
queried_at: 2026-05-09T00:04:28.848913
raw_data:
  {"abuse_confidence": 7, "total_reports": 2, "is_public": true, "is_tor": false, "country": "US", "isp": "Railway", "domain": "railway.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2026-03-26T14:22:31+00:00", "categories": [21, 7]}


indicator: 162.220.232.57
indicator_type: ipv4
source: abuseipdb
country: US
city: 2
hosting_provider: Railway
queried_at: 2026-05-09T00:04:30.578531
raw_data:
  {"abuse_confidence": 0, "total_reports": 2, "is_public": true, "is_tor": false, "country": "US", "isp": "Railway", "domain": "railway.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2026-03-26T14:22:44+00:00", "categories": [21, 7]}


indicator: 159.253.120.2
indicator_type: ipv4
source: virustotal
country: MD
hosting_provider: Alexhost Srl
queried_at: 2026-05-09T00:04:33.022838
raw_data:
  {"malicious": 14, "suspicious": 3, "harmless": 46, "undetected": 29, "reputation": -11, "country": "MD", "as_owner": "Alexhost Srl", "asn": 200019, "network": "159.253.120.0/24", "last_analysis_date": 1778283486}


indicator: 162.220.234.41
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Railway
queried_at: 2026-05-09T00:04:53.498908
raw_data:
  {"malicious": 9, "suspicious": 0, "harmless": 50, "undetected": 33, "reputation": 0, "country": "US", "as_owner": "Railway", "asn": 400940, "network": "162.220.232.0/22", "last_analysis_date": 1776695918}


indicator: 162.220.234.66
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Railway
queried_at: 2026-05-09T00:05:14.017591
raw_data:
  {"malicious": 9, "suspicious": 0, "harmless": 50, "undetected": 33, "reputation": -1, "country": "US", "as_owner": "Railway", "asn": 400940, "network": "162.220.232.0/22", "last_analysis_date": 1776908002}


indicator: 162.220.232.57
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Railway
queried_at: 2026-05-09T00:05:34.685448
raw_data:
  {"malicious": 10, "suspicious": 0, "harmless": 50, "undetected": 32, "reputation": 0, "country": "US", "as_owner": "Railway", "asn": 400940, "network": "162.220.232.0/22", "last_analysis_date": 1776696167}


indicator: 159.253.120.2
indicator_type: ipv4
source: censys
country: MD
city: Chisinau
reverse_dns: linux
hosting_provider: ALEXHOST
queried_at: 2026-05-09T00:05:55.906643
raw_data:
  {"ports": [21, 22, 25, 80, 110, 143, 443, 465, 587, 993, 995, 7777, 8888], "services": ["21/FTP", "22/SSH", "25/SMTP", "80/HTTP", "110/POP3", "143/IMAP", "443/HTTP", "465/SMTP", "587/SMTP", "993/IMAP", "995/POP3", "7777/HTTP", "8888/HTTP"], "os": "linux", "os_version": "", "asn": 200019, "as_name": "ALEXHOST", "country": "MD", "city": "Chisinau", "last_updated": "", "labels": []}


indicator: 162.220.234.41
indicator_type: ipv4
source: censys
country: US
city: Ashburn
hosting_provider: RAILWAY - Railway
queried_at: 2026-05-09T00:05:59.365083
raw_data:
  {"ports": [], "services": [], "os": "", "os_version": "", "asn": 400940, "as_name": "RAILWAY - Railway", "country": "US", "city": "Ashburn", "last_updated": "", "labels": []}


indicator: 162.220.232.57
indicator_type: ipv4
source: censys
country: US
city: Santa Clara
hosting_provider: RAILWAY - Railway
queried_at: 2026-05-09T00:06:06.170481
raw_data:
  {"ports": [22], "services": ["22/SSH"], "os": "", "os_version": "", "asn": 400940, "as_name": "RAILWAY - Railway", "country": "US", "city": "Santa Clara", "last_updated": "", "labels": []}


indicator: 159.253.120.2
indicator_type: ipv4
source: dshield
country: MD
reverse_dns: 159.253.120.0/24
hosting_provider: ALEXHOST
queried_at: 2026-05-09T00:06:10.472795
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@alexhost.com", "as": 200019, "asname": "ALEXHOST", "ascountry": "MD", "assource": "", "network": "159.253.120.0/24", "threatfeeds": {"rosti": {"lastseen": "2026-02-05", "firstseen": "2026-02-05"}}}


indicator: 162.220.234.41
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 162.220.234.0/24
hosting_provider: CLEARLINK
queried_at: 2026-05-09T00:06:13.319074
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "david@nettechsc.com", "as": 26296, "asname": "CLEARLINK", "ascountry": "US", "assource": "", "network": "162.220.234.0/24", "threatfeeds": {"rosti": {"lastseen": "2026-03-20", "firstseen": "2026-03-20"}}}


indicator: 162.220.232.57
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 162.220.232.0/24
hosting_provider: CLEARLINK
queried_at: 2026-05-09T00:06:19.226794
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "david@nettechsc.com", "as": 26296, "asname": "CLEARLINK", "ascountry": "US", "assource": "", "network": "162.220.232.0/24", "threatfeeds": {"rosti": {"lastseen": "2026-03-20", "firstseen": "2026-03-20"}}}


indicator: 159.253.120.2
indicator_type: ipv4
source: firehol
reverse_dns: 159.253.120.0/24
queried_at: 2026-05-09T00:06:25.486738
raw_data:
  {"listed": true, "matched_networks": ["159.253.120.0/24"], "match_count": 1, "lists_checked": 2, "total_networks": 18998}


indicator: 162.220.234.41
indicator_type: ipv4
source: firehol
queried_at: 2026-05-09T00:06:25.512307
raw_data:
  {"listed": false, "matched_networks": [], "match_count": 0, "lists_checked": 2, "total_networks": 18998}


indicator: 159.253.120.2
indicator_type: ipv4
source: stevenblack
queried_at: 2026-05-09T00:06:26.111082
raw_data:
  {"hostnames_checked": ["dbdfbd.xyz", "documentsstorage.chickenkiller.com", "chancevoiturelens.com", "likitrading.art", "freefoodaid.com", "electricite-retour.com", "vps32.com", "scotiabank-secure.info", "publicshare.chickenkiller.com", "smtracking.web_hassinezarrat.swp23.com", "www.freefoodaid.com", "smtracking.tadris.tn", "gsswiftmailbox353.top", "smtracking.miladfx.com"], "hostnames_count": 14, "matched_domains": [], "match_count": 0, "blocklist_size": 82624}


indicator: 162.220.234.41
indicator_type: ipv4
source: stevenblack
queried_at: 2026-05-09T00:06:26.131579
raw_data:
  {"hostnames_checked": [], "hostnames_count": 0, "matched_domains": [], "match_count": 0, "blocklist_size": 82624}


indicator: 107.189.19.48
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: 48.19.189.107.static.cloudzy.com
queried_at: 2026-05-17T06:05:09.284391
raw_data:
  {"ports": [3389], "vulns": [], "hostnames": ["48.19.189.107.static.cloudzy.com"], "tags": ["self-signed"], "cpes": []}


indicator: 77.110.107.165
indicator_type: ipv4
source: otx
country: LB
queried_at: 2026-05-17T06:05:31.017000
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Lebanon", "country_code": "LB", "city": null, "asn": "ASNone ", "indicator": "77.110.107.165", "tags": ["malicious", "gammadrop c2", "temp", "cloudflare", "gammaload ddns", "domains", "gammadrop", "malicious arj", "appdata", "gammaload", "malicious rar", "primary c2", "sha1", "ssl cert"], "pulses": ["IOC - Gamaredon\u2019s infection chain: Spoofed emails, GammaDrop and GammaLoad"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}

hosting_provider:
  malicious,gammadrop c2,temp,cloudflare,gammaload ddns,domains,gammadrop,malicious arj,appdata,gammaload


indicator: 107.189.19.48
indicator_type: ipv4
source: otx
country: US
queried_at: 2026-05-17T06:05:47.915741
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS53667 frantech solutions", "indicator": "107.189.19.48", "tags": ["malicious", "gammadrop c2", "temp", "cloudflare", "gammaload ddns", "domains", "gammadrop", "malicious arj", "appdata", "gammaload", "malicious rar", "primary c2", "sha1", "ssl cert"], "pulses": ["IOC - Gamaredon\u2019s infection chain: Spoofed emails, GammaDrop and GammaLoad"], "malware_count": 0, "passive_dns

hosting_provider:
  malicious,gammadrop c2,temp,cloudflare,gammaload ddns,domains,gammadrop,malicious arj,appdata,gammaload


indicator: 5.181.2.158
indicator_type: ipv4
source: otx
country: US
city: California
reverse_dns: azure-rift.live,marithbranch.com,connectglowsolana.com,ingdiba.sergolamn.de
queried_at: 2026-05-17T06:05:50.842617
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "California", "asn": "AS57844 spdnet telekomunikasyon hizmetleri bilgi teknolojileri taahhut sanayi ve ticaret a.s.", "indicator": "5.181.2.158", "tags": ["malicious", "gammadrop c2", "temp", "cloudflare", "gammaload ddns", "domains", "gammadrop", "malicious arj", "appdata", "gammaload", "malicious rar", "primary c2", "sha1", "ssl cert"], "pulses": ["IOC - Gamaredon\u2019s infection chain: Sp

hosting_provider:
  malicious,gammadrop c2,temp,cloudflare,gammaload ddns,domains,gammadrop,malicious arj,appdata,gammaload


indicator: 194.58.66.82
indicator_type: ipv4
source: otx
country: CZ
queried_at: 2026-05-17T06:06:08.119842
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Czechia", "country_code": "CZ", "city": null, "asn": "AS35112 llc dzhibien host", "indicator": "194.58.66.82", "tags": ["malicious", "gammadrop c2", "temp", "cloudflare", "gammaload ddns", "domains", "gammadrop", "malicious arj", "appdata", "gammaload", "malicious rar", "primary c2", "sha1", "ssl cert"], "pulses": ["IOC - Gamaredon\u2019s infection chain: Spoofed emails, GammaDrop and GammaLoad"], "malware_count": 0, "passive_dns_count": 0, "malwar

hosting_provider:
[cell repeats an earlier one in this file: 103 characters]


indicator: 77.110.107.165
indicator_type: ipv4
source: abuseipdb
country: DE
city: 0
hosting_provider: GLOBAL CONNECTIVITY SOLUTIONS LLP
queried_at: 2026-05-17T06:06:08.994400
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "DE", "isp": "GLOBAL CONNECTIVITY SOLUTIONS LLP", "domain": "globconnex.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 5.181.2.158
indicator_type: ipv4
source: abuseipdb
country: HR
city: 0
hosting_provider: GLOBAL CONNECTIVITY SOLUTIONS LLP
queried_at: 2026-05-17T06:06:13.254358
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "HR", "isp": "GLOBAL CONNECTIVITY SOLUTIONS LLP", "domain": "globconnex.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2021-07-31T00:28:08+00:00", "categories": []}


indicator: 194.58.66.82
indicator_type: ipv4
source: abuseipdb
country: SI
city: 0
hosting_provider: Baxet Group Inc.
queried_at: 2026-05-17T06:06:15.038311
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "SI", "isp": "Baxet Group Inc.", "domain": "baxet.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 77.110.107.165
indicator_type: ipv4
source: virustotal
country: DE
hosting_provider: Global Connectivity Solutions Llp
queried_at: 2026-05-17T06:06:17.156877
raw_data:
  {"malicious": 3, "suspicious": 1, "harmless": 55, "undetected": 33, "reputation": 0, "country": "DE", "as_owner": "Global Connectivity Solutions Llp", "asn": 215540, "network": "77.110.107.0/24", "last_analysis_date": 1778749242}


indicator: 107.189.19.48
indicator_type: ipv4
source: virustotal
country: NL
hosting_provider: RouterHosting LLC
queried_at: 2026-05-17T06:06:37.635577
raw_data:
  {"malicious": 2, "suspicious": 1, "harmless": 55, "undetected": 34, "reputation": 0, "country": "NL", "as_owner": "RouterHosting LLC", "asn": 14956, "network": "107.189.16.0/21", "last_analysis_date": 1778766913}


indicator: 5.181.2.158
indicator_type: ipv4
source: virustotal
country: HR
hosting_provider: Global Connectivity Solutions Llp
queried_at: 2026-05-17T06:06:58.088012
raw_data:
  {"malicious": 1, "suspicious": 1, "harmless": 56, "undetected": 34, "reputation": 0, "country": "HR", "as_owner": "Global Connectivity Solutions Llp", "asn": 215540, "network": "5.181.2.0/23", "last_analysis_date": 1778807638}


indicator: 194.58.66.82
indicator_type: ipv4
source: virustotal
country: SI
hosting_provider: Baxet Group Inc.
queried_at: 2026-05-17T06:07:18.714776
raw_data:
  {"malicious": 1, "suspicious": 0, "harmless": 57, "undetected": 34, "reputation": 0, "country": "SI", "as_owner": "Baxet Group Inc.", "asn": 26383, "network": "194.58.66.0/24", "last_analysis_date": 1778807638}


indicator: 77.110.107.165
indicator_type: ipv4
source: censys
country: DE
city: Frankfurt am Main
reverse_dns: linux
hosting_provider: GCS-AS
queried_at: 2026-05-17T06:07:39.605446
raw_data:
  {"ports": [22, 3389], "services": ["22/SSH", "3389/RDP"], "os": "linux", "os_version": "", "asn": 215540, "as_name": "GCS-AS", "country": "DE", "city": "Frankfurt am Main", "last_updated": "", "labels": []}


indicator: 107.189.19.48
indicator_type: ipv4
source: censys
country: NL
city: Zaandam
reverse_dns: windows
hosting_provider: ROUTERHOSTING - RouterHosting LLC
queried_at: 2026-05-17T06:07:42.947556
raw_data:
  {"ports": [3389, 5985], "services": ["3389/RDP", "5985/WINRM"], "os": "windows", "os_version": "", "asn": 14956, "as_name": "ROUTERHOSTING - RouterHosting LLC", "country": "NL", "city": "Zaandam", "last_updated": "", "labels": [{"value": "BULLETPROOF"}]}


indicator: 5.181.2.158
indicator_type: ipv4
source: censys
country: HR
city: Zagreb
hosting_provider: GCS-AS
queried_at: 2026-05-17T06:07:46.467847
raw_data:
  {"ports": [80, 443], "services": ["80/HTTP", "443/HTTP"], "os": "", "os_version": "", "asn": 215540, "as_name": "GCS-AS", "country": "HR", "city": "Zagreb", "last_updated": "", "labels": []}


indicator: 194.58.66.82
indicator_type: ipv4
source: censys
country: SI
city: Ljubljana
hosting_provider: ASNET - Baxet Group Inc.
queried_at: 2026-05-17T06:07:49.795789
raw_data:
  {"ports": [22], "services": ["22/SSH"], "os": "", "os_version": "", "asn": 26383, "as_name": "ASNET - Baxet Group Inc.", "country": "SI", "city": "Ljubljana", "last_updated": "", "labels": []}


indicator: 107.189.19.48
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 107.189.16.0/21
hosting_provider: PONYNET
queried_at: 2026-05-17T06:07:55.719032
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "admin@frantech.ca", "as": 53667, "asname": "PONYNET", "ascountry": "US", "assource": "", "network": "107.189.16.0/21", "threatfeeds": {}}


indicator: 5.181.2.158
indicator_type: ipv4
source: dshield
country: XX
hosting_provider: not routed
queried_at: 2026-05-17T06:07:57.497680
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": null, "as": 0, "asname": "not routed", "ascountry": "XX", "assource": "", "network": "", "threatfeeds": {"forumspam": {"lastseen": "2021-03-19", "firstseen": "2021-03-18"}}}


indicator: 77.110.107.165
indicator_type: ipv4
source: firehol
queried_at: 2026-05-17T06:08:06.702639
raw_data:
  {"listed": false, "matched_networks": [], "match_count": 0, "lists_checked": 2, "total_networks": 22550}


indicator: 77.110.107.165
indicator_type: ipv4
source: stevenblack
queried_at: 2026-05-17T06:08:07.500452
raw_data:
  {"hostnames_checked": [], "hostnames_count": 0, "matched_domains": [], "match_count": 0, "blocklist_size": 82208}


indicator: 107.189.19.48
indicator_type: ipv4
source: stevenblack
queried_at: 2026-05-17T06:08:07.527311
raw_data:
  {"hostnames_checked": ["48.19.189.107.static.cloudzy.com"], "hostnames_count": 1, "matched_domains": [], "match_count": 0, "blocklist_size": 82208}


indicator: 5.181.2.158
indicator_type: ipv4
source: stevenblack
queried_at: 2026-05-17T06:08:07.546126
raw_data:
  {"hostnames_checked": ["ingdiba.sergolamn.de", "marithbranch.com", "azure-rift.live", "connectglowsolana.com"], "hostnames_count": 4, "matched_domains": [], "match_count": 0, "blocklist_size": 82208}


indicator: 47.90.180.205
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-20T06:01:21.287740
raw_data:
  {"ports": [22, 3000], "vulns": [], "hostnames": [], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 47.252.11.99
indicator_type: ipv4
source: shodan
city: cloud,eol-product,database
hosting_provider: cpe:/a:oracle:mysql:8.0.45-0ubuntu0.24.04.1
queried_at: 2026-05-20T06:01:23.305015
raw_data:
  {"ports": [80, 2000, 3306], "vulns": [], "hostnames": [], "tags": ["cloud", "eol-product", "database"], "cpes": ["cpe:/a:oracle:mysql:8.0.45-0ubuntu0.24.04.1"]}


indicator: 172.120.234.223
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/o:debian:debian_linux,cpe:/o:linux:linux_kernel,cpe:/a:openbsd:openssh:9.2p1
queried_at: 2026-05-20T06:01:39.452078
raw_data:
  {"ports": [24442], "vulns": [], "hostnames": [], "tags": [], "cpes": ["cpe:/o:debian:debian_linux", "cpe:/o:linux:linux_kernel", "cpe:/a:openbsd:openssh:9.2p1"]}


indicator: 166.88.219.45
indicator_type: ipv4
source: shodan
reverse_dns: 166-88-219-45.ips.acedatacenter.com
hosting_provider: cpe:/o:debian:debian_linux,cpe:/o:linux:linux_kernel,cpe:/a:openbsd:openssh:9.2p1
queried_at: 2026-05-20T06:01:44.784126
raw_data:
  {"ports": [24442], "vulns": [], "hostnames": ["166-88-219-45.ips.acedatacenter.com"], "tags": [], "cpes": ["cpe:/o:debian:debian_linux", "cpe:/o:linux:linux_kernel", "cpe:/a:openbsd:openssh:9.2p1"]}


indicator: 47.90.180.205
indicator_type: ipv4
source: otx
country: US
queried_at: 2026-05-20T06:02:21.092911
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS45102 alibaba (us) technology co.  ltd.", "indicator": "47.90.180.205", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0}


indicator: 47.252.11.99
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: Alibaba Cloud - US
queried_at: 2026-05-20T06:06:24.961405
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "Alibaba Cloud - US", "domain": "alibabacloud.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 193.228.131.161
indicator_type: ipv4
source: abuseipdb
country: US
city: 1
hosting_provider: New York, NY
queried_at: 2026-05-20T06:06:26.670251
raw_data:
  {"abuse_confidence": 4, "total_reports": 1, "is_public": true, "is_tor": false, "country": "US", "isp": "New York, NY", "domain": "ithostline.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2026-05-17T08:35:12+00:00", "categories": [19, 15]}


indicator: 166.1.241.247
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: IWIHOST NET
queried_at: 2026-05-20T06:06:28.388171
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "IWIHOST NET", "domain": "iwihost.net", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2025-11-05T07:31:58+00:00", "categories": []}


indicator: 138.249.139.6
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: IT Hostline Ltd
queried_at: 2026-05-20T06:06:31.822976
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "IT Hostline Ltd", "domain": "ithostline.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 166.1.255.233
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: IWIHOST NET
queried_at: 2026-05-20T06:06:33.562161
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "IWIHOST NET", "domain": "iwihost.net", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 142.252.86.104
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: IWIHOST NET
queried_at: 2026-05-20T06:06:35.282356
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "IWIHOST NET", "domain": "iwihost.net", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2025-06-27T15:24:47+00:00", "categories": []}


indicator: 130.49.117.205
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: IT Hostline Ltd
queried_at: 2026-05-20T06:06:36.994159
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "IT Hostline Ltd", "domain": "ithostline.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2025-11-15T04:01:01+00:00", "categories": []}


indicator: 170.168.215.64
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: IT Hostline Ltd
queried_at: 2026-05-20T06:06:38.756803
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "IT Hostline Ltd", "domain": "ithostline.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2025-12-08T21:00:08+00:00", "categories": []}


indicator: 50.118.198.26
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: IWIHOST NET
queried_at: 2026-05-20T06:06:40.487476
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "IWIHOST NET", "domain": "iwihost.net", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2026-02-16T17:23:00+00:00", "categories": []}


indicator: 172.120.234.223
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: IWIHOST NET
queried_at: 2026-05-20T06:06:42.211468
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "IWIHOST NET", "domain": "iwihost.net", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2026-01-04T12:03:29+00:00", "categories": []}


indicator: 45.39.175.12
indicator_type: ipv4
source: abuseipdb
country: US
city: 1
hosting_provider: IWIHOST NET
queried_at: 2026-05-20T06:06:43.942590
raw_data:
  {"abuse_confidence": 0, "total_reports": 1, "is_public": true, "is_tor": false, "country": "US", "isp": "IWIHOST NET", "domain": "iwihost.net", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2026-03-04T00:01:34+00:00", "categories": [18, 15]}


indicator: 166.88.219.45
indicator_type: ipv4
source: abuseipdb
country: US
city: 0
hosting_provider: IWIHOST NET
queried_at: 2026-05-20T06:06:47.503427
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "US", "isp": "IWIHOST NET", "domain": "iwihost.net", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": "2026-02-17T07:00:10+00:00", "categories": []}


indicator: 47.90.180.205
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Alibaba US Technology Co., Ltd.
queried_at: 2026-05-20T06:06:53.135685
raw_data:
  {"malicious": 0, "suspicious": 0, "harmless": 56, "undetected": 36, "reputation": 0, "country": "US", "as_owner": "Alibaba US Technology Co., Ltd.", "asn": 45102, "network": "47.90.176.0/20", "last_analysis_date": 1778896580}


indicator: 47.252.11.99
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Alibaba US Technology Co., Ltd.
queried_at: 2026-05-20T06:07:13.581286
raw_data:
  {"malicious": 0, "suspicious": 1, "harmless": 56, "undetected": 35, "reputation": 0, "country": "US", "as_owner": "Alibaba US Technology Co., Ltd.", "asn": 45102, "network": "47.252.0.0/16", "last_analysis_date": 1778896605}


indicator: 193.228.131.161
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Clouvider Limited
queried_at: 2026-05-20T06:07:34.055851
raw_data:
  {"malicious": 3, "suspicious": 2, "harmless": 55, "undetected": 32, "reputation": 0, "country": "US", "as_owner": "Clouvider Limited", "asn": 62240, "network": "193.228.131.0/24", "last_analysis_date": 1779192873}


indicator: 166.1.241.247
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Clouvider Limited
queried_at: 2026-05-20T06:07:54.618468
raw_data:
  {"malicious": 2, "suspicious": 1, "harmless": 53, "undetected": 36, "reputation": 0, "country": "US", "as_owner": "Clouvider Limited", "asn": 62240, "network": "166.1.241.0/24", "last_analysis_date": 1779227817}


indicator: 138.249.139.6
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Clouvider Limited
queried_at: 2026-05-20T06:08:15.098818
raw_data:
  {"malicious": 4, "suspicious": 1, "harmless": 51, "undetected": 36, "reputation": 0, "country": "US", "as_owner": "Clouvider Limited", "asn": 62240, "network": "138.249.139.0/24", "last_analysis_date": 1779227832}


indicator: 166.1.255.233
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Clouvider Limited
queried_at: 2026-05-20T06:08:35.531822
raw_data:
  {"malicious": 3, "suspicious": 1, "harmless": 51, "undetected": 37, "reputation": 0, "country": "US", "as_owner": "Clouvider Limited", "asn": 62240, "network": "166.1.252.0/22", "last_analysis_date": 1779227798}


indicator: 142.252.86.104
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Clouvider Limited
queried_at: 2026-05-20T06:08:56.091754
raw_data:
  {"malicious": 2, "suspicious": 1, "harmless": 52, "undetected": 37, "reputation": 0, "country": "US", "as_owner": "Clouvider Limited", "asn": 62240, "network": "142.252.86.0/24", "last_analysis_date": 1779227825}


indicator: 130.49.117.205
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Green Floid LLC
queried_at: 2026-05-20T06:09:16.606022
raw_data:
  {"malicious": 2, "suspicious": 1, "harmless": 53, "undetected": 36, "reputation": 0, "country": "US", "as_owner": "Green Floid LLC", "asn": 204957, "network": "130.49.117.0/24", "last_analysis_date": 1779227843}


indicator: 170.168.215.64
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Green Floid LLC
queried_at: 2026-05-20T06:09:37.118751
raw_data:
  {"malicious": 2, "suspicious": 1, "harmless": 52, "undetected": 37, "reputation": 0, "country": "US", "as_owner": "Green Floid LLC", "asn": 204957, "network": "170.168.215.0/24", "last_analysis_date": 1779227819}


indicator: 50.118.198.26
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Host Telecom Ltd
queried_at: 2026-05-20T06:09:57.609392
raw_data:
  {"malicious": 3, "suspicious": 1, "harmless": 52, "undetected": 36, "reputation": 0, "country": "US", "as_owner": "Host Telecom Ltd", "asn": 214238, "network": "50.118.198.0/24", "last_analysis_date": 1779227798}


indicator: 172.120.234.223
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Host Telecom Ltd
queried_at: 2026-05-20T06:10:18.418864
raw_data:
  {"malicious": 2, "suspicious": 1, "harmless": 52, "undetected": 37, "reputation": 0, "country": "US", "as_owner": "Host Telecom Ltd", "asn": 214238, "network": "172.120.234.0/24", "last_analysis_date": 1779227840}


indicator: 45.39.175.12
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Host Telecom Ltd
queried_at: 2026-05-20T06:10:39.580776
raw_data:
  {"malicious": 2, "suspicious": 1, "harmless": 52, "undetected": 37, "reputation": 0, "country": "US", "as_owner": "Host Telecom Ltd", "asn": 214238, "network": "45.39.175.0/24", "last_analysis_date": 1779227846}


indicator: 142.252.171.135
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Host Telecom Ltd
queried_at: 2026-05-20T06:11:00.155344
raw_data:
  {"malicious": 2, "suspicious": 1, "harmless": 51, "undetected": 38, "reputation": 0, "country": "US", "as_owner": "Host Telecom Ltd", "asn": 214238, "network": "142.252.170.0/23", "last_analysis_date": 1779227852}


indicator: 166.88.219.45
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Host Telecom Ltd
queried_at: 2026-05-20T06:11:20.661219
raw_data:
  {"malicious": 2, "suspicious": 0, "harmless": 52, "undetected": 38, "reputation": 0, "country": "US", "as_owner": "Host Telecom Ltd", "asn": 214238, "network": "166.88.218.0/23", "last_analysis_date": 1779227850}


indicator: 172.120.57.92
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Host Telecom Ltd
queried_at: 2026-05-20T06:11:41.273526
raw_data:
  {"malicious": 2, "suspicious": 1, "harmless": 52, "undetected": 37, "reputation": 0, "country": "US", "as_owner": "Host Telecom Ltd", "asn": 214238, "network": "172.120.57.0/24", "last_analysis_date": 1779227831}


indicator: 172.121.59.99
indicator_type: ipv4
source: virustotal
country: US
hosting_provider: Host Telecom Ltd
queried_at: 2026-05-20T06:12:01.794902
raw_data:
  {"malicious": 2, "suspicious": 1, "harmless": 52, "undetected": 37, "reputation": 0, "country": "US", "as_owner": "Host Telecom Ltd", "asn": 214238, "network": "172.121.58.0/23", "last_analysis_date": 1779227837}


indicator: 47.90.180.205
indicator_type: ipv4
source: censys
country: US
city: Virginia Beach
reverse_dns: linux
hosting_provider: ALIBABA-CN-NET Alibaba US Technology Co., Ltd.
queried_at: 2026-05-20T06:12:22.661558
raw_data:
  {"ports": [22, 80, 3000], "services": ["22/SSH", "80/HTTP", "3000/HTTP"], "os": "linux", "os_version": "", "asn": 45102, "as_name": "ALIBABA-CN-NET Alibaba US Technology Co., Ltd.", "country": "US", "city": "Virginia Beach", "last_updated": "", "labels": []}


indicator: 47.252.11.99
indicator_type: ipv4
source: censys
country: US
city: Virginia Beach
reverse_dns: linux
hosting_provider: ALIBABA-CN-NET Alibaba US Technology Co., Ltd.
queried_at: 2026-05-20T06:12:26.277805
raw_data:
  {"ports": [22, 80, 2000, 3306], "services": ["22/SSH", "80/HTTP", "2000/HTTP", "3306/MYSQL"], "os": "linux", "os_version": "", "asn": 45102, "as_name": "ALIBABA-CN-NET Alibaba US Technology Co., Ltd.", "country": "US", "city": "Virginia Beach", "last_updated": "", "labels": []}


indicator: 193.228.131.161
indicator_type: ipv4
source: censys
country: US
city: Phoenix
hosting_provider: CLOUVIDER Clouvider - Global ASN
queried_at: 2026-05-20T06:12:29.636180
raw_data:
  {"ports": [24442], "services": ["24442/SSH"], "os": "", "os_version": "", "asn": 62240, "as_name": "CLOUVIDER Clouvider - Global ASN", "country": "US", "city": "Phoenix", "last_updated": "", "labels": []}


indicator: 166.1.241.247
indicator_type: ipv4
source: censys
country: US
city: Phoenix
reverse_dns: linux
hosting_provider: CLOUVIDER Clouvider - Global ASN
queried_at: 2026-05-20T06:12:33.057407
raw_data:
  {"ports": [24442], "services": ["24442/SSH"], "os": "linux", "os_version": "", "asn": 62240, "as_name": "CLOUVIDER Clouvider - Global ASN", "country": "US", "city": "Phoenix", "last_updated": "", "labels": []}


indicator: 138.249.139.6
indicator_type: ipv4
source: censys
country: US
city: Los Angeles
hosting_provider: CLOUVIDER Clouvider - Global ASN
queried_at: 2026-05-20T06:12:36.704719
raw_data:
  {"ports": [24442], "services": ["24442/SSH"], "os": "", "os_version": "", "asn": 62240, "as_name": "CLOUVIDER Clouvider - Global ASN", "country": "US", "city": "Los Angeles", "last_updated": "", "labels": []}


indicator: 142.252.86.104
indicator_type: ipv4
source: censys
country: US
city: Los Angeles
reverse_dns: linux
hosting_provider: CLOUVIDER Clouvider - Global ASN
queried_at: 2026-05-20T06:12:43.647261
raw_data:
  {"ports": [24442], "services": ["24442/SSH"], "os": "linux", "os_version": "", "asn": 62240, "as_name": "CLOUVIDER Clouvider - Global ASN", "country": "US", "city": "Los Angeles", "last_updated": "", "labels": []}


indicator: 130.49.117.205
indicator_type: ipv4
source: censys
country: US
city: Miami
hosting_provider: GREENFLOID-AS
queried_at: 2026-05-20T06:12:46.972317
raw_data:
  {"ports": [24442, 63052], "services": ["24442/SSH", "63052/HTTP"], "os": "", "os_version": "", "asn": 204957, "as_name": "GREENFLOID-AS", "country": "US", "city": "Miami", "last_updated": "", "labels": []}


indicator: 170.168.215.64
indicator_type: ipv4
source: censys
country: US
city: Miami
hosting_provider: GREENFLOID-AS
queried_at: 2026-05-20T06:12:50.490286
raw_data:
  {"ports": [24442], "services": ["24442/SSH"], "os": "", "os_version": "", "asn": 204957, "as_name": "GREENFLOID-AS", "country": "US", "city": "Miami", "last_updated": "", "labels": []}


indicator: 50.118.198.26
indicator_type: ipv4
source: censys
country: US
city: New York City
reverse_dns: linux
hosting_provider: IWIHOST
queried_at: 2026-05-20T06:12:53.861072
raw_data:
  {"ports": [24442], "services": ["24442/SSH"], "os": "linux", "os_version": "", "asn": 214238, "as_name": "IWIHOST", "country": "US", "city": "New York City", "last_updated": "", "labels": []}


indicator: 47.90.180.205
indicator_type: ipv4
source: dshield
country: CN
reverse_dns: 47.90.128.0/18
hosting_provider: ALIBABA-CN-NET Alibaba US Technology Co., Ltd.
queried_at: 2026-05-20T06:12:54.648194
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "ipas@cnnic.cn", "as": 45102, "asname": "ALIBABA-CN-NET Alibaba US Technology Co., Ltd.", "ascountry": "CN", "assource": "", "network": "47.90.128.0/18", "threatfeeds": {}}


indicator: 47.252.11.99
indicator_type: ipv4
source: dshield
country: CN
reverse_dns: 47.252.0.0/18
hosting_provider: ALIBABA-CN-NET Alibaba US Technology Co., Ltd.
queried_at: 2026-05-20T06:12:56.426862
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "ipas@cnnic.cn", "as": 45102, "asname": "ALIBABA-CN-NET Alibaba US Technology Co., Ltd.", "ascountry": "CN", "assource": "", "network": "47.252.0.0/18", "threatfeeds": {}}


indicator: 193.228.131.161
indicator_type: ipv4
source: dshield
country: GB
reverse_dns: 193.228.131.0/24
hosting_provider: CLOUVIDER Clouvider - Global ASN
queried_at: 2026-05-20T06:12:58.204041
raw_data:
  {"count": 8, "attacks": 1, "maxdate": "2026-05-20", "mindate": "2026-05-20", "updated": "2026-05-20 04:57:54", "comment": null, "asabusecontact": "abuse@clouvider.net", "as": 62240, "asname": "CLOUVIDER Clouvider - Global ASN", "ascountry": "GB", "assource": "", "network": "193.228.131.0/24", "threatfeeds": {}}


indicator: 166.1.241.247
indicator_type: ipv4
source: dshield
country: GB
reverse_dns: 166.1.241.0/24
hosting_provider: CLOUVIDER Clouvider - Global ASN
queried_at: 2026-05-20T06:12:59.965334
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@clouvider.net", "as": 62240, "asname": "CLOUVIDER Clouvider - Global ASN", "ascountry": "GB", "assource": "", "network": "166.1.241.0/24", "threatfeeds": {}}


indicator: 166.1.255.233
indicator_type: ipv4
source: dshield
country: GB
reverse_dns: 166.1.255.0/24
hosting_provider: CLOUVIDER Clouvider - Global ASN
queried_at: 2026-05-20T06:13:04.346615
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@clouvider.net", "as": 62240, "asname": "CLOUVIDER Clouvider - Global ASN", "ascountry": "GB", "assource": "", "network": "166.1.255.0/24", "threatfeeds": {}}


indicator: 142.252.86.104
indicator_type: ipv4
source: dshield
country: GB
reverse_dns: 142.252.86.0/24
hosting_provider: CLOUVIDER Clouvider - Global ASN
queried_at: 2026-05-20T06:13:06.123550
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@clouvider.net", "as": 62240, "asname": "CLOUVIDER Clouvider - Global ASN", "ascountry": "GB", "assource": "", "network": "142.252.86.0/24", "threatfeeds": {}}


indicator: 130.49.117.205
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 130.49.0.0/17
hosting_provider: UPITT-AS
queried_at: 2026-05-20T06:13:07.955979
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@pitt.edu", "as": 4130, "asname": "UPITT-AS", "ascountry": "US", "assource": "", "network": "130.49.0.0/17", "threatfeeds": {}}


indicator: 50.118.198.26
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 50.118.198.0/24
hosting_provider: GREENFLOID-AS
queried_at: 2026-05-20T06:13:12.502120
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@itldc.com", "as": 204957, "asname": "GREENFLOID-AS", "ascountry": "US", "assource": "", "network": "50.118.198.0/24", "threatfeeds": {}}


indicator: 172.120.234.223
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 172.120.234.0/24
hosting_provider: GREENFLOID-AS
queried_at: 2026-05-20T06:13:14.326551
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@itldc.com", "as": 204957, "asname": "GREENFLOID-AS", "ascountry": "US", "assource": "", "network": "172.120.234.0/24", "threatfeeds": {"blocklistde22": {"lastseen": "2024-08-15", "firstseen": "2024-08-13"}}}


indicator: 45.39.175.12
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 45.39.175.0/24
hosting_provider: GREENFLOID-AS
queried_at: 2026-05-20T06:13:16.157013
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@itldc.com", "as": 204957, "asname": "GREENFLOID-AS", "ascountry": "US", "assource": "", "network": "45.39.175.0/24", "threatfeeds": {}}


indicator: 142.252.171.135
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 142.252.171.0/24
hosting_provider: GREENFLOID-AS
queried_at: 2026-05-20T06:13:17.954453
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@itldc.com", "as": 204957, "asname": "GREENFLOID-AS", "ascountry": "US", "assource": "", "network": "142.252.171.0/24", "threatfeeds": {}}


indicator: 166.88.219.45
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 166.88.219.0/24
hosting_provider: GREENFLOID-AS
queried_at: 2026-05-20T06:13:19.756354
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@itldc.com", "as": 204957, "asname": "GREENFLOID-AS", "ascountry": "US", "assource": "", "network": "166.88.219.0/24", "threatfeeds": {}}


indicator: 172.120.57.92
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 172.120.57.0/24
hosting_provider: GREENFLOID-AS
queried_at: 2026-05-20T06:13:21.574125
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@itldc.com", "as": 204957, "asname": "GREENFLOID-AS", "ascountry": "US", "assource": "", "network": "172.120.57.0/24", "threatfeeds": {}}


indicator: 172.121.59.99
indicator_type: ipv4
source: dshield
country: US
reverse_dns: 172.121.59.0/24
hosting_provider: GREENFLOID-AS
queried_at: 2026-05-20T06:13:23.394261
raw_data:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@itldc.com", "as": 204957, "asname": "GREENFLOID-AS", "ascountry": "US", "assource": "", "network": "172.121.59.0/24", "threatfeeds": {}}


indicator: 47.90.180.205
indicator_type: ipv4
source: firehol
queried_at: 2026-05-20T06:13:41.908974
raw_data:
  {"listed": false, "matched_networks": [], "match_count": 0, "lists_checked": 2, "total_networks": 21612}


indicator: 166.88.219.45
indicator_type: ipv4
source: stevenblack
queried_at: 2026-05-20T06:13:43.125339
raw_data:
  {"hostnames_checked": ["166-88-219-45.ips.acedatacenter.com"], "hostnames_count": 1, "matched_domains": [], "match_count": 0, "blocklist_size": 82208}


indicator: 31.59.58.9
indicator_type: ipv4
source: shodan
city: database
hosting_provider: cpe:/a:mariadb:mariadb,cpe:/a:openbsd:openssh:7.4
queried_at: 2026-05-21T00:02:06.965248
raw_data:
  {"ports": [22, 3306], "vulns": ["CVE-2023-38408", "CVE-2007-2768", "CVE-2016-20012", "CVE-2023-51767", "CVE-2026-35387", "CVE-2023-51385", "CVE-2020-14145", "CVE-2008-3844", "CVE-2018-15473", "CVE-2018-20685", "CVE-2019-6110", "CVE-2025-26465", "CVE-2021-41617", "CVE-2019-6111", "CVE-2026-35388", "CVE-2026-35385", "CVE-2026-35386", "CVE-2026-35414", "CVE-2017-15906", "CVE-2019-6109", "CVE-2018-15919", "CVE-2020-15778", "CVE-2021-36368", "CVE-2023-48795", "CVE-2025-32728"], "hostnames": [], "tags


indicator: 31.59.58.9
indicator_type: ipv4
source: otx
country: IR
queried_at: 2026-05-21T00:02:42.365681
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Iran, Islamic Republic of", "country_code": "IR", "city": null, "asn": "AS58224 iran telecommunication company pjs", "indicator": "31.59.58.9", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 38.180.163.50
indicator_type: ipv4
source: otx
country: US
queried_at: 2026-05-21T00:03:01.084989
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS174 cogent communications", "indicator": "38.180.163.50", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 31.59.58.9
indicator_type: ipv4
source: abuseipdb
country: DE
city: 0
hosting_provider: freakhosting.com
queried_at: 2026-05-21T00:03:01.885778
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "DE", "isp": "freakhosting.com", "domain": "freakhosting.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 38.180.163.50
indicator_type: ipv4
source: abuseipdb
country: EE
city: 0
hosting_provider: 3NT SOLUTIONS LLP
queried_at: 2026-05-21T00:03:03.784762
raw_data:
  {"abuse_confidence": 0, "total_reports": 0, "is_public": true, "is_tor": false, "country": "EE", "isp": "3NT SOLUTIONS LLP", "domain": "3nt.com", "usage_type": "Data Center/Web Hosting/Transit", "last_reported": null, "categories": []}


indicator: 31.59.58.9
indicator_type: ipv4
source: virustotal
country: DE
hosting_provider: Freakhosting Ltd
queried_at: 2026-05-21T00:03:05.863384
raw_data:
  {"malicious": 0, "suspicious": 0, "harmless": 53, "undetected": 38, "reputation": 0, "country": "DE", "as_owner": "Freakhosting Ltd", "asn": 215703, "network": "31.59.58.0/24", "last_analysis_date": 1764931710}


indicator: 38.180.163.50
indicator_type: ipv4
source: virustotal
country: EE
hosting_provider: Aktsiaselts WaveCom
queried_at: 2026-05-21T00:03:26.361407
raw_data:
  {"malicious": 0, "suspicious": 0, "harmless": 0, "undetected": 91, "reputation": 0, "country": "EE", "as_owner": "Aktsiaselts WaveCom", "asn": 34702, "network": "38.180.163.0/24", "last_analysis_date": 1764501573}


indicator: 31.59.58.9
indicator_type: ipv4
source: censys
country: DE
city: Frankfurt am Main
reverse_dns: linux
hosting_provider: FREAKHOSTING _
queried_at: 2026-05-21T00:03:47.296470
raw_data:
  {"ports": [22, 80], "services": ["22/SSH", "80/HTTP"], "os": "linux", "os_version": "", "asn": 215703, "as_name": "FREAKHOSTING _", "country": "DE", "city": "Frankfurt am Main", "last_updated": "", "labels": []}


indicator: 38.180.163.50
indicator_type: ipv4
source: censys
country: EE
city: Tallinn
hosting_provider: WAVECOM-AS
queried_at: 2026-05-21T00:03:50.723783
raw_data:
  {"ports": [], "services": [], "os": "", "os_version": "", "asn": 34702, "as_name": "WAVECOM-AS", "country": "EE", "city": "Tallinn", "last_updated": "", "labels": []}


indicator: 87.121.85.73
indicator_type: ipv4
source: shodan
reverse_dns: seendicate.hu
hosting_provider: cpe:/a:f5:nginx:1.30.1
queried_at: 2026-05-23T18:04:50.936982
raw_data:
  {"ports": [80, 443], "vulns": [], "hostnames": ["seendicate.hu"], "tags": [], "cpes": ["cpe:/a:f5:nginx:1.30.1"]}


indicator: 37.221.65.153
indicator_type: ipv4
source: shodan
reverse_dns: cdn-edge-01
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-23T18:04:54.566470
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["cdn-edge-01"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 37.221.65.115
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: elizabethbailey.com
hosting_provider: cpe:/a:f5:nginx:1.30.0
queried_at: 2026-05-23T18:04:56.328669
raw_data:
  {"ports": [21, 110, 443, 993], "vulns": [], "hostnames": ["elizabethbailey.com"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx:1.30.0"]}


indicator: 37.221.65.134
indicator_type: ipv4
source: shodan
city: self-signed,starttls
queried_at: 2026-05-23T18:04:58.099720
raw_data:
  {"ports": [21, 22, 80, 110, 143, 465, 995, 8888], "vulns": ["CVE-2023-42119", "CVE-2026-40685", "CVE-2024-39929", "CVE-2023-42116", "CVE-2026-40686", "CVE-2023-42117", "CVE-2025-67896", "CVE-2023-42114", "CVE-2022-3620", "CVE-2023-42115", "CVE-2023-51766", "CVE-2022-37451", "CVE-2022-3559", "CVE-2026-40684", "CVE-2026-40687"], "hostnames": [], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:exim:exim:4.95", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/a:f5:nginx:1

hosting_provider:
  cpe:/o:canonical:ubuntu_linux,cpe:/a:exim:exim:4.95,cpe:/a:openbsd:openssh:8.9p1,cpe:/a:f5:nginx:1.28.0,cpe:/a:f5:nginx


indicator: 37.221.65.149
indicator_type: ipv4
source: shodan
reverse_dns: melloshopen.com
hosting_provider: cpe:/a:f5:nginx
queried_at: 2026-05-23T18:04:59.855428
raw_data:
  {"ports": [8888], "vulns": [], "hostnames": ["melloshopen.com"], "tags": [], "cpes": ["cpe:/a:f5:nginx"]}


indicator: 37.221.65.161
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: uruguay-supermatch.com
hosting_provider: cpe:/a:f5:nginx:1.28.0,cpe:/a:exim:exim:4.95
queried_at: 2026-05-23T18:05:01.717561
raw_data:
  {"ports": [21, 80, 443, 465, 587, 995], "vulns": ["CVE-2023-42117", "CVE-2023-42114", "CVE-2025-67896", "CVE-2022-37451", "CVE-2023-42115", "CVE-2026-40686", "CVE-2026-40684", "CVE-2024-39929", "CVE-2022-3620", "CVE-2022-3559", "CVE-2023-51766", "CVE-2023-42116", "CVE-2026-40687", "CVE-2023-42119", "CVE-2026-40685"], "hostnames": ["uruguay-supermatch.com"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx:1.28.0", "cpe:/a:exim:exim:4.95"]}


indicator: 37.221.65.187
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: vps810-29
hosting_provider: cpe:/a:exim:exim:4.95
queried_at: 2026-05-23T18:05:03.576659
raw_data:
  {"ports": [25, 143, 465, 587, 993, 995], "vulns": ["CVE-2023-42119", "CVE-2024-39929", "CVE-2023-42114", "CVE-2023-42117", "CVE-2023-42116", "CVE-2022-37451", "CVE-2025-67896", "CVE-2026-40685", "CVE-2022-3620", "CVE-2023-42115", "CVE-2023-51766", "CVE-2026-40686", "CVE-2022-3559", "CVE-2026-40684", "CVE-2026-40687"], "hostnames": ["vps810-29"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:exim:exim:4.95"]}


indicator: 37.221.65.191
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: alexvps100500-3
queried_at: 2026-05-23T18:05:05.364015
raw_data:
  {"ports": [21, 22, 80, 110, 443, 587, 993, 995, 7777, 8888], "vulns": ["CVE-2023-42117", "CVE-2023-42114", "CVE-2025-67896", "CVE-2022-37451", "CVE-2023-42115", "CVE-2024-39929", "CVE-2022-3620", "CVE-2022-3559", "CVE-2023-51766", "CVE-2023-42116", "CVE-2023-42119"], "hostnames": ["alexvps100500-3"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx:1.28.2", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/a:exim:exim:4.95"]}

hosting_provider:
  cpe:/a:f5:nginx:1.28.2,cpe:/o:canonical:ubuntu_linux,cpe:/a:f5:nginx,cpe:/a:openbsd:openssh:8.9p1,cpe:/a:exim:exim:4.95


indicator: 37.221.65.192
indicator_type: ipv4
source: shodan
city: self-signed,starttls
hosting_provider: cpe:/a:f5:nginx:1.28.0,cpe:/a:exim:exim:4.95
queried_at: 2026-05-23T18:05:07.138460
raw_data:
  {"ports": [80, 110, 143, 443, 465, 995], "vulns": ["CVE-2023-42117", "CVE-2023-42114", "CVE-2025-67896", "CVE-2022-37451", "CVE-2023-42115", "CVE-2026-40686", "CVE-2026-40684", "CVE-2024-39929", "CVE-2022-3620", "CVE-2022-3559", "CVE-2023-51766", "CVE-2023-42116", "CVE-2026-40687", "CVE-2023-42119", "CVE-2026-40685"], "hostnames": [], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx:1.28.0", "cpe:/a:exim:exim:4.95"]}


indicator: 37.221.65.195
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: ne6-2
queried_at: 2026-05-23T18:05:08.934268
raw_data:
  {"ports": [22, 80, 443, 465, 587, 995, 7777], "vulns": ["CVE-2023-42119", "CVE-2026-40685", "CVE-2024-39929", "CVE-2023-42116", "CVE-2026-40686", "CVE-2023-42117", "CVE-2025-67896", "CVE-2023-42114", "CVE-2022-3620", "CVE-2023-42115", "CVE-2023-51766", "CVE-2022-37451", "CVE-2022-3559", "CVE-2026-40684", "CVE-2026-40687"], "hostnames": ["ne6-2"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:exim:exim:4.95", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/a:f5:ngin

hosting_provider:
  cpe:/o:canonical:ubuntu_linux,cpe:/a:exim:exim:4.95,cpe:/a:openbsd:openssh:8.9p1,cpe:/a:f5:nginx,cpe:/a:f5:nginx:1.28.1


indicator: 37.221.65.198
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: vds810-34
hosting_provider: cpe:/a:openbsd:openssh:8.9p1,cpe:/o:canonical:ubuntu_linux,cpe:/a:exim:exim:4.95,cpe:/a:f5:nginx
queried_at: 2026-05-23T18:05:10.709936
raw_data:
  {"ports": [21, 22, 110, 143, 465, 587, 7777], "vulns": ["CVE-2023-42117", "CVE-2023-42114", "CVE-2025-67896", "CVE-2022-37451", "CVE-2023-42115", "CVE-2026-40686", "CVE-2026-40684", "CVE-2024-39929", "CVE-2022-3620", "CVE-2022-3559", "CVE-2023-51766", "CVE-2023-42116", "CVE-2026-40687", "CVE-2023-42119", "CVE-2026-40685"], "hostnames": ["vds810-34"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:openbsd:openssh:8.9p1", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:exim:exim:4.95", "cpe:/a:f5:


indicator: 37.221.65.228
indicator_type: ipv4
source: shodan
city: self-signed,starttls
hosting_provider: cpe:/a:f5:nginx,cpe:/a:exim:exim:4.95,cpe:/a:f5:nginx:1.28.0
queried_at: 2026-05-23T18:05:12.491932
raw_data:
  {"ports": [21, 80, 110, 465, 993, 995, 7777], "vulns": ["CVE-2023-42119", "CVE-2026-40685", "CVE-2024-39929", "CVE-2023-42116", "CVE-2026-40686", "CVE-2023-42117", "CVE-2025-67896", "CVE-2023-42114", "CVE-2022-3620", "CVE-2023-42115", "CVE-2023-51766", "CVE-2022-37451", "CVE-2022-3559", "CVE-2026-40684", "CVE-2026-40687"], "hostnames": [], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx", "cpe:/a:exim:exim:4.95", "cpe:/a:f5:nginx:1.28.0"]}


indicator: 37.221.65.61
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: dattios.com
hosting_provider: cpe:/a:f5:nginx:1.28.2,cpe:/a:exim:exim:4.95,cpe:/a:f5:nginx
queried_at: 2026-05-23T18:05:14.315635
raw_data:
  {"ports": [80, 143, 587, 993, 8888], "vulns": ["CVE-2023-42117", "CVE-2023-42114", "CVE-2025-67896", "CVE-2022-37451", "CVE-2023-42115", "CVE-2026-40686", "CVE-2026-40684", "CVE-2024-39929", "CVE-2022-3620", "CVE-2022-3559", "CVE-2023-51766", "CVE-2023-42116", "CVE-2026-40687", "CVE-2023-42119", "CVE-2026-40685"], "hostnames": ["dattios.com"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx:1.28.2", "cpe:/a:exim:exim:4.95", "cpe:/a:f5:nginx"]}


indicator: 37.221.65.77
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: vps5-9
queried_at: 2026-05-23T18:05:16.094354
raw_data:
  {"ports": [21, 22, 25, 110, 143, 443, 993, 7777], "vulns": ["CVE-2023-42117", "CVE-2023-42114", "CVE-2025-67896", "CVE-2022-37451", "CVE-2023-42115", "CVE-2026-40686", "CVE-2026-40684", "CVE-2024-39929", "CVE-2022-3620", "CVE-2022-3559", "CVE-2023-51766", "CVE-2023-42116", "CVE-2026-40687", "CVE-2023-42119", "CVE-2026-40685"], "hostnames": ["vps5-9"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx:1.28.2", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx", "cpe:/a:openbsd:openss

hosting_provider:
  cpe:/a:f5:nginx:1.28.2,cpe:/o:canonical:ubuntu_linux,cpe:/a:f5:nginx,cpe:/a:openbsd:openssh:8.9p1,cpe:/a:exim:exim:4.95


indicator: 37.221.65.84
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: vps19
queried_at: 2026-05-23T18:05:17.878129
raw_data:
  {"ports": [22, 80, 110, 143, 587, 993, 7777, 8888], "vulns": ["CVE-2023-42117", "CVE-2023-42114", "CVE-2025-67896", "CVE-2022-37451", "CVE-2023-42115", "CVE-2024-39929", "CVE-2022-3620", "CVE-2022-3559", "CVE-2023-51766", "CVE-2023-42116", "CVE-2023-42119"], "hostnames": ["vps19"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx:1.28.2", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/a:exim:exim:4.95"]}

hosting_provider:
  cpe:/a:f5:nginx:1.28.2,cpe:/o:canonical:ubuntu_linux,cpe:/a:f5:nginx,cpe:/a:openbsd:openssh:8.9p1,cpe:/a:exim:exim:4.95


indicator: 37.221.65.128
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: www.airmultystrike.com,airmultystrike.com
hosting_provider: cpe:/a:openbsd:openssh:8.9p1,cpe:/o:canonical:ubuntu_linux,cpe:/a:exim:exim:4.95,cpe:/a:f5:nginx
queried_at: 2026-05-23T18:05:19.976744
raw_data:
  {"ports": [21, 22, 53, 80, 443, 465], "vulns": ["CVE-2023-42117", "CVE-2023-42114", "CVE-2025-67896", "CVE-2022-37451", "CVE-2023-42115", "CVE-2026-40686", "CVE-2026-40684", "CVE-2024-39929", "CVE-2022-3620", "CVE-2022-3559", "CVE-2023-51766", "CVE-2023-42116", "CVE-2026-40687", "CVE-2023-42119", "CVE-2026-40685"], "hostnames": ["www.airmultystrike.com", "airmultystrike.com"], "tags": ["self-signed"], "cpes": ["cpe:/a:openbsd:openssh:8.9p1", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:exim:exim:4.9


indicator: 37.221.65.140
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: srv1.xbmovies.com
hosting_provider: cpe:/a:f5:nginx,cpe:/a:ntp:ntp:3,cpe:/a:exim:exim:4.95
queried_at: 2026-05-23T18:05:21.782299
raw_data:
  {"ports": [21, 25, 53, 80, 123, 143, 465, 587, 995], "vulns": ["CVE-2023-42119", "CVE-2026-40685", "CVE-2024-39929", "CVE-2023-42116", "CVE-2026-40686", "CVE-2023-42117", "CVE-2025-67896", "CVE-2023-42114", "CVE-2022-3620", "CVE-2023-42115", "CVE-2023-51766", "CVE-2022-37451", "CVE-2022-3559", "CVE-2026-40684", "CVE-2026-40687"], "hostnames": ["srv1.xbmovies.com"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx", "cpe:/a:ntp:ntp:3", "cpe:/a:exim:exim:4.95"]}


indicator: 37.221.65.15
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: eisnerwaldemar.com
hosting_provider: cpe:/a:openbsd:openssh:8.9p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-23T18:05:23.586768
raw_data:
  {"ports": [22, 993], "vulns": [], "hostnames": ["eisnerwaldemar.com"], "tags": ["self-signed"], "cpes": ["cpe:/a:openbsd:openssh:8.9p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 37.221.65.178
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: www.finquizpro.info,vps-ig22.com,finquizpro.info
hosting_provider: cpe:/a:ntp:ntp:3,cpe:/a:exim:exim:4.95,cpe:/a:f5:nginx
queried_at: 2026-05-23T18:05:25.430207
raw_data:
  {"ports": [25, 53, 110, 123, 443, 587, 995], "vulns": ["CVE-2023-42117", "CVE-2023-42114", "CVE-2025-67896", "CVE-2022-37451", "CVE-2023-42115", "CVE-2026-40686", "CVE-2026-40684", "CVE-2024-39929", "CVE-2022-3620", "CVE-2022-3559", "CVE-2023-51766", "CVE-2023-42116", "CVE-2026-40687", "CVE-2023-42119", "CVE-2026-40685"], "hostnames": ["www.finquizpro.info", "vps-ig22.com", "finquizpro.info"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:ntp:ntp:3", "cpe:/a:exim:exim:4.95", "cpe:/a:f5:n


indicator: 37.221.65.16
indicator_type: ipv4
source: shodan
reverse_dns: shaikhl.com
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.9p1
queried_at: 2026-05-23T18:05:28.988854
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["shaikhl.com"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1"]}


indicator: 37.221.65.204
indicator_type: ipv4
source: shodan
reverse_dns: md03
hosting_provider: cpe:/a:apache:http_server:2.4.52
queried_at: 2026-05-23T18:05:30.783936
raw_data:
  {"ports": [80], "vulns": ["CVE-2006-20001", "CVE-2024-42516", "CVE-2024-38473", "CVE-2024-39573", "CVE-2024-38475", "CVE-2013-4365", "CVE-2022-37436", "CVE-2022-26377", "CVE-2022-31813", "CVE-2025-49630", "CVE-2024-38476", "CVE-2023-38709", "CVE-2013-0941", "CVE-2022-30556", "CVE-2024-43204", "CVE-2024-38474", "CVE-2024-24795", "CVE-2022-28614", "CVE-2012-3526", "CVE-2024-27316", "CVE-2013-2765", "CVE-2009-2299", "CVE-2009-0796", "CVE-2022-28615", "CVE-2025-55753", "CVE-2023-25690", "CVE-2022-28


indicator: 37.221.65.25
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: inmortalscan
hosting_provider: cpe:/a:f5:nginx
queried_at: 2026-05-23T18:05:32.567465
raw_data:
  {"ports": [80, 443, 8083], "vulns": [], "hostnames": ["inmortalscan"], "tags": ["self-signed"], "cpes": ["cpe:/a:f5:nginx"]}


indicator: 37.221.65.49
indicator_type: ipv4
source: shodan
reverse_dns: tmd.xip.io
hosting_provider: cpe:/o:debian:debian_linux,cpe:/a:openbsd:openssh:10.0p2,cpe:/o:linux:linux_kernel
queried_at: 2026-05-23T18:05:34.432945
raw_data:
  {"ports": [2222], "vulns": [], "hostnames": ["tmd.xip.io"], "tags": [], "cpes": ["cpe:/o:debian:debian_linux", "cpe:/a:openbsd:openssh:10.0p2", "cpe:/o:linux:linux_kernel"]}


indicator: 37.221.65.6
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/a:f5:nginx:1.28.2,cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.9p1
queried_at: 2026-05-23T18:05:36.296676
raw_data:
  {"ports": [22, 80, 443], "vulns": [], "hostnames": [], "tags": [], "cpes": ["cpe:/a:f5:nginx:1.28.2", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1"]}


indicator: 37.221.65.7
indicator_type: ipv4
source: shodan
reverse_dns: webempresa
hosting_provider: cpe:/a:openbsd:openssh:8.9p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-23T18:05:38.119468
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["webempresa"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:8.9p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 37.221.65.19
indicator_type: ipv4
source: shodan
city: proxy
hosting_provider: cpe:/a:squid-cache:squid:3.3.8
queried_at: 2026-05-23T18:05:39.959216
raw_data:
  {"ports": [3128], "vulns": ["CVE-2023-46847", "CVE-2020-25097", "CVE-2016-2571", "CVE-2015-3455", "CVE-2021-31806", "CVE-2026-33526", "CVE-2019-12528", "CVE-2019-12519", "CVE-2014-7141", "CVE-2019-12529", "CVE-2016-4053", "CVE-2016-4052", "CVE-2020-11945", "CVE-2023-46728", "CVE-2020-15049", "CVE-2024-25617", "CVE-2016-3947", "CVE-2018-1000027", "CVE-2023-46846", "CVE-2018-1000024", "CVE-2023-5824", "CVE-2020-14058", "CVE-2019-12522", "CVE-2016-4554", "CVE-2018-19131", "CVE-2016-10002", "CVE-201


indicator: 37.221.65.23
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: mediagrove2.info,srv1.dae.com
hosting_provider: cpe:/a:postfix:postfix,cpe:/a:f5:nginx
queried_at: 2026-05-23T18:05:43.495648
raw_data:
  {"ports": [25, 53, 80, 110, 993, 995, 8083], "vulns": [], "hostnames": ["mediagrove2.info", "srv1.dae.com"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:postfix:postfix", "cpe:/a:f5:nginx"]}


indicator: 37.221.65.26
indicator_type: ipv4
source: shodan
reverse_dns: emmmmbed.com,testbckup3.com
hosting_provider: cpe:/a:f5:nginx,cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.9p1
queried_at: 2026-05-23T18:05:45.271202
raw_data:
  {"ports": [22, 80, 888], "vulns": [], "hostnames": ["emmmmbed.com", "testbckup3.com"], "tags": [], "cpes": ["cpe:/a:f5:nginx", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1"]}


indicator: 37.221.65.31
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: gameshost
hosting_provider: cpe:/a:pureftpd:pure-ftpd
queried_at: 2026-05-23T18:05:47.012015
raw_data:
  {"ports": [21], "vulns": [], "hostnames": ["gameshost"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:pureftpd:pure-ftpd"]}


indicator: 37.221.65.33
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: m-leathers.com,HomeIP
hosting_provider: cpe:/a:f5:nginx:1.24.0,cpe:/o:canonical:ubuntu_linux,cpe:/o:linux:linux_kernel
queried_at: 2026-05-23T18:05:48.768467
raw_data:
  {"ports": [80, 443], "vulns": ["CVE-2025-23419", "CVE-2023-44487"], "hostnames": ["m-leathers.com", "HomeIP"], "tags": ["eol-product"], "cpes": ["cpe:/a:f5:nginx:1.24.0", "cpe:/o:canonical:ubuntu_linux", "cpe:/o:linux:linux_kernel"]}


indicator: 37.221.65.36
indicator_type: ipv4
source: shodan
city: self-signed,database,eol-product
reverse_dns: proxy.famosaspeladas.blog
queried_at: 2026-05-23T18:05:52.274975
raw_data:
  {"ports": [21, 22, 53, 111, 443, 465, 995, 2082, 2083, 2086, 2087, 3306, 8181, 8443], "vulns": ["CVE-2020-7070", "CVE-2023-4807", "CVE-2021-23017", "CVE-2022-4900", "CVE-2023-0464", "CVE-2019-9511", "CVE-2009-1390", "CVE-2009-2299", "CVE-2012-4360", "CVE-2020-15778", "CVE-2019-9516", "CVE-2009-0796", "CVE-2007-2768", "CVE-2009-3765", "CVE-2024-3566", "CVE-2023-38408", "CVE-2020-14145", "CVE-2013-4365", "CVE-2007-4723", "CVE-2025-49812", "CVE-2025-59775", "CVE-2023-0466", "CVE-2022-31628", "CVE-2

hosting_provider:
  cpe:/a:control-webpanel:webpanel,cpe:/a:mariadb:mariadb,cpe:/a:f5:nginx:1.14.1,cpe:/a:openbsd:openssh:8.0,cpe:/a:apache:http_server:2.4.62,cpe:/o:unix:unix,cpe:/a:postfix:postfix,cpe:/a:php:php:7.2.30,cpe:/a:pureftpd:pure-ftpd,cpe:/a:openssl:openssl:1.1.1k


indicator: 37.221.65.41
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: a2403261.adm
queried_at: 2026-05-23T18:05:54.047109
raw_data:
  {"ports": [445, 5985, 5986], "vulns": [], "hostnames": ["a2403261.adm"], "tags": ["self-signed"], "cpes": []}


indicator: 37.221.65.45
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: serv.domains.pct
hosting_provider: cpe:/a:f5:nginx
queried_at: 2026-05-23T18:05:55.822092
raw_data:
  {"ports": [25, 53, 110, 995, 8083], "vulns": [], "hostnames": ["serv.domains.pct"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx"]}


indicator: 37.221.65.46
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/a:openvpn:openvpn_access_server
queried_at: 2026-05-23T18:05:57.588103
raw_data:
  {"ports": [443, 9443], "vulns": [], "hostnames": [], "tags": [], "cpes": ["cpe:/a:openvpn:openvpn_access_server"]}


indicator: 37.221.65.52
indicator_type: ipv4
source: shodan
city: vpn,eol-product
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/o:linux:linux_kernel,cpe:/a:f5:nginx:1.18.0
queried_at: 2026-05-23T18:05:59.384938
raw_data:
  {"ports": [80, 1194], "vulns": ["CVE-2025-23419", "CVE-2021-3618", "CVE-2023-44487", "CVE-2021-23017"], "hostnames": [], "tags": ["vpn", "eol-product"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/o:linux:linux_kernel", "cpe:/a:f5:nginx:1.18.0"]}


indicator: 37.221.65.55
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: domain.com,xcasino-hungary.com
hosting_provider: cpe:/a:f5:nginx,cpe:/a:openbsd:openssh:7.4
queried_at: 2026-05-23T18:06:02.957760
raw_data:
  {"ports": [22, 53, 80, 587, 993, 995], "vulns": ["CVE-2021-36368", "CVE-2019-6109", "CVE-2008-3844", "CVE-2007-2768", "CVE-2026-35386", "CVE-2020-14145", "CVE-2026-35385", "CVE-2026-35414", "CVE-2025-32728", "CVE-2023-48795", "CVE-2023-51385", "CVE-2019-6111", "CVE-2018-20685", "CVE-2018-15473", "CVE-2023-51767", "CVE-2021-41617", "CVE-2019-6110", "CVE-2020-15778", "CVE-2026-35387", "CVE-2018-15919", "CVE-2026-35388", "CVE-2025-26465", "CVE-2023-38408", "CVE-2017-15906", "CVE-2016-20012"], "host


indicator: 37.221.65.57
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: vncvncnc.com
queried_at: 2026-05-23T18:06:04.741340
raw_data:
  {"ports": [445, 3389, 5357], "vulns": ["CVE-2020-0796"], "hostnames": ["vncvncnc.com"], "tags": ["self-signed"], "cpes": []}


indicator: 37.221.65.60
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: 37-221-65-60.cprapid.com,medelitelibrary.shop,medvora.shop
hosting_provider: cpe:/a:apache:http_server,cpe:/a:cpanel:cpanel,cpe:/a:openbsd:openssh:8.7
queried_at: 2026-05-23T18:06:06.507601
raw_data:
  {"ports": [22, 53, 80, 111, 143, 443, 993, 995, 2082, 2083, 2086, 2087, 2096], "vulns": ["CVE-2026-35388", "CVE-2026-35414", "CVE-2021-36368", "CVE-2021-41617", "CVE-2025-32728", "CVE-2025-26465", "CVE-2023-48795", "CVE-2023-51385", "CVE-2023-38408", "CVE-2008-3844", "CVE-2007-2768", "CVE-2026-35386", "CVE-2024-6387", "CVE-2016-20012", "CVE-2026-35385", "CVE-2026-35387", "CVE-2023-51767"], "hostnames": ["37-221-65-60.cprapid.com", "medelitelibrary.shop", "medvora.shop"], "tags": ["self-signed", 


indicator: 37.221.65.79
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/a:microsoft:internet_information_services:10.0,cpe:/o:microsoft:windows
queried_at: 2026-05-23T18:06:10.113606
raw_data:
  {"ports": [80, 135, 139, 5985], "vulns": [], "hostnames": [], "tags": [], "cpes": ["cpe:/a:microsoft:internet_information_services:10.0", "cpe:/o:microsoft:windows"]}


indicator: 37.221.65.83
indicator_type: ipv4
source: shodan
reverse_dns: 0801261
hosting_provider: cpe:/o:microsoft:windows,cpe:/a:microsoft:internet_information_services:10.0
queried_at: 2026-05-23T18:06:13.868995
raw_data:
  {"ports": [80, 135, 445, 5985, 8880], "vulns": [], "hostnames": ["0801261"], "tags": [], "cpes": ["cpe:/o:microsoft:windows", "cpe:/a:microsoft:internet_information_services:10.0"]}


indicator: 37.221.65.87
indicator_type: ipv4
source: shodan
reverse_dns: worker
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.9p1
queried_at: 2026-05-23T18:06:15.626891
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["worker"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1"]}


indicator: 37.221.65.88
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: dafhfds3140
hosting_provider: cpe:/a:f5:nginx
queried_at: 2026-05-23T18:06:17.376322
raw_data:
  {"ports": [21, 80, 443, 587, 995], "vulns": [], "hostnames": ["dafhfds3140"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx"]}


indicator: 37.221.65.91
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: velikolepnyy-vek.online
hosting_provider: cpe:/a:ntp:ntp:3,cpe:/a:exim:exim:4.97
queried_at: 2026-05-23T18:06:19.135080
raw_data:
  {"ports": [21, 25, 53, 110, 123, 143, 465, 587, 993], "vulns": ["CVE-2025-67896", "CVE-2026-40686", "CVE-2026-40684", "CVE-2025-30232", "CVE-2024-39929", "CVE-2023-51766", "CVE-2026-40687", "CVE-2026-40685"], "hostnames": ["velikolepnyy-vek.online"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:ntp:ntp:3", "cpe:/a:exim:exim:4.97"]}


indicator: 37.221.65.92
indicator_type: ipv4
source: shodan
reverse_dns: tidal-voip.com
queried_at: 2026-05-23T18:06:20.909328
raw_data:
  {"ports": [82, 84, 5060, 6002, 8001], "vulns": [], "hostnames": ["tidal-voip.com"], "tags": [], "cpes": ["cpe:/a:expressjs:express", "cpe:/a:getbootstrap:bootstrap", "cpe:/a:apache:http_server", "cpe:/a:nodejs:node.js", "cpe:/a:jquery:jquery:3.6.0"]}

hosting_provider:
  cpe:/a:expressjs:express,cpe:/a:getbootstrap:bootstrap,cpe:/a:apache:http_server,cpe:/a:nodejs:node.js,cpe:/a:jquery:jquery:3.6.0


indicator: 37.221.65.94
indicator_type: ipv4
source: shodan
city: starttls
reverse_dns: go.22bet15.com,autoconfig.22bet15.com,srv3.22bet.com,autodiscover.22bet15.com,mail.22bet15.com
hosting_provider: cpe:/a:f5:nginx
queried_at: 2026-05-23T18:06:22.696416
raw_data:
  {"ports": [25, 443, 465, 993, 995], "vulns": [], "hostnames": ["go.22bet15.com", "autoconfig.22bet15.com", "srv3.22bet.com", "autodiscover.22bet15.com", "mail.22bet15.com"], "tags": ["starttls"], "cpes": ["cpe:/a:f5:nginx"]}


indicator: 37.221.65.103
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: rhythmstepdance.com
hosting_provider: cpe:/a:f5:nginx,cpe:/a:openbsd:openssh:8.9p1
queried_at: 2026-05-23T18:06:27.989552
raw_data:
  {"ports": [22, 53, 143, 465, 587, 993, 995, 8083], "vulns": [], "hostnames": ["rhythmstepdance.com"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx", "cpe:/a:openbsd:openssh:8.9p1"]}


indicator: 37.221.65.105
indicator_type: ipv4
source: shodan
reverse_dns: test30.com
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-23T18:06:29.765084
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["test30.com"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 37.221.65.109
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: serv.swbattlecry.com
hosting_provider: cpe:/a:f5:nginx,cpe:/a:openbsd:openssh:8.2p1
queried_at: 2026-05-23T18:06:31.548410
raw_data:
  {"ports": [22, 53, 110, 143, 995, 8083], "vulns": [], "hostnames": ["serv.swbattlecry.com"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx", "cpe:/a:openbsd:openssh:8.2p1"]}


indicator: 37.221.65.110
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: soluciona.li
hosting_provider: cpe:/a:f5:nginx
queried_at: 2026-05-23T18:06:33.298568
raw_data:
  {"ports": [21, 53, 143, 995, 8083], "vulns": [], "hostnames": ["soluciona.li"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx"]}


indicator: 37.221.65.117
indicator_type: ipv4
source: shodan
city: starttls,database
reverse_dns: 37-221-65-117.cprapid.com,fournilchatel.fr,mail.ad1950.de,autodiscover.ad1950.de
queried_at: 2026-05-23T18:06:36.879430
raw_data:
  {"ports": [53, 80, 110, 111, 443, 465, 993, 995, 2082, 2083, 2087, 3306, 4190], "vulns": [], "hostnames": ["37-221-65-117.cprapid.com", "fournilchatel.fr", "mail.ad1950.de", "autodiscover.ad1950.de"], "tags": ["starttls", "database"], "cpes": ["cpe:/a:apache:http_server", "cpe:/a:cpanel:cpanel", "cpe:/a:mariadb:mariadb", "cpe:/a:cpanel:whm", "cpe:/a:exim:exim:4.99.1"]}

hosting_provider:
  cpe:/a:apache:http_server,cpe:/a:cpanel:cpanel,cpe:/a:mariadb:mariadb,cpe:/a:cpanel:whm,cpe:/a:exim:exim:4.99.1


indicator: 37.221.65.122
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: top5erials
hosting_provider: cpe:/a:f5:nginx
queried_at: 2026-05-23T18:06:38.646785
raw_data:
  {"ports": [21, 53, 80, 110, 465, 993, 8083], "vulns": [], "hostnames": ["top5erials"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx"]}


indicator: 37.221.65.124
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: alienserver
hosting_provider: cpe:/a:f5:nginx:1.7.7,cpe:/a:f5:nginx
queried_at: 2026-05-23T18:06:40.422447
raw_data:
  {"ports": [8080, 31210], "vulns": ["CVE-2018-16845", "CVE-2017-7529", "CVE-2016-0747", "CVE-2016-4450", "CVE-2016-1247", "CVE-2016-0742", "CVE-2017-20005", "CVE-2021-23017", "CVE-2019-20372", "CVE-2021-3618", "CVE-2016-0746"], "hostnames": ["alienserver"], "tags": ["eol-product"], "cpes": ["cpe:/a:f5:nginx:1.7.7", "cpe:/a:f5:nginx"]}


indicator: 37.221.65.126
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: phoenix-pass.xyz
hosting_provider: cpe:/a:apache:http_server:2.4.52,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-23T18:06:42.227845
raw_data:
  {"ports": [21, 80], "vulns": ["CVE-2025-53020", "CVE-2022-22721", "CVE-2023-45802", "CVE-2025-55753", "CVE-2025-66200", "CVE-2006-20001", "CVE-2025-23048", "CVE-2013-0942", "CVE-2023-31122", "CVE-2024-38472", "CVE-2024-38473", "CVE-2022-30556", "CVE-2024-39573", "CVE-2026-29169", "CVE-2026-24072", "CVE-2024-27316", "CVE-2026-33857", "CVE-2026-34059", "CVE-2022-23943", "CVE-2023-25690", "CVE-2022-22719", "CVE-2026-33006", "CVE-2026-33523", "CVE-2024-38474", "CVE-2024-40898", "CVE-2022-36760", "CV


indicator: 37.221.65.142
indicator_type: ipv4
source: shodan
reverse_dns: baidu.com
hosting_provider: cpe:/a:openresty:openresty,cpe:/a:f5:nginx
queried_at: 2026-05-23T18:06:44.000308
raw_data:
  {"ports": [80], "vulns": [], "hostnames": ["baidu.com"], "tags": [], "cpes": ["cpe:/a:openresty:openresty", "cpe:/a:f5:nginx"]}


indicator: 37.221.65.143
indicator_type: ipv4
source: shodan
city: self-signed,ai
queried_at: 2026-05-23T18:06:45.774387
raw_data:
  {"ports": [135, 445, 3389, 5357, 47001], "vulns": [], "hostnames": [], "tags": ["self-signed", "ai"], "cpes": []}


indicator: 37.221.65.150
indicator_type: ipv4
source: shodan
reverse_dns: vps1.example.com
hosting_provider: cpe:/a:openbsd:openssh:7.4
queried_at: 2026-05-23T18:06:47.555797
raw_data:
  {"ports": [22], "vulns": ["CVE-2021-36368", "CVE-2019-6109", "CVE-2008-3844", "CVE-2007-2768", "CVE-2020-14145", "CVE-2026-35414", "CVE-2025-32728", "CVE-2023-48795", "CVE-2023-51385", "CVE-2019-6111", "CVE-2018-20685", "CVE-2018-15473", "CVE-2023-51767", "CVE-2021-41617", "CVE-2019-6110", "CVE-2020-15778", "CVE-2018-15919", "CVE-2025-26465", "CVE-2023-38408", "CVE-2017-15906", "CVE-2016-20012"], "hostnames": ["vps1.example.com"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:7.4"]}


indicator: 37.221.65.155
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: tod.com
hosting_provider: cpe:/a:litespeedtech:litespeed_web_server,cpe:/a:postfix:postfix
queried_at: 2026-05-23T18:06:49.344626
raw_data:
  {"ports": [25, 53, 80, 110, 443, 587, 993, 995], "vulns": [], "hostnames": ["tod.com"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:litespeedtech:litespeed_web_server", "cpe:/a:postfix:postfix"]}


indicator: 37.221.65.162
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: tipp3s.com
hosting_provider: cpe:/a:openbsd:openssh:8.9p1,cpe:/a:f5:nginx
queried_at: 2026-05-23T18:06:51.122656
raw_data:
  {"ports": [22, 25, 80, 110, 443, 587, 993, 8083], "vulns": [], "hostnames": ["tipp3s.com"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:openbsd:openssh:8.9p1", "cpe:/a:f5:nginx"]}


indicator: 37.221.65.173
indicator_type: ipv4
source: shodan
city: open-dir
reverse_dns: yarrakhacklersin.com
hosting_provider: cpe:/a:apache:http_server:2.4.52,cpe:/a:openbsd:openssh:8.9p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-23T18:06:52.922533
raw_data:
  {"ports": [22, 80], "vulns": ["CVE-2025-53020", "CVE-2022-22721", "CVE-2023-45802", "CVE-2025-55753", "CVE-2025-66200", "CVE-2006-20001", "CVE-2025-23048", "CVE-2013-0942", "CVE-2023-31122", "CVE-2024-38472", "CVE-2024-38473", "CVE-2022-30556", "CVE-2024-39573", "CVE-2026-29169", "CVE-2026-24072", "CVE-2024-27316", "CVE-2026-33857", "CVE-2026-34059", "CVE-2022-23943", "CVE-2023-25690", "CVE-2022-22719", "CVE-2026-33006", "CVE-2026-33523", "CVE-2024-38474", "CVE-2024-40898", "CVE-2022-36760", "CV


indicator: 37.221.65.185
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: alexgamble
queried_at: 2026-05-23T18:06:58.246158
raw_data:
  {"ports": [22, 25, 53, 110, 123, 443, 465, 587, 993, 995], "vulns": ["CVE-2023-42119", "CVE-2024-39929", "CVE-2023-42114", "CVE-2023-42117", "CVE-2023-42116", "CVE-2022-37451", "CVE-2025-67896", "CVE-2026-40685", "CVE-2026-40686", "CVE-2023-42115", "CVE-2023-51766", "CVE-2021-38371", "CVE-2022-3559", "CVE-2026-40684", "CVE-2026-40687", "CVE-2022-37452"], "hostnames": ["alexgamble"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:openbsd:openssh:8.4p1", "cpe:/o:linux:linux_kernel", "cpe:/a

hosting_provider:
  cpe:/a:openbsd:openssh:8.4p1,cpe:/o:linux:linux_kernel,cpe:/a:ntp:ntp:3,cpe:/a:exim:exim:4.94.2,cpe:/a:f5:nginx,cpe:/o:debian:debian_linux


indicator: 37.221.65.188
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: www.czsk.tv,czsk.tv,mail.czsk.tv
hosting_provider: cpe:/a:f5:nginx,cpe:/a:apache:http_server
queried_at: 2026-05-23T18:07:00.002926
raw_data:
  {"ports": [25, 80, 143, 443, 993, 995, 8080], "vulns": [], "hostnames": ["www.czsk.tv", "czsk.tv", "mail.czsk.tv"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx", "cpe:/a:apache:http_server"]}


indicator: 37.221.65.190
indicator_type: ipv4
source: shodan
city: self-signed,starttls,database
hosting_provider: cpe:/a:f5:nginx,cpe:/a:oracle:mysql:8.0.33
queried_at: 2026-05-23T18:07:01.754815
raw_data:
  {"ports": [21, 53, 80, 443, 3306], "vulns": ["CVE-2023-22059", "CVE-2024-21157", "CVE-2023-22092", "CVE-2024-21056", "CVE-2024-21212", "CVE-2024-21096", "CVE-2024-21236", "CVE-2024-20963", "CVE-2024-21160", "CVE-2024-21173", "CVE-2024-21165", "CVE-2024-20996", "CVE-2024-21055", "CVE-2024-20971", "CVE-2024-21198", "CVE-2024-20973", "CVE-2026-21964", "CVE-2024-21194", "CVE-2023-22110", "CVE-2024-21125", "CVE-2024-21049", "CVE-2025-50099", "CVE-2024-21134", "CVE-2024-21197", "CVE-2024-21159", "CVE-


indicator: 37.221.65.193
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: filmebro.com
hosting_provider: cpe:/a:openbsd:openssh:9.2p1,cpe:/a:f5:nginx
queried_at: 2026-05-23T18:07:03.568380
raw_data:
  {"ports": [22, 53, 80, 143, 587, 993, 995], "vulns": [], "hostnames": ["filmebro.com"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:openbsd:openssh:9.2p1", "cpe:/a:f5:nginx"]}


indicator: 37.221.65.217
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: gnuru.org,cassie
queried_at: 2026-05-23T18:07:07.159578
raw_data:
  {"ports": [22, 443, 587, 995], "vulns": ["CVE-2025-67896", "CVE-2026-40686", "CVE-2026-40684", "CVE-2026-40687", "CVE-2026-40685"], "hostnames": ["gnuru.org", "cassie"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:exim:exim:4.98.2", "cpe:/o:debian:debian_linux", "cpe:/a:openbsd:openssh:10.0p2", "cpe:/a:f5:nginx", "cpe:/o:linux:linux_kernel"]}

hosting_provider:
  cpe:/a:exim:exim:4.98.2,cpe:/o:debian:debian_linux,cpe:/a:openbsd:openssh:10.0p2,cpe:/a:f5:nginx,cpe:/o:linux:linux_kernel


indicator: 37.221.65.223
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: serial4.server.ru
hosting_provider: cpe:/a:f5:nginx,cpe:/a:openbsd:openssh:9.2p1
queried_at: 2026-05-23T18:07:08.934379
raw_data:
  {"ports": [22, 53, 80, 8083], "vulns": [], "hostnames": ["serial4.server.ru"], "tags": ["self-signed"], "cpes": ["cpe:/a:f5:nginx", "cpe:/a:openbsd:openssh:9.2p1"]}


indicator: 37.221.65.229
indicator_type: ipv4
source: shodan
reverse_dns: newhost
hosting_provider: cpe:/a:openbsd:openssh:8.4p1,cpe:/o:debian:debian_linux,cpe:/o:linux:linux_kernel
queried_at: 2026-05-23T18:07:12.533784
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["newhost"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:8.4p1", "cpe:/o:debian:debian_linux", "cpe:/o:linux:linux_kernel"]}


indicator: 37.221.65.231
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: serial2.server.ru
hosting_provider: cpe:/a:openbsd:openssh:9.2p1,cpe:/a:f5:nginx
queried_at: 2026-05-23T18:07:14.352328
raw_data:
  {"ports": [21, 22, 53, 80, 8083], "vulns": [], "hostnames": ["serial2.server.ru"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:openbsd:openssh:9.2p1", "cpe:/a:f5:nginx"]}


indicator: 37.221.65.233
indicator_type: ipv4
source: shodan
reverse_dns: www.999.md,docs.kozich.net,999.md
hosting_provider: cpe:/a:f5:nginx
queried_at: 2026-05-23T18:07:16.159746
raw_data:
  {"ports": [8443], "vulns": [], "hostnames": ["www.999.md", "docs.kozich.net", "999.md"], "tags": [], "cpes": ["cpe:/a:f5:nginx"]}


indicator: 37.221.65.235
indicator_type: ipv4
source: shodan
reverse_dns: tatsuya.mo
queried_at: 2026-05-23T18:07:17.928488
raw_data:
  {"ports": [22, 443, 10050], "vulns": [], "hostnames": ["tatsuya.mo"], "tags": [], "cpes": ["cpe:/o:debian:debian_linux", "cpe:/a:apache:http_server:2.4.67", "cpe:/o:linux:linux_kernel", "cpe:/a:openbsd:openssh:9.2p1"]}

hosting_provider:
  cpe:/o:debian:debian_linux,cpe:/a:apache:http_server:2.4.67,cpe:/o:linux:linux_kernel,cpe:/a:openbsd:openssh:9.2p1


indicator: 37.221.65.242
indicator_type: ipv4
source: shodan
reverse_dns: wcup.live,afu.su,uzspon.ru,wcp.su,spon.uz,tutsport.net,tutbet.net
hosting_provider: cpe:/a:openbsd:openssh:8.9p1,cpe:/o:canonical:ubuntu_linux,cpe:/a:f5:nginx
queried_at: 2026-05-23T18:07:19.737483
raw_data:
  {"ports": [22, 53, 80, 443], "vulns": [], "hostnames": ["wcup.live", "afu.su", "uzspon.ru", "wcp.su", "spon.uz", "tutsport.net", "tutbet.net"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:8.9p1", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx"]}


indicator: 37.221.65.246
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: play.gamingcraft.com
queried_at: 2026-05-23T18:07:21.539709
raw_data:
  {"ports": [80, 443], "vulns": [], "hostnames": ["play.gamingcraft.com"], "tags": ["self-signed"], "cpes": []}


indicator: 37.221.65.252
indicator_type: ipv4
source: shodan
reverse_dns: mail.chro-nix.live
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:7.6p1
queried_at: 2026-05-23T18:07:23.305372
raw_data:
  {"ports": [22, 53], "vulns": [], "hostnames": ["mail.chro-nix.live"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:7.6p1"]}


indicator: 87.121.85.31
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-23T18:07:26.855724
raw_data:
  {"ports": [22, 80], "vulns": [], "hostnames": [], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 87.121.85.63
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/a:facebook:react,cpe:/a:vercel:next.js
queried_at: 2026-05-23T18:08:13.535918
raw_data:
  {"ports": [3000], "vulns": [], "hostnames": [], "tags": [], "cpes": ["cpe:/a:facebook:react", "cpe:/a:vercel:next.js"]}


indicator: 87.121.85.101
indicator_type: ipv4
source: shodan
city: ai
queried_at: 2026-05-23T18:09:01.466118
raw_data:
  {"ports": [81, 443, 8000, 9090, 9443], "vulns": [], "hostnames": [], "tags": ["ai"], "cpes": ["cpe:/a:angularjs:angular.js", "cpe:/a:openresty:openresty", "cpe:/a:portainer:portainer:2.27.6", "cpe:/a:f5:nginx"]}

hosting_provider:
  cpe:/a:angularjs:angular.js,cpe:/a:openresty:openresty,cpe:/a:portainer:portainer:2.27.6,cpe:/a:f5:nginx


indicator: 87.121.85.104
indicator_type: ipv4
source: shodan
reverse_dns: mail.vargamarton.hu
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-23T18:09:03.234596
raw_data:
  {"ports": [22, 80], "vulns": [], "hostnames": ["mail.vargamarton.hu"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 87.121.85.114
indicator_type: ipv4
source: shodan
reverse_dns: gearzone.hu
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-23T18:09:06.750186
raw_data:
  {"ports": [22, 80], "vulns": [], "hostnames": ["gearzone.hu"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 87.121.85.122
indicator_type: ipv4
source: shodan
city: self-signed,database
reverse_dns: TimeTango.techcraft.hu
queried_at: 2026-05-23T18:09:08.532922
raw_data:
  {"ports": [22, 80, 5432], "vulns": [], "hostnames": ["TimeTango.techcraft.hu"], "tags": ["self-signed", "database"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:caddyserver:caddy", "cpe:/a:golang:go", "cpe:/a:postgresql:postgresql", "cpe:/a:openbsd:openssh:9.6p1"]}

hosting_provider:
  cpe:/o:canonical:ubuntu_linux,cpe:/a:caddyserver:caddy,cpe:/a:golang:go,cpe:/a:postgresql:postgresql,cpe:/a:openbsd:openssh:9.6p1


indicator: 87.121.85.124
indicator_type: ipv4
source: shodan
city: database
queried_at: 2026-05-23T18:09:10.337958
raw_data:
  {"ports": [22, 6379, 8080, 27017], "vulns": ["CVE-2025-11979", "CVE-2025-13507", "CVE-2009-3766", "CVE-2025-14345", "CVE-2026-28387", "CVE-2009-3767", "CVE-2025-69418", "CVE-2026-4148", "CVE-2026-31789", "CVE-2009-1390", "CVE-2026-28390", "CVE-2026-4358", "CVE-2025-6712", "CVE-2025-14847", "CVE-2025-12657", "CVE-2024-6119", "CVE-2025-10060", "CVE-2026-1848", "CVE-2026-5170", "CVE-2009-3765", "CVE-2026-28388", "CVE-2026-1850", "CVE-2019-0190", "CVE-2025-15467", "CVE-2025-10061", "CVE-2026-22795",

hosting_provider:
  cpe:/a:mongodb:mongodb:8.0.9,cpe:/a:openssl:openssl:3.0.13,cpe:/o:canonical:ubuntu_linux,cpe:/a:redislabs:redis,cpe:/a:openbsd:openssh:9.6p1


indicator: 87.121.85.136
indicator_type: ipv4
source: shodan
queried_at: 2026-05-23T18:09:13.920607
raw_data:
  {"ports": [22, 80, 8384], "vulns": ["CVE-2018-18405", "CVE-2020-11023", "CVE-2020-11022", "CVE-2019-11358", "CVE-2015-9251"], "hostnames": [], "tags": [], "cpes": ["cpe:/a:getbootstrap:bootstrap", "cpe:/a:f5:nginx:1.28.0", "cpe:/a:angularjs:angular.js", "cpe:/a:momentjs:moment", "cpe:/a:openbsd:openssh:10.0p2", "cpe:/o:canonical:ubuntu_linux", "cpe:/o:linux:linux_kernel", "cpe:/a:jquery:jquery:2.2.2"]}

hosting_provider:
  cpe:/a:getbootstrap:bootstrap,cpe:/a:f5:nginx:1.28.0,cpe:/a:angularjs:angular.js,cpe:/a:momentjs:moment,cpe:/a:openbsd:openssh:10.0p2,cpe:/o:canonical:ubuntu_linux,cpe:/o:linux:linux_kernel,cpe:/a:jquery:jquery:2.2.2


indicator: 87.121.85.151
indicator_type: ipv4
source: shodan
queried_at: 2026-05-23T18:09:21.021858
raw_data:
  {"ports": [22, 80], "vulns": [], "hostnames": [], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/a:caddyserver:caddy", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:golang:go"]}

hosting_provider:
  cpe:/a:openbsd:openssh:9.6p1,cpe:/a:caddyserver:caddy,cpe:/o:canonical:ubuntu_linux,cpe:/a:golang:go


indicator: 87.121.85.174
indicator_type: ipv4
source: shodan
city: open-dir
hosting_provider: cpe:/a:python:python:3.13.5
queried_at: 2026-05-23T18:09:24.538282
raw_data:
  {"ports": [443, 6080], "vulns": ["CVE-2026-4519", "CVE-2025-13837", "CVE-2021-32052", "CVE-2009-2940", "CVE-2025-12781", "CVE-2025-12084", "CVE-2025-13836", "CVE-2020-29396", "CVE-2025-6075", "CVE-2009-3720"], "hostnames": [], "tags": ["open-dir"], "cpes": ["cpe:/a:python:python:3.13.5"]}


indicator: 87.121.85.176
indicator_type: ipv4
source: shodan
city: self-signed,starttls
hosting_provider: cpe:/a:f5:nginx
queried_at: 2026-05-23T18:09:26.281765
raw_data:
  {"ports": [21, 53, 80, 110, 143, 443, 465, 587, 993, 995, 8083], "vulns": [], "hostnames": [], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx"]}


indicator: 87.121.85.220
indicator_type: ipv4
source: shodan
city: self-signed,database,starttls
reverse_dns: solvo.hostingbazis.hu
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/a:postgresql:postgresql,cpe:/a:f5:nginx
queried_at: 2026-05-23T18:09:49.203783
raw_data:
  {"ports": [21, 22, 53, 80, 110, 143, 443, 465, 5432, 8083], "vulns": [], "hostnames": ["solvo.hostingbazis.hu"], "tags": ["self-signed", "database", "starttls"], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/a:postgresql:postgresql", "cpe:/a:f5:nginx"]}


indicator: 87.121.85.221
indicator_type: ipv4
source: shodan
queried_at: 2026-05-23T18:09:50.954722
raw_data:
  {"ports": [80, 443, 8080, 8888, 9000, 9443], "vulns": ["CVE-2013-0942", "CVE-2026-29169", "CVE-2026-24072", "CVE-2026-33857", "CVE-2026-34059", "CVE-2026-33006", "CVE-2026-33523", "CVE-2011-1176", "CVE-2009-2299", "CVE-2012-4360", "CVE-2026-34032", "CVE-2009-0796", "CVE-2013-2765", "CVE-2012-3526", "CVE-2013-0941", "CVE-2026-23918", "CVE-2011-2688", "CVE-2026-33007", "CVE-2013-4365", "CVE-2007-4723", "CVE-2012-4001"], "hostnames": [], "tags": [], "cpes": ["cpe:/a:angularjs:angular.js", "cpe:/a:p

hosting_provider:
  cpe:/a:angularjs:angular.js,cpe:/a:portainer:portainer:2.33.6,cpe:/o:debian:debian_linux,cpe:/a:php:php:8.3.30,cpe:/a:getbootstrap:bootstrap:3.4.1,cpe:/a:f5:nginx,cpe:/a:apache:http_server:2.4.66,cpe:/a:openresty:openresty


indicator: 87.121.85.223
indicator_type: ipv4
source: shodan
queried_at: 2026-05-23T18:09:52.719964
raw_data:
  {"ports": [22, 80, 81, 443, 8083, 9443], "vulns": [], "hostnames": [], "tags": [], "cpes": ["cpe:/a:angularjs:angular.js", "cpe:/a:portainer:portainer:2.33.6", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx", "cpe:/a:openbsd:openssh:9.6p1", "cpe:/a:openresty:openresty"]}

hosting_provider:
  cpe:/a:angularjs:angular.js,cpe:/a:portainer:portainer:2.33.6,cpe:/o:canonical:ubuntu_linux,cpe:/a:f5:nginx,cpe:/a:openbsd:openssh:9.6p1,cpe:/a:openresty:openresty


indicator: 87.121.85.224
indicator_type: ipv4
source: shodan
city: eol-product,starttls
reverse_dns: grasspc.hu,www.grasspc.hu,mail.grasspc.hu
queried_at: 2026-05-23T18:09:54.485907
raw_data:
  {"ports": [22, 25, 80, 110, 443, 465, 587, 995, 8080, 8443], "vulns": ["CVE-2025-23419", "CVE-2023-44487"], "hostnames": ["grasspc.hu", "www.grasspc.hu", "mail.grasspc.hu"], "tags": ["eol-product", "starttls"], "cpes": ["cpe:/o:debian:debian_linux", "cpe:/a:openbsd:openssh:9.2p1", "cpe:/a:f5:nginx", "cpe:/a:f5:nginx:1.22.1", "cpe:/o:linux:linux_kernel", "cpe:/a:postfix:postfix"]}

hosting_provider:
  cpe:/o:debian:debian_linux,cpe:/a:openbsd:openssh:9.2p1,cpe:/a:f5:nginx,cpe:/a:f5:nginx:1.22.1,cpe:/o:linux:linux_kernel,cpe:/a:postfix:postfix


indicator: 87.121.85.240
indicator_type: ipv4
source: shodan
reverse_dns: www.gyalogkaland.hu,gyalogkaland.hu
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-23T18:10:12.836792
raw_data:
  {"ports": [22, 80, 443], "vulns": [], "hostnames": ["www.gyalogkaland.hu", "gyalogkaland.hu"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 87.121.85.250
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: multivpn.hostingbazis.hu,hostingbazis.hu
queried_at: 2026-05-23T18:10:18.640452
raw_data:
  {"ports": [22, 80, 443, 3000], "vulns": [], "hostnames": ["multivpn.hostingbazis.hu", "hostingbazis.hu"], "tags": ["self-signed"], "cpes": ["cpe:/a:jquery:jquery", "cpe:/o:linux:linux_kernel", "cpe:/a:f5:nginx", "cpe:/o:debian:debian_linux", "cpe:/a:lighttpd:lighttpd:1.4.69", "cpe:/a:openbsd:openssh:9.2p1"]}

hosting_provider:
  cpe:/a:jquery:jquery,cpe:/o:linux:linux_kernel,cpe:/a:f5:nginx,cpe:/o:debian:debian_linux,cpe:/a:lighttpd:lighttpd:1.4.69,cpe:/a:openbsd:openssh:9.2p1


indicator: 37.221.67.15
indicator_type: ipv4
source: shodan
reverse_dns: iv.pro
hosting_provider: cpe:/a:openbsd:openssh:7.4
queried_at: 2026-05-23T18:10:20.479904
raw_data:
  {"ports": [22, 80], "vulns": ["CVE-2021-36368", "CVE-2019-6109", "CVE-2008-3844", "CVE-2007-2768", "CVE-2020-14145", "CVE-2026-35414", "CVE-2025-32728", "CVE-2023-48795", "CVE-2023-51385", "CVE-2019-6111", "CVE-2018-20685", "CVE-2018-15473", "CVE-2023-51767", "CVE-2021-41617", "CVE-2019-6110", "CVE-2020-15778", "CVE-2018-15919", "CVE-2025-26465", "CVE-2023-38408", "CVE-2017-15906", "CVE-2016-20012"], "hostnames": ["iv.pro"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:7.4"]}


indicator: 37.221.67.179
indicator_type: ipv4
source: shodan
reverse_dns: vortexnetwork.xyz
hosting_provider: cpe:/o:debian:debian_linux,cpe:/a:apache:http_server:2.4.66
queried_at: 2026-05-23T18:10:24.164783
raw_data:
  {"ports": [80], "vulns": ["CVE-2007-4723", "CVE-2011-2688", "CVE-2013-2765", "CVE-2011-1176", "CVE-2009-2299", "CVE-2013-4365", "CVE-2009-0796", "CVE-2013-0941", "CVE-2013-0942", "CVE-2012-4360", "CVE-2012-4001", "CVE-2012-3526"], "hostnames": ["vortexnetwork.xyz"], "tags": [], "cpes": ["cpe:/o:debian:debian_linux", "cpe:/a:apache:http_server:2.4.66"]}


indicator: 37.221.67.191
indicator_type: ipv4
source: shodan
reverse_dns: us4.natan.biz
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-23T18:10:25.943880
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["us4.natan.biz"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 37.221.67.219
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: examgo.com
queried_at: 2026-05-23T18:10:27.914581
raw_data:
  {"ports": [22, 80, 33060], "vulns": ["CVE-2025-23419", "CVE-2023-44487"], "hostnames": ["examgo.com"], "tags": ["eol-product"], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/o:debian:debian_linux", "cpe:/a:openbsd:openssh:9.2p1", "cpe:/a:f5:nginx:1.22.1"]}

hosting_provider:
  cpe:/o:linux:linux_kernel,cpe:/o:debian:debian_linux,cpe:/a:openbsd:openssh:9.2p1,cpe:/a:f5:nginx:1.22.1


indicator: 37.221.67.25
indicator_type: ipv4
source: shodan
city: self-signed,database,starttls
reverse_dns: pocketoption.cx
queried_at: 2026-05-23T18:10:29.778114
raw_data:
  {"ports": [21, 22, 80, 143, 443, 465, 587, 993, 3306, 7777, 8888], "vulns": ["CVE-2023-42117", "CVE-2023-42114", "CVE-2025-67896", "CVE-2023-42115", "CVE-2026-40686", "CVE-2025-30232", "CVE-2024-39929", "CVE-2022-3620", "CVE-2022-3559", "CVE-2026-40684", "CVE-2023-51766", "CVE-2023-42116", "CVE-2026-40687", "CVE-2023-42119", "CVE-2026-40685"], "hostnames": ["pocketoption.cx"], "tags": ["self-signed", "database", "starttls"], "cpes": ["cpe:/a:exim:exim:4.96", "cpe:/a:f5:nginx:1.28.3", "cpe:/o:deb

hosting_provider:
  cpe:/a:exim:exim:4.96,cpe:/a:f5:nginx:1.28.3,cpe:/o:debian:debian_linux,cpe:/a:openbsd:openssh:9.2p1,cpe:/a:oracle:mysql,cpe:/a:f5:nginx,cpe:/o:linux:linux_kernel


indicator: 37.221.67.251
indicator_type: ipv4
source: shodan
city: self-signed,eol-product,starttls
reverse_dns: vps4
hosting_provider: cpe:/a:f5:nginx:1.26.2,cpe:/a:exim:exim:4.95,cpe:/a:f5:nginx
queried_at: 2026-05-23T18:10:31.670333
raw_data:
  {"ports": [21, 110, 443, 587, 993, 2222, 7777], "vulns": ["CVE-2023-42117", "CVE-2023-42114", "CVE-2025-67896", "CVE-2022-37451", "CVE-2023-42115", "CVE-2026-40686", "CVE-2026-40684", "CVE-2024-39929", "CVE-2022-3620", "CVE-2022-3559", "CVE-2023-51766", "CVE-2025-23419", "CVE-2023-42116", "CVE-2026-40687", "CVE-2023-42119", "CVE-2026-40685"], "hostnames": ["vps4"], "tags": ["self-signed", "eol-product", "starttls"], "cpes": ["cpe:/a:f5:nginx:1.26.2", "cpe:/a:exim:exim:4.95", "cpe:/a:f5:nginx"]}


indicator: 37.221.67.254
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: fxftp.local
hosting_provider: cpe:/a:control-webpanel:webpanel,cpe:/a:postfix:postfix
queried_at: 2026-05-23T18:10:33.445292
raw_data:
  {"ports": [21, 25, 53, 110, 465, 995, 2082, 2083, 2087], "vulns": [], "hostnames": ["fxftp.local"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:control-webpanel:webpanel", "cpe:/a:postfix:postfix"]}


indicator: 37.221.67.40
indicator_type: ipv4
source: shodan
city: starttls
reverse_dns: panel.alljfell.com
hosting_provider: cpe:/a:openbsd:openssh:8.9p1,cpe:/a:f5:nginx
queried_at: 2026-05-23T18:10:35.272372
raw_data:
  {"ports": [21, 22, 80, 110, 143, 587, 995], "vulns": [], "hostnames": ["panel.alljfell.com"], "tags": ["starttls"], "cpes": ["cpe:/a:openbsd:openssh:8.9p1", "cpe:/a:f5:nginx"]}


indicator: 37.221.67.98
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/o:linux:linux_kernel,cpe:/a:openbsd:openssh:9.2p1,cpe:/o:debian:debian_linux
queried_at: 2026-05-23T18:10:38.878816
raw_data:
  {"ports": [22, 3000], "vulns": [], "hostnames": [], "tags": [], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/a:openbsd:openssh:9.2p1", "cpe:/o:debian:debian_linux"]}


indicator: 87.121.84.18
indicator_type: ipv4
source: shodan
city: scanner
hosting_provider: cpe:/a:apache:http_server:2.4.52,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-23T18:10:46.264436
raw_data:
  {"ports": [80], "vulns": ["CVE-2025-53020", "CVE-2022-22721", "CVE-2023-45802", "CVE-2025-55753", "CVE-2025-66200", "CVE-2006-20001", "CVE-2025-23048", "CVE-2013-0942", "CVE-2023-31122", "CVE-2024-38472", "CVE-2024-38473", "CVE-2022-30556", "CVE-2024-39573", "CVE-2026-29169", "CVE-2026-24072", "CVE-2024-27316", "CVE-2026-33857", "CVE-2026-34059", "CVE-2022-23943", "CVE-2023-25690", "CVE-2022-22719", "CVE-2026-33006", "CVE-2026-33523", "CVE-2024-38474", "CVE-2024-40898", "CVE-2022-36760", "CVE-20


indicator: 87.121.84.253
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/a:f5:nginx,cpe:/a:openbsd:openssh:8.4p1,cpe:/o:debian:debian_linux,cpe:/o:linux:linux_kernel
queried_at: 2026-05-23T18:10:49.882294
raw_data:
  {"ports": [22, 80], "vulns": [], "hostnames": [], "tags": [], "cpes": ["cpe:/a:f5:nginx", "cpe:/a:openbsd:openssh:8.4p1", "cpe:/o:debian:debian_linux", "cpe:/o:linux:linux_kernel"]}


indicator: 87.121.84.29
indicator_type: ipv4
source: shodan
city: eol-product
queried_at: 2026-05-23T18:10:53.520286
raw_data:
  {"ports": [22, 80], "vulns": ["CVE-2025-23419", "CVE-2021-3618", "CVE-2021-23017", "CVE-2023-44487"], "hostnames": [], "tags": ["eol-product"], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx:1.18.0"]}

hosting_provider:
  cpe:/o:linux:linux_kernel,cpe:/a:openbsd:openssh:8.9p1,cpe:/o:canonical:ubuntu_linux,cpe:/a:f5:nginx:1.18.0


indicator: 87.121.84.86
indicator_type: ipv4
source: shodan
city: scanner
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-23T18:11:02.635040
raw_data:
  {"ports": [22], "vulns": [], "hostnames": [], "tags": ["scanner"], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 87.121.84.62
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/a:openbsd:openssh:10.2p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-23T18:11:08.051007
raw_data:
  {"ports": [22], "vulns": [], "hostnames": [], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:10.2p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 87.121.84.8
indicator_type: ipv4
source: shodan
city: scanner
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.9p1
queried_at: 2026-05-23T18:11:09.848624
raw_data:
  {"ports": [22], "vulns": [], "hostnames": [], "tags": ["scanner"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1"]}


indicator: 87.121.84.53
indicator_type: ipv4
source: shodan
city: database
queried_at: 2026-05-23T18:11:11.630695
raw_data:
  {"ports": [22, 3306, 27017], "vulns": ["CVE-2025-11979", "CVE-2025-13507", "CVE-2009-3766", "CVE-2025-14345", "CVE-2026-28387", "CVE-2009-3767", "CVE-2025-69418", "CVE-2026-4148", "CVE-2026-31789", "CVE-2009-1390", "CVE-2026-28390", "CVE-2026-4358", "CVE-2025-14847", "CVE-2025-12657", "CVE-2024-6119", "CVE-2025-10060", "CVE-2026-1848", "CVE-2026-5170", "CVE-2009-3765", "CVE-2026-28388", "CVE-2019-0190", "CVE-2025-15467", "CVE-2025-10061", "CVE-2026-22795", "CVE-2026-25610", "CVE-2025-13643", "CV

hosting_provider:
  cpe:/a:mongodb:mongodb:7.0.21,cpe:/a:mariadb:mariadb,cpe:/a:openssl:openssl:3.0.13,cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:9.6p1


indicator: 185.220.100.141
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: meet.fff.community
queried_at: 2026-05-23T18:11:13.417133
raw_data:
  {"ports": [22, 80, 443, 3478, 5222, 5269, 9090], "vulns": ["CVE-2025-23419", "CVE-2023-44487"], "hostnames": ["meet.fff.community"], "tags": ["eol-product"], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/o:debian:debian_linux", "cpe:/a:openbsd:openssh:9.2p1", "cpe:/a:f5:nginx:1.22.1"]}

hosting_provider:
  cpe:/o:linux:linux_kernel,cpe:/o:debian:debian_linux,cpe:/a:openbsd:openssh:9.2p1,cpe:/a:f5:nginx:1.22.1


indicator: 87.121.83.30
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: 87.121.83.30.neterra.net
hosting_provider: cpe:/a:ntp:ntp:4.2.8:p18,cpe:/a:php:php:8.3.23,cpe:/a:f5:nginx:1.28.0
queried_at: 2026-05-23T18:11:15.171501
raw_data:
  {"ports": [80, 123, 443, 3000], "vulns": ["CVE-2015-7978", "CVE-2015-8138", "CVE-2015-7853", "CVE-2017-6458", "CVE-2016-7433", "CVE-2020-13817", "CVE-2016-2516", "CVE-2017-6460", "CVE-2018-7170", "CVE-2013-2220", "CVE-2015-7974", "CVE-2015-7852", "CVE-2016-7426", "CVE-2016-4956", "CVE-2016-4957", "CVE-2016-1551", "CVE-2016-7431", "CVE-2017-6463", "CVE-2016-2517", "CVE-2015-8140", "CVE-2016-4955", "CVE-2018-12327", "CVE-2016-7434", "CVE-2016-1547", "CVE-2014-9750", "CVE-2015-7701", "CVE-2015-7973


indicator: 87.121.83.81
indicator_type: ipv4
source: shodan
city: self-signed,eol-product
reverse_dns: 87.121.83.81.neterra.net
hosting_provider: cpe:/a:php:php:7.3.24,cpe:/a:f5:nginx:1.18.0
queried_at: 2026-05-23T18:11:16.931687
raw_data:
  {"ports": [37, 53, 80, 179, 443, 3000], "vulns": ["CVE-2025-23419", "CVE-2021-21702", "CVE-2022-31628", "CVE-2021-21706", "CVE-2021-3618", "CVE-2024-25117", "CVE-2013-2220", "CVE-2023-44487", "CVE-2022-31629", "CVE-2021-21704", "CVE-2022-37454", "CVE-2021-21707", "CVE-2007-3205", "CVE-2021-23017", "CVE-2017-8923", "CVE-2022-4900", "CVE-2021-21705", "CVE-2024-3566", "CVE-2021-21703", "CVE-2020-7071"], "hostnames": ["87.121.83.81.neterra.net"], "tags": ["self-signed", "eol-product"], "cpes": ["cpe


indicator: 196.251.69.72
indicator_type: ipv4
source: shodan
city: eol-product
hosting_provider: cpe:/o:centos:centos,cpe:/a:apache:http_server:2.4.6,cpe:/a:php:php:5.4.16
queried_at: 2026-05-23T18:13:11.286360
raw_data:
  {"ports": [80], "vulns": ["CVE-2024-39573", "CVE-2017-7963", "CVE-2015-4604", "CVE-2015-4148", "CVE-2026-33523", "CVE-2014-3480", "CVE-2016-0736", "CVE-2013-2220", "CVE-2020-11985", "CVE-2014-0185", "CVE-2017-8923", "CVE-2014-0098", "CVE-2016-6291", "CVE-2018-17082", "CVE-2017-9224", "CVE-2015-4603", "CVE-2022-36760", "CVE-2025-58098", "CVE-2015-4642", "CVE-2016-3171", "CVE-2012-4360", "CVE-2014-4670", "CVE-2016-7413", "CVE-2026-33006", "CVE-2015-4026", "CVE-2015-3307", "CVE-2016-1903", "CVE-201


indicator: 196.251.70.12
indicator_type: ipv4
source: shodan
city: database
hosting_provider: cpe:/a:oracle:mysql
queried_at: 2026-05-23T18:13:34.226940
raw_data:
  {"ports": [22, 2525, 3306], "vulns": [], "hostnames": [], "tags": ["database"], "cpes": ["cpe:/a:oracle:mysql"]}


indicator: 196.251.70.22
indicator_type: ipv4
source: shodan
city: eol-product
hosting_provider: cpe:/a:php:php:5.6.40,cpe:/a:apache:http_server:2.4.37
queried_at: 2026-05-23T18:14:11.717824
raw_data:
  {"ports": [80], "vulns": ["CVE-2020-35452", "CVE-2021-39275", "CVE-2023-45802", "CVE-2024-38472", "CVE-2022-30556", "CVE-2022-4900", "CVE-2022-23943", "CVE-2009-2299", "CVE-2012-4360", "CVE-2009-0796", "CVE-2024-3566", "CVE-2020-1934", "CVE-2021-32785", "CVE-2013-4365", "CVE-2007-4723", "CVE-2019-9637", "CVE-2019-0196", "CVE-2025-49812", "CVE-2025-59775", "CVE-2017-7963", "CVE-2022-31628", "CVE-2022-31629", "CVE-2025-53020", "CVE-2022-22721", "CVE-2021-40438", "CVE-2025-55753", "CVE-2025-66200",


indicator: 87.121.85.141
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:19:50.389703
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.141", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.73
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:19:54.224114
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.73", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 37.221.65.141
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:20:10.422878
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.141", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 9, "malware_samples": [], "passive_dns": ["portaltuplusaval.com.co", "hygenecarcare.com", "decorationdoor.com", "et-transfer-rogers.com", "royalclient-id.com", "securedemt.info", "wss.cryptospin.win", "marketinghight.co.uk", "a-mne-zia.xyz"]}

reverse_dns:
  portaltuplusaval.com.co,hygenecarcare.com,decorationdoor.com,et-transfer-rogers.com,royalclient-id.com,securedemt.info,wss.cryptospin.win,marketinghight.co.uk,a-mne-zia.xyz


indicator: 37.221.65.153
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:20:14.558422
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.153", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 44, "malware_samples": [], "passive_dns": ["aeqps.com", "rd91-0-azurenet.top", "smtracking.adeventor.net", "37-221-65-153.cprapid.com", "photoepinastic.store", "grandpashabet1385.com", "monagri.colecenter.37-221-65-153.plesk.page", "trusting-hopper.37-221-65-153.ple

reverse_dns:
  aeqps.com,rd91-0-azurenet.top,smtracking.adeventor.net,37-221-65-153.cprapid.com,photoepinastic.store,grandpashabet1385.com,monagri.colecenter.37-221-65-153.plesk.page,trusting-hopper.37-221-65-153.plesk.page,www.trusting-hopper.37-221-65-153.plesk.page,quizzical-lewin.37-221-65-153.plesk.page


indicator: 37.221.65.115
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:20:31.827821
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.115", "tags": [], "pulses": ["IOCs - 20222121432", "IOCs - 20221291350"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 37.221.65.134
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:20:36.996723
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.134", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 5, "malware_samples": [], "passive_dns": ["auth-client-log.com", "info-cartevitale-ameli.com", "assurancegouv.fr", "zelow.ml", "priceless-borg.37-221-65-134.plesk.page"]}

reverse_dns:
  auth-client-log.com,info-cartevitale-ameli.com,assurancegouv.fr,zelow.ml,priceless-borg.37-221-65-134.plesk.page


indicator: 37.221.65.149
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:20:49.136179
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.149", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 10, "malware_samples": [], "passive_dns": ["smtracking.venturahighway.com", "zs-yellow-03.top", "smtracking.thelifeman.com", "smtracking.sundar_abs.swp23.com", "smtracking.cresilonitleads.com", "smtracking.cistus.eu", "smtracking.efreightbroker.com", "smtracking.oxi

reverse_dns:
  smtracking.venturahighway.com,zs-yellow-03.top,smtracking.thelifeman.com,smtracking.sundar_abs.swp23.com,smtracking.cresilonitleads.com,smtracking.cistus.eu,smtracking.efreightbroker.com,smtracking.oxinsta.com,smtracking.bayernland-email.eu,t.zs-yellow-03.top


indicator: 37.221.65.161
indicator_type: ipv4
source: otx
country: RU
reverse_dns: upsswissinfo.com,update-service.top
queried_at: 2026-05-23T18:20:58.758481
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.161", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["upsswissinfo.com", "update-service.top"]}


indicator: 37.221.65.187
indicator_type: ipv4
source: otx
country: RU
reverse_dns: www.a2mpoidslourds.fr,a2mpoidslourds.fr
queried_at: 2026-05-23T18:21:01.715932
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.187", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["www.a2mpoidslourds.fr", "a2mpoidslourds.fr"]}


indicator: 37.221.65.191
indicator_type: ipv4
source: otx
country: RU
reverse_dns: evesplayground.online,leisurell.info,szene.store,smtp.demonoid.info
queried_at: 2026-05-23T18:21:05.212167
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.191", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["evesplayground.online", "leisurell.info", "szene.store", "smtp.demonoid.info"]}


indicator: 37.221.65.192
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:21:22.208358
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.192", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 37.221.65.195
indicator_type: ipv4
source: otx
country: RU
reverse_dns: vids.yeb.cx
queried_at: 2026-05-23T18:21:36.489261
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.195", "tags": [], "pulses": ["2024-09-16 Fail2Ban 3a15840b-e560-4fb7-8577-bacdb504e532", "ETIC Cybersecurity  2024-09-17  Port Scan"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["vids.yeb.cx"]}


indicator: 37.221.65.198
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:21:53.670387
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.198", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 37.221.65.228
indicator_type: ipv4
source: otx
country: RU
hosting_provider: domain port,mirai botnet,mirai,gs005,gs003,iocs,combinations,linux,compromise ipv4,gs008
queried_at: 2026-05-23T18:22:10.674060
raw_data:
  {"pulse_count": 2, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.228", "tags": ["domain port", "mirai botnet", "mirai", "gs005", "gs003", "iocs", "combinations", "linux", "compromise ipv4", "gs008"], "pulses": ["Mirai Botnet IOCs - Part 3 - SEC-1275-1", "Mirai Botnet IOCs - Part 3 - SEC-1275-1. [Pulse copied from Gnostis]"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 37.221.65.61
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:22:27.904140
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.61", "tags": [], "pulses": ["Twitter Feed - malwrhunterteam - 31-08-2022"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 37.221.65.77
indicator_type: ipv4
source: otx
country: RU
hosting_provider: malware,tsec,urlhaus,la-safe.org,tpot19,honeypot
queried_at: 2026-05-23T18:22:44.877006
raw_data:
  {"pulse_count": 5, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.77", "tags": ["malware", "tsec", "urlhaus", "la-safe.org", "tpot19", "honeypot"], "pulses": ["ETIC Cybersecurity 2023-10-17 Port Scan", "ETIC Cybersecurity 2023-10-27 Port Scan", "URLHaus Malicious URL Blocklist 2023-09-24", "LCIA:HoneyNet:May 2023", "LCIA:HoneyNet:2023"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []


indicator: 37.221.65.84
indicator_type: ipv4
source: otx
country: RU
reverse_dns: vtikto.com,matrix.sfclub.top,sfclub.top
queried_at: 2026-05-23T18:22:47.527034
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.84", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["vtikto.com", "matrix.sfclub.top", "sfclub.top"]}


indicator: 37.221.65.128
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:23:04.394924
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.128", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 37.221.65.140
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:23:21.435286
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.140", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 37.221.65.15
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:23:38.545393
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.15", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 37.221.65.151
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:24:11.136906
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.151", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 37.221.65.16
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:24:13.771779
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.16", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 8, "malware_samples": [], "passive_dns": ["et-transfer1.com", "www.antai-infraction-stationnement.com", "www.ameli-espace-sante.com", "ameli-espace-sante.com", "antai-infraction-stationnement.com", "buytechnologiesstore.com", "malware-info.net", "www.malware-info.net

reverse_dns:
  et-transfer1.com,www.antai-infraction-stationnement.com,www.ameli-espace-sante.com,ameli-espace-sante.com,antai-infraction-stationnement.com,buytechnologiesstore.com,malware-info.net,www.malware-info.net


indicator: 37.221.65.204
indicator_type: ipv4
source: otx
country: RU
reverse_dns: chocho.site
queried_at: 2026-05-23T18:24:17.179918
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.204", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["chocho.site"]}


indicator: 37.221.65.25
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:24:34.615704
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.25", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 37.221.65.49
indicator_type: ipv4
source: otx
country: RU
reverse_dns: celium-arbitrage.com,k8ceramics.com,vk.neuraldynamics.online
queried_at: 2026-05-23T18:24:51.496707
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.49", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["celium-arbitrage.com", "k8ceramics.com", "vk.neuraldynamics.online"]}


indicator: 37.221.65.6
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:25:08.416181
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.6", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 37.221.65.7
indicator_type: ipv4
source: otx
country: RU
reverse_dns: suport-locaweb.digital,webaccout.com,facturesetpaiement.blogdns.org
queried_at: 2026-05-23T18:25:11.574940
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.7", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["suport-locaweb.digital", "webaccout.com", "facturesetpaiement.blogdns.org"]}


indicator: 37.221.65.19
indicator_type: ipv4
source: otx
country: RU
reverse_dns: planharmonia.com,minebit.top
hosting_provider: Skype,tcp,mirai,Malicious IP,scan,tsec,la-safe.org,tpot19,blacklist,botnet
queried_at: 2026-05-23T18:25:14.718121
raw_data:
  {"pulse_count": 15, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.19", "tags": ["Skype", "tcp", "mirai", "Malicious IP", "scan", "tsec", "la-safe.org", "tpot19", "blacklist", "botnet", "honeypot"], "pulses": ["ETIC Cybersecurity 2023-06-23 Port Scan", "ETIC Cybersecurity 2023-07-09 Port Scan", "ETIC Cybersecurity 2023-07-10 Port Scan", "ETIC Cybersecurity 2023-07-11 Port Scan", "ETIC Cybersecurity 202


indicator: 37.221.65.20
indicator_type: ipv4
source: otx
country: RU
hosting_provider: phishing,scanners,Nextray,vultr,ioc,cyber security,portscan,malicious,honeypot
queried_at: 2026-05-23T18:25:32.712216
raw_data:
  {"pulse_count": 35, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.20", "tags": ["phishing", "scanners", "Nextray", "vultr", "ioc", "cyber security", "portscan", "malicious", "honeypot"], "pulses": ["IOC Records Provided by @NextRayAI", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-04-13", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOC Records \u2192Provide


indicator: 37.221.65.23
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:25:50.089456
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.23", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 37.221.65.26
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:26:07.401373
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.26", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 37.221.65.31
indicator_type: ipv4
source: otx
country: RU
reverse_dns: cdn.jadify.co,ntbbl-juneway.ru
queried_at: 2026-05-23T18:26:13.270466
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.31", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["cdn.jadify.co", "ntbbl-juneway.ru"]}


indicator: 37.221.65.33
indicator_type: ipv4
source: otx
country: RU
hosting_provider: cowrie,asyncrat,automated,fatt,unknown-stealer,phishing,mailoney,unknown-malware,p0f,threatfox
queried_at: 2026-05-23T18:26:16.962493
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.33", "tags": ["cowrie", "asyncrat", "automated", "fatt", "unknown-stealer", "phishing", "mailoney", "unknown-malware", "p0f", "threatfox", "honeypot", "tpot", "tanner", "osint-volley", "c2-infrastructure", "dionaea", "honeytrap", "sentrypeer", "sensor-tagged", "suricata"], "pulses": ["Honeypot Data \u2013 T-Pot - Sydney, Australia - Febr

reverse_dns:
  data.museum,a.aenima.xyz,acs-courrier.com,acsexpresss.com,icicleintricacy.info,securs-doks.info,messagerie-orange.top,messagerievocale.life,messagerie-orange.info


indicator: 37.221.65.34
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:26:33.942040
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.34", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 37.221.65.36
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:26:52.327516
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.36", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 37.221.65.41
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:26:55.150644
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.41", "tags": [], "pulses": [], "malware_count": 1, "passive_dns_count": 14, "malware_samples": ["7ce687a676031082093ff59f210d07272619acf843c91aac8e6c456b1ec4015b"], "passive_dns": ["my-accountrestore.com", "silly-ramanujan.37-221-65-41.plesk.page", "status-track.info", "m-netflix.com", "m-disney.com", "spotlfy-player.com", "canadarevenue

reverse_dns:
  my-accountrestore.com,silly-ramanujan.37-221-65-41.plesk.page,status-track.info,m-netflix.com,m-disney.com,spotlfy-player.com,canadarevenueplatform.com,rbc-canada-security-alert-onlineverify.com,slave.vipembed.com,cdn.vipembed.com


indicator: 37.221.65.45
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:27:12.374723
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.45", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 37.221.65.46
indicator_type: ipv4
source: otx
country: RU
reverse_dns: vpnss-vp.site,sama-vp.net
queried_at: 2026-05-23T18:27:15.468656
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.46", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["vpnss-vp.site", "sama-vp.net"]}


indicator: 37.221.65.52
indicator_type: ipv4
source: otx
country: RU
reverse_dns: test.artkeramika.pro,www.artkeramika.pro,artkeramika.pro,vneshtorgizdat.ru,www.vneshtorgizdat.ru
queried_at: 2026-05-23T18:27:18.150348
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.52", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 5, "malware_samples": [], "passive_dns": ["test.artkeramika.pro", "www.artkeramika.pro", "artkeramika.pro", "vneshtorgizdat.ru", "www.vneshtorgizdat.ru"]}


indicator: 37.221.65.53
indicator_type: ipv4
source: otx
country: RU
reverse_dns: market-data-api.work,esponsis.com
queried_at: 2026-05-23T18:27:27.904940
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.53", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["market-data-api.work", "esponsis.com"]}


indicator: 37.221.65.55
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:27:36.195600
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.55", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 9, "malware_samples": [], "passive_dns": ["xcasino-hungary.com", "kpys1.top", "muka1.top", "livvetest.duckdns.org", "www.livvetest.duckdns.org", "c33-cpanel.duckdns.org", "www.c33-cpanel.duckdns.org", "ch3kp4n.duckdns.org", "www.ch3kp4n.duckdns.org"]}

reverse_dns:
  xcasino-hungary.com,kpys1.top,muka1.top,livvetest.duckdns.org,www.livvetest.duckdns.org,c33-cpanel.duckdns.org,www.c33-cpanel.duckdns.org,ch3kp4n.duckdns.org,www.ch3kp4n.duckdns.org


indicator: 37.221.65.57
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:27:39.090062
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.57", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 24, "malware_samples": [], "passive_dns": ["www.944z7awimb.com", "shxnvamb.com", "tqmwramb.com", "wksjxrmb.com", "nhhhgtmb.com", "www.7fh5owmb.com", "lkgjcymb.com", "www.c6jigemb.com", "5bywg3mb.com", "7fh5owmb.com", "eblv51wsmb.com", "82w065asmb.com", "www.ebecvuyb.

reverse_dns:
  www.944z7awimb.com,shxnvamb.com,tqmwramb.com,wksjxrmb.com,nhhhgtmb.com,www.7fh5owmb.com,lkgjcymb.com,www.c6jigemb.com,5bywg3mb.com,7fh5owmb.com


indicator: 37.221.65.60
indicator_type: ipv4
source: otx
country: RU
reverse_dns: www.medlifeparaguay.com,medlifeparaguay.com,dating-mood.life,colorloves.life,datingshall.life
queried_at: 2026-05-23T18:27:41.632107
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.60", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 5, "malware_samples": [], "passive_dns": ["www.medlifeparaguay.com", "medlifeparaguay.com", "dating-mood.life", "colorloves.life", "datingshall.life"]}


indicator: 37.221.65.69
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:27:54.082383
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.69", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 222, "malware_samples": [], "passive_dns": ["lordfilmvee.lol", "lordfilmtck.lat", "lordfilmgrt.lat", "lordfilmwer.lat", "lordfilmmnq.lat", "lordfilmvbn.lat", "help-plp.com", "lordfilmvaz.lol", "lordfilmmax.lol", "lordfilmkat.lol", "lordfilmlea.lol", "lordfilmlip.lol"

reverse_dns:
  lordfilmvee.lol,lordfilmtck.lat,lordfilmgrt.lat,lordfilmwer.lat,lordfilmmnq.lat,lordfilmvbn.lat,help-plp.com,lordfilmvaz.lol,lordfilmmax.lol,lordfilmkat.lol


indicator: 37.221.65.79
indicator_type: ipv4
source: otx
country: RU
reverse_dns: polarof.koyhelp.top
queried_at: 2026-05-23T18:28:00.953837
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.79", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["polarof.koyhelp.top"]}


indicator: 37.221.65.81
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:28:09.892306
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.81", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 18, "malware_samples": [], "passive_dns": ["taxanualuol.serveftp.net", "renouvellement-en-ligne-sms.fr", "multa-por-pagar.es", "masante-enligne.fr", "mon-renouvellement-carte-sms.fr", "sms-assure-renouvellement-enligne.fr", "sms-renouveler-assure.fr", "www.espace-sms

reverse_dns:
  taxanualuol.serveftp.net,renouvellement-en-ligne-sms.fr,multa-por-pagar.es,masante-enligne.fr,mon-renouvellement-carte-sms.fr,sms-assure-renouvellement-enligne.fr,sms-renouveler-assure.fr,www.espace-sms-contact.fr,espace-sms-contact.fr,www.espace-sms-enligne.fr


indicator: 37.221.65.83
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:28:27.242830
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.83", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 37.221.65.87
indicator_type: ipv4
source: otx
country: RU
reverse_dns: 37-221-65-87.cprapid.com
queried_at: 2026-05-23T18:28:34.974268
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.87", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["37-221-65-87.cprapid.com"]}


indicator: 37.221.65.88
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:28:45.896892
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.88", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 37.221.65.91
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:29:02.794398
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.91", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 37.221.65.92
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:29:05.430322
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.92", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 23, "malware_samples": [], "passive_dns": ["geometrlcs.com", "msd.futboldeveteranos.online", "login.futboldeveteranos.online", "sso.futboldeveteranos.online", "hgjuwqskaipfjernern.futboldeveteranos.online", "futboldeveteranos.online", "ulup.futboldeveteranos.online",

reverse_dns:
  geometrlcs.com,msd.futboldeveteranos.online,login.futboldeveteranos.online,sso.futboldeveteranos.online,hgjuwqskaipfjernern.futboldeveteranos.online,futboldeveteranos.online,ulup.futboldeveteranos.online,agence-chronopost.eu,3ch.icu,smtracking.instantmarketing.site


indicator: 37.221.65.94
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:29:11.225722
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.94", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 16, "malware_samples": [], "passive_dns": ["go.22bet15.com", "betbigcity.org", "freightmastersdhl.com", "insurancetempcover.com", "onlymodapk.com", "apkhives.com", "360seoservices.com", "grabapkfiles.com", "modcarparking.com", "apkregister.com", "instaapkeys.com", "w

reverse_dns:
  go.22bet15.com,betbigcity.org,freightmastersdhl.com,insurancetempcover.com,onlymodapk.com,apkhives.com,360seoservices.com,grabapkfiles.com,modcarparking.com,apkregister.com


indicator: 37.221.65.102
indicator_type: ipv4
source: otx
country: RU
hosting_provider: ,ransomware,malware
queried_at: 2026-05-23T18:29:29.044914
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.102", "tags": ["", "ransomware", "malware"], "pulses": ["ThreatFix"], "malware_count": 1, "passive_dns_count": 10, "malware_samples": ["4d0cc6010a58a2aa9cab880c750180424f45ed8c678d973b220e7517e7f2fa67"], "passive_dns": ["lomlvsst.com", "xn--ddouanement-dhl-relivraison-boc.com", "xn--ddouanements-dhl-bqb.com", "piblord.com", "abbarri.com"

reverse_dns:
  lomlvsst.com,xn--ddouanement-dhl-relivraison-boc.com,xn--ddouanements-dhl-bqb.com,piblord.com,abbarri.com,dayinic.com,fontaxo.com,caravanproin.com,www.netlflx.com,netlflx.com


indicator: 37.221.65.103
indicator_type: ipv4
source: otx
country: RU
hosting_provider: abuseipdb
queried_at: 2026-05-23T18:29:31.307657
raw_data:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.103", "tags": ["abuseipdb"], "pulses": ["Compiled Blocklist of AbuseIPDB: Most reported IP addresses - by skocherhan", "Aggregated Blocklist for AbuseIPDB: A list of the most reported IP addresses.", "Sources of Spam List"], "malware_count": 0, "passive_dns_count": 22, "malware_samples": [], "passive_dns": ["renouvellement-demande-espace

reverse_dns:
  renouvellement-demande-espace-assure.com,espace-demende-renouvellement-assure.com,demande-assure-renouvellement-enligne.com,assure-demande-renouvellement.fr,homepornpics.top,www.homemadepics.top,homemadepics.top,www.cutecamteens.top,cutecamteens.top,amzn-authenticate-secure.com


indicator: 37.221.65.105
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:29:33.789478
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.105", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 66, "malware_samples": [], "passive_dns": ["www.tpp-steptwo.tech", "tpp-steptwo.tech", "www.access-tpp.net", "access-tpp.net", "lordfilmcup.lol", "lordfilmgod.lat", "lordfilmfry.lol", "lordfilmgas.lol", "lordfilmdad.lol", "lordfilmdan.lol", "lordfilmgap.lol", "lordf

reverse_dns:
  www.tpp-steptwo.tech,tpp-steptwo.tech,www.access-tpp.net,access-tpp.net,lordfilmcup.lol,lordfilmgod.lat,lordfilmfry.lol,lordfilmgas.lol,lordfilmdad.lol,lordfilmdan.lol


indicator: 37.221.65.109
indicator_type: ipv4
source: otx
country: RU
reverse_dns: swbattlecry.com,www.swbattlecry.com
queried_at: 2026-05-23T18:29:37.760676
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.109", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["swbattlecry.com", "www.swbattlecry.com"]}


indicator: 37.221.65.110
indicator_type: ipv4
source: otx
country: RU
hosting_provider: ip address,urls ftp,mirai,gs005,gs003,sha1,sha256,telnet,compromise ipv4,urls https
queried_at: 2026-05-23T18:29:40.582258
raw_data:
  {"pulse_count": 10, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.110", "tags": ["ip address", "urls ftp", "mirai", "gs005", "gs003", "sha1", "sha256", "telnet", "compromise ipv4", "urls https", "botnet", "blacklist", "tcp/80", "mirai botnet", "iocs", "combinations", "seen", "ipv4 port", "http", "linux", "tcp/23", "malware url", "port 23", "urls http", "sha values", "hashes", "file name", "port 80", "

reverse_dns:
  vigialove.digital,certexpress.digital,poupamaisbr.digital,decomplicahoje.digital,www.ulys-paiementfr.com,ulys-paiementfr.com,espace-renouvellement-assure.com


indicator: 37.221.65.112
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:29:42.914135
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.112", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 13, "malware_samples": [], "passive_dns": ["connexion-securite.com", "ma-carte-vital.com", "hardcore-lewin.37-221-65-112.plesk.page", "www.hardcore-lewin.37-221-65-112.plesk.page", "netlfixwallet.fr", "procedure-ameli.com", "client-santes.com", "gifted-wright.37-221

reverse_dns:
  connexion-securite.com,ma-carte-vital.com,hardcore-lewin.37-221-65-112.plesk.page,www.hardcore-lewin.37-221-65-112.plesk.page,netlfixwallet.fr,procedure-ameli.com,client-santes.com,gifted-wright.37-221-65-112.plesk.page,www.gifted-wright.37-221-65-112.plesk.page,www.friendly-jackson.37-221-65-112.plesk.page


indicator: 37.221.65.117
indicator_type: ipv4
source: otx
country: RU
reverse_dns: luznestyle.pl,bundesminister.bio,www.iconarise.com,iconarise.com
queried_at: 2026-05-23T18:29:45.325956
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.117", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["luznestyle.pl", "bundesminister.bio", "www.iconarise.com", "iconarise.com"]}


indicator: 37.221.65.122
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:29:48.457147
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.122", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 15, "malware_samples": [], "passive_dns": ["sevdigimsensin.ru", "www.elturco.ru", "elturco.ru", "www.kimler-geldi-kimler-gecti.ru", "kimler-geldi-kimler-gecti.ru", "domdrakona-tv.com", "uzaksehir-tv.com", "uzak-sehir.com", "www.adliyedosyatakip.org", "cezadosyagorun

reverse_dns:
  sevdigimsensin.ru,www.elturco.ru,elturco.ru,www.kimler-geldi-kimler-gecti.ru,kimler-geldi-kimler-gecti.ru,domdrakona-tv.com,uzaksehir-tv.com,uzak-sehir.com,www.adliyedosyatakip.org,cezadosyagoruntuleme.org


indicator: 37.221.65.124
indicator_type: ipv4
source: otx
country: RU
reverse_dns: irvweek.co.uk,zzerude.com
queried_at: 2026-05-23T18:29:50.623921
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.124", "tags": [], "pulses": [], "malware_count": 1, "passive_dns_count": 2, "malware_samples": ["0c4ae821ce832d7a895f4b2997522b92c7bba93666ea76b9fdccf8fa91c32da8"], "passive_dns": ["irvweek.co.uk", "zzerude.com"]}


indicator: 37.221.65.126
indicator_type: ipv4
source: otx
country: RU
reverse_dns: mizihoubak.icu,mizihoubak.cyou
queried_at: 2026-05-23T18:29:52.753211
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.126", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["mizihoubak.icu", "mizihoubak.cyou"]}


indicator: 37.221.65.142
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:29:55.105871
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.142", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 41, "malware_samples": [], "passive_dns": ["my-postlu.com", "lux-trustt.com", "lux-trusts.com", "s-luxtrust.com", "opulentora.info", "rbc-canada-onlinealert-secure.com", "assurancemaladie-verification.fr", "paiement-netflx.fr", "cpam-carterenouv.fr", "banquedefrance

reverse_dns:
  my-postlu.com,lux-trustt.com,lux-trusts.com,s-luxtrust.com,opulentora.info,rbc-canada-onlinealert-secure.com,assurancemaladie-verification.fr,paiement-netflx.fr,cpam-carterenouv.fr,banquedefrance-secure.fr


indicator: 37.221.65.143
indicator_type: ipv4
source: otx
country: RU
reverse_dns: h2o.activebuy.top,heydri.dnslab.link,heydari.servequake.com,heydari.laravel-market.online
queried_at: 2026-05-23T18:29:57.483477
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.143", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["h2o.activebuy.top", "heydri.dnslab.link", "heydari.servequake.com", "heydari.laravel-market.online"]}


indicator: 37.221.65.150
indicator_type: ipv4
source: otx
country: RU
reverse_dns: werytrhrtdsaad.shop,myrw5.com,m1.myrw5.com,europe-mypackage.com,webpostcanada.com
hosting_provider: tcp,mirai,Malicious IP,telnet,scan,blacklist,botnet,honeypot
queried_at: 2026-05-23T18:29:59.886458
raw_data:
  {"pulse_count": 1, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.150", "tags": ["tcp", "mirai", "Malicious IP", "telnet", "scan", "blacklist", "botnet", "honeypot"], "pulses": ["Scan port 23 Telnet (S3#)"], "malware_count": 0, "passive_dns_count": 5, "malware_samples": [], "passive_dns": ["werytrhrtdsaad.shop", "myrw5.com", "m1.myrw5.com", "europe-mypackage.com", "webpostcanada.com"]}


indicator: 37.221.65.155
indicator_type: ipv4
source: otx
country: RU
reverse_dns: vpn.odivod.com
queried_at: 2026-05-23T18:30:02.510206
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.155", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["vpn.odivod.com"]}


indicator: 37.221.65.162
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:30:05.034299
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.162", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 10, "malware_samples": [], "passive_dns": ["37-221-65-162.plesk.page", "www.infovitale-sante.online", "infovitale-sante.online", "auth-accountsocietegeneral.com", "lucid-wescoff.37-221-65-162.plesk.page", "www.lucid-wescoff.37-221-65-162.plesk.page", "www.silly-cold

reverse_dns:
  37-221-65-162.plesk.page,www.infovitale-sante.online,infovitale-sante.online,auth-accountsocietegeneral.com,lucid-wescoff.37-221-65-162.plesk.page,www.lucid-wescoff.37-221-65-162.plesk.page,www.silly-colden.37-221-65-162.plesk.page,silly-colden.37-221-65-162.plesk.page,welcomsecurite.eu.com,emellibghiti.org.uk


indicator: 37.221.65.173
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:30:08.171752
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.173", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 62, "malware_samples": [], "passive_dns": ["relaytrackmondial.com", "37-221-65-173.plesk.page", "naughty-banach.37-221-65-173.plesk.page", "www.naughty-banach.37-221-65-173.plesk.page", "www.reactivecreditagric.mom", "azalagric.mom", "redgbdesroh.mom", "gsdpvrfxo.mo

reverse_dns:
  relaytrackmondial.com,37-221-65-173.plesk.page,naughty-banach.37-221-65-173.plesk.page,www.naughty-banach.37-221-65-173.plesk.page,www.reactivecreditagric.mom,azalagric.mom,redgbdesroh.mom,gsdpvrfxo.mom,carvefxsq.mom,recavxrfs.mom


indicator: 37.221.65.182
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:30:10.669893
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.182", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 9, "malware_samples": [], "passive_dns": ["clom-vr.world", "synnax.live", "airesumeexperts.com", "suivitransports-colis.com", "miseajour-sante.com", "contravention-regler.com", "auth.bosshome.ddnsgeek.com", "bosshome.ddnsgeek.com", "wg.bosshome.ddnsgeek.com"]}

reverse_dns:
  clom-vr.world,synnax.live,airesumeexperts.com,suivitransports-colis.com,miseajour-sante.com,contravention-regler.com,auth.bosshome.ddnsgeek.com,bosshome.ddnsgeek.com,wg.bosshome.ddnsgeek.com


indicator: 37.221.65.184
indicator_type: ipv4
source: otx
country: RU
hosting_provider: ssh,Bruteforce,SSH,sip,gameprofitshack,Honeypot,Brute-Force,astromust,dilboostenergy,scan
queried_at: 2026-05-23T18:30:13.991329
raw_data:
  {"pulse_count": 13, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.184", "tags": ["ssh", "Bruteforce", "SSH", "sip", "gameprofitshack", "Honeypot", "Brute-Force", "astromust", "dilboostenergy", "scan", "sipvicious"], "pulses": ["SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "Cloned SSH 

reverse_dns:
  help-coastcapitaisavings.com,novolocalpronet.shop,novoservertech.shop,localserver03.shop,pyramid-download.help


indicator: 37.221.65.185
indicator_type: ipv4
source: otx
country: RU
reverse_dns: www.testspdd.org,testspdd.org,host.seosolution.life,dhl-expressreschedule.one
hosting_provider: SSH,Telnet,tcp,mirai,Malicious IP,scan,login,scanner,botnet,cowrie
queried_at: 2026-05-23T18:30:18.448675
raw_data:
  {"pulse_count": 19, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.185", "tags": ["SSH", "Telnet", "tcp", "mirai", "Malicious IP", "scan", "login", "scanner", "botnet", "cowrie", "tsec", "la-safe.org", "telnet", "tpot19", "blacklist", "honeypot", "bruteforce", "attack"], "pulses": ["Ka's Honeypot visitors", "srg", "srg", "LCIA:HoneyNet:2022", "LCIA:HoneyNet:December 2022", "TELNET - US Honeypot IoCs 20


indicator: 37.221.65.188
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:30:20.777540
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.188", "tags": [], "pulses": [], "malware_count": 1, "passive_dns_count": 9, "malware_samples": ["54de431d841f759305b668ec7ad323a2dc1fe50df9c8a3d91fe5ad45b2509507"], "passive_dns": ["asdfdsa.online", "czsk.tv", "prowebserverloca.shop", "digitalserverlocanet.com", "jpdt2.top", "asouthm.com", "bropolenz.com", "valobbs.com", "chradol.com"]}

reverse_dns:
  asdfdsa.online,czsk.tv,prowebserverloca.shop,digitalserverlocanet.com,jpdt2.top,asouthm.com,bropolenz.com,valobbs.com,chradol.com


indicator: 37.221.65.190
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:30:23.065446
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.190", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 37.221.65.193
indicator_type: ipv4
source: otx
country: RU
reverse_dns: caspianads.net,hotposter.org
queried_at: 2026-05-23T18:30:28.543034
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.193", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["caspianads.net", "hotposter.org"]}


indicator: 37.221.65.208
indicator_type: ipv4
source: otx
country: RU
reverse_dns: bluesettle.com
queried_at: 2026-05-23T18:30:31.386333
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.208", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["bluesettle.com"]}


indicator: 37.221.65.217
indicator_type: ipv4
source: otx
country: RU
reverse_dns: www.whatwesalvaged.com,whatwesalvaged.com,gnuru.org
queried_at: 2026-05-23T18:30:33.742526
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.217", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["www.whatwesalvaged.com", "whatwesalvaged.com", "gnuru.org"]}


indicator: 37.221.65.223
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:30:36.993152
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.223", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 25, "malware_samples": [], "passive_dns": ["serial.walkingdead.top", "lost-tv.top", "www.lost-tv.top", "misfits-tv.top", "mult.familyguytv.top", "familyguytv.top", "www.familyguytv.top", "breakingbadserial.top", "mp4club.top", "www.dnevnikivampira.top", "dnevnikivam

reverse_dns:
  serial.walkingdead.top,lost-tv.top,www.lost-tv.top,misfits-tv.top,mult.familyguytv.top,familyguytv.top,www.familyguytv.top,breakingbadserial.top,mp4club.top,www.dnevnikivampira.top


indicator: 37.221.65.226
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:30:40.244756
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.226", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 14, "malware_samples": [], "passive_dns": ["alfaplus.cam", "www.alfaplus.cam", "cazinovas.com", "www.cazinovas.com", "allianceventures.ru", "baashinux.cloud", "outlook.outlook.baashinux.cloud", "login.outlook.baashinux.cloud", "account.outlook.baashinux.cloud", "log

reverse_dns:
  alfaplus.cam,www.alfaplus.cam,cazinovas.com,www.cazinovas.com,allianceventures.ru,baashinux.cloud,outlook.outlook.baashinux.cloud,login.outlook.baashinux.cloud,account.outlook.baashinux.cloud,login.secure.baashinux.cloud


indicator: 37.221.65.229
indicator_type: ipv4
source: otx
country: RU
reverse_dns: carbostream.com
queried_at: 2026-05-23T18:30:43.138446
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.229", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["carbostream.com"]}


indicator: 37.221.65.231
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:30:47.007089
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.231", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 38, "malware_samples": [], "passive_dns": ["arrowserial.top", "www.13reasonswhy.ru", "13reasonswhy.ru", "serial.dark-netflix.ru", "boys-tv.ru", "www.arcane-tv.top", "arcane-tv.top", "www.fargoserial.top", "fargoserial.top", "mult.gravityfalls.top", "desyatoekorolevs

reverse_dns:
  arrowserial.top,www.13reasonswhy.ru,13reasonswhy.ru,serial.dark-netflix.ru,boys-tv.ru,www.arcane-tv.top,arcane-tv.top,www.fargoserial.top,fargoserial.top,mult.gravityfalls.top


indicator: 37.221.65.233
indicator_type: ipv4
source: otx
country: RU
reverse_dns: dns.kozich.net,toast.kozich.net,dns.adguard.kozich.net,sobux.robux.kozich.net
queried_at: 2026-05-23T18:30:49.379720
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.233", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["dns.kozich.net", "toast.kozich.net", "dns.adguard.kozich.net", "sobux.robux.kozich.net"]}


indicator: 37.221.65.235
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:30:51.936721
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.235", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 11, "malware_samples": [], "passive_dns": ["onlyfansta.com", "onlyfanski.com", "onlyfansmi.com", "alpha-business-partners.online", "ups-mypackage-europe.com", "rappel-infraction-dossier.info", "ups-es-track.com", "shipment-parcel-ups.com", "ups-expedition-parcel.com

reverse_dns:
  onlyfansta.com,onlyfanski.com,onlyfansmi.com,alpha-business-partners.online,ups-mypackage-europe.com,rappel-infraction-dossier.info,ups-es-track.com,shipment-parcel-ups.com,ups-expedition-parcel.com,canadainstantransfer.com


indicator: 37.221.65.242
indicator_type: ipv4
source: otx
country: RU
reverse_dns: fa.uzspon.ru,fc.uzspon.ru,tutbet.net,x.tutbet.net
queried_at: 2026-05-23T18:30:54.750962
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.242", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["fa.uzspon.ru", "fc.uzspon.ru", "tutbet.net", "x.tutbet.net"]}


indicator: 37.221.65.246
indicator_type: ipv4
source: otx
country: RU
reverse_dns: cdnmd.openxrt.site
queried_at: 2026-05-23T18:30:57.331333
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.246", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["cdnmd.openxrt.site"]}


indicator: 37.221.65.252
indicator_type: ipv4
source: otx
country: RU
queried_at: 2026-05-23T18:30:59.918607
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.252", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 39, "malware_samples": [], "passive_dns": ["spineflo.it.com", "laurent-chenot.com", "m1.laurent-chenot.com", "cdnnd.openxrt.site", "reeeeeetchkjkhjljhkjhkjhk.xyz", "locationone.co", "secondstance.co", "secondaryline.co", "greatcreate.net", "lifelabz.co", "momentl.co

reverse_dns:
  spineflo.it.com,laurent-chenot.com,m1.laurent-chenot.com,cdnnd.openxrt.site,reeeeeetchkjkhjljhkjhkjhk.xyz,locationone.co,secondstance.co,secondaryline.co,greatcreate.net,lifelabz.co


indicator: 87.121.85.30
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:31:02.326406
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.30", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.31
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:31:05.000152
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.31", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.32
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:31:07.588210
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.32", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.33
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:31:21.213485
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.33", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.34
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:31:23.448544
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.34", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.35
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:31:25.840870
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.35", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.36
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:31:29.367013
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.36", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.37
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:31:33.098259
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.37", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.38
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:31:35.963372
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.38", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.39
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:31:38.229614
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.39", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.40
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:31:40.469600
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.40", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.41
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:31:42.826712
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.41", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.43
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:31:45.251035
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.43", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.44
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:31:47.649023
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.44", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.45
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:31:49.835057
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.45", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.46
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:31:52.421945
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.46", "tags": [], "pulses": [], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["2da828d18b3d565c9d7026fe49adbbc0472a3240c446848951dae4a1ddef5a7d"], "passive_dns": []}


indicator: 87.121.85.47
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:31:58.294422
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.47", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.48
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:00.817304
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.48", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.49
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:03.316408
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.49", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.50
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:05.465582
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.50", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.51
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:07.661163
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.51", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.52
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:12.990238
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.52", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.53
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:15.395620
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.53", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.54
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:17.591849
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.54", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.55
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:19.713127
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.55", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.56
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:21.839090
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.56", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.57
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:24.086329
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.57", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.63
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:27.069935
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.63", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.64
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:29.390644
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.64", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.74
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:31.577718
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.74", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.77
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:33.804548
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.77", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.78
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:36.009612
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.78", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.79
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:38.265674
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.79", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.80
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:41.292222
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.80", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.81
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:43.548982
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.81", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.82
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:45.794195
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.82", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.83
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:51.669880
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.83", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.84
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:54.590062
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.84", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.85
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:32:56.829799
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.85", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.86
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:33:05.228125
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.86", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.87
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:33:07.568776
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.87", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.88
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:33:09.659831
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.88", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.89
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:33:14.088908
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.89", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.90
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:33:31.194283
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.90", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


indicator: 87.121.85.91
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:33:33.287300
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.91", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.92
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:33:35.591288
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.92", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.93
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:33:39.516987
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.93", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.94
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:33:43.086614
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.94", "tags": [], "pulses": [], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["82e900b6db0d4571022437088fb3fe5e22339be7c712e6c91806deb5be7441a9"], "passive_dns": []}


indicator: 87.121.85.95
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:33:45.935291
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.95", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.96
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:33:48.650915
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.96", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.97
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:33:51.123499
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.97", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.98
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:33:53.264604
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.98", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.99
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:33:55.726873
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.99", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.100
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:33:58.271272
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.100", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.101
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:34:00.573004
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.101", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.104
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:34:03.564860
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.104", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.111
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:34:06.123675
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.111", "tags": [], "pulses": [], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["8e13fabe4ede72464cdf8042972201185ba08bd0dd769f42dcc4adb4be7ce3e1"], "passive_dns": []}


indicator: 87.121.85.114
indicator_type: ipv4
source: otx
country: BG
city: Burgas
reverse_dns: gearzone.hu
queried_at: 2026-05-23T18:34:08.357635
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.114", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["gearzone.hu"]}


indicator: 87.121.85.122
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:34:11.686589
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.122", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.124
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:34:14.202571
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.124", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.135
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:34:16.758024
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.135", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.136
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:34:19.131904
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.136", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 9, "malware_samples": [], "passive_dns": ["foundry.vargaoliver.com", "www.riddlecreek.com", "www.mulchini.com", "mulchini.com", "riddlecreek.com", "puzzle.mulchini.com", "penpot.mulchini.com", "foundry.mulchini.com", "budget.mulchini.com"]}

reverse_dns:
  foundry.vargaoliver.com,www.riddlecreek.com,www.mulchini.com,mulchini.com,riddlecreek.com,puzzle.mulchini.com,penpot.mulchini.com,foundry.mulchini.com,budget.mulchini.com


indicator: 87.121.85.139
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:34:21.746438
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.139", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.140
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:34:23.862904
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.140", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.148
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:34:26.016911
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.148", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.151
indicator_type: ipv4
source: otx
country: BG
city: Burgas
reverse_dns: hircsekk.hu,hirek.tech,hircheck.hu,www.hircheck.hu
queried_at: 2026-05-23T18:34:28.237385
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.151", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["hircsekk.hu", "hirek.tech", "hircheck.hu", "www.hircheck.hu"]}


indicator: 87.121.85.166
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:34:30.632922
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.166", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 87.121.85.174
indicator_type: ipv4
source: otx
country: BG
city: Burgas
queried_at: 2026-05-23T18:34:33.813394
raw_data:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.174", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


indicator: 176.65.134.14
indicator_type: ipv4
source: shodan
reverse_dns: 176.65.134.14
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:01:10.307038
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["176.65.134.14"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 176.65.134.16
indicator_type: ipv4
source: shodan
reverse_dns: 176.65.134.16
hosting_provider: cpe:/a:openbsd:openssh:8.4p1,cpe:/o:debian:debian_linux,cpe:/o:linux:linux_kernel
queried_at: 2026-05-24T00:01:12.221365
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["176.65.134.16"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:8.4p1", "cpe:/o:debian:debian_linux", "cpe:/o:linux:linux_kernel"]}


indicator: 176.65.134.254
indicator_type: ipv4
source: shodan
reverse_dns: 176.65.134.254
hosting_provider: cpe:/a:f5:nginx
queried_at: 2026-05-24T00:01:14.049832
raw_data:
  {"ports": [80, 10051], "vulns": [], "hostnames": ["176.65.134.254"], "tags": [], "cpes": ["cpe:/a:f5:nginx"]}


indicator: 176.65.134.34
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: 176.65.134.34
hosting_provider: cpe:/o:linux:linux_kernel,cpe:/o:canonical:ubuntu_linux,cpe:/a:f5:nginx:1.18.0
queried_at: 2026-05-24T00:01:17.780296
raw_data:
  {"ports": [80], "vulns": ["CVE-2025-23419", "CVE-2021-3618", "CVE-2021-23017", "CVE-2023-44487"], "hostnames": ["176.65.134.34"], "tags": ["eol-product"], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx:1.18.0"]}


indicator: 176.65.134.2
indicator_type: ipv4
source: shodan
reverse_dns: 176.65.134.2
hosting_provider: cpe:/o:debian:debian_linux,cpe:/o:linux:linux_kernel,cpe:/a:openbsd:openssh:9.2p1
queried_at: 2026-05-24T00:01:25.289205
raw_data:
  {"ports": [22, 111, 3128, 5901, 5904, 5915, 10050], "vulns": [], "hostnames": ["176.65.134.2"], "tags": [], "cpes": ["cpe:/o:debian:debian_linux", "cpe:/o:linux:linux_kernel", "cpe:/a:openbsd:openssh:9.2p1"]}


indicator: 176.65.134.13
indicator_type: ipv4
source: shodan
reverse_dns: 176.65.134.13
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:01:27.172457
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["176.65.134.13"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 93.157.106.122
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: vps2388238434.local
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux,cpe:/a:f5:nginx:1.24.0
queried_at: 2026-05-24T00:01:38.209357
raw_data:
  {"ports": [22, 443], "vulns": ["CVE-2025-23419", "CVE-2023-44487"], "hostnames": ["vps2388238434.local"], "tags": ["eol-product"], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx:1.24.0"]}


indicator: 93.157.106.123
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: russkie-serialy.org
hosting_provider: cpe:/a:ntp:ntp:3,cpe:/a:exim:exim:4.97
queried_at: 2026-05-24T00:01:40.084649
raw_data:
  {"ports": [21, 25, 53, 110, 123, 143, 465, 587, 993, 1500], "vulns": ["CVE-2025-67896", "CVE-2026-40686", "CVE-2026-40684", "CVE-2025-30232", "CVE-2024-39929", "CVE-2023-51766", "CVE-2026-40687", "CVE-2026-40685"], "hostnames": ["russkie-serialy.org"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:ntp:ntp:3", "cpe:/a:exim:exim:4.97"]}


indicator: 93.157.106.128
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: r3ttg2hy.your-company.com
queried_at: 2026-05-24T00:01:41.931162
raw_data:
  {"ports": [22, 4022, 8080], "vulns": ["CVE-2025-23419", "CVE-2021-3618", "CVE-2021-23017", "CVE-2023-44487"], "hostnames": ["r3ttg2hy.your-company.com"], "tags": ["eol-product"], "cpes": ["cpe:/a:openbsd:openssh:8.2p1", "cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx:1.18.0", "cpe:/o:linux:linux_kernel"]}

hosting_provider:
  cpe:/a:openbsd:openssh:8.2p1,cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux,cpe:/a:f5:nginx:1.18.0,cpe:/o:linux:linux_kernel


indicator: 93.157.106.131
indicator_type: ipv4
source: shodan
reverse_dns: z525.com,z525,www.z525.com
hosting_provider: cpe:/a:openbsd:openssh:8.7,cpe:/a:f5:nginx
queried_at: 2026-05-24T00:01:43.879930
raw_data:
  {"ports": [22, 443, 888], "vulns": ["CVE-2025-26465", "CVE-2026-35388", "CVE-2023-38408", "CVE-2008-3844", "CVE-2026-35387", "CVE-2023-51767", "CVE-2026-35385", "CVE-2021-36368", "CVE-2024-6387", "CVE-2025-32728", "CVE-2026-35386", "CVE-2023-51385", "CVE-2007-2768", "CVE-2023-48795", "CVE-2016-20012", "CVE-2021-41617", "CVE-2026-35414"], "hostnames": ["z525.com", "z525", "www.z525.com"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:8.7", "cpe:/a:f5:nginx"]}


indicator: 93.157.106.135
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: blogserver
queried_at: 2026-05-24T00:01:45.703338
raw_data:
  {"ports": [22, 80], "vulns": ["CVE-2025-23419", "CVE-2023-44487"], "hostnames": ["blogserver"], "tags": ["eol-product"], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/o:debian:debian_linux", "cpe:/a:openbsd:openssh:9.2p1", "cpe:/a:f5:nginx:1.22.1"]}

hosting_provider:
  cpe:/o:linux:linux_kernel,cpe:/o:debian:debian_linux,cpe:/a:openbsd:openssh:9.2p1,cpe:/a:f5:nginx:1.22.1


indicator: 93.157.106.141
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: futemax.com
queried_at: 2026-05-24T00:01:47.535291
raw_data:
  {"ports": [21, 22, 443], "vulns": [], "hostnames": ["futemax.com"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/a:pureftpd:pure-ftpd", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx"]}

hosting_provider:
  cpe:/a:openbsd:openssh:9.6p1,cpe:/a:pureftpd:pure-ftpd,cpe:/o:canonical:ubuntu_linux,cpe:/a:f5:nginx


indicator: 93.157.106.150
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/o:linux:linux_kernel,cpe:/a:openbsd:openssh:8.4p1,cpe:/o:debian:debian_linux
queried_at: 2026-05-24T00:01:49.340262
raw_data:
  {"ports": [22, 443], "vulns": [], "hostnames": ["kotikey-blog", "vk.com", "stats.vk-portal.net", "m.vk.ru", "vk.me", "vk.cc", "vk.ru", "m.vk.com", "vk.design", "api.vk.ru", "api.vk.com", "vkontakte.com", "vk.link", "vkvideo.ru", "vkontakte.ru"], "tags": [], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/a:openbsd:openssh:8.4p1", "cpe:/o:debian:debian_linux"]}

reverse_dns:
  kotikey-blog,vk.com,stats.vk-portal.net,m.vk.ru,vk.me,vk.cc,vk.ru,m.vk.com,vk.design,api.vk.ru,api.vk.com,vkontakte.com,vk.link,vkvideo.ru,vkontakte.ru


indicator: 93.157.106.166
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: bl-7,dog240.rwunderland.com,max.ru
queried_at: 2026-05-24T00:01:51.162535
raw_data:
  {"ports": [22, 443, 4443, 8443], "vulns": ["CVE-2025-23419", "CVE-2021-3618", "CVE-2023-44487", "CVE-2021-23017"], "hostnames": ["bl-7", "dog240.rwunderland.com", "max.ru"], "tags": ["eol-product"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/o:linux:linux_kernel", "cpe:/a:f5:nginx:1.18.0"]}

hosting_provider:
  cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.9p1,cpe:/o:linux:linux_kernel,cpe:/a:f5:nginx:1.18.0


indicator: 93.157.106.181
indicator_type: ipv4
source: shodan
reverse_dns: krasnyvpn.com
hosting_provider: cpe:/a:expressjs:express,cpe:/a:nodejs:node.js
queried_at: 2026-05-24T00:01:54.886664
raw_data:
  {"ports": [3000], "vulns": [], "hostnames": ["krasnyvpn.com"], "tags": [], "cpes": ["cpe:/a:expressjs:express", "cpe:/a:nodejs:node.js"]}


indicator: 93.157.106.191
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: inwebap
queried_at: 2026-05-24T00:01:56.705189
raw_data:
  {"ports": [22, 80], "vulns": ["CVE-2025-23419", "CVE-2021-3618", "CVE-2023-44487", "CVE-2021-23017"], "hostnames": ["inwebap"], "tags": ["eol-product"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/o:linux:linux_kernel", "cpe:/a:f5:nginx:1.18.0"]}

hosting_provider:
  cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.9p1,cpe:/o:linux:linux_kernel,cpe:/a:f5:nginx:1.18.0


indicator: 93.157.106.194
indicator_type: ipv4
source: shodan
reverse_dns: bg.un1
hosting_provider: cpe:/a:openbsd:openssh:8.9p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:01:58.547272
raw_data:
  {"ports": [22, 9999], "vulns": [], "hostnames": ["bg.un1"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:8.9p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 93.157.106.207
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: fullbyfc
hosting_provider: cpe:/o:linux:linux_kernel,cpe:/o:canonical:ubuntu_linux,cpe:/a:f5:nginx:1.18.0
queried_at: 2026-05-24T00:02:02.277413
raw_data:
  {"ports": [8000, 8080], "vulns": ["CVE-2025-23419", "CVE-2021-3618", "CVE-2021-23017", "CVE-2023-44487"], "hostnames": ["fullbyfc"], "tags": ["eol-product"], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx:1.18.0"]}


indicator: 93.157.106.224
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/o:microsoft:windows
queried_at: 2026-05-24T00:02:07.790845
raw_data:
  {"ports": [80, 139, 5985], "vulns": [], "hostnames": [], "tags": [], "cpes": ["cpe:/o:microsoft:windows"]}


indicator: 93.157.106.227
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: bulgaria
hosting_provider: cpe:/a:google:web_server,cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.9p1
queried_at: 2026-05-24T00:02:09.662190
raw_data:
  {"ports": [22, 443, 2096], "vulns": [], "hostnames": ["bulgaria"], "tags": ["self-signed"], "cpes": ["cpe:/a:google:web_server", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1"]}


indicator: 93.157.106.230
indicator_type: ipv4
source: shodan
city: database,eol-product
reverse_dns: gp-01
hosting_provider: cpe:/a:oracle:mysql:8.0.45-0ubuntu0.24.04.1
queried_at: 2026-05-24T00:02:11.473031
raw_data:
  {"ports": [3306], "vulns": [], "hostnames": ["gp-01"], "tags": ["database", "eol-product"], "cpes": ["cpe:/a:oracle:mysql:8.0.45-0ubuntu0.24.04.1"]}


indicator: 93.157.106.232
indicator_type: ipv4
source: shodan
reverse_dns: 20260114.bul61
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:02:13.344630
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["20260114.bul61"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 93.157.106.239
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: dsmffsd23
queried_at: 2026-05-24T00:02:15.177367
raw_data:
  {"ports": [22, 80], "vulns": ["CVE-2025-23419", "CVE-2023-44487"], "hostnames": ["dsmffsd23"], "tags": ["eol-product"], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx:1.24.0"]}

hosting_provider:
[cell repeats an earlier one in this file: 107 characters]


indicator: 93.157.106.242
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: TRAINER.SITES24
queried_at: 2026-05-24T00:02:17.027183
raw_data:
  {"ports": [22, 8443], "vulns": [], "hostnames": ["TRAINER.SITES24"], "tags": ["self-signed"], "cpes": ["cpe:/a:jquery:jquery", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:getbootstrap:bootstrap", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/a:f5:nginx"]}

hosting_provider:
  cpe:/a:jquery:jquery,cpe:/o:canonical:ubuntu_linux,cpe:/a:getbootstrap:bootstrap,cpe:/a:openbsd:openssh:8.9p1,cpe:/a:f5:nginx


indicator: 93.157.106.244
indicator_type: ipv4
source: shodan
reverse_dns: s1029393.intracom.wan
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:02:18.728414
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["s1029393.intracom.wan"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 93.157.106.3
indicator_type: ipv4
source: shodan
city: self-signed
queried_at: 2026-05-24T00:02:20.535345
raw_data:
  {"ports": [22, 80, 8443], "vulns": [], "hostnames": [], "tags": ["self-signed"], "cpes": ["cpe:/a:getbootstrap:bootstrap", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx", "cpe:/a:openbsd:openssh:9.6p1", "cpe:/a:jquery:jquery"]}

hosting_provider:
  cpe:/a:getbootstrap:bootstrap,cpe:/o:canonical:ubuntu_linux,cpe:/a:f5:nginx,cpe:/a:openbsd:openssh:9.6p1,cpe:/a:jquery:jquery


indicator: 93.157.106.5
indicator_type: ipv4
source: shodan
city: self-signed
hosting_provider: cpe:/o:microsoft:windows
queried_at: 2026-05-24T00:02:24.207299
raw_data:
  {"ports": [80, 3389, 5986], "vulns": [], "hostnames": [], "tags": ["self-signed"], "cpes": ["cpe:/o:microsoft:windows"]}


indicator: 93.157.106.71
indicator_type: ipv4
source: shodan
city: self-signed
hosting_provider: cpe:/a:openbsd:openssh:for_Windows_9.5,cpe:/o:microsoft:windows
queried_at: 2026-05-24T00:02:26.042167
raw_data:
  {"ports": [22, 80, 135, 3389, 5357], "vulns": [], "hostnames": [], "tags": ["self-signed"], "cpes": ["cpe:/a:openbsd:openssh:for_Windows_9.5", "cpe:/o:microsoft:windows"]}


indicator: 93.157.106.78
indicator_type: ipv4
source: shodan
city: self-signed,starttls
reverse_dns: s1.kinopolice.com
queried_at: 2026-05-24T00:02:29.751125
raw_data:
  {"ports": [21, 22, 25, 53, 143, 443, 465, 587, 993, 995, 7777, 8888], "vulns": ["CVE-2023-42117", "CVE-2023-42114", "CVE-2025-67896", "CVE-2023-42115", "CVE-2026-40686", "CVE-2026-40684", "CVE-2025-30232", "CVE-2024-39929", "CVE-2022-3620", "CVE-2022-3559", "CVE-2023-51766", "CVE-2023-42116", "CVE-2026-40687", "CVE-2023-42119", "CVE-2026-40685"], "hostnames": ["s1.kinopolice.com"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:exim:exim:4.96", "cpe:/a:f5:nginx:1.30.0", "cpe:/o:debian:deb

hosting_provider:
  cpe:/a:exim:exim:4.96,cpe:/a:f5:nginx:1.30.0,cpe:/o:debian:debian_linux,cpe:/a:openbsd:openssh:9.2p1,cpe:/a:f5:nginx,cpe:/o:linux:linux_kernel


indicator: 91.103.140.107
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: finish.nepali-konto.ru
queried_at: 2026-05-24T00:02:35.213034
raw_data:
  {"ports": [22, 80, 443, 8443], "vulns": ["CVE-2025-23419", "CVE-2023-44487"], "hostnames": ["finish.nepali-konto.ru"], "tags": ["eol-product"], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx:1.24.0"]}

hosting_provider:
[cell repeats an earlier one in this file: 107 characters]


indicator: 91.103.140.12
indicator_type: ipv4
source: shodan
queried_at: 2026-05-24T00:02:44.329106
raw_data:
  {"ports": [443], "vulns": [], "hostnames": ["wwwqa.microsoft.com", "staticview.microsoft.com", "www.microsoft.com", "microsoft.com", "privacy.microsoft.com", "i.s-microsoft.com", "c.s-microsoft.com"], "tags": [], "cpes": []}

reverse_dns:
  wwwqa.microsoft.com,staticview.microsoft.com,www.microsoft.com,microsoft.com,privacy.microsoft.com,i.s-microsoft.com,c.s-microsoft.com


indicator: 91.103.140.127
indicator_type: ipv4
source: shodan
city: self-signed
hosting_provider: cpe:/a:google:web_server
queried_at: 2026-05-24T00:02:49.783417
raw_data:
  {"ports": [443], "vulns": [], "hostnames": [], "tags": ["self-signed"], "cpes": ["cpe:/a:google:web_server"]}


indicator: 91.103.140.135
indicator_type: ipv4
source: shodan
reverse_dns: vpgen.mooo.com
hosting_provider: cpe:/a:python:python,cpe:/a:encode:uvicorn
queried_at: 2026-05-24T00:02:58.800367
raw_data:
  {"ports": [8443], "vulns": [], "hostnames": ["vpgen.mooo.com"], "tags": [], "cpes": ["cpe:/a:python:python", "cpe:/a:encode:uvicorn"]}


indicator: 91.103.140.136
indicator_type: ipv4
source: shodan
queried_at: 2026-05-24T00:03:00.659664
raw_data:
  {"ports": [443], "vulns": [], "hostnames": ["sf-api-token-service.itunes.apple.com", "api.music.apple.com", "pd.itunes.apple.com", "api.itunes.apple.com", "is1-ssl.mzstatic.com", "radio-activity.itunes.apple.com", "a5.mzstatic.com", "sp.itunes.apple.com", "upp.itunes.apple.com", "sync.itunes.apple.com", "s.mzstatic.com", "store.mzstatic.com", "b5.mzstatic.com", "s3.mzstatic.com", "itc.mzstatic.com", "search.itunes.apple.com", "b4.mzstatic.com", "api.apps.apple.com", "apps.apple.com", "images-mer

reverse_dns:
  sf-api-token-service.itunes.apple.com,api.music.apple.com,pd.itunes.apple.com,api.itunes.apple.com,is1-ssl.mzstatic.com,radio-activity.itunes.apple.com,a5.mzstatic.com,sp.itunes.apple.com,upp.itunes.apple.com,sync.itunes.apple.com,s.mzstatic.com,store.mzstatic.com,b5.mzstatic.com,s3.mzstatic.com,itc.mzstatic.com,search.itunes.apple.com,b4.mzstatic.com,api.apps.apple.com,apps.apple.com,images-mercury.mzstatic.com,videos.apple.com,b2.mzstatic.com,is2-ssl.mzstatic.com,s4.mzstatic.com,se.itunes.appl


indicator: 91.103.140.140
indicator_type: ipv4
source: shodan
city: eol-product
queried_at: 2026-05-24T00:03:04.200233
raw_data:
  {"ports": [80, 5353, 8000], "vulns": ["CVE-2025-23419", "CVE-2023-44487"], "hostnames": [], "tags": ["eol-product"], "cpes": ["cpe:/a:f5:nginx:1.24.0", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:encode:uvicorn", "cpe:/o:linux:linux_kernel", "cpe:/a:python:python"]}

hosting_provider:
  cpe:/a:f5:nginx:1.24.0,cpe:/o:canonical:ubuntu_linux,cpe:/a:encode:uvicorn,cpe:/o:linux:linux_kernel,cpe:/a:python:python


indicator: 91.103.140.141
indicator_type: ipv4
source: shodan
queried_at: 2026-05-24T00:03:05.993556
raw_data:
  {"ports": [443], "vulns": [], "hostnames": ["myvisualization.oracle.com", "sites.oracle.com", "itweb.oracle.com", "analytics.covid19.oracle.com", "biapps-fusioncrm.oracle.com", "securesites.oracle.com", "elocation.oracle.com", "m.oracle.com", "scm-fusioncrm.oracle.com", "restgwoci-dr.oracle.com", "appcenter.bronto.com", "myemm.oracle.com", "cn.forums.oracle.com", "container-registry.oracle.com", "restgwoci.oracle.com", "www.covid19-rx.org", "wwwcmsapi.oracle.com", "maps.oracle.com", "content.bro

reverse_dns:
  myvisualization.oracle.com,sites.oracle.com,itweb.oracle.com,analytics.covid19.oracle.com,biapps-fusioncrm.oracle.com,securesites.oracle.com,elocation.oracle.com,m.oracle.com,scm-fusioncrm.oracle.com,restgwoci-dr.oracle.com,appcenter.bronto.com,myemm.oracle.com,cn.forums.oracle.com,container-registry.oracle.com,restgwoci.oracle.com,www.covid19-rx.org,wwwcmsapi.oracle.com,maps.oracle.com,content.bronto.com,mymobile.oracle.com,blog.bronto.com,wikis.oracle.com,mysites-api.oracle.com,covpn-site-port


indicator: 91.103.140.154
indicator_type: ipv4
source: shodan
reverse_dns: www.marisova.ru,spbsky.su,www.spbfly.ru,www.spbsky.su,spbfly.ru,marisova.ru
hosting_provider: cpe:/a:f5:nginx:1.29.6
queried_at: 2026-05-24T00:03:16.594044
raw_data:
  {"ports": [80, 443], "vulns": [], "hostnames": ["www.marisova.ru", "spbsky.su", "www.spbfly.ru", "www.spbsky.su", "spbfly.ru", "marisova.ru"], "tags": [], "cpes": ["cpe:/a:f5:nginx:1.29.6"]}


indicator: 91.103.140.177
indicator_type: ipv4
source: shodan
reverse_dns: mattermost.appiogames.com
hosting_provider: cpe:/a:facebook:react,cpe:/a:jenkins:mattermost,cpe:/a:golang:go,cpe:/a:f5:nginx:1.28.0
queried_at: 2026-05-24T00:03:31.004305
raw_data:
  {"ports": [443], "vulns": [], "hostnames": ["mattermost.appiogames.com"], "tags": [], "cpes": ["cpe:/a:facebook:react", "cpe:/a:jenkins:mattermost", "cpe:/a:golang:go", "cpe:/a:f5:nginx:1.28.0"]}


indicator: 91.103.140.207
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:03:54.026201
raw_data:
  {"ports": [2222, 8080], "vulns": [], "hostnames": [], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.140.233
indicator_type: ipv4
source: shodan
reverse_dns: www.consulting.1c.ru,1c.ru,www.torg.1c.ru
hosting_provider: cpe:/a:python:python,cpe:/a:encode:uvicorn
queried_at: 2026-05-24T00:04:15.558237
raw_data:
  {"ports": [443, 444, 445, 8002, 8080, 8443], "vulns": [], "hostnames": ["www.consulting.1c.ru", "1c.ru", "www.torg.1c.ru"], "tags": [], "cpes": ["cpe:/a:python:python", "cpe:/a:encode:uvicorn"]}


indicator: 91.103.140.27
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:04:30.109594
raw_data:
  {"ports": [22, 443], "vulns": [], "hostnames": [], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.140.3
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/a:getbootstrap:bootstrap,cpe:/a:jquery:jquery:3.5.1
queried_at: 2026-05-24T00:04:32.072394
raw_data:
  {"ports": [8080, 9000], "vulns": [], "hostnames": [], "tags": [], "cpes": ["cpe:/a:getbootstrap:bootstrap", "cpe:/a:jquery:jquery:3.5.1"]}


indicator: 91.103.140.36
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/a:openbsd:openssh:8.9p1,cpe:/a:apache:traffic_server,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:04:39.139768
raw_data:
  {"ports": [22, 8443], "vulns": [], "hostnames": ["brb.yahoo.net", "ddl.fp.yahoo.com", "ca.my.yahoo.com", "ca.rogers.yahoo.com", "add.my.yahoo.com", "tw.rd.yahoo.com", "hk.rd.yahoo.com", "mbp.yimg.com", "fr-ca.rogers.yahoo.com", "s.yimg.com", "yahoo.com"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:8.9p1", "cpe:/a:apache:traffic_server", "cpe:/o:canonical:ubuntu_linux"]}

reverse_dns:
  brb.yahoo.net,ddl.fp.yahoo.com,ca.my.yahoo.com,ca.rogers.yahoo.com,add.my.yahoo.com,tw.rd.yahoo.com,hk.rd.yahoo.com,mbp.yimg.com,fr-ca.rogers.yahoo.com,s.yimg.com,yahoo.com


indicator: 91.103.140.48
indicator_type: ipv4
source: shodan
reverse_dns: za-chto.gufa-ubilo.ru
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:04:48.101307
raw_data:
  {"ports": [22, 443], "vulns": [], "hostnames": ["za-chto.gufa-ubilo.ru"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.140.89
indicator_type: ipv4
source: shodan
reverse_dns: max.ru
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.2p1
queried_at: 2026-05-24T00:05:24.355442
raw_data:
  {"ports": [22, 443, 8080], "vulns": [], "hostnames": ["max.ru"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.2p1"]}


indicator: 91.103.140.90
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:05:27.906299
raw_data:
  {"ports": [22, 2222], "vulns": [], "hostnames": [], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.140.91
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: pastesolutions.tech
queried_at: 2026-05-24T00:05:29.678885
raw_data:
  {"ports": [22, 8443], "vulns": ["CVE-2025-23419", "CVE-2023-44487"], "hostnames": ["pastesolutions.tech"], "tags": ["eol-product"], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx:1.24.0"]}

hosting_provider:
[cell repeats an earlier one in this file: 107 characters]


indicator: 91.103.140.94
indicator_type: ipv4
source: shodan
queried_at: 2026-05-24T00:05:31.445909
raw_data:
  {"ports": [443, 8080], "vulns": [], "hostnames": ["vk.com", "stats.vk-portal.net", "m.vk.ru", "vk.me", "vk.cc", "vk.ru", "m.vk.com", "vk.design", "api.vk.ru", "api.vk.com", "vkontakte.com", "vk.link", "vkvideo.ru", "vkontakte.ru"], "tags": [], "cpes": []}

reverse_dns:
  vk.com,stats.vk-portal.net,m.vk.ru,vk.me,vk.cc,vk.ru,m.vk.com,vk.design,api.vk.ru,api.vk.com,vkontakte.com,vk.link,vkvideo.ru,vkontakte.ru


indicator: 91.103.252.101
indicator_type: ipv4
source: shodan
reverse_dns: vm3924561.firstbyte.club
queried_at: 2026-05-24T00:05:36.723754
raw_data:
  {"ports": [22, 443], "vulns": [], "hostnames": ["vm3924561.firstbyte.club"], "tags": [], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/a:openbsd:openssh:9.2p1", "cpe:/a:cloudflare:cloudflare", "cpe:/o:debian:debian_linux"]}

hosting_provider:
  cpe:/o:linux:linux_kernel,cpe:/a:openbsd:openssh:9.2p1,cpe:/a:cloudflare:cloudflare,cpe:/o:debian:debian_linux


indicator: 91.103.252.108
indicator_type: ipv4
source: shodan
reverse_dns: nikitalol.internal
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:05:38.507990
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["nikitalol.internal"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.252.115
indicator_type: ipv4
source: shodan
reverse_dns: vm3926536.firstbyte.club
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:05:43.867189
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["vm3926536.firstbyte.club"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.252.116
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: vm4111892.firstbyte.club
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux,cpe:/a:google:web_server
queried_at: 2026-05-24T00:05:45.638842
raw_data:
  {"ports": [22, 443], "vulns": [], "hostnames": ["vm4111892.firstbyte.club"], "tags": ["self-signed"], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:google:web_server"]}


indicator: 91.103.252.117
indicator_type: ipv4
source: shodan
reverse_dns: vm4162910.firstbyte.club
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:05:47.397672
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["vm4162910.firstbyte.club"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.252.120
indicator_type: ipv4
source: shodan
reverse_dns: vm4111964.firstbyte.club
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:05:49.155289
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["vm4111964.firstbyte.club"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.252.123
indicator_type: ipv4
source: shodan
reverse_dns: swawildvpn.com
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:05:51.003700
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["swawildvpn.com"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.252.126
indicator_type: ipv4
source: shodan
reverse_dns: ud6coo.uicode.pro
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:05:52.853324
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["ud6coo.uicode.pro"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.252.131
indicator_type: ipv4
source: shodan
queried_at: 2026-05-24T00:05:56.436980
raw_data:
  {"ports": [443], "vulns": [], "hostnames": ["yandex.com", "yandex.uz", "yandex.co.il", "ya.ru", "yandex.aero", "yandex.ee", "yandex.net", "yandex.ru", "yandex.lv", "yandex.it", "yandex.fr", "yandex.tr", "yandex.tj", "yandex.md", "yandex.com.am", "yandex.com.ge", "yandex.kz", "yandex.com.tr", "yandex.lt", "yandex.org", "xn--d1acpjx3f.xn--p1ai", "yandex.by", "yandex.az", "yandex.tm", "yandex.de", "yandex.jobs", "vm3927674.firstbyte.club"], "tags": [], "cpes": []}

reverse_dns:
  yandex.com,yandex.uz,yandex.co.il,ya.ru,yandex.aero,yandex.ee,yandex.net,yandex.ru,yandex.lv,yandex.it,yandex.fr,yandex.tr,yandex.tj,yandex.md,yandex.com.am,yandex.com.ge,yandex.kz,yandex.com.tr,yandex.lt,yandex.org,xn--d1acpjx3f.xn--p1ai,yandex.by,yandex.az,yandex.tm,yandex.de,yandex.jobs,vm3927674.firstbyte.club


indicator: 91.103.252.133
indicator_type: ipv4
source: shodan
reverse_dns: ravenspirit74.ru
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:05:58.250863
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["ravenspirit74.ru"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.252.143
indicator_type: ipv4
source: shodan
reverse_dns: vm4112605.firstbyte.club
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:06:05.753502
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["vm4112605.firstbyte.club"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.252.147
indicator_type: ipv4
source: shodan
reverse_dns: vm3929243.firstbyte.club
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:06:07.508585
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["vm3929243.firstbyte.club"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.252.148
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:06:09.298897
raw_data:
  {"ports": [22, 443, 4433, 9091], "vulns": [], "hostnames": ["www.cisco.com", "www-dev-cloud-cdn.cisco.com", "www.mediafiles-cisco.com", "techdocs.cisco.com", "vm4112560.firstbyte.club", "www.static-cisco.com", "www-stage-cloud-cdn.cisco.com", "petrovich.ru", "www-cloud-cdn.cisco.com"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}

reverse_dns:
  www.cisco.com,www-dev-cloud-cdn.cisco.com,www.mediafiles-cisco.com,techdocs.cisco.com,vm4112560.firstbyte.club,www.static-cisco.com,www-stage-cloud-cdn.cisco.com,petrovich.ru,www-cloud-cdn.cisco.com


indicator: 91.103.252.157
indicator_type: ipv4
source: shodan
city: self-signed
reverse_dns: bypass.srv
hosting_provider: cpe:/a:google:web_server
queried_at: 2026-05-24T00:06:12.915060
raw_data:
  {"ports": [443], "vulns": [], "hostnames": ["bypass.srv"], "tags": ["self-signed"], "cpes": ["cpe:/a:google:web_server"]}


indicator: 91.103.252.160
indicator_type: ipv4
source: shodan
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:06:14.708430
raw_data:
  {"ports": [22, 443], "vulns": [], "hostnames": ["icloud.cdn-apple.com", "icloud.com", "auth.apple.com", "www.icloud.com.cn", "vm4112677.firstbyte.club", "www.icloud.com"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}

reverse_dns:
  icloud.cdn-apple.com,icloud.com,auth.apple.com,www.icloud.com.cn,vm4112677.firstbyte.club,www.icloud.com


indicator: 91.103.252.173
indicator_type: ipv4
source: shodan
reverse_dns: roshads.com
queried_at: 2026-05-24T00:06:18.324584
raw_data:
  {"ports": [22, 80], "vulns": [], "hostnames": ["roshads.com"], "tags": [], "cpes": ["cpe:/a:f5:nginx:1.29.6", "cpe:/o:linux:linux_kernel", "cpe:/a:openbsd:openssh:9.2p1", "cpe:/o:debian:debian_linux"]}

hosting_provider:
  cpe:/a:f5:nginx:1.29.6,cpe:/o:linux:linux_kernel,cpe:/a:openbsd:openssh:9.2p1,cpe:/o:debian:debian_linux


indicator: 91.103.252.177
indicator_type: ipv4
source: shodan
reverse_dns: hitler.com
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:06:20.214577
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["hitler.com"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.252.178
indicator_type: ipv4
source: shodan
reverse_dns: vm4113648.firstbyte.club,images.apple.com,ozon.ru,www.ozon.ru
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.2p1
queried_at: 2026-05-24T00:06:22.053504
raw_data:
  {"ports": [22, 443, 8443], "vulns": [], "hostnames": ["vm4113648.firstbyte.club", "images.apple.com", "ozon.ru", "www.ozon.ru"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.2p1"]}


indicator: 91.103.252.18
indicator_type: ipv4
source: shodan
reverse_dns: n.sni-347-default.ssl.fastly.net,myserver.nl
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:06:25.599309
raw_data:
  {"ports": [22, 443], "vulns": [], "hostnames": ["n.sni-347-default.ssl.fastly.net", "myserver.nl"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.252.182
indicator_type: ipv4
source: shodan
reverse_dns: vm3937264.firstbyte.club
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:06:27.346844
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["vm3937264.firstbyte.club"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.252.184
indicator_type: ipv4
source: shodan
reverse_dns: vm4205005.firstbyte.club
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:06:29.149728
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["vm4205005.firstbyte.club"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.252.185
indicator_type: ipv4
source: shodan
city: proxy
reverse_dns: vm3949711.firstbyte.club
queried_at: 2026-05-24T00:06:30.909197
raw_data:
  {"ports": [3128], "vulns": [], "hostnames": ["vm3949711.firstbyte.club"], "tags": ["proxy"], "cpes": []}


indicator: 91.103.252.189
indicator_type: ipv4
source: shodan
reverse_dns: vm4209301.firstbyte.club
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:06:32.655487
raw_data:
  {"ports": [22, 443], "vulns": [], "hostnames": ["vm4209301.firstbyte.club"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.252.198
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: 9781273647d1415d9b8z.v6.rocks,vm3938903.firstbyte.club
queried_at: 2026-05-24T00:06:37.973689
raw_data:
  {"ports": [22, 80, 443], "vulns": ["CVE-2025-23419", "CVE-2023-44487"], "hostnames": ["9781273647d1415d9b8z.v6.rocks", "vm3938903.firstbyte.club"], "tags": ["eol-product"], "cpes": ["cpe:/a:f5:nginx:1.24.0", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:linux:linux_kernel"]}

hosting_provider:
  cpe:/a:f5:nginx:1.24.0,cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:9.6p1,cpe:/o:linux:linux_kernel


indicator: 91.103.252.203
indicator_type: ipv4
source: shodan
reverse_dns: vm4112843.firstbyte.club
hosting_provider: cpe:/o:linux:linux_kernel,cpe:/a:openbsd:openssh:8.4p1,cpe:/o:debian:debian_linux
queried_at: 2026-05-24T00:06:45.222405
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["vm4112843.firstbyte.club"], "tags": [], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/a:openbsd:openssh:8.4p1", "cpe:/o:debian:debian_linux"]}


indicator: 91.103.252.204
indicator_type: ipv4
source: shodan
reverse_dns: kt.com
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:06:47.022905
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["kt.com"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.252.214
indicator_type: ipv4
source: shodan
queried_at: 2026-05-24T00:06:52.348565
raw_data:
  {"ports": [8443], "vulns": [], "hostnames": ["download-installer.cdn.mozilla.net", "www-dev.allizom.org", "releases.mozilla.org", "download.cdn.mozilla.net", "eduard.limonov", "archive.mozilla.org", "www.mozilla.org", "www.allizom.org"], "tags": [], "cpes": []}

reverse_dns:
  download-installer.cdn.mozilla.net,www-dev.allizom.org,releases.mozilla.org,download.cdn.mozilla.net,eduard.limonov,archive.mozilla.org,www.mozilla.org,www.allizom.org


indicator: 91.103.252.219
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: www.yummymy.space,yummyserv.test1,yummymy.space
hosting_provider: cpe:/a:f5:nginx:1.24.0,cpe:/o:canonical:ubuntu_linux,cpe:/o:linux:linux_kernel
queried_at: 2026-05-24T00:06:55.895777
raw_data:
  {"ports": [80, 443, 2096], "vulns": ["CVE-2025-23419", "CVE-2023-44487"], "hostnames": ["www.yummymy.space", "yummyserv.test1", "yummymy.space"], "tags": ["eol-product"], "cpes": ["cpe:/a:f5:nginx:1.24.0", "cpe:/o:canonical:ubuntu_linux", "cpe:/o:linux:linux_kernel"]}


indicator: 91.103.252.229
indicator_type: ipv4
source: shodan
reverse_dns: corvusina.com
hosting_provider: cpe:/a:openbsd:openssh:8.4p1,cpe:/o:debian:debian_linux,cpe:/o:linux:linux_kernel
queried_at: 2026-05-24T00:07:03.028115
raw_data:
  {"ports": [22, 443], "vulns": [], "hostnames": ["corvusina.com"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:8.4p1", "cpe:/o:debian:debian_linux", "cpe:/o:linux:linux_kernel"]}


indicator: 91.103.252.231
indicator_type: ipv4
source: shodan
queried_at: 2026-05-24T00:07:04.909350
raw_data:
  {"ports": [22, 8443], "vulns": [], "hostnames": ["us.amazon.com", "uedata.amazon.com", "amzn.com", "p-nt-www-amazon-com-kalias.amazon.com", "p-y3-www-amazon-com-kalias.amazon.com", "corporate.amazon.com", "iphone.amazon.com", "test-www.amazon.com", "home.amazon.com", "mp3recs.amazon.com", "huddles.amazon.com", "www.amazon.com", "origin-www.amazon.com", "vm3943041.firstbyte.club", "yellowpages.amazon.com", "buybox.amazon.com", "buckeye-retail-website.amazon.com", "yp.amazon.com", "shop.business.a

reverse_dns:
  us.amazon.com,uedata.amazon.com,amzn.com,p-nt-www-amazon-com-kalias.amazon.com,p-y3-www-amazon-com-kalias.amazon.com,corporate.amazon.com,iphone.amazon.com,test-www.amazon.com,home.amazon.com,mp3recs.amazon.com,huddles.amazon.com,www.amazon.com,origin-www.amazon.com,vm3943041.firstbyte.club,yellowpages.amazon.com,buybox.amazon.com,buckeye-retail-website.amazon.com,yp.amazon.com,shop.business.amazon.com,p-yo-www-amazon-com-kalias.amazon.com,amazon.com,konrad-test.amazon.com,www.cdn.amazon.com,www

hosting_provider:
  cpe:/o:debian:debian_linux,cpe:/a:openbsd:openssh:9.2p1,cpe:/o:linux:linux_kernel,cpe:/a:amazon:amazon_cloudfront


indicator: 91.103.252.232
indicator_type: ipv4
source: shodan
city: eol-product
reverse_dns: vm3943389.firstbyte.club
queried_at: 2026-05-24T00:07:06.676410
raw_data:
  {"ports": [22, 80], "vulns": ["CVE-2025-23419", "CVE-2021-3618", "CVE-2023-44487", "CVE-2021-23017"], "hostnames": ["vm3943389.firstbyte.club"], "tags": ["eol-product"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.2p1", "cpe:/o:linux:linux_kernel", "cpe:/a:f5:nginx:1.18.0"]}

hosting_provider:
  cpe:/o:canonical:ubuntu_linux,cpe:/a:openbsd:openssh:8.2p1,cpe:/o:linux:linux_kernel,cpe:/a:f5:nginx:1.18.0


indicator: 91.103.252.237
indicator_type: ipv4
source: shodan
reverse_dns: zarechnyivpn.com
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:07:08.439699
raw_data:
  {"ports": [22, 53], "vulns": [], "hostnames": ["zarechnyivpn.com"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.252.238
indicator_type: ipv4
source: shodan
reverse_dns: vm4113452.firstbyte.club
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:07:10.193038
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["vm4113452.firstbyte.club"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.252.24
indicator_type: ipv4
source: shodan
reverse_dns: www.cloudflare.com,blog.api.www.cloudflare.com,vm3913652.firstbyte.club
hosting_provider: cpe:/o:canonical:ubuntu_linux,cpe:/a:cloudflare:cloudflare,cpe:/a:openbsd:openssh:8.2p1
queried_at: 2026-05-24T00:07:11.947141
raw_data:
  {"ports": [22, 443], "vulns": [], "hostnames": ["www.cloudflare.com", "blog.api.www.cloudflare.com", "vm3913652.firstbyte.club"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:cloudflare:cloudflare", "cpe:/a:openbsd:openssh:8.2p1"]}


indicator: 91.103.252.243
indicator_type: ipv4
source: shodan
reverse_dns: vm3946320.firstbyte.club
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:07:13.687565
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["vm3946320.firstbyte.club"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.252.247
indicator_type: ipv4
source: shodan
reverse_dns: vm4163306.firstbyte.club
hosting_provider: cpe:/a:openbsd:openssh:9.6p1,cpe:/o:canonical:ubuntu_linux
queried_at: 2026-05-24T00:07:15.437112
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["vm4163306.firstbyte.club"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


indicator: 91.103.252.250
indicator_type: ipv4
source: shodan
reverse_dns: vm4113497.firstbyte.club,www.consulting.1c.ru,www.torg.1c.ru,1c.ru
queried_at: 2026-05-24T00:07:20.886724
raw_data:
  {"ports": [443], "vulns": [], "hostnames": ["vm4113497.firstbyte.club", "www.consulting.1c.ru", "www.torg.1c.ru", "1c.ru"], "tags": [], "cpes": []}


indicator: 91.103.252.26
indicator_type: ipv4
source: shodan
reverse_dns: pc.net
hosting_provider: cpe:/o:debian:debian_linux,cpe:/o:linux:linux_kernel,cpe:/a:openbsd:openssh:9.2p1
queried_at: 2026-05-24T00:07:26.483612
raw_data:
  {"ports": [22], "vulns": [], "hostnames": ["pc.net"], "tags": [], "cpes": ["cpe:/o:debian:debian_linux", "cpe:/o:linux:linux_kernel", "cpe:/a:openbsd:openssh:9.2p1"]}


