# staging_servers

ip: 181.215.170.152
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.154
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.156
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.161
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.163
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.165
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.17
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.172
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.176
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.185
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.190
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.197
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.201
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.21
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.218
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.224
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.23
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.230
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.235
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.236
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.237
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.24
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.242
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.246
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.248
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.26
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.27
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.34
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.35
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.44
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.52
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.55
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.6
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.62
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.71
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.83", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.83
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.84", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.84
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.98", "181.215.170.99"]


ip: 181.215.170.98
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.99"]


ip: 181.215.170.99
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["181.215.170.111", "181.215.170.119", "181.215.170.132", "181.215.170.136", "181.215.170.139", "181.215.170.14", "181.215.170.140", "181.215.170.146", "181.215.170.147", "181.215.170.148", "181.215.170.150", "181.215.170.152", "181.215.170.154", "181.215.170.156", "181.215.170.161", "181.215.170.163", "181.215.170.165", "181.215.170.17", "181.215.170.172", "181.215.170.176", "181.215.170.185", "181.215.170.190", "181.215.170.197", "181.215.170.201", "181.215.170.21", "181.215.170.218", "181.215.170.224", "181.215.170.23", "181.215.170.230", "181.215.170.235", "181.215.170.236", "181.215.170.237", "181.215.170.24", "181.215.170.242", "181.215.170.246", "181.215.170.248", "181.215.170.26", "181.215.170.27", "181.215.170.34", "181.215.170.35", "181.215.170.44", "181.215.170.52", "181.215.170.55", "181.215.170.6", "181.215.170.62", "181.215.170.71", "181.215.170.83", "181.215.170.84", "181.215.170.98"]


ip: 91.103.140.108
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.103.140.104", "91.103.140.106", "91.103.140.107", "91.103.140.110", "91.103.140.113", "91.103.140.119", "91.103.140.12", "91.103.140.120", "91.103.140.122", "91.103.140.127", "91.103.140.129", "91.103.140.130", "91.103.140.131", "91.103.140.133", "91.103.140.135", "91.103.140.136", "91.103.140.137", "91.103.140.140", "91.103.140.141", "91.103.140.143", "91.103.140.148", "91.103.140.151", "91.103.140.152", "91.103.140.153", "91.103.140.154", "91.103.140.163", "91.103.140.165", "91.103.140.166", "91.103.140.168", "91.103.140.169", "91.103.140.172", "91.103.140.175", "91.103.140.177", "91.103.140.178", "91.103.140.180", "91.103.140.182", "91.103.140.183", "91.103.140.190", "91.103.140.191", "91.103.140.194", "91.103.140.195", "91.103.140.198", "91.103.140.203", "91.103.140.204", "91.103.140.206", "91.103.140.207", "91.103.140.210", "91.103.140.212", "91.103.140.216", "91.103.140.219", "91.103.140.221", "91.103.140.223", "91.103.140.225", "91.103.140.228", "91.103.140.229", "91.103.140.23", "91.103.140.231", "91.103.140.233", "91.103.140.237", "91.103.140.24", "91.103.140.240", "91.103.140.249", "91.103.140.250", "91.103.140.252", "91.103.140.254", "91.103.140.27", "91.103.140.3", "91.103.140.31", "91.103.140.32", "91.103.140.34", "91.103.140.36", "91.103.140.39", "91.103.140.40", "91.103.140.42", "91.103.140.44", "91.103.140.48", "91.103.140.49", "91.103.140.5", "91.103.140.50", "91.103.140.52", "91.103.140.57", "91.103.140.6", "91.103.140.61", "91.103.140.63", "91.103.140.65", "91.103.140.67", "91.103.140.7", "91.103.140.70", "91.103.140.71", "91.103.140.75", "91.103.140.77", "91.103.140.78", "91.103.140.8", "91.103.140.80", "91.103.140.87", "91.103.140.89", "91.103.140.9", "91.103.140.90", "91.103.140.91", "91.103.140.94", "91.103.140.95", "91.103.140.98"]


ip: 91.108.240.242
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.108.240.10", "91.108.240.108", "91.108.240.114", "91.108.240.115", "91.108.240.116", "91.108.240.120", "91.108.240.128", "91.108.240.13", "91.108.240.132", "91.108.240.136", "91.108.240.138", "91.108.240.14", "91.108.240.140", "91.108.240.145", "91.108.240.146", "91.108.240.149", "91.108.240.154", "91.108.240.165", "91.108.240.169", "91.108.240.17", "91.108.240.170", "91.108.240.177", "91.108.240.18", "91.108.240.180", "91.108.240.182", "91.108.240.183", "91.108.240.184", "91.108.240.187", "91.108.240.190", "91.108.240.195", "91.108.240.2", "91.108.240.202", "91.108.240.210", "91.108.240.215", "91.108.240.22", "91.108.240.220", "91.108.240.226", "91.108.240.230", "91.108.240.232", "91.108.240.235", "91.108.240.236", "91.108.240.26", "91.108.240.27", "91.108.240.35", "91.108.240.38", "91.108.240.4", "91.108.240.50", "91.108.240.51", "91.108.240.55", "91.108.240.56", "91.108.240.59", "91.108.240.6", "91.108.240.60", "91.108.240.67", "91.108.240.71", "91.108.240.8", "91.108.240.88", "91.108.240.93", "91.108.240.97"]


ip: 91.184.242.94
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.184.242.0", "91.184.242.1", "91.184.242.106", "91.184.242.108", "91.184.242.109", "91.184.242.110", "91.184.242.113", "91.184.242.115", "91.184.242.116", "91.184.242.12", "91.184.242.125", "91.184.242.126", "91.184.242.129", "91.184.242.131", "91.184.242.135", "91.184.242.139", "91.184.242.14", "91.184.242.141", "91.184.242.151", "91.184.242.156", "91.184.242.16", "91.184.242.160", "91.184.242.164", "91.184.242.165", "91.184.242.17", "91.184.242.171", "91.184.242.172", "91.184.242.179", "91.184.242.182", "91.184.242.183", "91.184.242.185", "91.184.242.186", "91.184.242.187", "91.184.242.189", "91.184.242.194", "91.184.242.196", "91.184.242.197", "91.184.242.20", "91.184.242.200", "91.184.242.203", "91.184.242.205", "91.184.242.209", "91.184.242.210", "91.184.242.211", "91.184.242.212", "91.184.242.216", "91.184.242.219", "91.184.242.22", "91.184.242.221", "91.184.242.222", "91.184.242.232", "91.184.242.233", "91.184.242.239", "91.184.242.243", "91.184.242.252", "91.184.242.253", "91.184.242.254", "91.184.242.27", "91.184.242.29", "91.184.242.30", "91.184.242.31", "91.184.242.35", "91.184.242.40", "91.184.242.42", "91.184.242.48", "91.184.242.5", "91.184.242.52", "91.184.242.54", "91.184.242.57", "91.184.242.58", "91.184.242.61", "91.184.242.64", "91.184.242.65", "91.184.242.66", "91.184.242.7", "91.184.242.70", "91.184.242.74", "91.184.242.80", "91.184.242.83", "91.184.242.85", "91.184.242.87", "91.184.242.88", "91.184.242.90", "91.184.242.95", "91.184.242.98"]


ip: 91.186.212.4
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.186.212.113", "91.186.212.132", "91.186.212.134", "91.186.212.137", "91.186.212.142", "91.186.212.15", "91.186.212.157", "91.186.212.168", "91.186.212.171", "91.186.212.172", "91.186.212.179", "91.186.212.18", "91.186.212.189", "91.186.212.192", "91.186.212.206", "91.186.212.209", "91.186.212.210", "91.186.212.220", "91.186.212.223", "91.186.212.233", "91.186.212.235", "91.186.212.237", "91.186.212.24", "91.186.212.247", "91.186.212.250", "91.186.212.253", "91.186.212.32", "91.186.212.39", "91.186.212.46", "91.186.212.49", "91.186.212.5", "91.186.212.57", "91.186.212.60", "91.186.212.63", "91.186.212.7", "91.186.212.70", "91.186.212.77", "91.186.212.78", "91.186.212.84", "91.186.212.9", "91.186.212.98"]


ip: 91.186.216.25
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.186.216.0", "91.186.216.100", "91.186.216.101", "91.186.216.104", "91.186.216.105", "91.186.216.115", "91.186.216.118", "91.186.216.119", "91.186.216.12", "91.186.216.122", "91.186.216.125", "91.186.216.127", "91.186.216.130", "91.186.216.134", "91.186.216.140", "91.186.216.165", "91.186.216.17", "91.186.216.172", "91.186.216.184", "91.186.216.199", "91.186.216.200", "91.186.216.204", "91.186.216.205", "91.186.216.209", "91.186.216.211", "91.186.216.212", "91.186.216.216", "91.186.216.217", "91.186.216.225", "91.186.216.226", "91.186.216.228", "91.186.216.229", "91.186.216.230", "91.186.216.232", "91.186.216.234", "91.186.216.240", "91.186.216.249", "91.186.216.28", "91.186.216.30", "91.186.216.40", "91.186.216.41", "91.186.216.44", "91.186.216.46", "91.186.216.48", "91.186.216.5", "91.186.216.59", "91.186.216.65", "91.186.216.8", "91.186.216.84", "91.186.216.91"]


ip: 91.186.218.148
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.186.218.0", "91.186.218.108", "91.186.218.109", "91.186.218.117", "91.186.218.121", "91.186.218.124", "91.186.218.128", "91.186.218.136", "91.186.218.140", "91.186.218.143", "91.186.218.152", "91.186.218.155", "91.186.218.156", "91.186.218.158", "91.186.218.16", "91.186.218.161", "91.186.218.162", "91.186.218.165", "91.186.218.177", "91.186.218.178", "91.186.218.179", "91.186.218.180", "91.186.218.192", "91.186.218.194", "91.186.218.195", "91.186.218.196", "91.186.218.197", "91.186.218.210", "91.186.218.214", "91.186.218.215", "91.186.218.219", "91.186.218.225", "91.186.218.230", "91.186.218.232", "91.186.218.236", "91.186.218.24", "91.186.218.241", "91.186.218.33", "91.186.218.34", "91.186.218.43", "91.186.218.5", "91.186.218.52", "91.186.218.54", "91.186.218.56", "91.186.218.61", "91.186.218.65", "91.186.218.72", "91.186.218.81", "91.186.218.91"]


ip: 78.40.116.122
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["78.40.116.10", "78.40.116.102", "78.40.116.114", "78.40.116.121", "78.40.116.136", "78.40.116.151", "78.40.116.180", "78.40.116.183", "78.40.116.2", "78.40.116.217", "78.40.116.228", "78.40.116.230", "78.40.116.231", "78.40.116.238", "78.40.116.241", "78.40.116.25", "78.40.116.36", "78.40.116.47", "78.40.116.48", "78.40.116.50", "78.40.116.51", "78.40.116.69", "78.40.116.73", "78.40.116.79", "78.40.116.92"]


ip: 84.54.51.192
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["84.54.51.117", "84.54.51.136", "84.54.51.140", "84.54.51.186", "84.54.51.205", "84.54.51.207", "84.54.51.30", "84.54.51.5", "84.54.51.77", "84.54.51.95"]


ip: 91.103.140.198
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.103.140.104", "91.103.140.106", "91.103.140.107", "91.103.140.108", "91.103.140.110", "91.103.140.113", "91.103.140.119", "91.103.140.12", "91.103.140.120", "91.103.140.122", "91.103.140.127", "91.103.140.129", "91.103.140.130", "91.103.140.131", "91.103.140.133", "91.103.140.135", "91.103.140.136", "91.103.140.137", "91.103.140.140", "91.103.140.141", "91.103.140.143", "91.103.140.148", "91.103.140.151", "91.103.140.152", "91.103.140.153", "91.103.140.154", "91.103.140.163", "91.103.140.165", "91.103.140.166", "91.103.140.168", "91.103.140.169", "91.103.140.172", "91.103.140.175", "91.103.140.177", "91.103.140.178", "91.103.140.180", "91.103.140.182", "91.103.140.183", "91.103.140.190", "91.103.140.191", "91.103.140.194", "91.103.140.195", "91.103.140.203", "91.103.140.204", "91.103.140.206", "91.103.140.207", "91.103.140.210", "91.103.140.212", "91.103.140.216", "91.103.140.219", "91.103.140.221", "91.103.140.223", "91.103.140.225", "91.103.140.228", "91.103.140.229", "91.103.140.23", "91.103.140.231", "91.103.140.233", "91.103.140.237", "91.103.140.24", "91.103.140.240", "91.103.140.249", "91.103.140.250", "91.103.140.252", "91.103.140.254", "91.103.140.27", "91.103.140.3", "91.103.140.31", "91.103.140.32", "91.103.140.34", "91.103.140.36", "91.103.140.39", "91.103.140.40", "91.103.140.42", "91.103.140.44", "91.103.140.48", "91.103.140.49", "91.103.140.5", "91.103.140.50", "91.103.140.52", "91.103.140.57", "91.103.140.6", "91.103.140.61", "91.103.140.63", "91.103.140.65", "91.103.140.67", "91.103.140.7", "91.103.140.70", "91.103.140.71", "91.103.140.75", "91.103.140.77", "91.103.140.78", "91.103.140.8", "91.103.140.80", "91.103.140.87", "91.103.140.89", "91.103.140.9", "91.103.140.90", "91.103.140.91", "91.103.140.94", "91.103.140.95", "91.103.140.98"]


ip: 91.103.252.229
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.103.252.101", "91.103.252.108", "91.103.252.111", "91.103.252.114", "91.103.252.115", "91.103.252.116", "91.103.252.117", "91.103.252.120", "91.103.252.123", "91.103.252.126", "91.103.252.129", "91.103.252.131", "91.103.252.133", "91.103.252.134", "91.103.252.135", "91.103.252.14", "91.103.252.143", "91.103.252.147", "91.103.252.148", "91.103.252.153", "91.103.252.157", "91.103.252.160", "91.103.252.166", "91.103.252.173", "91.103.252.177", "91.103.252.178", "91.103.252.179", "91.103.252.18", "91.103.252.182", "91.103.252.184", "91.103.252.185", "91.103.252.189", "91.103.252.19", "91.103.252.193", "91.103.252.198", "91.103.252.20", "91.103.252.200", "91.103.252.201", "91.103.252.203", "91.103.252.204", "91.103.252.209", "91.103.252.21", "91.103.252.214", "91.103.252.216", "91.103.252.219", "91.103.252.220", "91.103.252.222", "91.103.252.227", "91.103.252.231", "91.103.252.232", "91.103.252.237", "91.103.252.238", "91.103.252.24", "91.103.252.243", "91.103.252.247", "91.103.252.248", "91.103.252.25", "91.103.252.250", "91.103.252.252", "91.103.252.253", "91.103.252.26", "91.103.252.28", "91.103.252.31", "91.103.252.32", "91.103.252.33", "91.103.252.34", "91.103.252.36", "91.103.252.38", "91.103.252.4", "91.103.252.47", "91.103.252.48", "91.103.252.49", "91.103.252.52", "91.103.252.59", "91.103.252.61", "91.103.252.62", "91.103.252.64", "91.103.252.65", "91.103.252.69", "91.103.252.71", "91.103.252.77", "91.103.252.81", "91.103.252.86", "91.103.252.88", "91.103.252.90", "91.103.252.97", "91.103.252.99"]


ip: 91.108.241.113
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.108.241.0", "91.108.241.100", "91.108.241.107", "91.108.241.108", "91.108.241.119", "91.108.241.12", "91.108.241.121", "91.108.241.124", "91.108.241.125", "91.108.241.128", "91.108.241.13", "91.108.241.132", "91.108.241.136", "91.108.241.137", "91.108.241.140", "91.108.241.146", "91.108.241.147", "91.108.241.148", "91.108.241.149", "91.108.241.15", "91.108.241.151", "91.108.241.153", "91.108.241.154", "91.108.241.156", "91.108.241.159", "91.108.241.161", "91.108.241.170", "91.108.241.172", "91.108.241.173", "91.108.241.176", "91.108.241.188", "91.108.241.189", "91.108.241.194", "91.108.241.197", "91.108.241.20", "91.108.241.204", "91.108.241.207", "91.108.241.208", "91.108.241.21", "91.108.241.210", "91.108.241.212", "91.108.241.216", "91.108.241.217", "91.108.241.221", "91.108.241.222", "91.108.241.23", "91.108.241.24", "91.108.241.241", "91.108.241.253", "91.108.241.254", "91.108.241.3", "91.108.241.31", "91.108.241.34", "91.108.241.36", "91.108.241.39", "91.108.241.42", "91.108.241.44", "91.108.241.45", "91.108.241.46", "91.108.241.47", "91.108.241.49", "91.108.241.5", "91.108.241.52", "91.108.241.53", "91.108.241.54", "91.108.241.56", "91.108.241.57", "91.108.241.58", "91.108.241.59", "91.108.241.62", "91.108.241.65", "91.108.241.68", "91.108.241.73", "91.108.241.74", "91.108.241.77", "91.108.241.83", "91.108.241.88", "91.108.241.89", "91.108.241.90", "91.108.241.95", "91.108.241.96", "91.108.241.99"]


ip: 91.108.241.83
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.108.241.0", "91.108.241.100", "91.108.241.107", "91.108.241.108", "91.108.241.113", "91.108.241.119", "91.108.241.12", "91.108.241.121", "91.108.241.124", "91.108.241.125", "91.108.241.128", "91.108.241.13", "91.108.241.132", "91.108.241.136", "91.108.241.137", "91.108.241.140", "91.108.241.146", "91.108.241.147", "91.108.241.148", "91.108.241.149", "91.108.241.15", "91.108.241.151", "91.108.241.153", "91.108.241.154", "91.108.241.156", "91.108.241.159", "91.108.241.161", "91.108.241.170", "91.108.241.172", "91.108.241.173", "91.108.241.176", "91.108.241.188", "91.108.241.189", "91.108.241.194", "91.108.241.197", "91.108.241.20", "91.108.241.204", "91.108.241.207", "91.108.241.208", "91.108.241.21", "91.108.241.210", "91.108.241.212", "91.108.241.216", "91.108.241.217", "91.108.241.221", "91.108.241.222", "91.108.241.23", "91.108.241.24", "91.108.241.241", "91.108.241.253", "91.108.241.254", "91.108.241.3", "91.108.241.31", "91.108.241.34", "91.108.241.36", "91.108.241.39", "91.108.241.42", "91.108.241.44", "91.108.241.45", "91.108.241.46", "91.108.241.47", "91.108.241.49", "91.108.241.5", "91.108.241.52", "91.108.241.53", "91.108.241.54", "91.108.241.56", "91.108.241.57", "91.108.241.58", "91.108.241.59", "91.108.241.62", "91.108.241.65", "91.108.241.68", "91.108.241.73", "91.108.241.74", "91.108.241.77", "91.108.241.88", "91.108.241.89", "91.108.241.90", "91.108.241.95", "91.108.241.96", "91.108.241.99"]


ip: 91.108.242.217
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.108.242.102", "91.108.242.106", "91.108.242.11", "91.108.242.114", "91.108.242.116", "91.108.242.118", "91.108.242.12", "91.108.242.131", "91.108.242.134", "91.108.242.142", "91.108.242.146", "91.108.242.150", "91.108.242.151", "91.108.242.157", "91.108.242.16", "91.108.242.161", "91.108.242.163", "91.108.242.168", "91.108.242.169", "91.108.242.170", "91.108.242.171", "91.108.242.18", "91.108.242.185", "91.108.242.191", "91.108.242.197", "91.108.242.198", "91.108.242.2", "91.108.242.206", "91.108.242.210", "91.108.242.213", "91.108.242.214", "91.108.242.220", "91.108.242.222", "91.108.242.228", "91.108.242.237", "91.108.242.26", "91.108.242.28", "91.108.242.3", "91.108.242.30", "91.108.242.38", "91.108.242.44", "91.108.242.47", "91.108.242.48", "91.108.242.49", "91.108.242.5", "91.108.242.51", "91.108.242.55", "91.108.242.59", "91.108.242.6", "91.108.242.62", "91.108.242.66", "91.108.242.68", "91.108.242.69", "91.108.242.74", "91.108.242.75", "91.108.242.84", "91.108.242.85", "91.108.242.87", "91.108.242.92", "91.108.242.94", "91.108.242.97"]


ip: 91.184.240.142
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.184.240.1", "91.184.240.10", "91.184.240.106", "91.184.240.107", "91.184.240.110", "91.184.240.112", "91.184.240.113", "91.184.240.117", "91.184.240.120", "91.184.240.121", "91.184.240.13", "91.184.240.133", "91.184.240.141", "91.184.240.144", "91.184.240.145", "91.184.240.149", "91.184.240.150", "91.184.240.154", "91.184.240.155", "91.184.240.157", "91.184.240.158", "91.184.240.159", "91.184.240.160", "91.184.240.166", "91.184.240.169", "91.184.240.17", "91.184.240.172", "91.184.240.173", "91.184.240.176", "91.184.240.182", "91.184.240.187", "91.184.240.188", "91.184.240.192", "91.184.240.193", "91.184.240.2", "91.184.240.200", "91.184.240.206", "91.184.240.212", "91.184.240.213", "91.184.240.215", "91.184.240.216", "91.184.240.217", "91.184.240.218", "91.184.240.22", "91.184.240.220", "91.184.240.223", "91.184.240.228", "91.184.240.229", "91.184.240.23", "91.184.240.232", "91.184.240.240", "91.184.240.247", "91.184.240.252", "91.184.240.3", "91.184.240.37", "91.184.240.4", "91.184.240.46", "91.184.240.48", "91.184.240.49", "91.184.240.51", "91.184.240.52", "91.184.240.55", "91.184.240.58", "91.184.240.6", "91.184.240.61", "91.184.240.65", "91.184.240.67", "91.184.240.71", "91.184.240.72", "91.184.240.73", "91.184.240.74", "91.184.240.78", "91.184.240.83", "91.184.240.85", "91.184.240.87", "91.184.240.88", "91.184.240.89", "91.184.240.9", "91.184.240.90", "91.184.240.93", "91.184.240.97", "91.184.240.98"]


ip: 91.184.240.154
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.184.240.1", "91.184.240.10", "91.184.240.106", "91.184.240.107", "91.184.240.110", "91.184.240.112", "91.184.240.113", "91.184.240.117", "91.184.240.120", "91.184.240.121", "91.184.240.13", "91.184.240.133", "91.184.240.141", "91.184.240.142", "91.184.240.144", "91.184.240.145", "91.184.240.149", "91.184.240.150", "91.184.240.155", "91.184.240.157", "91.184.240.158", "91.184.240.159", "91.184.240.160", "91.184.240.166", "91.184.240.169", "91.184.240.17", "91.184.240.172", "91.184.240.173", "91.184.240.176", "91.184.240.182", "91.184.240.187", "91.184.240.188", "91.184.240.192", "91.184.240.193", "91.184.240.2", "91.184.240.200", "91.184.240.206", "91.184.240.212", "91.184.240.213", "91.184.240.215", "91.184.240.216", "91.184.240.217", "91.184.240.218", "91.184.240.22", "91.184.240.220", "91.184.240.223", "91.184.240.228", "91.184.240.229", "91.184.240.23", "91.184.240.232", "91.184.240.240", "91.184.240.247", "91.184.240.252", "91.184.240.3", "91.184.240.37", "91.184.240.4", "91.184.240.46", "91.184.240.48", "91.184.240.49", "91.184.240.51", "91.184.240.52", "91.184.240.55", "91.184.240.58", "91.184.240.6", "91.184.240.61", "91.184.240.65", "91.184.240.67", "91.184.240.71", "91.184.240.72", "91.184.240.73", "91.184.240.74", "91.184.240.78", "91.184.240.83", "91.184.240.85", "91.184.240.87", "91.184.240.88", "91.184.240.89", "91.184.240.9", "91.184.240.90", "91.184.240.93", "91.184.240.97", "91.184.240.98"]


ip: 91.184.241.30
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.184.241.1", "91.184.241.100", "91.184.241.103", "91.184.241.105", "91.184.241.108", "91.184.241.109", "91.184.241.113", "91.184.241.116", "91.184.241.118", "91.184.241.121", "91.184.241.122", "91.184.241.126", "91.184.241.13", "91.184.241.131", "91.184.241.142", "91.184.241.147", "91.184.241.151", "91.184.241.152", "91.184.241.153", "91.184.241.157", "91.184.241.163", "91.184.241.164", "91.184.241.165", "91.184.241.168", "91.184.241.169", "91.184.241.170", "91.184.241.176", "91.184.241.179", "91.184.241.185", "91.184.241.186", "91.184.241.188", "91.184.241.190", "91.184.241.195", "91.184.241.209", "91.184.241.211", "91.184.241.212", "91.184.241.22", "91.184.241.223", "91.184.241.224", "91.184.241.225", "91.184.241.226", "91.184.241.229", "91.184.241.23", "91.184.241.230", "91.184.241.233", "91.184.241.234", "91.184.241.236", "91.184.241.24", "91.184.241.243", "91.184.241.247", "91.184.241.251", "91.184.241.253", "91.184.241.255", "91.184.241.33", "91.184.241.35", "91.184.241.37", "91.184.241.39", "91.184.241.41", "91.184.241.48", "91.184.241.5", "91.184.241.52", "91.184.241.53", "91.184.241.58", "91.184.241.59", "91.184.241.61", "91.184.241.65", "91.184.241.66", "91.184.241.72", "91.184.241.74", "91.184.241.76", "91.184.241.78", "91.184.241.84", "91.184.241.85", "91.184.241.86", "91.184.241.87", "91.184.241.88", "91.184.241.89", "91.184.241.92", "91.184.241.93", "91.184.241.95", "91.184.241.99"]


ip: 91.184.243.158
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.184.243.1", "91.184.243.100", "91.184.243.102", "91.184.243.103", "91.184.243.107", "91.184.243.109", "91.184.243.11", "91.184.243.110", "91.184.243.112", "91.184.243.114", "91.184.243.115", "91.184.243.117", "91.184.243.121", "91.184.243.128", "91.184.243.129", "91.184.243.130", "91.184.243.131", "91.184.243.134", "91.184.243.139", "91.184.243.14", "91.184.243.140", "91.184.243.141", "91.184.243.142", "91.184.243.146", "91.184.243.147", "91.184.243.151", "91.184.243.155", "91.184.243.156", "91.184.243.157", "91.184.243.159", "91.184.243.16", "91.184.243.161", "91.184.243.162", "91.184.243.164", "91.184.243.167", "91.184.243.168", "91.184.243.172", "91.184.243.173", "91.184.243.174", "91.184.243.176", "91.184.243.177", "91.184.243.179", "91.184.243.18", "91.184.243.182", "91.184.243.184", "91.184.243.188", "91.184.243.189", "91.184.243.19", "91.184.243.190", "91.184.243.192", "91.184.243.194", "91.184.243.198", "91.184.243.2", "91.184.243.205", "91.184.243.207", "91.184.243.215", "91.184.243.216", "91.184.243.217", "91.184.243.219", "91.184.243.220", "91.184.243.231", "91.184.243.232", "91.184.243.233", "91.184.243.24", "91.184.243.242", "91.184.243.244", "91.184.243.245", "91.184.243.246", "91.184.243.25", "91.184.243.28", "91.184.243.3", "91.184.243.30", "91.184.243.32", "91.184.243.33", "91.184.243.34", "91.184.243.36", "91.184.243.38", "91.184.243.40", "91.184.243.45", "91.184.243.51", "91.184.243.52", "91.184.243.53", "91.184.243.56", "91.184.243.57", "91.184.243.58", "91.184.243.6", "91.184.243.61", "91.184.243.62", "91.184.243.63", "91.184.243.64", "91.184.243.65", "91.184.243.66", "91.184.243.68", "91.184.243.7", "91.184.243.71", "91.184.243.72", "91.184.243.74", "91.184.243.76", "91.184.243.81", "91.184.243.88", "91.184.243.92", "91.184.243.94", "91.184.243.98", "91.184.243.99"]


ip: 91.184.243.33
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.184.243.1", "91.184.243.100", "91.184.243.102", "91.184.243.103", "91.184.243.107", "91.184.243.109", "91.184.243.11", "91.184.243.110", "91.184.243.112", "91.184.243.114", "91.184.243.115", "91.184.243.117", "91.184.243.121", "91.184.243.128", "91.184.243.129", "91.184.243.130", "91.184.243.131", "91.184.243.134", "91.184.243.139", "91.184.243.14", "91.184.243.140", "91.184.243.141", "91.184.243.142", "91.184.243.146", "91.184.243.147", "91.184.243.151", "91.184.243.155", "91.184.243.156", "91.184.243.157", "91.184.243.158", "91.184.243.159", "91.184.243.16", "91.184.243.161", "91.184.243.162", "91.184.243.164", "91.184.243.167", "91.184.243.168", "91.184.243.172", "91.184.243.173", "91.184.243.174", "91.184.243.176", "91.184.243.177", "91.184.243.179", "91.184.243.18", "91.184.243.182", "91.184.243.184", "91.184.243.188", "91.184.243.189", "91.184.243.19", "91.184.243.190", "91.184.243.192", "91.184.243.194", "91.184.243.198", "91.184.243.2", "91.184.243.205", "91.184.243.207", "91.184.243.215", "91.184.243.216", "91.184.243.217", "91.184.243.219", "91.184.243.220", "91.184.243.231", "91.184.243.232", "91.184.243.233", "91.184.243.24", "91.184.243.242", "91.184.243.244", "91.184.243.245", "91.184.243.246", "91.184.243.25", "91.184.243.28", "91.184.243.3", "91.184.243.30", "91.184.243.32", "91.184.243.34", "91.184.243.36", "91.184.243.38", "91.184.243.40", "91.184.243.45", "91.184.243.51", "91.184.243.52", "91.184.243.53", "91.184.243.56", "91.184.243.57", "91.184.243.58", "91.184.243.6", "91.184.243.61", "91.184.243.62", "91.184.243.63", "91.184.243.64", "91.184.243.65", "91.184.243.66", "91.184.243.68", "91.184.243.7", "91.184.243.71", "91.184.243.72", "91.184.243.74", "91.184.243.76", "91.184.243.81", "91.184.243.88", "91.184.243.92", "91.184.243.94", "91.184.243.98", "91.184.243.99"]


ip: 91.92.35.233
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.92.35.1", "91.92.35.105", "91.92.35.106", "91.92.35.112", "91.92.35.113", "91.92.35.114", "91.92.35.123", "91.92.35.131", "91.92.35.140", "91.92.35.141", "91.92.35.144", "91.92.35.147", "91.92.35.149", "91.92.35.150", "91.92.35.157", "91.92.35.16", "91.92.35.17", "91.92.35.175", "91.92.35.180", "91.92.35.184", "91.92.35.188", "91.92.35.189", "91.92.35.196", "91.92.35.200", "91.92.35.201", "91.92.35.205", "91.92.35.206", "91.92.35.209", "91.92.35.21", "91.92.35.210", "91.92.35.224", "91.92.35.229", "91.92.35.236", "91.92.35.237", "91.92.35.239", "91.92.35.241", "91.92.35.245", "91.92.35.249", "91.92.35.252", "91.92.35.255", "91.92.35.28", "91.92.35.29", "91.92.35.33", "91.92.35.35", "91.92.35.36", "91.92.35.38", "91.92.35.41", "91.92.35.44", "91.92.35.51", "91.92.35.64", "91.92.35.70", "91.92.35.73", "91.92.35.74", "91.92.35.81", "91.92.35.85", "91.92.35.90", "91.92.35.92"]


ip: 91.92.42.201
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.92.42.111", "91.92.42.116", "91.92.42.120", "91.92.42.13", "91.92.42.131", "91.92.42.133", "91.92.42.136", "91.92.42.137", "91.92.42.139", "91.92.42.142", "91.92.42.143", "91.92.42.144", "91.92.42.146", "91.92.42.148", "91.92.42.165", "91.92.42.167", "91.92.42.168", "91.92.42.172", "91.92.42.173", "91.92.42.174", "91.92.42.183", "91.92.42.189", "91.92.42.199", "91.92.42.200", "91.92.42.202", "91.92.42.205", "91.92.42.207", "91.92.42.209", "91.92.42.21", "91.92.42.213", "91.92.42.218", "91.92.42.232", "91.92.42.234", "91.92.42.238", "91.92.42.250", "91.92.42.27", "91.92.42.30", "91.92.42.32", "91.92.42.45", "91.92.42.48", "91.92.42.49", "91.92.42.5", "91.92.42.55", "91.92.42.69", "91.92.42.7", "91.92.42.70", "91.92.42.71", "91.92.42.72", "91.92.42.74", "91.92.42.81", "91.92.42.85", "91.92.42.86", "91.92.42.90", "91.92.42.92", "91.92.42.93", "91.92.42.95", "91.92.42.96", "91.92.42.99"]


ip: 91.92.42.205
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.92.42.111", "91.92.42.116", "91.92.42.120", "91.92.42.13", "91.92.42.131", "91.92.42.133", "91.92.42.136", "91.92.42.137", "91.92.42.139", "91.92.42.142", "91.92.42.143", "91.92.42.144", "91.92.42.146", "91.92.42.148", "91.92.42.165", "91.92.42.167", "91.92.42.168", "91.92.42.172", "91.92.42.173", "91.92.42.174", "91.92.42.183", "91.92.42.189", "91.92.42.199", "91.92.42.200", "91.92.42.201", "91.92.42.202", "91.92.42.207", "91.92.42.209", "91.92.42.21", "91.92.42.213", "91.92.42.218", "91.92.42.232", "91.92.42.234", "91.92.42.238", "91.92.42.250", "91.92.42.27", "91.92.42.30", "91.92.42.32", "91.92.42.45", "91.92.42.48", "91.92.42.49", "91.92.42.5", "91.92.42.55", "91.92.42.69", "91.92.42.7", "91.92.42.70", "91.92.42.71", "91.92.42.72", "91.92.42.74", "91.92.42.81", "91.92.42.85", "91.92.42.86", "91.92.42.90", "91.92.42.92", "91.92.42.93", "91.92.42.95", "91.92.42.96", "91.92.42.99"]


ip: 91.92.42.81
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.92.42.111", "91.92.42.116", "91.92.42.120", "91.92.42.13", "91.92.42.131", "91.92.42.133", "91.92.42.136", "91.92.42.137", "91.92.42.139", "91.92.42.142", "91.92.42.143", "91.92.42.144", "91.92.42.146", "91.92.42.148", "91.92.42.165", "91.92.42.167", "91.92.42.168", "91.92.42.172", "91.92.42.173", "91.92.42.174", "91.92.42.183", "91.92.42.189", "91.92.42.199", "91.92.42.200", "91.92.42.201", "91.92.42.202", "91.92.42.205", "91.92.42.207", "91.92.42.209", "91.92.42.21", "91.92.42.213", "91.92.42.218", "91.92.42.232", "91.92.42.234", "91.92.42.238", "91.92.42.250", "91.92.42.27", "91.92.42.30", "91.92.42.32", "91.92.42.45", "91.92.42.48", "91.92.42.49", "91.92.42.5", "91.92.42.55", "91.92.42.69", "91.92.42.7", "91.92.42.70", "91.92.42.71", "91.92.42.72", "91.92.42.74", "91.92.42.85", "91.92.42.86", "91.92.42.90", "91.92.42.92", "91.92.42.93", "91.92.42.95", "91.92.42.96", "91.92.42.99"]


ip: 91.92.43.215
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.92.43.0", "91.92.43.1", "91.92.43.106", "91.92.43.11", "91.92.43.110", "91.92.43.112", "91.92.43.117", "91.92.43.118", "91.92.43.119", "91.92.43.120", "91.92.43.121", "91.92.43.126", "91.92.43.127", "91.92.43.129", "91.92.43.13", "91.92.43.130", "91.92.43.133", "91.92.43.134", "91.92.43.135", "91.92.43.137", "91.92.43.138", "91.92.43.141", "91.92.43.142", "91.92.43.145", "91.92.43.153", "91.92.43.154", "91.92.43.156", "91.92.43.159", "91.92.43.160", "91.92.43.163", "91.92.43.164", "91.92.43.165", "91.92.43.167", "91.92.43.168", "91.92.43.170", "91.92.43.172", "91.92.43.175", "91.92.43.177", "91.92.43.182", "91.92.43.183", "91.92.43.187", "91.92.43.188", "91.92.43.189", "91.92.43.19", "91.92.43.190", "91.92.43.192", "91.92.43.195", "91.92.43.197", "91.92.43.20", "91.92.43.200", "91.92.43.204", "91.92.43.208", "91.92.43.211", "91.92.43.218", "91.92.43.219", "91.92.43.223", "91.92.43.231", "91.92.43.234", "91.92.43.236", "91.92.43.237", "91.92.43.238", "91.92.43.24", "91.92.43.241", "91.92.43.242", "91.92.43.246", "91.92.43.249", "91.92.43.251", "91.92.43.252", "91.92.43.254", "91.92.43.26", "91.92.43.29", "91.92.43.3", "91.92.43.32", "91.92.43.34", "91.92.43.39", "91.92.43.4", "91.92.43.42", "91.92.43.44", "91.92.43.45", "91.92.43.46", "91.92.43.48", "91.92.43.50", "91.92.43.52", "91.92.43.6", "91.92.43.61", "91.92.43.62", "91.92.43.67", "91.92.43.69", "91.92.43.7", "91.92.43.70", "91.92.43.71", "91.92.43.72", "91.92.43.74", "91.92.43.75", "91.92.43.77", "91.92.43.78", "91.92.43.85", "91.92.43.89", "91.92.43.9", "91.92.43.90", "91.92.43.93", "91.92.43.94", "91.92.43.98"]


ip: 91.92.43.52
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.92.43.0", "91.92.43.1", "91.92.43.106", "91.92.43.11", "91.92.43.110", "91.92.43.112", "91.92.43.117", "91.92.43.118", "91.92.43.119", "91.92.43.120", "91.92.43.121", "91.92.43.126", "91.92.43.127", "91.92.43.129", "91.92.43.13", "91.92.43.130", "91.92.43.133", "91.92.43.134", "91.92.43.135", "91.92.43.137", "91.92.43.138", "91.92.43.141", "91.92.43.142", "91.92.43.145", "91.92.43.153", "91.92.43.154", "91.92.43.156", "91.92.43.159", "91.92.43.160", "91.92.43.163", "91.92.43.164", "91.92.43.165", "91.92.43.167", "91.92.43.168", "91.92.43.170", "91.92.43.172", "91.92.43.175", "91.92.43.177", "91.92.43.182", "91.92.43.183", "91.92.43.187", "91.92.43.188", "91.92.43.189", "91.92.43.19", "91.92.43.190", "91.92.43.192", "91.92.43.195", "91.92.43.197", "91.92.43.20", "91.92.43.200", "91.92.43.204", "91.92.43.208", "91.92.43.211", "91.92.43.215", "91.92.43.218", "91.92.43.219", "91.92.43.223", "91.92.43.231", "91.92.43.234", "91.92.43.236", "91.92.43.237", "91.92.43.238", "91.92.43.24", "91.92.43.241", "91.92.43.242", "91.92.43.246", "91.92.43.249", "91.92.43.251", "91.92.43.252", "91.92.43.254", "91.92.43.26", "91.92.43.29", "91.92.43.3", "91.92.43.32", "91.92.43.34", "91.92.43.39", "91.92.43.4", "91.92.43.42", "91.92.43.44", "91.92.43.45", "91.92.43.46", "91.92.43.48", "91.92.43.50", "91.92.43.6", "91.92.43.61", "91.92.43.62", "91.92.43.67", "91.92.43.69", "91.92.43.7", "91.92.43.70", "91.92.43.71", "91.92.43.72", "91.92.43.74", "91.92.43.75", "91.92.43.77", "91.92.43.78", "91.92.43.85", "91.92.43.89", "91.92.43.9", "91.92.43.90", "91.92.43.93", "91.92.43.94", "91.92.43.98"]


ip: 84.54.51.117
role: staging
detection_reasons: ["proxy_service:squid"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["84.54.51.136", "84.54.51.140", "84.54.51.186", "84.54.51.192", "84.54.51.205", "84.54.51.207", "84.54.51.30", "84.54.51.5", "84.54.51.77", "84.54.51.95"]


ip: 176.65.134.2
role: staging
detection_reasons: ["proxy_service:squid", "ssh_tunnel_capable"]
proxy_services: squid
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["176.65.134.11", "176.65.134.13", "176.65.134.14", "176.65.134.16", "176.65.134.19", "176.65.134.253", "176.65.134.254", "176.65.134.3", "176.65.134.34", "176.65.134.4"]


ip: 194.85.251.238
role: staging
detection_reasons: ["proxy_service:socks", "ssh_tunnel_capable"]
proxy_services: socks
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["194.85.251.100", "194.85.251.101", "194.85.251.102", "194.85.251.104", "194.85.251.107", "194.85.251.113", "194.85.251.116", "194.85.251.117", "194.85.251.124", "194.85.251.128", "194.85.251.134", "194.85.251.135", "194.85.251.136", "194.85.251.138", "194.85.251.14", "194.85.251.140", "194.85.251.142", "194.85.251.143", "194.85.251.144", "194.85.251.146", "194.85.251.147", "194.85.251.148", "194.85.251.150", "194.85.251.151", "194.85.251.154", "194.85.251.155", "194.85.251.156", "194.85.251.158", "194.85.251.159", "194.85.251.160", "194.85.251.161", "194.85.251.163", "194.85.251.166", "194.85.251.167", "194.85.251.168", "194.85.251.169", "194.85.251.170", "194.85.251.172", "194.85.251.175", "194.85.251.176", "194.85.251.177", "194.85.251.178", "194.85.251.180", "194.85.251.181", "194.85.251.182", "194.85.251.184", "194.85.251.185", "194.85.251.19", "194.85.251.190", "194.85.251.191", "194.85.251.192", "194.85.251.194", "194.85.251.195", "194.85.251.197", "194.85.251.20", "194.85.251.200", "194.85.251.202", "194.85.251.203", "194.85.251.205", "194.85.251.206", "194.85.251.208", "194.85.251.21", "194.85.251.214", "194.85.251.216", "194.85.251.218", "194.85.251.22", "194.85.251.222", "194.85.251.224", "194.85.251.226", "194.85.251.228", "194.85.251.229", "194.85.251.230", "194.85.251.231", "194.85.251.234", "194.85.251.239", "194.85.251.240", "194.85.251.241", "194.85.251.25", "194.85.251.250", "194.85.251.251", "194.85.251.253", "194.85.251.26", "194.85.251.27", "194.85.251.30", "194.85.251.31", "194.85.251.32", "194.85.251.36", "194.85.251.37", "194.85.251.42", "194.85.251.44", "194.85.251.45", "194.85.251.47", "194.85.251.48", "194.85.251.49", "194.85.251.51", "194.85.251.52", "194.85.251.54", "194.85.251.55", "194.85.251.56", "194.85.251.58", "194.85.251.59", "194.85.251.61", "194.85.251.62", "194.85.251.63", "194.85.251.65", "194.85.251.67", "194.85.251.70", "194.85.251.74", "194.85.251.77", "194.85.251.78", "194.85.251.85", "194.85.251.88", "194.85.251.89", "194.85.251.93", "194.85.251.94", "194.85.251.96", "194.85.251.99"]


ip: 91.108.240.132
role: staging
detection_reasons: ["proxy_service:squid"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.108.240.10", "91.108.240.108", "91.108.240.114", "91.108.240.115", "91.108.240.116", "91.108.240.120", "91.108.240.128", "91.108.240.13", "91.108.240.136", "91.108.240.138", "91.108.240.14", "91.108.240.140", "91.108.240.145", "91.108.240.146", "91.108.240.149", "91.108.240.154", "91.108.240.165", "91.108.240.169", "91.108.240.17", "91.108.240.170", "91.108.240.177", "91.108.240.18", "91.108.240.180", "91.108.240.182", "91.108.240.183", "91.108.240.184", "91.108.240.187", "91.108.240.190", "91.108.240.195", "91.108.240.2", "91.108.240.202", "91.108.240.210", "91.108.240.215", "91.108.240.22", "91.108.240.220", "91.108.240.226", "91.108.240.230", "91.108.240.232", "91.108.240.235", "91.108.240.236", "91.108.240.242", "91.108.240.26", "91.108.240.27", "91.108.240.35", "91.108.240.38", "91.108.240.4", "91.108.240.50", "91.108.240.51", "91.108.240.55", "91.108.240.56", "91.108.240.59", "91.108.240.6", "91.108.240.60", "91.108.240.67", "91.108.240.71", "91.108.240.8", "91.108.240.88", "91.108.240.93", "91.108.240.97"]


ip: 5.181.0.23
role: staging
detection_reasons: ["proxy_service:squid"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["5.181.0.106", "5.181.0.12", "5.181.0.155", "5.181.0.161", "5.181.0.165", "5.181.0.2", "5.181.0.239", "5.181.0.25", "5.181.0.29", "5.181.0.5", "5.181.0.50", "5.181.0.52", "5.181.0.79", "5.181.0.81", "5.181.0.96"]


ip: 91.108.241.5
role: staging
detection_reasons: ["proxy_service:socks"]
proxy_services: socks
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.108.241.0", "91.108.241.100", "91.108.241.107", "91.108.241.108", "91.108.241.113", "91.108.241.119", "91.108.241.12", "91.108.241.121", "91.108.241.124", "91.108.241.125", "91.108.241.128", "91.108.241.13", "91.108.241.132", "91.108.241.136", "91.108.241.137", "91.108.241.140", "91.108.241.146", "91.108.241.147", "91.108.241.148", "91.108.241.149", "91.108.241.15", "91.108.241.151", "91.108.241.153", "91.108.241.154", "91.108.241.156", "91.108.241.159", "91.108.241.161", "91.108.241.170", "91.108.241.172", "91.108.241.173", "91.108.241.176", "91.108.241.188", "91.108.241.189", "91.108.241.194", "91.108.241.197", "91.108.241.20", "91.108.241.204", "91.108.241.207", "91.108.241.208", "91.108.241.21", "91.108.241.210", "91.108.241.212", "91.108.241.216", "91.108.241.217", "91.108.241.221", "91.108.241.222", "91.108.241.23", "91.108.241.24", "91.108.241.241", "91.108.241.253", "91.108.241.254", "91.108.241.3", "91.108.241.31", "91.108.241.34", "91.108.241.36", "91.108.241.39", "91.108.241.42", "91.108.241.44", "91.108.241.45", "91.108.241.46", "91.108.241.47", "91.108.241.49", "91.108.241.52", "91.108.241.53", "91.108.241.54", "91.108.241.56", "91.108.241.57", "91.108.241.58", "91.108.241.59", "91.108.241.62", "91.108.241.65", "91.108.241.68", "91.108.241.73", "91.108.241.74", "91.108.241.77", "91.108.241.83", "91.108.241.88", "91.108.241.89", "91.108.241.90", "91.108.241.95", "91.108.241.96", "91.108.241.99"]


ip: 91.108.242.214
role: staging
detection_reasons: ["proxy_service:squid"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.108.242.102", "91.108.242.106", "91.108.242.11", "91.108.242.114", "91.108.242.116", "91.108.242.118", "91.108.242.12", "91.108.242.131", "91.108.242.134", "91.108.242.142", "91.108.242.146", "91.108.242.150", "91.108.242.151", "91.108.242.157", "91.108.242.16", "91.108.242.161", "91.108.242.163", "91.108.242.168", "91.108.242.169", "91.108.242.170", "91.108.242.171", "91.108.242.18", "91.108.242.185", "91.108.242.191", "91.108.242.197", "91.108.242.198", "91.108.242.2", "91.108.242.206", "91.108.242.210", "91.108.242.213", "91.108.242.217", "91.108.242.220", "91.108.242.222", "91.108.242.228", "91.108.242.237", "91.108.242.26", "91.108.242.28", "91.108.242.3", "91.108.242.30", "91.108.242.38", "91.108.242.44", "91.108.242.47", "91.108.242.48", "91.108.242.49", "91.108.242.5", "91.108.242.51", "91.108.242.55", "91.108.242.59", "91.108.242.6", "91.108.242.62", "91.108.242.66", "91.108.242.68", "91.108.242.69", "91.108.242.74", "91.108.242.75", "91.108.242.84", "91.108.242.85", "91.108.242.87", "91.108.242.92", "91.108.242.94", "91.108.242.97"]


ip: 91.184.240.188
role: staging
detection_reasons: ["proxy_service:squid"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.184.240.1", "91.184.240.10", "91.184.240.106", "91.184.240.107", "91.184.240.110", "91.184.240.112", "91.184.240.113", "91.184.240.117", "91.184.240.120", "91.184.240.121", "91.184.240.13", "91.184.240.133", "91.184.240.141", "91.184.240.142", "91.184.240.144", "91.184.240.145", "91.184.240.149", "91.184.240.150", "91.184.240.154", "91.184.240.155", "91.184.240.157", "91.184.240.158", "91.184.240.159", "91.184.240.160", "91.184.240.166", "91.184.240.169", "91.184.240.17", "91.184.240.172", "91.184.240.173", "91.184.240.176", "91.184.240.182", "91.184.240.187", "91.184.240.192", "91.184.240.193", "91.184.240.2", "91.184.240.200", "91.184.240.206", "91.184.240.212", "91.184.240.213", "91.184.240.215", "91.184.240.216", "91.184.240.217", "91.184.240.218", "91.184.240.22", "91.184.240.220", "91.184.240.223", "91.184.240.228", "91.184.240.229", "91.184.240.23", "91.184.240.232", "91.184.240.240", "91.184.240.247", "91.184.240.252", "91.184.240.3", "91.184.240.37", "91.184.240.4", "91.184.240.46", "91.184.240.48", "91.184.240.49", "91.184.240.51", "91.184.240.52", "91.184.240.55", "91.184.240.58", "91.184.240.6", "91.184.240.61", "91.184.240.65", "91.184.240.67", "91.184.240.71", "91.184.240.72", "91.184.240.73", "91.184.240.74", "91.184.240.78", "91.184.240.83", "91.184.240.85", "91.184.240.87", "91.184.240.88", "91.184.240.89", "91.184.240.9", "91.184.240.90", "91.184.240.93", "91.184.240.97", "91.184.240.98"]


ip: 91.184.242.197
role: staging
detection_reasons: ["proxy_service:squid"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.184.242.0", "91.184.242.1", "91.184.242.106", "91.184.242.108", "91.184.242.109", "91.184.242.110", "91.184.242.113", "91.184.242.115", "91.184.242.116", "91.184.242.12", "91.184.242.125", "91.184.242.126", "91.184.242.129", "91.184.242.131", "91.184.242.135", "91.184.242.139", "91.184.242.14", "91.184.242.141", "91.184.242.151", "91.184.242.156", "91.184.242.16", "91.184.242.160", "91.184.242.164", "91.184.242.165", "91.184.242.17", "91.184.242.171", "91.184.242.172", "91.184.242.179", "91.184.242.182", "91.184.242.183", "91.184.242.185", "91.184.242.186", "91.184.242.187", "91.184.242.189", "91.184.242.194", "91.184.242.196", "91.184.242.20", "91.184.242.200", "91.184.242.203", "91.184.242.205", "91.184.242.209", "91.184.242.210", "91.184.242.211", "91.184.242.212", "91.184.242.216", "91.184.242.219", "91.184.242.22", "91.184.242.221", "91.184.242.222", "91.184.242.232", "91.184.242.233", "91.184.242.239", "91.184.242.243", "91.184.242.252", "91.184.242.253", "91.184.242.254", "91.184.242.27", "91.184.242.29", "91.184.242.30", "91.184.242.31", "91.184.242.35", "91.184.242.40", "91.184.242.42", "91.184.242.48", "91.184.242.5", "91.184.242.52", "91.184.242.54", "91.184.242.57", "91.184.242.58", "91.184.242.61", "91.184.242.64", "91.184.242.65", "91.184.242.66", "91.184.242.7", "91.184.242.70", "91.184.242.74", "91.184.242.80", "91.184.242.83", "91.184.242.85", "91.184.242.87", "91.184.242.88", "91.184.242.90", "91.184.242.94", "91.184.242.95", "91.184.242.98"]


ip: 91.186.219.51
role: staging
detection_reasons: ["proxy_service:squid"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.186.219.1", "91.186.219.100", "91.186.219.101", "91.186.219.106", "91.186.219.108", "91.186.219.109", "91.186.219.110", "91.186.219.115", "91.186.219.12", "91.186.219.124", "91.186.219.125", "91.186.219.131", "91.186.219.142", "91.186.219.143", "91.186.219.144", "91.186.219.147", "91.186.219.156", "91.186.219.157", "91.186.219.158", "91.186.219.167", "91.186.219.17", "91.186.219.174", "91.186.219.179", "91.186.219.180", "91.186.219.181", "91.186.219.183", "91.186.219.192", "91.186.219.2", "91.186.219.201", "91.186.219.202", "91.186.219.205", "91.186.219.21", "91.186.219.214", "91.186.219.215", "91.186.219.22", "91.186.219.223", "91.186.219.228", "91.186.219.231", "91.186.219.240", "91.186.219.255", "91.186.219.41", "91.186.219.42", "91.186.219.59", "91.186.219.65", "91.186.219.66", "91.186.219.71", "91.186.219.74", "91.186.219.79", "91.186.219.80", "91.186.219.95"]


ip: 91.92.43.112
role: staging
detection_reasons: ["proxy_service:squid"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.92.43.0", "91.92.43.1", "91.92.43.106", "91.92.43.11", "91.92.43.110", "91.92.43.117", "91.92.43.118", "91.92.43.119", "91.92.43.120", "91.92.43.121", "91.92.43.126", "91.92.43.127", "91.92.43.129", "91.92.43.13", "91.92.43.130", "91.92.43.133", "91.92.43.134", "91.92.43.135", "91.92.43.137", "91.92.43.138", "91.92.43.141", "91.92.43.142", "91.92.43.145", "91.92.43.153", "91.92.43.154", "91.92.43.156", "91.92.43.159", "91.92.43.160", "91.92.43.163", "91.92.43.164", "91.92.43.165", "91.92.43.167", "91.92.43.168", "91.92.43.170", "91.92.43.172", "91.92.43.175", "91.92.43.177", "91.92.43.182", "91.92.43.183", "91.92.43.187", "91.92.43.188", "91.92.43.189", "91.92.43.19", "91.92.43.190", "91.92.43.192", "91.92.43.195", "91.92.43.197", "91.92.43.20", "91.92.43.200", "91.92.43.204", "91.92.43.208", "91.92.43.211", "91.92.43.215", "91.92.43.218", "91.92.43.219", "91.92.43.223", "91.92.43.231", "91.92.43.234", "91.92.43.236", "91.92.43.237", "91.92.43.238", "91.92.43.24", "91.92.43.241", "91.92.43.242", "91.92.43.246", "91.92.43.249", "91.92.43.251", "91.92.43.252", "91.92.43.254", "91.92.43.26", "91.92.43.29", "91.92.43.3", "91.92.43.32", "91.92.43.34", "91.92.43.39", "91.92.43.4", "91.92.43.42", "91.92.43.44", "91.92.43.45", "91.92.43.46", "91.92.43.48", "91.92.43.50", "91.92.43.52", "91.92.43.6", "91.92.43.61", "91.92.43.62", "91.92.43.67", "91.92.43.69", "91.92.43.7", "91.92.43.70", "91.92.43.71", "91.92.43.72", "91.92.43.74", "91.92.43.75", "91.92.43.77", "91.92.43.78", "91.92.43.85", "91.92.43.89", "91.92.43.9", "91.92.43.90", "91.92.43.93", "91.92.43.94", "91.92.43.98"]


ip: 91.92.43.7
role: staging
detection_reasons: ["proxy_service:squid"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.92.43.0", "91.92.43.1", "91.92.43.106", "91.92.43.11", "91.92.43.110", "91.92.43.112", "91.92.43.117", "91.92.43.118", "91.92.43.119", "91.92.43.120", "91.92.43.121", "91.92.43.126", "91.92.43.127", "91.92.43.129", "91.92.43.13", "91.92.43.130", "91.92.43.133", "91.92.43.134", "91.92.43.135", "91.92.43.137", "91.92.43.138", "91.92.43.141", "91.92.43.142", "91.92.43.145", "91.92.43.153", "91.92.43.154", "91.92.43.156", "91.92.43.159", "91.92.43.160", "91.92.43.163", "91.92.43.164", "91.92.43.165", "91.92.43.167", "91.92.43.168", "91.92.43.170", "91.92.43.172", "91.92.43.175", "91.92.43.177", "91.92.43.182", "91.92.43.183", "91.92.43.187", "91.92.43.188", "91.92.43.189", "91.92.43.19", "91.92.43.190", "91.92.43.192", "91.92.43.195", "91.92.43.197", "91.92.43.20", "91.92.43.200", "91.92.43.204", "91.92.43.208", "91.92.43.211", "91.92.43.215", "91.92.43.218", "91.92.43.219", "91.92.43.223", "91.92.43.231", "91.92.43.234", "91.92.43.236", "91.92.43.237", "91.92.43.238", "91.92.43.24", "91.92.43.241", "91.92.43.242", "91.92.43.246", "91.92.43.249", "91.92.43.251", "91.92.43.252", "91.92.43.254", "91.92.43.26", "91.92.43.29", "91.92.43.3", "91.92.43.32", "91.92.43.34", "91.92.43.39", "91.92.43.4", "91.92.43.42", "91.92.43.44", "91.92.43.45", "91.92.43.46", "91.92.43.48", "91.92.43.50", "91.92.43.52", "91.92.43.6", "91.92.43.61", "91.92.43.62", "91.92.43.67", "91.92.43.69", "91.92.43.70", "91.92.43.71", "91.92.43.72", "91.92.43.74", "91.92.43.75", "91.92.43.77", "91.92.43.78", "91.92.43.85", "91.92.43.89", "91.92.43.9", "91.92.43.90", "91.92.43.93", "91.92.43.94", "91.92.43.98"]


ip: 176.65.134.16
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire,metasploit,custom_c2", "ssh_tunnel_capable"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire,metasploit,custom_c2
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["176.65.134.11", "176.65.134.13", "176.65.134.14", "176.65.134.19", "176.65.134.2", "176.65.134.253", "176.65.134.254", "176.65.134.3", "176.65.134.34", "176.65.134.4"]


ip: 176.65.134.253
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire", "ssh_tunnel_capable", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["176.65.134.11", "176.65.134.13", "176.65.134.14", "176.65.134.16", "176.65.134.19", "176.65.134.2", "176.65.134.254", "176.65.134.3", "176.65.134.34", "176.65.134.4"]


ip: 194.85.251.178
role: staging
detection_reasons: ["proxy_service:squid", "ssh_tunnel_capable"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["194.85.251.100", "194.85.251.101", "194.85.251.102", "194.85.251.104", "194.85.251.107", "194.85.251.113", "194.85.251.116", "194.85.251.117", "194.85.251.124", "194.85.251.128", "194.85.251.134", "194.85.251.135", "194.85.251.136", "194.85.251.138", "194.85.251.14", "194.85.251.140", "194.85.251.142", "194.85.251.143", "194.85.251.144", "194.85.251.146", "194.85.251.147", "194.85.251.148", "194.85.251.150", "194.85.251.151", "194.85.251.154", "194.85.251.155", "194.85.251.156", "194.85.251.158", "194.85.251.159", "194.85.251.160", "194.85.251.161", "194.85.251.163", "194.85.251.166", "194.85.251.167", "194.85.251.168", "194.85.251.169", "194.85.251.170", "194.85.251.172", "194.85.251.175", "194.85.251.176", "194.85.251.177", "194.85.251.180", "194.85.251.181", "194.85.251.182", "194.85.251.184", "194.85.251.185", "194.85.251.19", "194.85.251.190", "194.85.251.191", "194.85.251.192", "194.85.251.194", "194.85.251.195", "194.85.251.197", "194.85.251.20", "194.85.251.200", "194.85.251.202", "194.85.251.203", "194.85.251.205", "194.85.251.206", "194.85.251.208", "194.85.251.21", "194.85.251.214", "194.85.251.216", "194.85.251.218", "194.85.251.22", "194.85.251.222", "194.85.251.224", "194.85.251.226", "194.85.251.228", "194.85.251.229", "194.85.251.230", "194.85.251.231", "194.85.251.234", "194.85.251.238", "194.85.251.239", "194.85.251.240", "194.85.251.241", "194.85.251.25", "194.85.251.250", "194.85.251.251", "194.85.251.253", "194.85.251.26", "194.85.251.27", "194.85.251.30", "194.85.251.31", "194.85.251.32", "194.85.251.36", "194.85.251.37", "194.85.251.42", "194.85.251.44", "194.85.251.45", "194.85.251.47", "194.85.251.48", "194.85.251.49", "194.85.251.51", "194.85.251.52", "194.85.251.54", "194.85.251.55", "194.85.251.56", "194.85.251.58", "194.85.251.59", "194.85.251.61", "194.85.251.62", "194.85.251.63", "194.85.251.65", "194.85.251.67", "194.85.251.70", "194.85.251.74", "194.85.251.77", "194.85.251.78", "194.85.251.85", "194.85.251.88", "194.85.251.89", "194.85.251.93", "194.85.251.94", "194.85.251.96", "194.85.251.99"]


ip: 194.85.251.194
role: staging
detection_reasons: ["proxy_service:squid", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["194.85.251.100", "194.85.251.101", "194.85.251.102", "194.85.251.104", "194.85.251.107", "194.85.251.113", "194.85.251.116", "194.85.251.117", "194.85.251.124", "194.85.251.128", "194.85.251.134", "194.85.251.135", "194.85.251.136", "194.85.251.138", "194.85.251.14", "194.85.251.140", "194.85.251.142", "194.85.251.143", "194.85.251.144", "194.85.251.146", "194.85.251.147", "194.85.251.148", "194.85.251.150", "194.85.251.151", "194.85.251.154", "194.85.251.155", "194.85.251.156", "194.85.251.158", "194.85.251.159", "194.85.251.160", "194.85.251.161", "194.85.251.163", "194.85.251.166", "194.85.251.167", "194.85.251.168", "194.85.251.169", "194.85.251.170", "194.85.251.172", "194.85.251.175", "194.85.251.176", "194.85.251.177", "194.85.251.178", "194.85.251.180", "194.85.251.181", "194.85.251.182", "194.85.251.184", "194.85.251.185", "194.85.251.19", "194.85.251.190", "194.85.251.191", "194.85.251.192", "194.85.251.195", "194.85.251.197", "194.85.251.20", "194.85.251.200", "194.85.251.202", "194.85.251.203", "194.85.251.205", "194.85.251.206", "194.85.251.208", "194.85.251.21", "194.85.251.214", "194.85.251.216", "194.85.251.218", "194.85.251.22", "194.85.251.222", "194.85.251.224", "194.85.251.226", "194.85.251.228", "194.85.251.229", "194.85.251.230", "194.85.251.231", "194.85.251.234", "194.85.251.238", "194.85.251.239", "194.85.251.240", "194.85.251.241", "194.85.251.25", "194.85.251.250", "194.85.251.251", "194.85.251.253", "194.85.251.26", "194.85.251.27", "194.85.251.30", "194.85.251.31", "194.85.251.32", "194.85.251.36", "194.85.251.37", "194.85.251.42", "194.85.251.44", "194.85.251.45", "194.85.251.47", "194.85.251.48", "194.85.251.49", "194.85.251.51", "194.85.251.52", "194.85.251.54", "194.85.251.55", "194.85.251.56", "194.85.251.58", "194.85.251.59", "194.85.251.61", "194.85.251.62", "194.85.251.63", "194.85.251.65", "194.85.251.67", "194.85.251.70", "194.85.251.74", "194.85.251.77", "194.85.251.78", "194.85.251.85", "194.85.251.88", "194.85.251.89", "194.85.251.93", "194.85.251.94", "194.85.251.96", "194.85.251.99"]


ip: 194.85.251.206
role: staging
detection_reasons: ["proxy_service:squid", "ssh_tunnel_capable", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["194.85.251.100", "194.85.251.101", "194.85.251.102", "194.85.251.104", "194.85.251.107", "194.85.251.113", "194.85.251.116", "194.85.251.117", "194.85.251.124", "194.85.251.128", "194.85.251.134", "194.85.251.135", "194.85.251.136", "194.85.251.138", "194.85.251.14", "194.85.251.140", "194.85.251.142", "194.85.251.143", "194.85.251.144", "194.85.251.146", "194.85.251.147", "194.85.251.148", "194.85.251.150", "194.85.251.151", "194.85.251.154", "194.85.251.155", "194.85.251.156", "194.85.251.158", "194.85.251.159", "194.85.251.160", "194.85.251.161", "194.85.251.163", "194.85.251.166", "194.85.251.167", "194.85.251.168", "194.85.251.169", "194.85.251.170", "194.85.251.172", "194.85.251.175", "194.85.251.176", "194.85.251.177", "194.85.251.178", "194.85.251.180", "194.85.251.181", "194.85.251.182", "194.85.251.184", "194.85.251.185", "194.85.251.19", "194.85.251.190", "194.85.251.191", "194.85.251.192", "194.85.251.194", "194.85.251.195", "194.85.251.197", "194.85.251.20", "194.85.251.200", "194.85.251.202", "194.85.251.203", "194.85.251.205", "194.85.251.208", "194.85.251.21", "194.85.251.214", "194.85.251.216", "194.85.251.218", "194.85.251.22", "194.85.251.222", "194.85.251.224", "194.85.251.226", "194.85.251.228", "194.85.251.229", "194.85.251.230", "194.85.251.231", "194.85.251.234", "194.85.251.238", "194.85.251.239", "194.85.251.240", "194.85.251.241", "194.85.251.25", "194.85.251.250", "194.85.251.251", "194.85.251.253", "194.85.251.26", "194.85.251.27", "194.85.251.30", "194.85.251.31", "194.85.251.32", "194.85.251.36", "194.85.251.37", "194.85.251.42", "194.85.251.44", "194.85.251.45", "194.85.251.47", "194.85.251.48", "194.85.251.49", "194.85.251.51", "194.85.251.52", "194.85.251.54", "194.85.251.55", "194.85.251.56", "194.85.251.58", "194.85.251.59", "194.85.251.61", "194.85.251.62", "194.85.251.63", "194.85.251.65", "194.85.251.67", "194.85.251.70", "194.85.251.74", "194.85.251.77", "194.85.251.78", "194.85.251.85", "194.85.251.88", "194.85.251.89", "194.85.251.93", "194.85.251.94", "194.85.251.96", "194.85.251.99"]


ip: 194.85.251.21
role: staging
detection_reasons: ["proxy_service:squid", "ssh_tunnel_capable", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["194.85.251.100", "194.85.251.101", "194.85.251.102", "194.85.251.104", "194.85.251.107", "194.85.251.113", "194.85.251.116", "194.85.251.117", "194.85.251.124", "194.85.251.128", "194.85.251.134", "194.85.251.135", "194.85.251.136", "194.85.251.138", "194.85.251.14", "194.85.251.140", "194.85.251.142", "194.85.251.143", "194.85.251.144", "194.85.251.146", "194.85.251.147", "194.85.251.148", "194.85.251.150", "194.85.251.151", "194.85.251.154", "194.85.251.155", "194.85.251.156", "194.85.251.158", "194.85.251.159", "194.85.251.160", "194.85.251.161", "194.85.251.163", "194.85.251.166", "194.85.251.167", "194.85.251.168", "194.85.251.169", "194.85.251.170", "194.85.251.172", "194.85.251.175", "194.85.251.176", "194.85.251.177", "194.85.251.178", "194.85.251.180", "194.85.251.181", "194.85.251.182", "194.85.251.184", "194.85.251.185", "194.85.251.19", "194.85.251.190", "194.85.251.191", "194.85.251.192", "194.85.251.194", "194.85.251.195", "194.85.251.197", "194.85.251.20", "194.85.251.200", "194.85.251.202", "194.85.251.203", "194.85.251.205", "194.85.251.206", "194.85.251.208", "194.85.251.214", "194.85.251.216", "194.85.251.218", "194.85.251.22", "194.85.251.222", "194.85.251.224", "194.85.251.226", "194.85.251.228", "194.85.251.229", "194.85.251.230", "194.85.251.231", "194.85.251.234", "194.85.251.238", "194.85.251.239", "194.85.251.240", "194.85.251.241", "194.85.251.25", "194.85.251.250", "194.85.251.251", "194.85.251.253", "194.85.251.26", "194.85.251.27", "194.85.251.30", "194.85.251.31", "194.85.251.32", "194.85.251.36", "194.85.251.37", "194.85.251.42", "194.85.251.44", "194.85.251.45", "194.85.251.47", "194.85.251.48", "194.85.251.49", "194.85.251.51", "194.85.251.52", "194.85.251.54", "194.85.251.55", "194.85.251.56", "194.85.251.58", "194.85.251.59", "194.85.251.61", "194.85.251.62", "194.85.251.63", "194.85.251.65", "194.85.251.67", "194.85.251.70", "194.85.251.74", "194.85.251.77", "194.85.251.78", "194.85.251.85", "194.85.251.88", "194.85.251.89", "194.85.251.93", "194.85.251.94", "194.85.251.96", "194.85.251.99"]


ip: 196.251.69.100
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire,custom_c2", "ssh_tunnel_capable"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire,custom_c2
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["196.251.69.10", "196.251.69.103", "196.251.69.106", "196.251.69.107", "196.251.69.108", "196.251.69.109", "196.251.69.11", "196.251.69.110", "196.251.69.111", "196.251.69.113", "196.251.69.114", "196.251.69.115", "196.251.69.119", "196.251.69.121", "196.251.69.122", "196.251.69.125", "196.251.69.126", "196.251.69.128", "196.251.69.13", "196.251.69.130", "196.251.69.131", "196.251.69.133", "196.251.69.14", "196.251.69.144", "196.251.69.146", "196.251.69.154", "196.251.69.155", "196.251.69.157", "196.251.69.164", "196.251.69.166", "196.251.69.17", "196.251.69.172", "196.251.69.174", "196.251.69.175", "196.251.69.178", "196.251.69.18", "196.251.69.180", "196.251.69.183", "196.251.69.185", "196.251.69.188", "196.251.69.190", "196.251.69.192", "196.251.69.197", "196.251.69.198", "196.251.69.201", "196.251.69.205", "196.251.69.207", "196.251.69.208", "196.251.69.209", "196.251.69.211", "196.251.69.216", "196.251.69.22", "196.251.69.220", "196.251.69.230", "196.251.69.231", "196.251.69.232", "196.251.69.233", "196.251.69.234", "196.251.69.239", "196.251.69.240", "196.251.69.241", "196.251.69.244", "196.251.69.246", "196.251.69.25", "196.251.69.251", "196.251.69.253", "196.251.69.32", "196.251.69.34", "196.251.69.35", "196.251.69.42", "196.251.69.44", "196.251.69.49", "196.251.69.57", "196.251.69.59", "196.251.69.6", "196.251.69.60", "196.251.69.66", "196.251.69.67", "196.251.69.69", "196.251.69.71", "196.251.69.72", "196.251.69.74", "196.251.69.75", "196.251.69.79", "196.251.69.80", "196.251.69.83", "196.251.69.84", "196.251.69.85", "196.251.69.86", "196.251.69.9", "196.251.69.91", "196.251.69.93", "196.251.69.94", "196.251.69.97"]


ip: 196.251.69.110
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire", "ssh_tunnel_capable"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["196.251.69.10", "196.251.69.100", "196.251.69.103", "196.251.69.106", "196.251.69.107", "196.251.69.108", "196.251.69.109", "196.251.69.11", "196.251.69.111", "196.251.69.113", "196.251.69.114", "196.251.69.115", "196.251.69.119", "196.251.69.121", "196.251.69.122", "196.251.69.125", "196.251.69.126", "196.251.69.128", "196.251.69.13", "196.251.69.130", "196.251.69.131", "196.251.69.133", "196.251.69.14", "196.251.69.144", "196.251.69.146", "196.251.69.154", "196.251.69.155", "196.251.69.157", "196.251.69.164", "196.251.69.166", "196.251.69.17", "196.251.69.172", "196.251.69.174", "196.251.69.175", "196.251.69.178", "196.251.69.18", "196.251.69.180", "196.251.69.183", "196.251.69.185", "196.251.69.188", "196.251.69.190", "196.251.69.192", "196.251.69.197", "196.251.69.198", "196.251.69.201", "196.251.69.205", "196.251.69.207", "196.251.69.208", "196.251.69.209", "196.251.69.211", "196.251.69.216", "196.251.69.22", "196.251.69.220", "196.251.69.230", "196.251.69.231", "196.251.69.232", "196.251.69.233", "196.251.69.234", "196.251.69.239", "196.251.69.240", "196.251.69.241", "196.251.69.244", "196.251.69.246", "196.251.69.25", "196.251.69.251", "196.251.69.253", "196.251.69.32", "196.251.69.34", "196.251.69.35", "196.251.69.42", "196.251.69.44", "196.251.69.49", "196.251.69.57", "196.251.69.59", "196.251.69.6", "196.251.69.60", "196.251.69.66", "196.251.69.67", "196.251.69.69", "196.251.69.71", "196.251.69.72", "196.251.69.74", "196.251.69.75", "196.251.69.79", "196.251.69.80", "196.251.69.83", "196.251.69.84", "196.251.69.85", "196.251.69.86", "196.251.69.9", "196.251.69.91", "196.251.69.93", "196.251.69.94", "196.251.69.97"]


ip: 196.251.69.79
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["196.251.69.10", "196.251.69.100", "196.251.69.103", "196.251.69.106", "196.251.69.107", "196.251.69.108", "196.251.69.109", "196.251.69.11", "196.251.69.110", "196.251.69.111", "196.251.69.113", "196.251.69.114", "196.251.69.115", "196.251.69.119", "196.251.69.121", "196.251.69.122", "196.251.69.125", "196.251.69.126", "196.251.69.128", "196.251.69.13", "196.251.69.130", "196.251.69.131", "196.251.69.133", "196.251.69.14", "196.251.69.144", "196.251.69.146", "196.251.69.154", "196.251.69.155", "196.251.69.157", "196.251.69.164", "196.251.69.166", "196.251.69.17", "196.251.69.172", "196.251.69.174", "196.251.69.175", "196.251.69.178", "196.251.69.18", "196.251.69.180", "196.251.69.183", "196.251.69.185", "196.251.69.188", "196.251.69.190", "196.251.69.192", "196.251.69.197", "196.251.69.198", "196.251.69.201", "196.251.69.205", "196.251.69.207", "196.251.69.208", "196.251.69.209", "196.251.69.211", "196.251.69.216", "196.251.69.22", "196.251.69.220", "196.251.69.230", "196.251.69.231", "196.251.69.232", "196.251.69.233", "196.251.69.234", "196.251.69.239", "196.251.69.240", "196.251.69.241", "196.251.69.244", "196.251.69.246", "196.251.69.25", "196.251.69.251", "196.251.69.253", "196.251.69.32", "196.251.69.34", "196.251.69.35", "196.251.69.42", "196.251.69.44", "196.251.69.49", "196.251.69.57", "196.251.69.59", "196.251.69.6", "196.251.69.60", "196.251.69.66", "196.251.69.67", "196.251.69.69", "196.251.69.71", "196.251.69.72", "196.251.69.74", "196.251.69.75", "196.251.69.80", "196.251.69.83", "196.251.69.84", "196.251.69.85", "196.251.69.86", "196.251.69.9", "196.251.69.91", "196.251.69.93", "196.251.69.94", "196.251.69.97"]


ip: 196.251.69.93
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire", "ssh_tunnel_capable"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["196.251.69.10", "196.251.69.100", "196.251.69.103", "196.251.69.106", "196.251.69.107", "196.251.69.108", "196.251.69.109", "196.251.69.11", "196.251.69.110", "196.251.69.111", "196.251.69.113", "196.251.69.114", "196.251.69.115", "196.251.69.119", "196.251.69.121", "196.251.69.122", "196.251.69.125", "196.251.69.126", "196.251.69.128", "196.251.69.13", "196.251.69.130", "196.251.69.131", "196.251.69.133", "196.251.69.14", "196.251.69.144", "196.251.69.146", "196.251.69.154", "196.251.69.155", "196.251.69.157", "196.251.69.164", "196.251.69.166", "196.251.69.17", "196.251.69.172", "196.251.69.174", "196.251.69.175", "196.251.69.178", "196.251.69.18", "196.251.69.180", "196.251.69.183", "196.251.69.185", "196.251.69.188", "196.251.69.190", "196.251.69.192", "196.251.69.197", "196.251.69.198", "196.251.69.201", "196.251.69.205", "196.251.69.207", "196.251.69.208", "196.251.69.209", "196.251.69.211", "196.251.69.216", "196.251.69.22", "196.251.69.220", "196.251.69.230", "196.251.69.231", "196.251.69.232", "196.251.69.233", "196.251.69.234", "196.251.69.239", "196.251.69.240", "196.251.69.241", "196.251.69.244", "196.251.69.246", "196.251.69.25", "196.251.69.251", "196.251.69.253", "196.251.69.32", "196.251.69.34", "196.251.69.35", "196.251.69.42", "196.251.69.44", "196.251.69.49", "196.251.69.57", "196.251.69.59", "196.251.69.6", "196.251.69.60", "196.251.69.66", "196.251.69.67", "196.251.69.69", "196.251.69.71", "196.251.69.72", "196.251.69.74", "196.251.69.75", "196.251.69.79", "196.251.69.80", "196.251.69.83", "196.251.69.84", "196.251.69.85", "196.251.69.86", "196.251.69.9", "196.251.69.91", "196.251.69.94", "196.251.69.97"]


ip: 196.251.70.211
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire", "ssh_tunnel_capable", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["196.251.70.101", "196.251.70.102", "196.251.70.106", "196.251.70.107", "196.251.70.112", "196.251.70.117", "196.251.70.12", "196.251.70.121", "196.251.70.124", "196.251.70.126", "196.251.70.133", "196.251.70.137", "196.251.70.139", "196.251.70.140", "196.251.70.145", "196.251.70.150", "196.251.70.153", "196.251.70.161", "196.251.70.163", "196.251.70.166", "196.251.70.168", "196.251.70.170", "196.251.70.176", "196.251.70.177", "196.251.70.181", "196.251.70.184", "196.251.70.185", "196.251.70.188", "196.251.70.191", "196.251.70.195", "196.251.70.203", "196.251.70.212", "196.251.70.213", "196.251.70.217", "196.251.70.22", "196.251.70.221", "196.251.70.230", "196.251.70.232", "196.251.70.234", "196.251.70.238", "196.251.70.242", "196.251.70.248", "196.251.70.25", "196.251.70.252", "196.251.70.254", "196.251.70.28", "196.251.70.29", "196.251.70.30", "196.251.70.35", "196.251.70.39", "196.251.70.46", "196.251.70.49", "196.251.70.5", "196.251.70.53", "196.251.70.54", "196.251.70.72", "196.251.70.73", "196.251.70.75", "196.251.70.76", "196.251.70.77", "196.251.70.8", "196.251.70.80", "196.251.70.83", "196.251.70.85", "196.251.70.86", "196.251.70.89", "196.251.70.92", "196.251.70.95", "196.251.70.97", "196.251.70.98"]


ip: 196.251.70.212
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire", "ssh_tunnel_capable", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["196.251.70.101", "196.251.70.102", "196.251.70.106", "196.251.70.107", "196.251.70.112", "196.251.70.117", "196.251.70.12", "196.251.70.121", "196.251.70.124", "196.251.70.126", "196.251.70.133", "196.251.70.137", "196.251.70.139", "196.251.70.140", "196.251.70.145", "196.251.70.150", "196.251.70.153", "196.251.70.161", "196.251.70.163", "196.251.70.166", "196.251.70.168", "196.251.70.170", "196.251.70.176", "196.251.70.177", "196.251.70.181", "196.251.70.184", "196.251.70.185", "196.251.70.188", "196.251.70.191", "196.251.70.195", "196.251.70.203", "196.251.70.211", "196.251.70.213", "196.251.70.217", "196.251.70.22", "196.251.70.221", "196.251.70.230", "196.251.70.232", "196.251.70.234", "196.251.70.238", "196.251.70.242", "196.251.70.248", "196.251.70.25", "196.251.70.252", "196.251.70.254", "196.251.70.28", "196.251.70.29", "196.251.70.30", "196.251.70.35", "196.251.70.39", "196.251.70.46", "196.251.70.49", "196.251.70.5", "196.251.70.53", "196.251.70.54", "196.251.70.72", "196.251.70.73", "196.251.70.75", "196.251.70.76", "196.251.70.77", "196.251.70.8", "196.251.70.80", "196.251.70.83", "196.251.70.85", "196.251.70.86", "196.251.70.89", "196.251.70.92", "196.251.70.95", "196.251.70.97", "196.251.70.98"]


ip: 196.251.70.213
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire", "ssh_tunnel_capable", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["196.251.70.101", "196.251.70.102", "196.251.70.106", "196.251.70.107", "196.251.70.112", "196.251.70.117", "196.251.70.12", "196.251.70.121", "196.251.70.124", "196.251.70.126", "196.251.70.133", "196.251.70.137", "196.251.70.139", "196.251.70.140", "196.251.70.145", "196.251.70.150", "196.251.70.153", "196.251.70.161", "196.251.70.163", "196.251.70.166", "196.251.70.168", "196.251.70.170", "196.251.70.176", "196.251.70.177", "196.251.70.181", "196.251.70.184", "196.251.70.185", "196.251.70.188", "196.251.70.191", "196.251.70.195", "196.251.70.203", "196.251.70.211", "196.251.70.212", "196.251.70.217", "196.251.70.22", "196.251.70.221", "196.251.70.230", "196.251.70.232", "196.251.70.234", "196.251.70.238", "196.251.70.242", "196.251.70.248", "196.251.70.25", "196.251.70.252", "196.251.70.254", "196.251.70.28", "196.251.70.29", "196.251.70.30", "196.251.70.35", "196.251.70.39", "196.251.70.46", "196.251.70.49", "196.251.70.5", "196.251.70.53", "196.251.70.54", "196.251.70.72", "196.251.70.73", "196.251.70.75", "196.251.70.76", "196.251.70.77", "196.251.70.8", "196.251.70.80", "196.251.70.83", "196.251.70.85", "196.251.70.86", "196.251.70.89", "196.251.70.92", "196.251.70.95", "196.251.70.97", "196.251.70.98"]


ip: 196.251.70.232
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:empire,metasploit", "ssh_tunnel_capable", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire,metasploit
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["196.251.70.101", "196.251.70.102", "196.251.70.106", "196.251.70.107", "196.251.70.112", "196.251.70.117", "196.251.70.12", "196.251.70.121", "196.251.70.124", "196.251.70.126", "196.251.70.133", "196.251.70.137", "196.251.70.139", "196.251.70.140", "196.251.70.145", "196.251.70.150", "196.251.70.153", "196.251.70.161", "196.251.70.163", "196.251.70.166", "196.251.70.168", "196.251.70.170", "196.251.70.176", "196.251.70.177", "196.251.70.181", "196.251.70.184", "196.251.70.185", "196.251.70.188", "196.251.70.191", "196.251.70.195", "196.251.70.203", "196.251.70.211", "196.251.70.212", "196.251.70.213", "196.251.70.217", "196.251.70.22", "196.251.70.221", "196.251.70.230", "196.251.70.234", "196.251.70.238", "196.251.70.242", "196.251.70.248", "196.251.70.25", "196.251.70.252", "196.251.70.254", "196.251.70.28", "196.251.70.29", "196.251.70.30", "196.251.70.35", "196.251.70.39", "196.251.70.46", "196.251.70.49", "196.251.70.5", "196.251.70.53", "196.251.70.54", "196.251.70.72", "196.251.70.73", "196.251.70.75", "196.251.70.76", "196.251.70.77", "196.251.70.8", "196.251.70.80", "196.251.70.83", "196.251.70.85", "196.251.70.86", "196.251.70.89", "196.251.70.92", "196.251.70.95", "196.251.70.97", "196.251.70.98"]


ip: 196.251.70.5
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire", "ssh_tunnel_capable"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["196.251.70.101", "196.251.70.102", "196.251.70.106", "196.251.70.107", "196.251.70.112", "196.251.70.117", "196.251.70.12", "196.251.70.121", "196.251.70.124", "196.251.70.126", "196.251.70.133", "196.251.70.137", "196.251.70.139", "196.251.70.140", "196.251.70.145", "196.251.70.150", "196.251.70.153", "196.251.70.161", "196.251.70.163", "196.251.70.166", "196.251.70.168", "196.251.70.170", "196.251.70.176", "196.251.70.177", "196.251.70.181", "196.251.70.184", "196.251.70.185", "196.251.70.188", "196.251.70.191", "196.251.70.195", "196.251.70.203", "196.251.70.211", "196.251.70.212", "196.251.70.213", "196.251.70.217", "196.251.70.22", "196.251.70.221", "196.251.70.230", "196.251.70.232", "196.251.70.234", "196.251.70.238", "196.251.70.242", "196.251.70.248", "196.251.70.25", "196.251.70.252", "196.251.70.254", "196.251.70.28", "196.251.70.29", "196.251.70.30", "196.251.70.35", "196.251.70.39", "196.251.70.46", "196.251.70.49", "196.251.70.53", "196.251.70.54", "196.251.70.72", "196.251.70.73", "196.251.70.75", "196.251.70.76", "196.251.70.77", "196.251.70.8", "196.251.70.80", "196.251.70.83", "196.251.70.85", "196.251.70.86", "196.251.70.89", "196.251.70.92", "196.251.70.95", "196.251.70.97", "196.251.70.98"]


ip: 196.251.71.242
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire", "ssh_tunnel_capable"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["196.251.71.101", "196.251.71.11", "196.251.71.111", "196.251.71.112", "196.251.71.113", "196.251.71.114", "196.251.71.115", "196.251.71.12", "196.251.71.128", "196.251.71.138", "196.251.71.140", "196.251.71.142", "196.251.71.147", "196.251.71.149", "196.251.71.15", "196.251.71.154", "196.251.71.157", "196.251.71.158", "196.251.71.159", "196.251.71.161", "196.251.71.164", "196.251.71.165", "196.251.71.17", "196.251.71.171", "196.251.71.172", "196.251.71.174", "196.251.71.178", "196.251.71.180", "196.251.71.181", "196.251.71.184", "196.251.71.186", "196.251.71.188", "196.251.71.191", "196.251.71.192", "196.251.71.194", "196.251.71.195", "196.251.71.198", "196.251.71.205", "196.251.71.207", "196.251.71.208", "196.251.71.21", "196.251.71.211", "196.251.71.212", "196.251.71.214", "196.251.71.215", "196.251.71.22", "196.251.71.223", "196.251.71.225", "196.251.71.23", "196.251.71.234", "196.251.71.237", "196.251.71.238", "196.251.71.243", "196.251.71.249", "196.251.71.25", "196.251.71.253", "196.251.71.28", "196.251.71.3", "196.251.71.30", "196.251.71.35", "196.251.71.37", "196.251.71.39", "196.251.71.44", "196.251.71.47", "196.251.71.5", "196.251.71.53", "196.251.71.55", "196.251.71.57", "196.251.71.58", "196.251.71.6", "196.251.71.62", "196.251.71.64", "196.251.71.70", "196.251.71.71", "196.251.71.75", "196.251.71.79", "196.251.71.80", "196.251.71.85", "196.251.71.88", "196.251.71.89", "196.251.71.9", "196.251.71.91", "196.251.71.92", "196.251.71.93", "196.251.71.96", "196.251.71.98"]


ip: 196.251.71.6
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire", "ssh_tunnel_capable", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["196.251.71.101", "196.251.71.11", "196.251.71.111", "196.251.71.112", "196.251.71.113", "196.251.71.114", "196.251.71.115", "196.251.71.12", "196.251.71.128", "196.251.71.138", "196.251.71.140", "196.251.71.142", "196.251.71.147", "196.251.71.149", "196.251.71.15", "196.251.71.154", "196.251.71.157", "196.251.71.158", "196.251.71.159", "196.251.71.161", "196.251.71.164", "196.251.71.165", "196.251.71.17", "196.251.71.171", "196.251.71.172", "196.251.71.174", "196.251.71.178", "196.251.71.180", "196.251.71.181", "196.251.71.184", "196.251.71.186", "196.251.71.188", "196.251.71.191", "196.251.71.192", "196.251.71.194", "196.251.71.195", "196.251.71.198", "196.251.71.205", "196.251.71.207", "196.251.71.208", "196.251.71.21", "196.251.71.211", "196.251.71.212", "196.251.71.214", "196.251.71.215", "196.251.71.22", "196.251.71.223", "196.251.71.225", "196.251.71.23", "196.251.71.234", "196.251.71.237", "196.251.71.238", "196.251.71.242", "196.251.71.243", "196.251.71.249", "196.251.71.25", "196.251.71.253", "196.251.71.28", "196.251.71.3", "196.251.71.30", "196.251.71.35", "196.251.71.37", "196.251.71.39", "196.251.71.44", "196.251.71.47", "196.251.71.5", "196.251.71.53", "196.251.71.55", "196.251.71.57", "196.251.71.58", "196.251.71.62", "196.251.71.64", "196.251.71.70", "196.251.71.71", "196.251.71.75", "196.251.71.79", "196.251.71.80", "196.251.71.85", "196.251.71.88", "196.251.71.89", "196.251.71.9", "196.251.71.91", "196.251.71.92", "196.251.71.93", "196.251.71.96", "196.251.71.98"]


ip: 196.251.71.85
role: staging
detection_reasons: ["proxy_service:squid", "ssh_tunnel_capable"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["196.251.71.101", "196.251.71.11", "196.251.71.111", "196.251.71.112", "196.251.71.113", "196.251.71.114", "196.251.71.115", "196.251.71.12", "196.251.71.128", "196.251.71.138", "196.251.71.140", "196.251.71.142", "196.251.71.147", "196.251.71.149", "196.251.71.15", "196.251.71.154", "196.251.71.157", "196.251.71.158", "196.251.71.159", "196.251.71.161", "196.251.71.164", "196.251.71.165", "196.251.71.17", "196.251.71.171", "196.251.71.172", "196.251.71.174", "196.251.71.178", "196.251.71.180", "196.251.71.181", "196.251.71.184", "196.251.71.186", "196.251.71.188", "196.251.71.191", "196.251.71.192", "196.251.71.194", "196.251.71.195", "196.251.71.198", "196.251.71.205", "196.251.71.207", "196.251.71.208", "196.251.71.21", "196.251.71.211", "196.251.71.212", "196.251.71.214", "196.251.71.215", "196.251.71.22", "196.251.71.223", "196.251.71.225", "196.251.71.23", "196.251.71.234", "196.251.71.237", "196.251.71.238", "196.251.71.242", "196.251.71.243", "196.251.71.249", "196.251.71.25", "196.251.71.253", "196.251.71.28", "196.251.71.3", "196.251.71.30", "196.251.71.35", "196.251.71.37", "196.251.71.39", "196.251.71.44", "196.251.71.47", "196.251.71.5", "196.251.71.53", "196.251.71.55", "196.251.71.57", "196.251.71.58", "196.251.71.6", "196.251.71.62", "196.251.71.64", "196.251.71.70", "196.251.71.71", "196.251.71.75", "196.251.71.79", "196.251.71.80", "196.251.71.88", "196.251.71.89", "196.251.71.9", "196.251.71.91", "196.251.71.92", "196.251.71.93", "196.251.71.96", "196.251.71.98"]


ip: 196.251.72.134
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:empire,custom_c2", "ssh_tunnel_capable"]
proxy_services: squid
c2_frameworks: empire,custom_c2
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["196.251.72.10", "196.251.72.102", "196.251.72.113", "196.251.72.114", "196.251.72.115", "196.251.72.116", "196.251.72.118", "196.251.72.119", "196.251.72.120", "196.251.72.121", "196.251.72.122", "196.251.72.125", "196.251.72.127", "196.251.72.13", "196.251.72.132", "196.251.72.133", "196.251.72.139", "196.251.72.146", "196.251.72.147", "196.251.72.151", "196.251.72.153", "196.251.72.154", "196.251.72.156", "196.251.72.158", "196.251.72.159", "196.251.72.160", "196.251.72.161", "196.251.72.163", "196.251.72.165", "196.251.72.169", "196.251.72.172", "196.251.72.173", "196.251.72.174", "196.251.72.179", "196.251.72.18", "196.251.72.180", "196.251.72.181", "196.251.72.185", "196.251.72.189", "196.251.72.19", "196.251.72.190", "196.251.72.192", "196.251.72.198", "196.251.72.205", "196.251.72.214", "196.251.72.219", "196.251.72.221", "196.251.72.223", "196.251.72.225", "196.251.72.228", "196.251.72.230", "196.251.72.232", "196.251.72.237", "196.251.72.24", "196.251.72.240", "196.251.72.242", "196.251.72.243", "196.251.72.245", "196.251.72.246", "196.251.72.248", "196.251.72.25", "196.251.72.27", "196.251.72.35", "196.251.72.39", "196.251.72.40", "196.251.72.47", "196.251.72.50", "196.251.72.51", "196.251.72.56", "196.251.72.58", "196.251.72.6", "196.251.72.68", "196.251.72.69", "196.251.72.75", "196.251.72.81", "196.251.72.82", "196.251.72.83", "196.251.72.85", "196.251.72.89", "196.251.72.9", "196.251.72.93", "196.251.72.94", "196.251.72.96", "196.251.72.98"]


ip: 196.251.72.214
role: staging
detection_reasons: ["proxy_service:squid"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["196.251.72.10", "196.251.72.102", "196.251.72.113", "196.251.72.114", "196.251.72.115", "196.251.72.116", "196.251.72.118", "196.251.72.119", "196.251.72.120", "196.251.72.121", "196.251.72.122", "196.251.72.125", "196.251.72.127", "196.251.72.13", "196.251.72.132", "196.251.72.133", "196.251.72.134", "196.251.72.139", "196.251.72.146", "196.251.72.147", "196.251.72.151", "196.251.72.153", "196.251.72.154", "196.251.72.156", "196.251.72.158", "196.251.72.159", "196.251.72.160", "196.251.72.161", "196.251.72.163", "196.251.72.165", "196.251.72.169", "196.251.72.172", "196.251.72.173", "196.251.72.174", "196.251.72.179", "196.251.72.18", "196.251.72.180", "196.251.72.181", "196.251.72.185", "196.251.72.189", "196.251.72.19", "196.251.72.190", "196.251.72.192", "196.251.72.198", "196.251.72.205", "196.251.72.219", "196.251.72.221", "196.251.72.223", "196.251.72.225", "196.251.72.228", "196.251.72.230", "196.251.72.232", "196.251.72.237", "196.251.72.24", "196.251.72.240", "196.251.72.242", "196.251.72.243", "196.251.72.245", "196.251.72.246", "196.251.72.248", "196.251.72.25", "196.251.72.27", "196.251.72.35", "196.251.72.39", "196.251.72.40", "196.251.72.47", "196.251.72.50", "196.251.72.51", "196.251.72.56", "196.251.72.58", "196.251.72.6", "196.251.72.68", "196.251.72.69", "196.251.72.75", "196.251.72.81", "196.251.72.82", "196.251.72.83", "196.251.72.85", "196.251.72.89", "196.251.72.9", "196.251.72.93", "196.251.72.94", "196.251.72.96", "196.251.72.98"]


ip: 196.251.72.232
role: staging
detection_reasons: ["proxy_service:squid", "ssh_tunnel_capable", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["196.251.72.10", "196.251.72.102", "196.251.72.113", "196.251.72.114", "196.251.72.115", "196.251.72.116", "196.251.72.118", "196.251.72.119", "196.251.72.120", "196.251.72.121", "196.251.72.122", "196.251.72.125", "196.251.72.127", "196.251.72.13", "196.251.72.132", "196.251.72.133", "196.251.72.134", "196.251.72.139", "196.251.72.146", "196.251.72.147", "196.251.72.151", "196.251.72.153", "196.251.72.154", "196.251.72.156", "196.251.72.158", "196.251.72.159", "196.251.72.160", "196.251.72.161", "196.251.72.163", "196.251.72.165", "196.251.72.169", "196.251.72.172", "196.251.72.173", "196.251.72.174", "196.251.72.179", "196.251.72.18", "196.251.72.180", "196.251.72.181", "196.251.72.185", "196.251.72.189", "196.251.72.19", "196.251.72.190", "196.251.72.192", "196.251.72.198", "196.251.72.205", "196.251.72.214", "196.251.72.219", "196.251.72.221", "196.251.72.223", "196.251.72.225", "196.251.72.228", "196.251.72.230", "196.251.72.237", "196.251.72.24", "196.251.72.240", "196.251.72.242", "196.251.72.243", "196.251.72.245", "196.251.72.246", "196.251.72.248", "196.251.72.25", "196.251.72.27", "196.251.72.35", "196.251.72.39", "196.251.72.40", "196.251.72.47", "196.251.72.50", "196.251.72.51", "196.251.72.56", "196.251.72.58", "196.251.72.6", "196.251.72.68", "196.251.72.69", "196.251.72.75", "196.251.72.81", "196.251.72.82", "196.251.72.83", "196.251.72.85", "196.251.72.89", "196.251.72.9", "196.251.72.93", "196.251.72.94", "196.251.72.96", "196.251.72.98"]


ip: 87.121.84.100
role: c2_relay
detection_reasons: ["proxy_service:squid", "multi_c2:gh0st_rat,empire", "ssh_tunnel_capable"]
proxy_services: squid
c2_frameworks: gh0st_rat,empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["87.121.84.108", "87.121.84.117", "87.121.84.127", "87.121.84.150", "87.121.84.166", "87.121.84.18", "87.121.84.23", "87.121.84.253", "87.121.84.26", "87.121.84.29", "87.121.84.38", "87.121.84.47", "87.121.84.53", "87.121.84.62", "87.121.84.8", "87.121.84.83", "87.121.84.84", "87.121.84.86", "87.121.84.89"]


ip: 87.121.84.166
role: staging
detection_reasons: ["proxy_service:squid", "ssh_tunnel_capable"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["87.121.84.100", "87.121.84.108", "87.121.84.117", "87.121.84.127", "87.121.84.150", "87.121.84.18", "87.121.84.23", "87.121.84.253", "87.121.84.26", "87.121.84.29", "87.121.84.38", "87.121.84.47", "87.121.84.53", "87.121.84.62", "87.121.84.8", "87.121.84.83", "87.121.84.84", "87.121.84.86", "87.121.84.89"]


ip: 87.121.84.89
role: staging
detection_reasons: ["proxy_service:squid", "proxy_service:socks", "ssh_tunnel_capable"]
proxy_services: squid,socks
c2_frameworks: gh0st_rat
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["87.121.84.100", "87.121.84.108", "87.121.84.117", "87.121.84.127", "87.121.84.150", "87.121.84.166", "87.121.84.18", "87.121.84.23", "87.121.84.253", "87.121.84.26", "87.121.84.29", "87.121.84.38", "87.121.84.47", "87.121.84.53", "87.121.84.62", "87.121.84.8", "87.121.84.83", "87.121.84.84", "87.121.84.86"]


ip: 91.184.240.1
role: staging
detection_reasons: ["proxy_service:squid", "ssh_tunnel_capable", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.184.240.10", "91.184.240.106", "91.184.240.107", "91.184.240.110", "91.184.240.112", "91.184.240.113", "91.184.240.117", "91.184.240.120", "91.184.240.121", "91.184.240.13", "91.184.240.133", "91.184.240.141", "91.184.240.142", "91.184.240.144", "91.184.240.145", "91.184.240.149", "91.184.240.150", "91.184.240.154", "91.184.240.155", "91.184.240.157", "91.184.240.158", "91.184.240.159", "91.184.240.160", "91.184.240.166", "91.184.240.169", "91.184.240.17", "91.184.240.172", "91.184.240.173", "91.184.240.176", "91.184.240.182", "91.184.240.187", "91.184.240.188", "91.184.240.192", "91.184.240.193", "91.184.240.2", "91.184.240.200", "91.184.240.206", "91.184.240.212", "91.184.240.213", "91.184.240.215", "91.184.240.216", "91.184.240.217", "91.184.240.218", "91.184.240.22", "91.184.240.220", "91.184.240.223", "91.184.240.228", "91.184.240.229", "91.184.240.23", "91.184.240.232", "91.184.240.240", "91.184.240.247", "91.184.240.252", "91.184.240.3", "91.184.240.37", "91.184.240.4", "91.184.240.46", "91.184.240.48", "91.184.240.49", "91.184.240.51", "91.184.240.52", "91.184.240.55", "91.184.240.58", "91.184.240.6", "91.184.240.61", "91.184.240.65", "91.184.240.67", "91.184.240.71", "91.184.240.72", "91.184.240.73", "91.184.240.74", "91.184.240.78", "91.184.240.83", "91.184.240.85", "91.184.240.87", "91.184.240.88", "91.184.240.89", "91.184.240.9", "91.184.240.90", "91.184.240.93", "91.184.240.97", "91.184.240.98"]


ip: 91.184.241.1
role: staging
detection_reasons: ["proxy_service:squid", "ssh_tunnel_capable", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.184.241.100", "91.184.241.103", "91.184.241.105", "91.184.241.108", "91.184.241.109", "91.184.241.113", "91.184.241.116", "91.184.241.118", "91.184.241.121", "91.184.241.122", "91.184.241.126", "91.184.241.13", "91.184.241.131", "91.184.241.142", "91.184.241.147", "91.184.241.151", "91.184.241.152", "91.184.241.153", "91.184.241.157", "91.184.241.163", "91.184.241.164", "91.184.241.165", "91.184.241.168", "91.184.241.169", "91.184.241.170", "91.184.241.176", "91.184.241.179", "91.184.241.185", "91.184.241.186", "91.184.241.188", "91.184.241.190", "91.184.241.195", "91.184.241.209", "91.184.241.211", "91.184.241.212", "91.184.241.22", "91.184.241.223", "91.184.241.224", "91.184.241.225", "91.184.241.226", "91.184.241.229", "91.184.241.23", "91.184.241.230", "91.184.241.233", "91.184.241.234", "91.184.241.236", "91.184.241.24", "91.184.241.243", "91.184.241.247", "91.184.241.251", "91.184.241.253", "91.184.241.255", "91.184.241.30", "91.184.241.33", "91.184.241.35", "91.184.241.37", "91.184.241.39", "91.184.241.41", "91.184.241.48", "91.184.241.5", "91.184.241.52", "91.184.241.53", "91.184.241.58", "91.184.241.59", "91.184.241.61", "91.184.241.65", "91.184.241.66", "91.184.241.72", "91.184.241.74", "91.184.241.76", "91.184.241.78", "91.184.241.84", "91.184.241.85", "91.184.241.86", "91.184.241.87", "91.184.241.88", "91.184.241.89", "91.184.241.92", "91.184.241.93", "91.184.241.95", "91.184.241.99"]


ip: 91.184.242.1
role: staging
detection_reasons: ["proxy_service:squid", "ssh_tunnel_capable", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.184.242.0", "91.184.242.106", "91.184.242.108", "91.184.242.109", "91.184.242.110", "91.184.242.113", "91.184.242.115", "91.184.242.116", "91.184.242.12", "91.184.242.125", "91.184.242.126", "91.184.242.129", "91.184.242.131", "91.184.242.135", "91.184.242.139", "91.184.242.14", "91.184.242.141", "91.184.242.151", "91.184.242.156", "91.184.242.16", "91.184.242.160", "91.184.242.164", "91.184.242.165", "91.184.242.17", "91.184.242.171", "91.184.242.172", "91.184.242.179", "91.184.242.182", "91.184.242.183", "91.184.242.185", "91.184.242.186", "91.184.242.187", "91.184.242.189", "91.184.242.194", "91.184.242.196", "91.184.242.197", "91.184.242.20", "91.184.242.200", "91.184.242.203", "91.184.242.205", "91.184.242.209", "91.184.242.210", "91.184.242.211", "91.184.242.212", "91.184.242.216", "91.184.242.219", "91.184.242.22", "91.184.242.221", "91.184.242.222", "91.184.242.232", "91.184.242.233", "91.184.242.239", "91.184.242.243", "91.184.242.252", "91.184.242.253", "91.184.242.254", "91.184.242.27", "91.184.242.29", "91.184.242.30", "91.184.242.31", "91.184.242.35", "91.184.242.40", "91.184.242.42", "91.184.242.48", "91.184.242.5", "91.184.242.52", "91.184.242.54", "91.184.242.57", "91.184.242.58", "91.184.242.61", "91.184.242.64", "91.184.242.65", "91.184.242.66", "91.184.242.7", "91.184.242.70", "91.184.242.74", "91.184.242.80", "91.184.242.83", "91.184.242.85", "91.184.242.87", "91.184.242.88", "91.184.242.90", "91.184.242.94", "91.184.242.95", "91.184.242.98"]


ip: 91.184.243.1
role: staging
detection_reasons: ["proxy_service:squid", "ssh_tunnel_capable", "vpn_tunnel"]
proxy_services: squid
c2_frameworks: empire
first_seen: 2026-03-04T20:25:33.161267
last_seen: 2026-03-04T20:25:33.161267
created_at: 2026-03-04 20:25:33
updated_at: 2026-03-04T20:25:33.161267
downstream_ips:
  ["91.184.243.100", "91.184.243.102", "91.184.243.103", "91.184.243.107", "91.184.243.109", "91.184.243.11", "91.184.243.110", "91.184.243.112", "91.184.243.114", "91.184.243.115", "91.184.243.117", "91.184.243.121", "91.184.243.128", "91.184.243.129", "91.184.243.130", "91.184.243.131", "91.184.243.134", "91.184.243.139", "91.184.243.14", "91.184.243.140", "91.184.243.141", "91.184.243.142", "91.184.243.146", "91.184.243.147", "91.184.243.151", "91.184.243.155", "91.184.243.156", "91.184.243.157", "91.184.243.158", "91.184.243.159", "91.184.243.16", "91.184.243.161", "91.184.243.162", "91.184.243.164", "91.184.243.167", "91.184.243.168", "91.184.243.172", "91.184.243.173", "91.184.243.174", "91.184.243.176", "91.184.243.177", "91.184.243.179", "91.184.243.18", "91.184.243.182", "91.184.243.184", "91.184.243.188", "91.184.243.189", "91.184.243.19", "91.184.243.190", "91.184.243.192", "91.184.243.194", "91.184.243.198", "91.184.243.2", "91.184.243.205", "91.184.243.207", "91.184.243.215", "91.184.243.216", "91.184.243.217", "91.184.243.219", "91.184.243.220", "91.184.243.231", "91.184.243.232", "91.184.243.233", "91.184.243.24", "91.184.243.242", "91.184.243.244", "91.184.243.245", "91.184.243.246", "91.184.243.25", "91.184.243.28", "91.184.243.3", "91.184.243.30", "91.184.243.32", "91.184.243.33", "91.184.243.34", "91.184.243.36", "91.184.243.38", "91.184.243.40", "91.184.243.45", "91.184.243.51", "91.184.243.52", "91.184.243.53", "91.184.243.56", "91.184.243.57", "91.184.243.58", "91.184.243.6", "91.184.243.61", "91.184.243.62", "91.184.243.63", "91.184.243.64", "91.184.243.65", "91.184.243.66", "91.184.243.68", "91.184.243.7", "91.184.243.71", "91.184.243.72", "91.184.243.74", "91.184.243.76", "91.184.243.81", "91.184.243.88", "91.184.243.92", "91.184.243.94", "91.184.243.98", "91.184.243.99"]


ip: 194.85.251.27
role: phishing_hub
detection_reasons: cert_analysis,multi_brand_spoofing
created_at: 2026-04-05 21:33:48
updated_at: 2026-04-05 21:33:48
notes:
  HOSTKEY Phishing Farm: Multi-brand cert hub — github.com + apple.com + VK + max.ru + Yandex + edgecdn. 6 different cert clusters on one host.


ip: 176.65.144.98
role: distribution
detection_reasons: Exposed Prometheus config, Grafana default creds, URL shortener on :8080, Telegram bot on :8000
c2_frameworks: custom_url_shortener,telegram_bot
first_seen: 2026-04-05
last_seen: 2026-04-05
created_at: 2026-04-05 23:34:47
updated_at: 2026-04-05 23:34:47
notes:
  Phishing distribution platform on DEDIK SERVICES. Docker Compose: 6 services + monitoring. Cross-subnet link to HOSTKEY farm via 176.65.144.102.


ip: 176.65.144.130
role: compromised_redis
confidence: high
detection_reasons: Unauthenticated Redis, crontab injection keys backup1-4, oracle.zzhreceive.top C2
created_at: 2026-04-06 01:22:01
updated_at: 2026-04-06 01:22:01
notes:
  DEDIK SERVICES Redis compromised by separate cryptominer operator via Mullvad VPN (146.70.52.14). OS: Linux 5.15.0-173-generic.


ip: 37.221.65.73
role: scraper_backend
confidence: high
c2_frameworks: celery
created_at: 2026-04-06 01:22:01
updated_at: 2026-04-06 01:22:01
detection_reasons:
  Celery task meta (blogger scraper), SSH key in Redis key "x", Docker/Redis/Celery stack matching .98

notes:
  ALEXHOST SRL blogger scraper bot farm. Worker celery@4e640d1007a5. OS: Linux 6.8.0-31-generic. REASSESSED: not legitimate infrastructure.


# validation_queue

ip: 178.19.63.70
status: done
queued_at: 2026-03-31T13:22:29.065746
completed_at: 2026-03-31T13:28:20.712904
sources_requested:
  shodan,otx,abuseipdb,virustotal,censys,dshield,threatfox,firehol,stevenblack,c2tracker,tweetfeed,ipsum,emerging_threats

sources_completed:
  abuseipdb,c2tracker,censys,dshield,emerging_threats,firehol,ipsum,otx,shodan,stevenblack,threatfox,tweetfeed,virustotal


# scoring_sources

source: cert_pattern_analysis
category: infrastructure
created_at: 2026-04-05 21:21:47
description:
  SSL/TLS certificate pattern analysis — spoofed certs, shared serials, VM clone detection, hosting panel fingerprinting


# source_validations

ioc_type: ipv4
ioc_value: 1.3.6.1
source: otx
validated_at: 2026-03-31T13:23:11.360342
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "China", "country_code": "CN", "city": null, "asn": "ASNone ", "indicator": "1.3.6.1", "tags": ["aaaa", "malware", "shell folders", "command line", "social media", "default", "backdoor", "domain names", "rndhex", "indent", "list bullet", "cus cngts", "jpeg bitmap", "root", "port", "emotet", "remote process", "pulses", "high", "ip address", "injection write process", "adversaries", "v3 serial", "ck id", "related tags", "loaderid", "yahoo", "false", "windir", "packer", "compromises device", "table classic", "jfifexif jpeg", "microsoft", "mbisslshort", "full path", "google", "ssdeep", "trojan", "meta", "dynamic function loading", "server", "christopher p. ahmann", "iocontrol", "bearer", "pulses otx", "informative", "dynamicloader", "alienvault otx", "first counter"], "pulses": ["The Belasco Chain", "CAPE Sandbox -stream cal/custom dictionary", "CAPE Sandbox VT-68/71", "CAPE Sandbox VT-68/71", "Untitled.", "Untitled.", "instagram staged credit clone a vashti :(", "CAPE Sandbox -Verizon-Exported-_N_8_14.doc __substg1.0_37010102", "CAPE Sandbox -Verizon-Exported-_N_8_14.doc __substg1.0_37010102", "CAPE Sandbox -Verizon-Exported-_N_8_14.doc __substg1.0_37010102", "CAPE Sandbox -statement request.msg", "CAPE Sandbox -statement request.msg", "Access Warning | Barracuda Networks", "Access Warning | Barracuda Networks", "fastly.com", "spectrum.com", "I See You, Too. #.icu", ".NET Framework, Cryptographic Stagnation, Legacy Vulnerability, and Pipeline Rot", "enom.com", "wordpress.com press key"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 2.5.29.37
source: otx
validated_at: 2026-03-31T13:23:20.776565
raw_response:
  {"pulse_count": 17, "reputation": 0, "country": "France", "country_code": "FR", "city": "Valescourt", "asn": "AS3215 orange s.a.", "indicator": "2.5.29.37", "tags": ["typlibid", "whois record", "pe32 compiler", "informacja o", "critical risk", "alexa top", "pavlov", "backdoor", "request", "dos executable", "gmt server", "runtime-modules", "worm", "cascade", "emotet", "nsa weapons", "install", "hacktool", "overlay", "ip address", "runtime process", "pkcs", "document format", "mapa", "explorer", "windir", "first", "as8068", "slcc2", "communicating", "skip", "hybrid", "process t1543", "microsoft", "v2 dokument", "dev0022", "fullscreen", "certificate", "ceidg szybki", "http response", "included review", "ssdeep", "never", "pejzasz", "blank", "pulses otx", "file attributes", "access ob0005", "maltiverse", "lockbit"], "pulses": ["clone scoreblue", "Q Vashti post \"monitored target\"", "pdfkit.net pulses", "EternalRocks (SHADOW BROKERS)  MicroBotMassiveNet - NSA Exploits", "Executed \u2022 Installend RMS Module | .exe RMS.exe", "PIT Projekt.exe (www.pitprojekt.pl , pitprojekt.pl)  oraz  Ceidg.gov.pl - Dane publiczne wpisu", "http://www.jeffreyrusertjeffersoncounty.net/", "Malicious WiFi Internet network | trojan.morstar/bundler", "Monitored Target- bounty-50872035906958562", "https://www.hybrid-analysis.com/sample/25ff97e91e1d8e1b36935ead05e8bf92cf64ca6faff4ab9c2fdca5ad4352b0e5/66000b626c42699e7d0e1065", "Sample_5adcc978b45f6a54af936c48.exe  MD5 1f37eebe61bc9252bd72e643f4223896", "PrivateLoader is a malware with a module structure that has the capability is to download and execute one or several payloads", "InstallMonstr | Emotet affecting HCA | PHI | PII | Technologies", "Worm:Win32/Enosch - Affecting YouTube, Google and more", "Hijacker", "The infectors and The infected - string.dmp", "#039;472.dmp.strings&#039; Hybrid upload of string dmp"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 5.2.3.4
source: otx
validated_at: 2026-03-31T13:23:29.321665
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Italy", "country_code": "IT", "city": null, "asn": "AS198471 linkem spa", "indicator": "5.2.3.4", "tags": ["aaaa", "dnssec", "malware", "capture", "city", "checkin", "cookie", "files ip", "show", "backdoor", "path", "class", "related pulses", "gmt server", "103.28.36.182", "worm", "wow64", "dynamic", "labs pulses", "content type", "downloader", "los angeles", "drweb", "iana", "possible", "hacktool", "memreserve", "whois registrar", "high", "ip address", "updater", "redacted for", "as24940 hetzner", "namecheap inc", "v3 serial", "location united", "a div", "panda", "top destination", "equiv cache", "as8075", "first", "slcc2", "scan endpoints", "international", "orgtechhandle", "owotrus ca", "certificate", "windows nt", "a nxdomain"], "pulses": ["Telegram - Remote install | log4shell-generic | Botnet | Pegasus Relationship"], "malware_count": 1, "passive_dns_count": 2, "malware_samples": ["1434421de95b9b14df5832e6de173479752e37ed8f2b4caede2a9542393be5f8"], "passive_dns": ["rtc-firewall.786hub.com", "test.avdija.eu.org"]}


ioc_type: ipv4
ioc_value: 5.5.7.3
source: otx
validated_at: 2026-03-31T13:23:38.059124
raw_response:
  {"pulse_count": 21, "reputation": 0, "country": "Germany", "country_code": "DE", "city": null, "asn": "AS6805 telefonica germany gmbh & co.ohg", "indicator": "5.5.7.3", "tags": ["affa", "prfen", "disableoverride", "denver police", "isinternalbuild", "cobwa", "bool", "document", "generic http", "saudi arabia", "pkcs", "relying party", "manpath", "synaptics", "slcc2", "certificate", "returns", "mozilla firefox", "quantum", "rooter", "lockbit", "saml", "provides macros", "html", "perlioprintf", "shell", "nsuuid uuid", "postfix dsn", "modern smtp", "aoskgetuserinfo", "15385730680", "webauthn", "cname", "next associated", "AHS", "monitoring", "domain", "none", "sameorigin", "window", "jumpcloud go", "alma", "mcextern", "medium", "zero", "xofkoxzh", "kernel", "wknavigation", "iframes", "comp"], "pulses": ["Clone Pulse Reference", "Pools Open", "System32 - Subfolders", "C:\\Windows\\system32\\free", "$RECYCLE . BIN\\ -> Part 2", "Pool's Closed", "Espionage - Gravity RAT + | Legal entities are State owned.  Attacking severely injured  PT\u2019s SA victim.", "http://www.jeffreyrusertjeffersoncounty.net/", "plik wykonywalny PE32 (DLL) dla systemu MS Windows i'u\u017cytkownik,", "x.com/KulinskiArkadi", "The Best Buy Virus - Spreads Via Bluetooth, Pre-Boots Bios", "macOS Threat Infrastructure Leveraging Remote Agents via remotewd.com and rtmsprod.net", "PrivateLoader is a malware with a module structure that has the capability is to download and execute one or several payloads", "Norton & Norton Lifelock Products", "YouTube Creator Cyber Attacks | Jays Youtube Bot.exe | YT Botnet", "Worm:Win32/Enosch - Affecting YouTube, Google and more", "Eternal Blue _ WannaCry MS17-010  | Apple iOS iMessage injection infiltration", "iOS Attack - Crouching Yeti: http://x.com/denverpolice/status/|", "Pool's Closed (by @scnrscnr)", "Pool's Closed (by @scnrscnr)"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 62.72.21.10
source: otx
validated_at: 2026-03-31T13:23:44.164969
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS5427 ptgi international carrier services ltd", "indicator": "62.72.21.10", "tags": ["coruna", "unc6353", "body", "exploit", "loader", "look", "null", "unc6748", "pars defense", "c2 server", "patched", "strong", "figure", "ghostknife", "darksword", "iframe", "life", "contact", "ransomware", "title", "november", "powerful", "ukraine", "code", "gtig", "telegram", "meta", "virustotal", "next"], "pulses": ["The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors"], "malware_count": 0, "passive_dns_count": 50, "malware_samples": [], "passive_dns": ["aseelmk.com", "shymatours.com", "jagour-eg.com", "linkgo.vip", "tut.reisen", "grid-eg.com", "www.toplevelballoons.com", "5g-host.com", "ftp.elhassan-trading.com", "www.elhassan-trading.com", "elhassan-trading.com", "www.al-kayangroup.com", "ftp.al-kayangroup.com", "al-kayangroup.com", "ftp.powertools-eg.com", "www.powertools-eg.com", "powertools-eg.com", "somo-sushi.com", "horizon-sw.org", "kababgi-eldahan.com"]}


ioc_type: ipv4
ioc_value: 72.60.98.48
source: otx
validated_at: 2026-03-31T13:23:47.349043
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Harrison", "asn": "AS1239 sprint", "indicator": "72.60.98.48", "tags": ["coruna", "unc6353", "body", "exploit", "loader", "look", "null", "unc6748", "pars defense", "c2 server", "patched", "strong", "figure", "ghostknife", "darksword", "iframe", "life", "contact", "ransomware", "title", "november", "powerful", "ukraine", "code", "gtig", "telegram", "meta", "virustotal", "next"], "pulses": ["The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 62.72.21.10
source: stevenblack
validated_at: 2026-03-31T13:28:16.432575
raw_response:
  {"hostnames_checked": ["aseelmk.com", "ftp.powertools-eg.com", "somo-sushi.com", "horizon-sw.org", "5g-host.com", "kababgi-eldahan.com", "linkgo.vip", "elhassan-trading.com", "jagour-eg.com", "www.elhassan-trading.com", "ftp.al-kayangroup.com", "powertools-eg.com", "shymatours.com", "www.toplevelballoons.com", "grid-eg.com", "www.powertools-eg.com", "ftp.elhassan-trading.com", "al-kayangroup.com", "www.al-kayangroup.com", "tut.reisen"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 88764}


ioc_type: ipv4
ioc_value: 185.118.115.15
source: shodan
validated_at: 2026-04-01T06:01:00.591647
raw_response:
  {"ports": [53, 80, 143, 443, 587, 993, 2082, 2083, 2086, 2087], "vulns": [], "hostnames": ["linhaexotica.com", "cpanel.sv1.tecnmir.com", "cpcalendars.sv1.tecnmir.com", "sv1.tecnmir.com", "webmail.sv1.tecnmir.com", "alexanderxzane.com", "ipv6.sv1.tecnmir.com", "mail.sv1.tecnmir.com", "whm.sv1.tecnmir.com", "autodiscover.alexanderxzane.com", "cpanel.alexanderxzane.com", "webdisk.alexanderxzane.com", "mail.alexanderxzane.com", "webdisk.sv1.tecnmir.com", "www.sv1.tecnmir.com", "webmail.alexanderxzane.com", "cpcalendars.alexanderxzane.com", "cpcontacts.sv1.tecnmir.com", "www.alexanderxzane.com", "autoconfig.sv1.tecnmir.com", "autodiscover.sv1.tecnmir.com", "cpcontacts.alexanderxzane.com"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx", "cpe:/a:openresty:openresty:1.27.1.1", "cpe:/a:exim:exim:4.99.1", "cpe:/a:openresty:lua-nginx-module:1.27.1.1"]}


ioc_type: ipv4
ioc_value: 141.195.117.129
source: shodan
validated_at: 2026-04-01T06:01:25.560722
raw_response:
  {"ports": [80, 443], "vulns": ["CVE-2022-4450", "CVE-2021-32785", "CVE-2024-0727", "CVE-2024-42516", "CVE-2025-49812", "CVE-2021-32786", "CVE-2019-0190", "CVE-2024-47252", "CVE-2009-2299", "CVE-2012-4001", "CVE-2019-0217", "CVE-2023-38709", "CVE-2020-13938", "CVE-2012-4360", "CVE-2013-2765", "CVE-2018-17189", "CVE-2009-3767", "CVE-2026-22796", "CVE-2025-69418", "CVE-2009-1390", "CVE-2007-4723", "CVE-2021-32791", "CVE-2022-31813", "CVE-2023-0464", "CVE-2025-49630", "CVE-2024-38473", "CVE-2006-20001", "CVE-2021-3712", "CVE-2019-10082", "CVE-2023-31122", "CVE-2022-22720", "CVE-2025-68160", "CVE-2024-24795", "CVE-2021-32792", "CVE-2021-4160", "CVE-2011-2688", "CVE-2021-40438", "CVE-2022-29404", "CVE-2026-22795", "CVE-2025-23048", "CVE-2024-38474", "CVE-2019-10092", "CVE-2013-2220", "CVE-2025-69421", "CVE-2025-59775", "CVE-2021-44790", "CVE-2007-3205", "CVE-2021-36160", "CVE-2025-65082", "CVE-2024-38475", "CVE-2013-0941", "CVE-2019-0196", "CVE-2021-44224", "CVE-2024-27316", "CVE-2019-0215", "CVE-2013-4365", "CVE-2022-22721", "CVE-2022-23943", "CVE-2023-5678", "CVE-2023-0286", "CVE-2025-58098", "CVE-2022-26377", "CVE-2020-9490", "CVE-2022-22719", "CVE-2022-28614", "CVE-2019-0197", "CVE-2019-0220", "CVE-2023-0215", "CVE-2018-17199", "CVE-2019-10098", "CVE-2023-2650", "CVE-2021-34798", "CVE-2020-35452", "CVE-2021-39275", "CVE-2022-30556", "CVE-2024-43394", "CVE-2019-9517", "CVE-2022-28330", "CVE-2023-27522", "CVE-2021-33193", "CVE-2020-1927", "CVE-2024-3566", "CVE-2009-0796", "CVE-2021-26690", "CVE-2012-3526", "CVE-2022-1292", "CVE-2024-39573", "CVE-2023-3817", "CVE-2022-4304", "CVE-2024-40898", "CVE-2009-3765", "CVE-2009-3766", "CVE-2022-0778", "CVE-2025-53020", "CVE-2020-11993", "CVE-2023-0465", "CVE-2023-4807", "CVE-2022-28615", "CVE-2020-11984", "CVE-2019-10081", "CVE-2019-0211", "CVE-2024-43204", "CVE-2025-55753", "CVE-2024-38476", "CVE-2023-25690", "CVE-2022-36760", "CVE-2013-0942", "CVE-2021-3711", "CVE-2019-17567", "CVE-2025-69420", "CVE-2022-2097", "CVE-2023-0466",


ioc_type: ipv4
ioc_value: 185.177.126.225
source: shodan
validated_at: 2026-04-01T06:01:29.194153
raw_response:
  {"ports": [22, 80], "vulns": ["CVE-2025-53020", "CVE-2011-2688", "CVE-2024-42516", "CVE-2025-49812", "CVE-2024-47252", "CVE-2025-23048", "CVE-2024-38474", "CVE-2025-59775", "CVE-2024-43204", "CVE-2009-2299", "CVE-2024-43394", "CVE-2012-4001", "CVE-2025-55753", "CVE-2025-65082", "CVE-2024-38476", "CVE-2024-38475", "CVE-2023-38709", "CVE-2013-0942", "CVE-2013-0941", "CVE-2012-4360", "CVE-2013-2765", "CVE-2024-38472", "CVE-2011-1176", "CVE-2024-27316", "CVE-2013-4365", "CVE-2012-3526", "CVE-2009-0796", "CVE-2007-4723", "CVE-2024-39573", "CVE-2025-58098", "CVE-2025-49630", "CVE-2024-38473", "CVE-2025-66200", "CVE-2024-40898", "CVE-2024-38477", "CVE-2024-36387", "CVE-2024-24795"], "hostnames": ["185-177-126-225.hosted-by-worldstream.net"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:apache:http_server:2.4.58", "cpe:/a:openbsd:openssh:9.6p1"]}


ioc_type: ipv4
ioc_value: 92.204.164.50
source: shodan
validated_at: 2026-04-01T06:01:54.113482
raw_response:
  {"ports": [8080], "vulns": ["CVE-2022-28614", "CVE-2021-32792", "CVE-2015-0228", "CVE-2016-8612", "CVE-2013-6438", "CVE-2011-2688", "CVE-2021-32785", "CVE-2016-4975", "CVE-2025-49812", "CVE-2013-4365", "CVE-2021-40438", "CVE-2022-29404", "CVE-2022-28615", "CVE-2021-32786", "CVE-2017-9798", "CVE-2021-34798", "CVE-2009-0796", "CVE-2021-44790", "CVE-2017-3169", "CVE-2014-0226", "CVE-2021-39275", "CVE-2022-30556", "CVE-2009-2299", "CVE-2012-4001", "CVE-2022-28330", "CVE-2017-3167", "CVE-2023-38709", "CVE-2013-0942", "CVE-2013-0941", "CVE-2012-4360", "CVE-2013-2765", "CVE-2016-5387", "CVE-2018-1303", "CVE-2011-1176", "CVE-2007-4723", "CVE-2018-1302", "CVE-2018-1301", "CVE-2021-32791", "CVE-2022-22721", "CVE-2022-31813", "CVE-2016-8743", "CVE-2017-9788", "CVE-2014-0231", "CVE-2017-7679", "CVE-2014-0098", "CVE-2012-3526", "CVE-2025-58098", "CVE-2006-20001", "CVE-2014-0118", "CVE-2023-31122", "CVE-2022-22720", "CVE-2024-40898", "CVE-2013-5704", "CVE-2015-3183", "CVE-2022-37436", "CVE-2022-22719"], "hostnames": [], "tags": [], "cpes": ["cpe:/a:apache:http_server:2.2.25"]}


ioc_type: ipv4
ioc_value: 194.126.178.8
source: otx
validated_at: 2026-04-01T06:02:43.785634
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "France", "country_code": "FR", "city": null, "asn": "AS35625 eurafibre sas", "indicator": "194.126.178.8", "tags": ["amazon02", "programdata", "june", "future", "seznam", "scroll", "slovakia", "indonesia", "as16509", "install", "sysupdate", "CERT-UA#8399", "python", "akamaiasn1", "local", "pixpirate", "javascript", "sector", "webdav", "Nextray", "public url", "malware", "ITG05", "tactictechnique", "as8075", "united", "monitor", "tools", "april", "august", "facebook", "explorer", "ghost", "as3359", "strong", "ukraine", "contact", "smb", "australian", "play", "czech", "forest blizzard", "mini", "win64", "x-force", "polish", "malicious", "media", "ioc", "cyber"], "pulses": ["Ongoing ITG05 operations leverage evolving malware arsenal in global campaigns", "APT28: From Initial Damage to Domain Controller Threats in an Hour (CERT-UA#8399)", "InQuest - 05-06-2025", "Brennan - 2025-05-23 - ASD Advisory", "Russian GRU Targeting Western Logistics Entities and Technology Companies | CISA", "Russian GRU Targeting Western Logistics Entities and Technology Companies | CISA", "n0paste - Show paste: \\\"No Problems\\\" - dos meses del URLscan", "C&C-IP-List", "Domain-URL-IP-Hash-IOC", "Domain-URL-IP-Hash-IOC", "IOC Records Provided by @NextRayAI", "APT28: From initial attack to creating threats to a domain controller in an hour (CERT-UA#8399)", "APT28: From initial attack to creating threats to a domain controller in an hour (CERT-UA#8399)", "APT28: From Initial Damage to Domain Controller Threats in an Hour", "APT28: From Initial Damage to Domain Controller Threats in an Hour", "APT28: From Initial Damage to Domain Controller Threats in an Hour", "APT28: From Initial Damage to Domain Controller Threats in an Hour (CERT-UA#8399)", "APT28 Hacker Group Targeting Europe, Americas, Asia in Widespread Phishing Scheme", "Ongoing ITG05 operations leverage evolving malware arsenal in global campaigns", "Ongoing ITG05 operations leverage evol


ioc_type: ipv4
ioc_value: 91.202.4.76
source: otx
validated_at: 2026-04-01T06:02:55.595860
raw_response:
  {"pulse_count": 26, "reputation": 0, "country": "Poland", "country_code": "PL", "city": null, "asn": "AS43641 sollutium eu sp z.o.o.", "indicator": "91.202.4.76", "tags": ["group", "truebot", "clop", "june", "moveit transfer", "cl0p", "azure sql", "sql injection", "powershell", "ransomware", "ta505", "tinymet", "movit exploit", "vulnerability", "russia", "random", "suite", "research", "path", "sdbot", "cobalt strike", "panama", "fingerprint", "exploit", "cryptomix"], "pulses": ["#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability", "BLOCK_2024", "BLOCK_2025_DIC", "CLOP RANSOMWARE: DISSECTING NETWORK", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Threat Trend Report on Ransomware", "MOVEit Indicators", "InQuest - 11-06-2023", "InQuest - 10-06-2023", "InQuest - 09-06-2023", "InQuest - 08-06-2023", "StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability", "StopRansomware: CL0P Ransomware  Gang Exploits  CVE-2023-34362 MOVEit Vulnerability"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["www.revofilstore.com", "revofilstore.com"]}


ioc_type: ipv4
ioc_value: 155.138.252.221
source: otx
validated_at: 2026-04-01T06:03:05.004623
raw_response:
  {"pulse_count": 22, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "155.138.252.221", "tags": ["Gamaredon", "microsoft word", "team", "service", "Exfil", "threatactor.primitivebear", "Trident Ursa", "word", "base64encoded", "armageddon", "ukraine", "Lnk Files", "ip address", "domain", "xorbytes", "threatactor/tridentursa", "vbscript", "powershell", "threatactor/gamaredon", "VBS Script", "Phishing", "temp", "cisco talos", "never", "threatactor/actinium", "Gamaredon Group", "garmaredon", "cyber", "powershell code", "cybersecurity", "Military", "mitigation tips", "gamaredon apt", "umbrella", "url https", "are gamaredon", "cisco secure", "SpearPhishing", "Government", "sample", "written", "GammaSteel", "OSINT", "T1566", "c2 server", "yara rule", "infostealer", "Powershell", "code", "august"], "pulses": ["Gamaredon APT targets Ukrainian government agencies in new campaign", "PS / HTTP", "Gamaredon Leverages Microsoft Office Docs to Target Ukraine Government and Military", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Gamaredon Leverages Microsoft Office Docs to Target Ukraine Government and Military", "Ransomware Dopple Paymer IOCs", "Cisco Talos Intelligence Group - Comprehensive Threat Intelligence: Gamaredon APT targets Ukrainian government agencies in new campaign", "Gamaredon APT targets Ukrainian government agencies in new campaign", "Report Spam Author avatar Gamaredon APT targets Ukrainian government agencies in new campaign", "Cisco Talos Intelligence Group - Com


ioc_type: ipv4
ioc_value: 162.33.178.129
source: otx
validated_at: 2026-04-01T06:03:08.843589
raw_response:
  {"pulse_count": 49, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS399629 bl networks", "indicator": "162.33.178.129", "tags": ["Gamaredon", "msi file", "zip archive", "VBS Script", "Phishing", "Powershell", "malspam email", "Exfil", "anna paula", "utf8", "tuesday", "Lnk Files", "associated", "headers", "from email", "currc3adculo"], "pulses": ["Gamaredon APT targets Ukrainian government agencies in new campaign", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test", "test"], "malware_count": 0, "passive_dns_count": 14, "malware_samples": [], "passive_dns": ["caipgovaccount.info", "winsecupdate.com", "retbr.fun", "tumnt.top", "www.basketballreviews.org", "basketballreviews.org", "celticso.ru", "mitrograd.ru", "sheldoni.ru", "mishitron.ru", "162-33-178-129.cprapid.com", "www.162-33-178-129.cprapid.com", "wfsdomain11.com", "www.wfsdomain11.com"]}


ioc_type: ipv4
ioc_value: 168.119.152.19
source: otx
validated_at: 2026-04-01T06:03:21.362616
raw_response:
  {"pulse_count": 6, "reputation": 0, "country": "Germany", "country_code": "DE", "city": null, "asn": "AS24940 hetzner online gmbh", "indicator": "168.119.152.19", "tags": ["execution", "restart", "service", "june", "first", "kazuar v3", "kazuar", "strong", "ukraine", "february", "amadey", "pteropaste", "vbscript", "powershell", "bridge", "persistence", "telegram", "snake", "defense", "c server", "pteroodd", "eset research", "pterographin", "oilrig", "invisimole", "tips", "wordpress site", "third", "kazuar c", "network ip", "april", "gamaredon", "ionos se", "turla", "virustotal", "kazuar v2"], "pulses": ["EbeeSep2025 Pt4", "EbeeSep2025 Pt5", "12-30-Sep-25", "IOC - Gamaredon X Turla collab", "Russian Hackers Gamaredon and Turla Deploy Kazuar Backdoor", "Gamaredon X Turla collab"], "malware_count": 0, "passive_dns_count": 500, "malware_samples": [], "passive_dns": ["qemail.ir", "bestlisto.com", "mahshidmolooki.ir", "cultivia.ir", "healme.help", "www.cultivia.ir.healme.help", "www.mylvora.site.healme.help", "www.psystore.ir.healme.help", "mylvora.site.healme.help", "www.mahshidmolooki.ir.healme.help", "www.panel.clickro.ir.sysdl.ir", "mamanikala.com", "ramezannia.ir", "ameenshop.com", "www.forwardbot.yaghobyy.ir", "bot.yaghobyy.ir", "yaghobyy.ir", "nemostofi.com", "maraltejarat-j.com", "sheydamonfared.com"]}


ioc_type: ipv4
ioc_value: 185.118.115.15
source: otx
validated_at: 2026-04-01T06:03:25.228456
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "Portugal", "country_code": "PT", "city": null, "asn": "AS39384 dream fusion - it services  lda", "indicator": "185.118.115.15", "tags": ["execution", "restart", "service", "pterostew", "june", "first", "kazuar v3", "ukraine", "kazuar", "strong", "february", "amadey", "cyberespionage", "pteropaste", "fsb", "vbscript", "powershell", "bridge", "collaboration", "auto-generated security", "pterolnk", "persistence", "telegram", "russia", "snake", "defense", "c server", "pteroodd", "eset research", "pterographin", "oilrig", "invisimole", "tips", "wordpress site", "third", "kazuar c", "network ip", "april", "pteroeffigy", "gamaredon", "apt", "ionos se", "turla", "virustotal", "kazuar v2"], "pulses": ["Gamaredon X Turla collaboration", "EbeeSep2025 Pt4", "EbeeSep2025 Pt5", "12-30-Sep-25", "IOC - Gamaredon X Turla collab", "Malware Filter - Botnet List - 20-09-2025", "Russian Hackers Gamaredon and Turla Deploy Kazuar Backdoor", "Gamaredon X Turla collaboration", "Gamaredon X Turla collab", "Auto-generated Pulse"], "malware_count": 0, "passive_dns_count": 96, "malware_samples": [], "passive_dns": ["europrofit.pt", "banquetesaduarte.com", "dev.gapetec.com", "www.dev.gapetec.com", "online2.tecnmir.com", "sv1.tecnmir.com", "help.equirest.com", "www.help.equirest.com", "intermove.pt", "grouplacerent.pt", "casacastor.pt", "fosinvest.pt", "apparelx.pt", "floristasaojose.pt", "www.email.catchgrupo.com", "email.catchgrupo.com", "investilar.com.pt", "www.portal.cryaz.pt", "portal.cryaz.pt", "www.engiplace.rhsoftware.pt"]}


ioc_type: ipv4
ioc_value: 195.62.52.93
source: otx
validated_at: 2026-04-01T06:03:27.734160
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS44812 ip server llc", "indicator": "195.62.52.93", "tags": [], "pulses": [], "malware_count": 11, "passive_dns_count": 3, "malware_samples": ["6f774e199844e385d6f36666c1c69892da56753bde496fc16199ea86ec2014e1", "5c04aaaa1df23999672e43f11acd8fcb03413c73ce1021aaa3aeb0e964ef82eb", "2a4d48532887bb97e4881cbfd162d87a0f2ad7e0fe9911e6b3e5d7896eb5a2b3", "2d4326409a49b9768733276df9aacebaae19020163cbd316dcce63e9fe9d5991", "8512aabfa0175684bdbb77481d6b272b63dbc4249b04a44e1003b7d8fdea0a89", "86c81f03cf7d8f8af38c2559dbf506cccdc25579f3b29fb574f823a67f99a0a3", "208dc592111a8221a9c633efc120b890585f9a67ed340cbb5ec9db4cd5e164e4", "71c5b899a5187baeb8f605ca39ca56bf05a63025a8f9f84c45590d8345e5d349", "aa860d405746401ae4155485326fdeb39718832c77c73540d48f4fbb8e596215", "e24715900aa5c9de807b0c8f6ba8015683af26c42c66f94bee38e50a34e034c4"], "passive_dns": ["lumenvisit.com", "trickradar.net", "check-update.ru"]}


ioc_type: ipv4
ioc_value: 217.160.0.159
source: otx
validated_at: 2026-04-01T06:03:45.095617
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Germany", "country_code": "DE", "city": null, "asn": "AS8560 1&1 ionos se", "indicator": "217.160.0.159", "tags": [], "pulses": ["EbeeSep2025 Pt5", "12-30-Sep-25", "Russian Hackers Gamaredon and Turla Deploy Kazuar Backdoor"], "malware_count": 7, "passive_dns_count": 500, "malware_samples": ["3d8657e114a07f6048014b5b50489af4156a1bd946d2b5ffb93d03674fced272", "67b16edf51df4a7cd498f1d0153452edc5bfa79767e928d955c49ab94a289c55", "369b9b0924146e0b7d6afd385ba3266a629e6272f0aa0a22d15ea50ef1c3865f", "474a986eae85622d39271668086c51af6ec1d4aaaa7f92e7606c9565444fe1dd", "570f2428e1e37492c438b85080673f60ef297853c9e10a7ac3d8fce487234d3b", "21d057832c48171778abfa70b1e0433c24076d972ae070814b83b2b9bbdab727", "c71fdf5a097fdfbf24a392b96946a110f88444de7fe3efc318346320c9bd764f"], "passive_dns": ["www.hannahblossoms.co.uk", "www.stamm-lauer.de", "kurtenbach-communications.com", "ppl-ds.com", "duurzaampaleis.com", "paddlemoinscher.com", "hypnose-langenfeld.de", "abada-capoeira.eu", "theiss-live.store", "auqauneo.store", "monytrix.store", "hoarder-app.com", "prioriteauxlivres.com", "hurstfitpt.com", "socialistasdegijon.com", "elbshift.com", "dressurportal.de", "www.galabau-recica.de", "jlc-ingenieurbuero.de", "spielewelt.tech"]}


ioc_type: ipv4
ioc_value: 217.160.0.33
source: otx
validated_at: 2026-04-01T06:04:02.176036
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Germany", "country_code": "DE", "city": null, "asn": "AS8560 1&1 ionos se", "indicator": "217.160.0.33", "tags": ["auto-generated security"], "pulses": ["EbeeSep2025 Pt5", "12-30-Sep-25", "Russian Hackers Gamaredon and Turla Deploy Kazuar Backdoor", "Auto-generated Pulse"], "malware_count": 7, "passive_dns_count": 500, "malware_samples": ["43bfb06d7ff6d8f9c6aeb84b4e96084a6bf2f2b3ef8de1eca1f75cd38ce6e393", "2e0107288eccaab62de29c9bf6a26e21886ab70114af782e9bdd11f1d635ac4c", "5c4322d5fb038a726ce2240ae4c7d4501d425b5cdb7aed8644544a3962fdd332", "cfc1530bb675031890d211fc9505cbd8e7e42a98bd94e3964601071c09036b9b", "e5c110d2ff22b22f3f16575db880655abd9309b78dd2545d0fe65873b6f8cce0", "15a67720397ff8b1be5fa893ece4ee87c130c29c268efd09bcea0a075c6426c9", "390405b92fc7a8de13b82bf8ce7797a0038c58a242081a1705988c0ff41e0f4c"], "passive_dns": ["www.jh-maschinenbau.de", "snote.fun", "smmartservices.com", "franz-kortmann.de", "www.zimmermann-mehr-wert-coaching.de", "mindthegaps.uk", "aliciacrooksod.com", "www.therawstories.com", "marbi-tech.com", "hennairperfumes.com", "hammergifts.com", "sativasocialshop.com", "wandel-beratung.com", "hammergeschenke.com", "hanseatic-trade.com", "wohnwagenentsorgung-berlitz.de", "ipg-schwerin.de", "www.amalgama-creations.com", "amalgama-creations.com", "www.knitables.com"]}


ioc_type: ipv4
ioc_value: 45.77.237.252
source: otx
validated_at: 2026-04-01T06:04:14.668883
raw_response:
  {"pulse_count": 22, "reputation": 0, "country": "Australia", "country_code": "AU", "city": "Alexandria", "asn": "AS20473 the constant company  llc", "indicator": "45.77.237.252", "tags": ["Gamaredon", "microsoft word", "team", "appdata", "service", "Exfil", "threatactor.primitivebear", "Trident Ursa", "word", "base64encoded", "armageddon", "ukraine", "Lnk Files", "ip address", "domain", "xorbytes", "threatactor/tridentursa", "null", "vbscript", "powershell", "threatactor/gamaredon", "newobject", "msctfmonitor", "VBS Script", "Phishing", "userprofile", "temp", "cisco talos", "never", "threatactor/actinium", "Gamaredon Group", "garmaredon", "cyber", "powershell code", "cybersecurity", "Military", "mitigation tips", "gamaredon apt", "umbrella", "url https", "are gamaredon", "cisco secure", "SpearPhishing", "Government", "username", "xorbyte", "sample", "path", "written", "getrandom"], "pulses": ["Gamaredon APT targets Ukrainian government agencies in new campaign", "Russian-Backed Gamaredon's Spyware Variants", "Gamaredon Leverages Microsoft Office Docs to Target Ukraine Government and Military", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Gamaredon Leverages Microsoft Office Docs to Target Ukraine Government and Military", "Ransomware Dopple Paymer IOCs", "Cisco Talos Intelligence Group - Comprehensive Threat Intelligence: Gamaredon APT targets Ukrainian government agencies in new campaign", "Gamaredon APT targets Ukrainian government agencies in new campaign", "Report Spam Author avatar Gamaredon APT targets Ukrainian government agencies in new campaign", "Cisco Tal


ioc_type: ipv4
ioc_value: 64.176.173.164
source: otx
validated_at: 2026-04-01T06:04:31.714863
raw_response:
  {"pulse_count": 6, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "64.176.173.164", "tags": ["execution", "restart", "service", "june", "first", "kazuar v3", "kazuar", "strong", "ukraine", "february", "amadey", "pteropaste", "vbscript", "powershell", "bridge", "persistence", "telegram", "snake", "defense", "c server", "pteroodd", "eset research", "pterographin", "oilrig", "invisimole", "tips", "wordpress site", "third", "kazuar c", "network ip", "april", "gamaredon", "ionos se", "turla", "virustotal", "kazuar v2"], "pulses": ["EbeeSep2025 Pt4", "EbeeSep2025 Pt5", "12-30-Sep-25", "IOC - Gamaredon X Turla collab", "Russian Hackers Gamaredon and Turla Deploy Kazuar Backdoor", "Gamaredon X Turla collab"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 77.46.148.242
source: otx
validated_at: 2026-04-01T06:04:39.331617
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Serbia", "country_code": "RS", "city": null, "asn": "AS8400 telekom srbija a.d.", "indicator": "77.46.148.242", "tags": ["execution", "restart", "service", "pterostew", "june", "first", "kazuar v3", "ukraine", "kazuar", "strong", "february", "amadey", "cyberespionage", "pteropaste", "fsb", "vbscript", "powershell", "bridge", "collaboration", "pterolnk", "persistence", "telegram", "russia", "snake", "defense", "c server", "pteroodd", "eset research", "pterographin", "oilrig", "invisimole", "tips", "wordpress site", "third", "kazuar c", "network ip", "april", "pteroeffigy", "gamaredon", "apt", "ionos se", "turla", "virustotal", "kazuar v2"], "pulses": ["Gamaredon X Turla collaboration", "EbeeSep2025 Pt4", "EbeeSep2025 Pt5", "12-30-Sep-25", "IOC - Gamaredon X Turla collab", "Malware Filter - Botnet List - 20-09-2025", "Russian Hackers Gamaredon and Turla Deploy Kazuar Backdoor", "Gamaredon X Turla collaboration", "Gamaredon X Turla collab"], "malware_count": 0, "passive_dns_count": 28, "malware_samples": [], "passive_dns": ["srmagroup.com", "vsresidence.rs", "aleksamatic.com", "new.ingas.rs", "www.agroletac.com", "goplast.gr", "mail.ronex.rs", "kazoil.rs", "tabakcoop.rs", "perlaluxapartmani.com", "vls.co.rs", "gvozdenovicsolar.rs", "www.gvozdenovicsolar.rs", "boma-court.rs", "petrouzinex.rs", "ronex.rs", "srmahome.com", "boma-court.com", "plastikgogic.site", "ingas.rs"]}


ioc_type: ipv4
ioc_value: 85.13.145.231
source: otx
validated_at: 2026-04-01T06:04:44.100924
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Loebau", "asn": "AS34788 neue medien muennich", "indicator": "85.13.145.231", "tags": ["execution", "restart", "service", "pterostew", "june", "first", "kazuar v3", "ukraine", "kazuar", "strong", "february", "amadey", "cyberespionage", "pteropaste", "fsb", "vbscript", "powershell", "bridge", "collaboration", "pterolnk", "persistence", "telegram", "russia", "snake", "defense", "c server", "pteroodd", "eset research", "pterographin", "oilrig", "invisimole", "tips", "wordpress site", "third", "kazuar c", "network ip", "april", "pteroeffigy", "gamaredon", "apt", "ionos se", "turla", "virustotal", "kazuar v2"], "pulses": ["Gamaredon X Turla collaboration", "EbeeSep2025 Pt4", "EbeeSep2025 Pt5", "12-30-Sep-25", "IOC - Gamaredon X Turla collab", "Malware Filter - Botnet List - 20-09-2025", "Russian Hackers Gamaredon and Turla Deploy Kazuar Backdoor", "Gamaredon X Turla collaboration", "Gamaredon X Turla collab"], "malware_count": 0, "passive_dns_count": 237, "malware_samples": [], "passive_dns": ["www.rwcsports.com", "rwcsports.com", "www.assets.extrarunde-biathlon.de", "assets.extrarunde-biathlon.de", "mirjamgerber.de", "www.mirjamgerber.de", "mrw-mas.com", "meshcotic.com", "v2.mtv-salzgitter.de", "www.v2.mtv-salzgitter.de", "podcast.extrarunde.com", "www.levensohn.christinahucke.de", "levensohn.christinahucke.de", "www.duerrhammer.com", "www.jfv-lohberg-shop.com", "jfv-lohberg-shop.com", "juwelierkern.at", "goebelgmbh.com", "www.gerber-artists.de", "gerber-artists.de"]}


ioc_type: ipv4
ioc_value: 46.30.188.187
source: otx
validated_at: 2026-04-01T06:05:00.018482
raw_response:
  {"pulse_count": 36, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": "Amsterdam", "asn": "AS8100 quadranet enterprises llc", "indicator": "46.30.188.187", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "malicious", "phishing", "aws iam", "amazon", "attack", "secure data", "ioc", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "Nextray", "rdp", "small", "carriers", "research", "cyber security", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "IOC Records Provided by @NextRayAI", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOC Records \u2192Provided by @NextRayAI", "HIVE           (Pulse created by RVS_i_am)", "HIVE           (Pulse created by RVS_i_am)", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE"], "malware_count": 3, "passive_dns_count": 1, "malware_samples": ["77f99b8bc55455100e05e12899c7b2caed905163e46042b15041cc3448df20d0", "c36cb4000691fc4e33014c21f831de331bded72b7d980654d29bc56cdef83717", "0c74b6ce15d8cf2370e1f533b7cbd7b9e68c70e95c88ae04893b35f4a15a34de"], "


ioc_type: ipv4
ioc_value: 178.255.43.30
source: otx
validated_at: 2026-04-01T06:05:18.573343
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Poland", "country_code": "PL", "city": null, "asn": "AS197155 artnet sp. z o.o.", "indicator": "178.255.43.30", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 104.161.58.10
source: otx
validated_at: 2026-04-01T06:05:29.348521
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Phoenix", "asn": "AS53755 input output flood llc", "indicator": "104.161.58.10", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 6, "malware_samples": [], "passive_dns": ["3vuwn8m.top", "us1px68.top", "r8te226.top", "pin13x8.top", "8lt7sdk.top", "fangtongban.com"]}


ioc_type: ipv4
ioc_value: 185.187.155.69
source: otx
validated_at: 2026-04-01T06:05:47.388087
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": null, "asn": "AS62240 clouvider limited", "indicator": "185.187.155.69", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 5.187.49.186
source: otx
validated_at: 2026-04-01T06:05:56.766306
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Poland", "country_code": "PL", "city": null, "asn": "AS197155 artnet sp. z o.o.", "indicator": "5.187.49.186", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 45.82.66.39
source: otx
validated_at: 2026-04-01T06:06:00.659030
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": null, "asn": "AS49981 worldstream b.v.", "indicator": "45.82.66.39", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 141.195.117.129
source: otx
validated_at: 2026-04-01T06:06:03.941184
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "141.195.117.129", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["lg.par-1.fr.radwebhosting.com"]}


ioc_type: ipv4
ioc_value: 103.144.139.253
source: otx
validated_at: 2026-04-01T06:06:28.654078
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Malaysia", "country_code": "MY", "city": null, "asn": "AS55720 gigabit hosting sdn bhd", "indicator": "103.144.139.253", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 6, "malware_samples": [], "passive_dns": ["www.shouye8.com", "www.dramahao.com", "www.dianyingbay.com", "ezshyxx.com", "www.ezshyxx.com", "www.duokanju.com"]}


ioc_type: ipv4
ioc_value: 185.177.126.225
source: otx
validated_at: 2026-04-01T06:06:32.710659
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": null, "asn": "AS49981 worldstream b.v.", "indicator": "185.177.126.225", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 7, "malware_samples": [], "passive_dns": ["preprod.mobilecamsx.com", "www.mobilecamsx.com", "mobilecamsx.com", "staging.olefans.com", "preprod.olefans.com", "ksadrama.com", "startbox.ltd"]}


ioc_type: ipv4
ioc_value: 185.100.234.105
source: otx
validated_at: 2026-04-01T06:06:51.873741
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": "Haarlem", "asn": "AS31120 padaco automatisering b.v.", "indicator": "185.100.234.105", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 45.137.21.10
source: otx
validated_at: 2026-04-01T06:07:10.761701
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Bangladesh", "country_code": "BD", "city": null, "asn": "AS51447 rootlayer web services ltd.", "indicator": "45.137.21.10", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 5.183.95.240
source: otx
validated_at: 2026-04-01T06:07:14.667390
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS31400 accelerated it services & consulting gmbh", "indicator": "5.183.95.240", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 37.28.153.214
source: otx
validated_at: 2026-04-01T06:07:34.010204
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Poland", "country_code": "PL", "city": null, "asn": "AS197155 artnet sp. z o.o.", "indicator": "37.28.153.214", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "IOCs - 20225111358 - ANIA Threat Feeds - IP Segment 3", "Server Scanning 09/05/2022"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 185.172.39.230
source: otx
validated_at: 2026-04-01T06:07:37.185309
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": "Amsterdam", "asn": "AS3320 deutsche telekom ag", "indicator": "185.172.39.230", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 162.216.243.210
source: otx
validated_at: 2026-04-01T06:07:41.838376
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS398019 dynu systems incorporated", "indicator": "162.216.243.210", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 9, "malware_samples": [], "passive_dns": ["porte11.com", "magtg.com", "topco.shop", "simple-feet.net", "tse.simple-feet.net", "pf-admin.tequenikality.net", "server1.tequenikality.net", "tequenikality.net", "162.216.243.210"]}


ioc_type: ipv4
ioc_value: 185.243.112.24
source: otx
validated_at: 2026-04-01T06:07:58.627724
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": null, "asn": "AS208258 access2.it group b.v.", "indicator": "185.243.112.24", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 5, "malware_samples": [], "passive_dns": ["app.185.243.112.24.sslip.io", "185.243.112.24.nip.io", "de24.connectv2rayng.biz", "www.login.microsoftonline.com.msftsec.com", "login.login.microsoftonline.com.msftsec.com"]}


ioc_type: ipv4
ioc_value: 185.243.115.124
source: otx
validated_at: 2026-04-01T06:08:01.771299
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS48314 michael sebastian schinzel trading as ip-projects gmbh & co. kg", "indicator": "185.243.115.124", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 45.86.162.170
source: otx
validated_at: 2026-04-01T06:08:05.586241
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": "Amsterdam", "asn": "AS8100 quadranet enterprises llc", "indicator": "45.86.162.170", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 172.86.73.187
source: otx
validated_at: 2026-04-01T06:08:34.193078
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Los Angeles", "asn": "AS46261 quickpacket  llc", "indicator": "172.86.73.187", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 46.30.189.91
source: otx
validated_at: 2026-04-01T06:08:37.638429
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS31400 accelerated it services & consulting gmbh", "indicator": "46.30.189.91", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["brewssh.com"]}


ioc_type: ipv4
ioc_value: 175.110.112.221
source: otx
validated_at: 2026-04-01T06:08:44.541577
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": null, "asn": "ASNone ", "indicator": "175.110.112.221", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 7, "malware_samples": [], "passive_dns": ["from.dashpoo.xyz", "g.dashpoo.xyz", "www.dashpoo.xyz", "elementweb.dashpoo.xyz", "rc.dashpoo.xyz", "dashpoo.xyz", "element.dashpoo.xyz"]}


ioc_type: ipv4
ioc_value: 155.138.238.169
source: otx
validated_at: 2026-04-01T06:08:48.287571
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Atlanta", "asn": "AS20473 the constant company  llc", "indicator": "155.138.238.169", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["cadevsolutions.com"]}


ioc_type: ipv4
ioc_value: 92.204.164.50
source: otx
validated_at: 2026-04-01T06:08:52.666526
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "", "country_code": "", "city": "", "asn": "AS29066 host europe gmbh", "indicator": "92.204.164.50", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 8, "malware_samples": [], "passive_dns": ["testdashboard.wasaneveri.com", "api.saamitradestar.com", "www.scsplindia.com", "scsplindia.com", "www.proeserve.com", "proeserve.com", "saamitradestar.com", "www.saamitradestar.com"]}


ioc_type: ipv4
ioc_value: 103.144.139.74
source: otx
validated_at: 2026-04-01T06:09:10.352129
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Malaysia", "country_code": "MY", "city": null, "asn": "AS55720 gigabit hosting sdn bhd", "indicator": "103.144.139.74", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 185.172.39.220
source: otx
validated_at: 2026-04-01T06:09:13.788644
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": "Amsterdam", "asn": "AS3320 deutsche telekom ag", "indicator": "185.172.39.220", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 5.183.95.158
source: otx
validated_at: 2026-04-01T06:09:43.602372
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS31400 accelerated it services & consulting gmbh", "indicator": "5.183.95.158", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["195be444b70b09260bea365c3de454778444949df21f3577e1caf9534cb04fb8"]}


ioc_type: ipv4
ioc_value: 193.29.56.221
source: otx
validated_at: 2026-04-01T06:10:01.708487
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS48314 michael sebastian schinzel trading as ip-projects gmbh & co. kg", "indicator": "193.29.56.221", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 175.110.114.9
source: otx
validated_at: 2026-04-01T06:10:20.443489
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": null, "asn": "ASNone ", "indicator": "175.110.114.9", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 45.137.21.11
source: otx
validated_at: 2026-04-01T06:10:38.389170
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Bangladesh", "country_code": "BD", "city": null, "asn": "AS51447 rootlayer web services ltd.", "indicator": "45.137.21.11", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 66.206.13.130
source: otx
validated_at: 2026-04-01T06:10:56.842915
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "New York", "asn": "AS29802 hivelocity  inc.", "indicator": "66.206.13.130", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 185.243.114.9
source: otx
validated_at: 2026-04-01T06:11:29.455886
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS48314 michael sebastian schinzel trading as ip-projects gmbh & co. kg", "indicator": "185.243.114.9", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "tsec", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "honeypot", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "la-safe.org", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "tpot19", "august", "identity center", "data exchange", "iam identity"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "LCIA:HoneyNet:2022", "LCIA:HoneyNet:August 2022", "LCIA:HoneyNet:June 2022"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 46.30.189.62
source: otx
validated_at: 2026-04-01T06:11:52.181512
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS31400 accelerated it services & consulting gmbh", "indicator": "46.30.189.62", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 37.28.157.246
source: otx
validated_at: 2026-04-01T06:12:03.441218
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Poland", "country_code": "PL", "city": null, "asn": "AS197155 artnet sp. z o.o.", "indicator": "37.28.157.246", "tags": ["stop", "Python Remote Desktop Protocol MITM tool (PyRDP)", "zero trust", "trend vision", "protect", "service", "rogue", "ukraine", "ip address", "indonesia", "virustotal", "october", "rdp campaign", "data exfiltration", "RogueRDP", "threat insights", "spear-phishing", "device security", "earth koshchei", "aws iam", "amazon", "attack", "secure data", "learn", "apt & targeted attacks", "alliance", "latest news", "find", "trend micro", "hybrid", "rdp", "small", "carriers", "research", "midnight blizzard", "suomi", "apt29", "vision one", "koshchei", "aws secure", "tools", "target", "august", "identity center", "data exchange", "iam identity", "pyrdp", "TOR exit nodes"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 45.61.149.109
source: otx
validated_at: 2026-04-01T06:13:44.274045
raw_response:
  {"pulse_count": 8, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS46261 quickpacket  llc", "indicator": "45.61.149.109", "tags": ["service", "defender", "iocs", "bluesky", "ip address", "february", "domain", "cyberespionage", "window", "twitter", "moscow", "root certificates", "model", "russia", "snake", "apolloshadow", "secret blizzard", "firefox", "aitm", "asim", "file name", "microsoft", "wraith", "code", "aitm position", "sentinel", "turla"], "pulses": ["Frozen in transit: Secret Blizzard's AiTM campaign against diplomats", "IOC TCS- IP", "EbeeAugust2025 Pt3", "EbeeAugust2025 Pt1", "Frozen in transit: Secret Blizzard\u2019s AiTM campaign against diplomats | Microsoft Security Blog", "Frozen in transit: Secret Blizzard\u2019s AiTM campaign against diplomats | Microsoft Security Blog [by CyberHunter_NL]", "Frozen in transit: Secret Blizzard\u2019s AiTM campaign against diplomats | Microsoft Security Blog", "Frozen in transit: Secret Blizzard\u2019s AiTM campaign against diplomats."], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 65.21.51.58
source: otx
validated_at: 2026-04-01T06:14:17.863562
raw_response:
  {"pulse_count": 6, "reputation": 0, "country": "Finland", "country_code": "FI", "city": "Helsinki", "asn": "AS24940 hetzner online gmbh", "indicator": "65.21.51.58", "tags": ["hashes", "mimikatz", "execution", "ncsc", "service", "https", "stix", "powershell", "shell", "cert polska", "ck techniques", "indicator", "fileobj", "wellmail", "svr cyber", "cyber", "persistence", "cisa", "powersploit", "wellmess", "diplomatic orbiter", "simplehashvalue", "cyber actors", "graphicalproton", "mitre att", "technique title", "behavior", "encrypt", "enterprise", "cyboxcommon", "attackpatterns", "april", "title", "cozybear", "hash", "sorefang"], "pulses": ["Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally | CISA", "AA23-347A Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally", "Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally | CISA", "Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally | CISA", "Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally | CISA", "Russian Foreign Intelligence Service (SVR)  Exploiting JetBrains TeamCity CVE Globally"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 85.239.52.32
source: otx
validated_at: 2026-04-01T06:14:36.249721
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS62005 bluevps ou", "indicator": "85.239.52.32", "tags": ["lostkeys", "cti weekly", "gtig", "coldcopy", "clickfix", "june", "iocs", "coldcopy domain", "yesrobot c2", "mayberobot", "article", "weekly digest", "powershell", "digest article", "gc3 cti", "norobot", "coldriver", "python", "indicator", "simplefix", "download", "malware", "mayberobot c2", "russian state-sponsored", "zscaler", "backdoor", "yesrobot", "august", "indicator type"], "pulses": ["To Be (A Robot) or Not to Be: New Malware Attributed to Russia State-Sponsored COLDRIVER", "OS - Threat Intel IOCs IPs", "EbeeOct2025 Pt3", "Malware Filter - Botnet List - 22-10-2025", "Cyber Threat Advisory - COLDRIVER Unleashes ROBOT Malware Suite Following LOSTKEYS Exposure", "To Be (A Robot) or Not to Be: New Malware Attributed to Russia State-Sponsored COLDRIVER | Google Cloud Blog", "To Be (A Robot) or Not to Be: New Malware Attributed to Russia State-Sponsored COLDRIVER", "To Be (A Robot) or Not to Be: New Malware Attributed to Russia State-Sponsored COLDRIVER", "IOC -  To Be (A Robot) or Not to Be: New Malware Attributed to Russia", "IOC - To Be (A Robot) or Not to Be: New Malware Attributed to Russia State-Sponsored COLDRIVER"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 193.187.148.169
source: otx
validated_at: 2026-04-01T06:14:48.288287
raw_response:
  {"pulse_count": 21, "reputation": 0, "country": "Romania", "country_code": "RO", "city": "Bucharest", "asn": "AS35505 pronet solutii it srl", "indicator": "193.187.148.169", "tags": ["filen", "execution", "filehashmd5", "eu", "syria", "oper informativ", "nato", "iocs", "prismex", "filehashsha1", "word", "covenant", "ukraine", "network", "cve-2026-21509", "com hijacking", "notdoor", "ip address", "domains", "windows", "czech republic", "simpleloader", "onedrivehealth", "slovak", "bypass", "filehashsha256", "ips domain", "final", "compromise", "prismexdrop", "#supportsitewebsiteabuse #rootcertificatefailure #cryptographicf", "microsoft office", "ipv6240e", "prismexloader", "steganography", "prismexstager", "uac0001", "cyber threat", "beardshell", "critical infrastructure", "outlook", "persistence", "proton", "romania", "webdav", "inprocserver32", "certua", "create tn", "f tn", "redacted"], "pulses": ["Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities", "Danger Bulletin: Cyberattacks Against Ukraine and EU Countries Using CVE-2026-21509 Exploit", "Hybrid Managed Service Actor / provisioned insider", "Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities", "Rare Tier 1 Persistence - Critical \"Patched\", Non Patched Vulnerabilities Remain bypassing Lockdown Mode", "zero trust", "IOC - Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities", "hostasa.org", "hostasa.org", "151.101.0.22", "APT28s Stealthy Multi-Stage Campaign Leveraging CVE202621509 and Cloud C2 Infrastructure", "EbeeFeb2026 Pt2", "EbeeFeb2026 Pt1", "Malware Filter - Botnet List - 05-02-2026 (Part 2)", "IOC - APT28\u2019s Stealthy Multi-Stage Campaign Leveraging CVE\u20112026\u201121509 and Cloud C2 Infrastructure", "Danger Bulletin: Cyberattacks Against Ukraine and EU Countries Using CVE-2026-21509 Exploit", "CVE-2026-21509: APT28 Actively Exploits Microsoft Office Vulnerability in Ukrai


ioc_type: ipv4
ioc_value: 23.227.202.14
source: otx
validated_at: 2026-04-01T06:15:06.962121
raw_response:
  {"pulse_count": 13, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Tampa", "asn": "AS29802 hivelocity  inc.", "indicator": "23.227.202.14", "tags": ["filen", "execution", "filehashmd5", "eu", "team", "syria", "oper informativ", "nato", "iocs", "prismex", "filehashsha1", "programdata", "covenant", "ukraine", "network", "cve-2026-21509", "com hijacking", "notdoor", "ip address", "domains", "windows", "simpleloader", "onedrivehealth", "slovak", "bypass", "filehashsha256", "ips domain", "final", "compromise", "prismexdrop", "microsoft office", "ipv6240e", "prismexloader", "steganography", "prismexstager", "uac0001", "cyber threat", "beardshell", "critical infrastructure", "outlook", "persistence", "proton", "webdav", "inprocserver32", "certua", "create tn", "f tn", "redacted", "cve202621509", "filen cloud"], "pulses": ["Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities", "Danger Bulletin: Cyberattacks Against Ukraine and EU Countries Using CVE-2026-21509 Exploit", "Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities", "IOC - Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities", "APT28s Stealthy Multi-Stage Campaign Leveraging CVE202621509 and Cloud C2 Infrastructure", "EbeeFeb2026 Pt1", "EbeeFeb2026 Pt2", "IOC - APT28\u2019s Stealthy Multi-Stage Campaign Leveraging CVE\u20112026\u201121509 and Cloud C2 Infrastructure", "Danger Bulletin: Cyberattacks Against Ukraine and EU Countries Using CVE-2026-21509 Exploit", "CVE-2026-21509: APT28 Actively Exploits Microsoft Office Vulnerability in Ukraine", "Microsoft Office 0-day Vulnerability Exploited By Threat Actors to Deploy  Malware", "\"Danger Bulletin\": UAC-0001 (APT28) carries out cyberattacks against Ukraine and EU countries using the CVE-2026-21509 exploit (CERT-UA#19542)", "\"\u0411\u044e\u043b\u0435\u0442\u0435\u043d\u044c \u043d\u0435\u0431\u0435\u0437\u


ioc_type: ipv4
ioc_value: 72.62.185.31
source: otx
validated_at: 2026-04-01T06:15:24.967242
raw_response:
  {"pulse_count": 8, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Phoenix", "asn": "AS1239 sprint", "indicator": "72.62.185.31", "tags": ["execution", "filehashmd5", "syria", "oper informativ", "nato", "prismex", "filehashsha1", "covenant", "ukraine", "network", "cve-2026-21509", "ip address", "notdoor", "domains", "simpleloader", "slovak", "bypass", "filehashsha256", "ips domain", "final", "prismexdrop", "ipv6240e", "phishing", "prismexloader", "steganography", "prismexstager", "uac0001", "beardshell", "critical infrastructure", "outlook", "persistence", "proton", "certua", "cve202621509", "defense evasion", "minidoor", "email address", "yara", "cve-2026-21513", "cve20261281 cve", "europe", "supply chain", "apt28"], "pulses": ["Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities", "Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities", "IOC - Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities", "APT28s Stealthy Multi-Stage Campaign Leveraging CVE202621509 and Cloud C2 Infrastructure", "EbeeFeb2026 Pt2", "IOC - APT28\u2019s Stealthy Multi-Stage Campaign Leveraging CVE\u20112026\u201121509 and Cloud C2 Infrastructure", "Twitter Feed - skocherhan - 03-02-2026", "Malware Filter - Botnet List - 03-02-2026 (Part 5)"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["be859b4f4576ec09b69a2ef2d119939f7eb31de121aa01d38e1f0b2290f5a15e"]}


ioc_type: ipv4
ioc_value: 142.11.206.73
source: otx
validated_at: 2026-04-01T06:15:45.483077
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS54290 hostwinds llc.", "indicator": "142.11.206.73", "tags": ["write", "macos", "linux python", "network", "cicd", "windows", "c2 url", "install", "vbscript", "powershell", "github actions", "python", "malicious", "c2 domain", "stepsecurity", "post body", "kics", "copy", "verify", "linux", "c2 post", "http", "hardenrunner", "c2 ip"], "pulses": ["Axios Package Hijacked to Execute Remote Access Attacks", "IOC - axios Compromised on npm - Malicious Versions Drop Remote Access Trojan", "Axios Package Hijacked to Execute Remote Access Attacks"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 195.3.220.48
source: otx
validated_at: 2026-04-01T12:00:55.223977
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Poland", "country_code": "PL", "city": null, "asn": "AS201814 meverywhere sp. z o.o.", "indicator": "195.3.220.48", "tags": ["stop", "midnight blizzard", "october", "spear-phishing", "alliance", "research", "vision one", "service", "rdp", "ukraine", "ip address", "earth koshchei", "trend micro", "rogue", "suomi", "hybrid", "apt & targeted attacks", "koshchei", "Python Remote Desktop Protocol MITM tool (PyRDP)", "threat insights", "iam identity", "latest news", "amazon", "learn", "virustotal", "zero trust", "tools", "TOR exit nodes", "RogueRDP", "rdp campaign", "carriers", "secure data", "protect", "data exchange", "small", "indonesia", "identity center", "trend vision", "aws iam", "attack", "pyrdp", "find", "device security", "target", "data exfiltration", "aws secure", "apt29", "august"], "pulses": ["Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks", "Hackers Weaponize Red Team Tools in RDP Campaigns", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks | Trend Micro (US)", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration", "Hackers Leverage Red Team Tools in RDP Attacks Via TOR & VPN for Data Exfiltration"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 5.255.122.118
source: otx
validated_at: 2026-04-01T12:01:12.692194
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": null, "asn": "AS60404 the infrastructure group b.v.", "indicator": "5.255.122.118", "tags": ["eclecticiq", "screen", "cyber", "alliance", "python", "rdp", "darkcrystal", "ukraine", "threat", "loader", "defence", "strong", "backorder", "stealth", "dark crystal", "kms update", "crypto cyber", "virustotal", "tools", "liberty", "monitoring", "april", "protect", "kalambur", "cluster", "dcrat", "kms activation", "confidential", "sandworm", "time", "classification", "defender", "ssh", "online", "blackenergy", "february", "windows"], "pulses": ["IOC TCS- IP", "Sandworm APT Deploys DcRAT Via Trojanized KMS Tools", "Sandworm APT Deploys DcRAT Via Trojanized KMS Tools", "Sandworm APT Targets Ukrainian Users with Trojanized Microsoft KMS Activation Tools in Cyber Espionage Campaigns"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 142.11.206.72
source: shodan
validated_at: 2026-04-02T06:01:05.953391
raw_response:
  {"ports": [22, 80], "vulns": ["CVE-2023-27522", "CVE-2024-24795", "CVE-2023-31122", "CVE-2023-38709", "CVE-2022-28330", "CVE-2024-38473", "CVE-2024-40898", "CVE-2025-59775", "CVE-2022-22721", "CVE-2013-0942", "CVE-2013-4365", "CVE-2024-38476", "CVE-2025-53020", "CVE-2025-65082", "CVE-2012-4360", "CVE-2025-58098", "CVE-2022-28615", "CVE-2024-42516", "CVE-2024-43394", "CVE-2023-25690", "CVE-2013-2765", "CVE-2009-0796", "CVE-2024-27316", "CVE-2007-4723", "CVE-2022-22720", "CVE-2009-2299", "CVE-2012-4001", "CVE-2025-23048", "CVE-2024-38472", "CVE-2024-47252", "CVE-2025-49812", "CVE-2025-55753", "CVE-2022-36760", "CVE-2022-22719", "CVE-2013-0941", "CVE-2012-3526", "CVE-2025-66200", "CVE-2024-43204", "CVE-2024-38474", "CVE-2022-28614", "CVE-2022-29404", "CVE-2025-49630", "CVE-2023-45802", "CVE-2022-37436", "CVE-2022-23943", "CVE-2022-30556", "CVE-2024-38475", "CVE-2011-2688", "CVE-2022-26377", "CVE-2024-38477", "CVE-2022-31813", "CVE-2006-20001", "CVE-2011-1176", "CVE-2024-39573"], "hostnames": ["hwsrv-1270163.hostwindsdns.com"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/a:apache:http_server:2.4.52"]}


ioc_type: ipv4
ioc_value: 142.11.206.72
source: otx
validated_at: 2026-04-02T06:01:12.253788
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS54290 hostwinds llc.", "indicator": "142.11.206.72", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 12, "malware_samples": [], "passive_dns": ["www.atads.erau-research.net", "avopsinsight.com", "www.avopsinsight.com", "atads.erau-research.net", "www.erau-research.net", "erau-research.net", "adsvergroup.us", "hwsrv-873556.hostwindsdns.com", "jbmtest.jobmarket.cc", "www.jbmtest.jobmarket.cc", "jobmarket.cc", "www.jobmarket.cc"]}


ioc_type: ipv4
ioc_value: 162.159.140.167
source: otx
validated_at: 2026-04-02T18:03:13.290782
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "", "country_code": "", "city": "", "asn": "AS13335 cloudflare", "indicator": "162.159.140.167", "tags": ["Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi", "ip address", "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71", "9698f46495ce9401c8bcaf9a2afe1598", "status code", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)", "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link"], "pulses": ["\u201cBroken Seal\u201d DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)", "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos", "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos", "Broadcom."], "malware_count": 6, "passive_dns_count": 0, "malware_samples": ["61e806a0bb119838a14dbbb9c078c3bb47a66f3e6ff4ef880ac5f84f72968d85", "2087a2c3e57b615446e064ea2561ee73e0e34fa05fd3258b177cd1c643067430", "aa949a845cb0440061c6a6b6d78eb3747b3547abb35e23cca70cb4ace86a245d", "dc897832655254307be76f01cc8f9bf71a6c5de7b24ac947f84d29706f190fd3", "ed45213dc98a17a1533c3593441dfd765f4d48bcfd7b6b2a5806bb6b4a325338", "edb3175bca6d281e688080c2c033de4afd1c7753e72de693dd1135aeb8fc4bde"]}


ioc_type: ipv4
ioc_value: 172.66.0.165
source: otx
validated_at: 2026-04-02T18:03:30.624342
raw_response:
  {"pulse_count": 6, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "172.66.0.165", "tags": ["next", "cape", "search otx", "as62597 nsone", "meta", "newprotocol", "present sep", "443 ma2592000", "msie", "hostname add", "meta name", "ipv4 add", "formbook cnc", "medium", "america asn", "span p", "level", "aaaa", "write", "accept accept", "url http", "levelblue", "passive dns", "expiro malware", "analysis date", "python", "japan unknown", "notifications", "pe32", "as43830", "named pipe", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link", "ieedge chrome1", "pragma", "as396982 google", "dongjun jeong", "agent", "related nids", "brian sabey", "all scoreblue", "malware", "a nxdomain", "query", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)", "infosec journey", "iemobile", "pulse pulses", "nxdomain", "stars", "domains top"], "pulses": ["\u201cBroken Seal\u201d DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)", "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos", "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos", "Mirai \u2022 Cycbot - Who is Dennis Schroeder (303) 444-4444 | Social Engineering ~ Legal", "Mirai \u2022 Cycbot - Who is Dennis Schroeder (303) 444-4444 | Social Engineering ~ Legal", "Zendesk as VirusTotal \u00bb Ransom:Win32/CVE"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["e45fad70aa7a225fe50ef06ad29305e4d3ca95620068db83adab91359289c0d5"]}


ioc_type: ipv4
ioc_value: 159.203.21.16
source: shodan
validated_at: 2026-04-02T18:26:13.702388
raw_response:
  {"ports": [21, 22, 25, 53, 80, 110, 143, 443, 465, 587, 995, 2082, 2083, 2086, 2087, 2095], "vulns": ["CVE-2023-3817", "CVE-2023-0465", "CVE-2019-11358", "CVE-2023-4807", "CVE-2022-31628", "CVE-2020-7068", "CVE-2020-7069", "CVE-2012-4360", "CVE-2022-2097", "CVE-2023-38408", "CVE-2015-9251", "CVE-2025-69420", "CVE-2023-48795", "CVE-2025-55753", "CVE-2024-3566", "CVE-2009-3766", "CVE-2022-0778", "CVE-2020-7070", "CVE-2011-1176", "CVE-2007-3205", "CVE-2017-8923", "CVE-2023-0286", "CVE-2022-37454", "CVE-2025-59775", "CVE-2025-65082", "CVE-2025-69421", "CVE-2025-58098", "CVE-2007-2768", "CVE-2009-3765", "CVE-2007-4723", "CVE-2024-25117", "CVE-2024-0727", "CVE-2023-0215", "CVE-2021-4160", "CVE-2023-51767", "CVE-2023-5678", "CVE-2021-41617", "CVE-2023-0466", "CVE-2011-2688", "CVE-2022-31629", "CVE-2013-2220", "CVE-2022-4900", "CVE-2016-20012", "CVE-2023-0464", "CVE-2023-2650", "CVE-2020-15778", "CVE-2021-3711", "CVE-2026-22796", "CVE-2013-0942", "CVE-2025-69418", "CVE-2023-51385", "CVE-2025-69419", "CVE-2009-3767", "CVE-2019-16905", "CVE-2013-2765", "CVE-2012-4001", "CVE-2025-32728", "CVE-2013-0941", "CVE-2022-4304", "CVE-2008-3844", "CVE-2020-11022", "CVE-2019-0190", "CVE-2013-4365", "CVE-2022-2068", "CVE-2025-26465", "CVE-2009-0796", "CVE-2020-14145", "CVE-2009-2299", "CVE-2026-22795", "CVE-2020-11023", "CVE-2021-36368", "CVE-2022-1292", "CVE-2019-11048", "CVE-2012-3526", "CVE-2025-66200", "CVE-2024-5458", "CVE-2021-3712", "CVE-2022-4450", "CVE-2025-68160", "CVE-2009-1390"], "hostnames": ["crm.pardonsandwaivers.com", "prd.pardonsandwaivers.com"], "tags": ["self-signed", "eol-product", "cloud", "starttls"], "cpes": ["cpe:/a:php:php:7.4.33", "cpe:/a:apache:http_server:2.4.65", "cpe:/o:unix:unix", "cpe:/a:jquery:jquery", "cpe:/a:pureftpd:pure-ftpd", "cpe:/a:openssl:openssl:1.1.1k", "cpe:/a:jquery:jquery_ui", "cpe:/a:php:php:7.2.30", "cpe:/a:postfix:postfix", "cpe:/a:getbootstrap:bootstrap", "cpe:/a:openbsd:openssh:8.0", "cpe:/a:control-webpanel:webpanel", "cpe:/a:jquery:jqu


ioc_type: ipv4
ioc_value: 165.232.136.224
source: shodan
validated_at: 2026-04-02T18:26:23.321743
raw_response:
  {"ports": [80, 135, 137, 3306], "vulns": ["CVE-2025-14177", "CVE-2024-3566", "CVE-2025-1734", "CVE-2025-6491", "CVE-2024-11235", "CVE-2025-1736", "CVE-2025-1217", "CVE-2013-2220", "CVE-2025-1861", "CVE-2025-1219", "CVE-2007-3205", "CVE-2025-14180", "CVE-2023-44487", "CVE-2025-1735", "CVE-2025-1220", "CVE-2025-14178", "CVE-2025-23419"], "hostnames": [], "tags": ["eol-product", "cloud", "database"], "cpes": ["cpe:/a:php:php:8.4.1", "cpe:/a:mariadb:mariadb:10.11.2-MariaDB", "cpe:/a:f5:nginx:1.23.3"]}


ioc_type: ipv4
ioc_value: 185.20.225.35
source: shodan
validated_at: 2026-04-02T18:26:38.357278
raw_response:
  {"ports": [21, 25, 80, 110, 143, 443, 465, 587, 993, 995, 3306, 7777, 8888], "vulns": ["CVE-2025-67896", "CVE-2020-28024", "CVE-2023-42114", "CVE-2020-28025", "CVE-2024-39929", "CVE-2022-37452", "CVE-2020-28007", "CVE-2020-28013", "CVE-2023-51766", "CVE-2020-28019", "CVE-2020-28021", "CVE-2025-23419", "CVE-2021-38371", "CVE-2020-28008", "CVE-2020-28026", "CVE-2023-42115", "CVE-2020-28011", "CVE-2020-8015", "CVE-2020-28017", "CVE-2022-37451", "CVE-2020-12783", "CVE-2020-28022", "CVE-2023-42117", "CVE-2020-28012", "CVE-2021-27216", "CVE-2020-28009", "CVE-2022-3559", "CVE-2020-28023", "CVE-2020-28018", "CVE-2021-3618", "CVE-2023-42119", "CVE-2023-44487", "CVE-2020-28014", "CVE-2020-28016", "CVE-2020-28015", "CVE-2023-42116", "CVE-2020-28010"], "hostnames": ["185-20-225-35.cloudvps.regruhosting.ru"], "tags": ["self-signed", "eol-product", "starttls", "database"], "cpes": ["cpe:/a:f5:nginx", "cpe:/a:exim:exim:4.93", "cpe:/a:oracle:mysql", "cpe:/a:f5:nginx:1.20.2"]}


ioc_type: ipv4
ioc_value: 188.225.44.181
source: shodan
validated_at: 2026-04-02T18:27:00.235356
raw_response:
  {"ports": [22, 80], "vulns": ["CVE-2006-20001", "CVE-2024-38476", "CVE-2024-24795", "CVE-2023-45802", "CVE-2024-38477", "CVE-2007-4723", "CVE-2022-30556", "CVE-2024-38472", "CVE-2022-29404", "CVE-2009-0796", "CVE-2025-49630", "CVE-2025-53020", "CVE-2025-65082", "CVE-2011-2688", "CVE-2025-58098", "CVE-2024-43204", "CVE-2025-55753", "CVE-2012-4360", "CVE-2023-31122", "CVE-2022-22720", "CVE-2023-25690", "CVE-2025-66200", "CVE-2013-4365", "CVE-2025-49812", "CVE-2022-26377", "CVE-2022-22719", "CVE-2022-28614", "CVE-2025-59775", "CVE-2022-22721", "CVE-2022-28330", "CVE-2022-28615", "CVE-2024-38475", "CVE-2022-36760", "CVE-2024-39573", "CVE-2012-4001", "CVE-2024-43394", "CVE-2024-40898", "CVE-2025-23048", "CVE-2011-1176", "CVE-2012-3526", "CVE-2023-38709", "CVE-2024-38474", "CVE-2024-42516", "CVE-2023-27522", "CVE-2013-0942", "CVE-2024-38473", "CVE-2024-27316", "CVE-2013-2765", "CVE-2009-2299", "CVE-2013-0941", "CVE-2024-47252", "CVE-2022-37436", "CVE-2022-31813", "CVE-2022-23943"], "hostnames": ["1357577-cu17374.tw1.ru"], "tags": [], "cpes": ["cpe:/a:apache:http_server:2.4.52", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/o:canonical:ubuntu_linux"]}


ioc_type: ipv4
ioc_value: 194.58.103.22
source: shodan
validated_at: 2026-04-02T18:27:09.930391
raw_response:
  {"ports": [21, 22, 25, 53, 110, 465, 587, 993, 995], "vulns": ["CVE-2020-28023", "CVE-2020-28011", "CVE-2020-8015", "CVE-2020-28012", "CVE-2020-28026", "CVE-2020-28008", "CVE-2023-42114", "CVE-2020-28007", "CVE-2020-28013", "CVE-2020-28021", "CVE-2021-27216", "CVE-2020-28022", "CVE-2020-28019", "CVE-2024-39929", "CVE-2023-42116", "CVE-2022-37452", "CVE-2022-37451", "CVE-2020-28024", "CVE-2020-12783", "CVE-2021-38371", "CVE-2023-51766", "CVE-2025-67896", "CVE-2023-42117", "CVE-2023-42115", "CVE-2020-28010", "CVE-2020-28015", "CVE-2022-3559", "CVE-2020-28018", "CVE-2020-28009", "CVE-2020-28016", "CVE-2023-42119", "CVE-2020-28025", "CVE-2020-28014", "CVE-2020-28017"], "hostnames": ["800degrees.ru"], "tags": ["starttls", "self-signed"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.2p1", "cpe:/a:exim:exim:4.93"]}


ioc_type: ipv4
ioc_value: 194.58.122.212
source: shodan
validated_at: 2026-04-02T18:27:20.434394
raw_response:
  {"ports": [21, 22, 25, 53, 110, 143, 443, 465, 587, 993, 995], "vulns": ["CVE-2025-67896", "CVE-2008-3844", "CVE-2023-42114", "CVE-2019-6110", "CVE-2019-6111", "CVE-2018-15473", "CVE-2024-39929", "CVE-2020-15778", "CVE-2023-51766", "CVE-2025-23419", "CVE-2025-26465", "CVE-2023-51385", "CVE-2023-42115", "CVE-2022-37451", "CVE-2007-2768", "CVE-2023-38408", "CVE-2023-42117", "CVE-2022-3620", "CVE-2022-3559", "CVE-2020-14145", "CVE-2021-3618", "CVE-2025-32728", "CVE-2023-42119", "CVE-2023-44487", "CVE-2023-48795", "CVE-2017-15906", "CVE-2021-36368", "CVE-2018-15919", "CVE-2023-51767", "CVE-2021-41617", "CVE-2019-6109", "CVE-2018-20685", "CVE-2023-42116", "CVE-2016-20012"], "hostnames": ["korpusnyak.ru", "www.korpusnyak.ru", "prinfix.ru"], "tags": ["self-signed", "eol-product", "starttls"], "cpes": ["cpe:/a:f5:nginx:1.20.2", "cpe:/a:exim:exim:4.95", "cpe:/a:openbsd:openssh:7.4"]}


ioc_type: ipv4
ioc_value: 194.58.98.215
source: shodan
validated_at: 2026-04-02T18:27:25.776852
raw_response:
  {"ports": [22, 80, 443, 8070], "vulns": ["CVE-2019-6109", "CVE-2019-6110", "CVE-2023-51385", "CVE-2018-20685", "CVE-2025-32728", "CVE-2023-38408", "CVE-2008-3844", "CVE-2019-6111", "CVE-2021-36368", "CVE-2007-2768", "CVE-2023-48795", "CVE-2018-15919", "CVE-2020-15778", "CVE-2021-41617", "CVE-2017-15906", "CVE-2025-26465", "CVE-2023-51767", "CVE-2018-15473", "CVE-2016-20012", "CVE-2020-14145"], "hostnames": ["194-58-98-215.cloudvps.regruhosting.ru"], "tags": ["self-signed"], "cpes": ["cpe:/a:openbsd:openssh:7.4", "cpe:/a:f5:nginx"]}


ioc_type: ipv4
ioc_value: 194.67.109.14
source: shodan
validated_at: 2026-04-02T18:27:28.122825
raw_response:
  {"ports": [21, 22, 25, 53, 80, 110, 123, 143, 443, 587, 993, 995, 1500], "vulns": ["CVE-2023-44487", "CVE-2024-39929", "CVE-2023-42116", "CVE-2022-3559", "CVE-2023-51766", "CVE-2025-67896", "CVE-2023-42117", "CVE-2025-23419", "CVE-2023-42115", "CVE-2023-42114", "CVE-2023-42119", "CVE-2021-23017", "CVE-2022-3620", "CVE-2022-37451", "CVE-2021-3618"], "hostnames": ["194-67-109-14.cloudvps.regruhosting.ru"], "tags": ["starttls", "eol-product", "self-signed"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:exim:exim:4.95", "cpe:/a:f5:nginx:1.18.0", "cpe:/o:linux:linux_kernel", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/a:ntp:ntp:3"]}


ioc_type: ipv4
ioc_value: 194.67.113.186
source: shodan
validated_at: 2026-04-02T18:27:35.104852
raw_response:
  {"ports": [21, 22], "vulns": ["CVE-2019-6109", "CVE-2019-6110", "CVE-2023-51385", "CVE-2018-20685", "CVE-2025-32728", "CVE-2023-38408", "CVE-2008-3844", "CVE-2019-6111", "CVE-2021-36368", "CVE-2007-2768", "CVE-2023-48795", "CVE-2018-15919", "CVE-2020-15778", "CVE-2021-41617", "CVE-2017-15906", "CVE-2025-26465", "CVE-2023-51767", "CVE-2018-15473", "CVE-2016-20012", "CVE-2020-14145"], "hostnames": ["194-67-113-186.cloudvps.regruhosting.ru"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:7.4", "cpe:/a:pureftpd:pure-ftpd"]}


ioc_type: ipv4
ioc_value: 194.67.113.50
source: shodan
validated_at: 2026-04-02T18:27:36.380430
raw_response:
  {"ports": [443], "vulns": ["CVE-2024-24795", "CVE-2020-1934", "CVE-2022-30556", "CVE-2025-53020", "CVE-2024-43204", "CVE-2025-55753", "CVE-2025-66200", "CVE-2021-32786", "CVE-2022-28614", "CVE-2025-59775", "CVE-2020-13938", "CVE-2024-40898", "CVE-2025-23048", "CVE-2011-1176", "CVE-2024-38474", "CVE-2020-35452", "CVE-2013-2765", "CVE-2023-38709", "CVE-2024-47252", "CVE-2021-32792", "CVE-2022-31813", "CVE-2022-23943", "CVE-2023-45802", "CVE-2021-26690", "CVE-2022-29404", "CVE-2021-33193", "CVE-2020-13950", "CVE-2025-65082", "CVE-2011-2688", "CVE-2021-32785", "CVE-2021-32791", "CVE-2023-25690", "CVE-2021-44790", "CVE-2022-22721", "CVE-2022-28615", "CVE-2012-4001", "CVE-2024-43394", "CVE-2019-17567", "CVE-2012-3526", "CVE-2021-30641", "CVE-2024-38473", "CVE-2006-20001", "CVE-2024-38476", "CVE-2021-40438", "CVE-2024-38472", "CVE-2025-49630", "CVE-2020-11993", "CVE-2023-31122", "CVE-2022-22720", "CVE-2013-4365", "CVE-2022-22719", "CVE-2021-34798", "CVE-2020-1927", "CVE-2024-27316", "CVE-2009-2299", "CVE-2013-0941", "CVE-2022-37436", "CVE-2024-38477", "CVE-2007-4723", "CVE-2009-0796", "CVE-2025-58098", "CVE-2021-39275", "CVE-2012-4360", "CVE-2020-11984", "CVE-2025-49812", "CVE-2022-26377", "CVE-2021-44224", "CVE-2022-28330", "CVE-2024-38475", "CVE-2022-36760", "CVE-2024-39573", "CVE-2021-36160", "CVE-2020-9490", "CVE-2024-42516", "CVE-2023-27522", "CVE-2013-0942", "CVE-2021-26691"], "hostnames": ["194-67-113-50.cloudvps.regruhosting.ru", "sfmai.ru"], "tags": [], "cpes": ["cpe:/a:apache:http_server:2.4.41"]}


ioc_type: ipv4
ioc_value: 209.97.165.187
source: shodan
validated_at: 2026-04-02T18:27:57.570800
raw_response:
  {"ports": [80, 81, 443], "vulns": ["CVE-2024-24795", "CVE-2020-1934", "CVE-2022-30556", "CVE-2025-53020", "CVE-2024-43204", "CVE-2025-55753", "CVE-2025-66200", "CVE-2021-32786", "CVE-2022-28614", "CVE-2025-59775", "CVE-2020-13938", "CVE-2024-40898", "CVE-2025-23048", "CVE-2011-1176", "CVE-2024-38474", "CVE-2020-35452", "CVE-2013-2765", "CVE-2023-38709", "CVE-2024-47252", "CVE-2021-32792", "CVE-2022-31813", "CVE-2022-23943", "CVE-2023-45802", "CVE-2021-26690", "CVE-2022-29404", "CVE-2021-33193", "CVE-2020-13950", "CVE-2025-65082", "CVE-2011-2688", "CVE-2021-32785", "CVE-2025-23419", "CVE-2021-32791", "CVE-2023-25690", "CVE-2021-44790", "CVE-2021-3618", "CVE-2022-22721", "CVE-2022-28615", "CVE-2012-4001", "CVE-2024-43394", "CVE-2019-17567", "CVE-2012-3526", "CVE-2021-30641", "CVE-2024-38473", "CVE-2006-20001", "CVE-2024-38476", "CVE-2021-40438", "CVE-2024-38472", "CVE-2025-49630", "CVE-2021-23017", "CVE-2020-11993", "CVE-2023-31122", "CVE-2022-22720", "CVE-2013-4365", "CVE-2022-22719", "CVE-2021-34798", "CVE-2020-1927", "CVE-2024-27316", "CVE-2009-2299", "CVE-2013-0941", "CVE-2022-37436", "CVE-2024-38477", "CVE-2007-4723", "CVE-2009-0796", "CVE-2025-58098", "CVE-2021-39275", "CVE-2012-4360", "CVE-2020-11984", "CVE-2025-49812", "CVE-2022-26377", "CVE-2021-44224", "CVE-2023-44487", "CVE-2022-28330", "CVE-2024-38475", "CVE-2022-36760", "CVE-2024-39573", "CVE-2021-36160", "CVE-2020-9490", "CVE-2024-42516", "CVE-2023-27522", "CVE-2013-0942", "CVE-2021-26691"], "hostnames": ["pg.api789.work"], "tags": ["eol-product", "cloud"], "cpes": ["cpe:/a:apache:http_server:2.4.41", "cpe:/a:f5:nginx:1.18.0", "cpe:/o:canonical:ubuntu_linux", "cpe:/o:linux:linux_kernel"]}


ioc_type: ipv4
ioc_value: 5.63.154.128
source: shodan
validated_at: 2026-04-02T18:28:20.874879
raw_response:
  {"ports": [21, 22, 25, 80, 110, 143, 465, 587, 993, 995], "vulns": ["CVE-2020-28023", "CVE-2020-28011", "CVE-2020-8015", "CVE-2020-28012", "CVE-2020-28026", "CVE-2020-28008", "CVE-2023-42114", "CVE-2020-28007", "CVE-2020-28013", "CVE-2020-28021", "CVE-2021-27216", "CVE-2020-28022", "CVE-2020-28019", "CVE-2024-39929", "CVE-2023-42116", "CVE-2025-23419", "CVE-2022-37452", "CVE-2022-37451", "CVE-2021-3618", "CVE-2023-44487", "CVE-2020-28024", "CVE-2020-12783", "CVE-2021-38371", "CVE-2023-51766", "CVE-2025-67896", "CVE-2023-42117", "CVE-2023-42115", "CVE-2020-28010", "CVE-2020-28015", "CVE-2022-3559", "CVE-2020-28018", "CVE-2020-28009", "CVE-2020-28016", "CVE-2023-42119", "CVE-2020-28025", "CVE-2020-28014", "CVE-2020-28017"], "hostnames": ["5-63-154-128.cloudvps.regruhosting.ru"], "tags": ["starttls", "eol-product", "self-signed"], "cpes": ["cpe:/a:f5:nginx:1.20.2", "cpe:/a:openbsd:openssh:8.2p1", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:exim:exim:4.93"]}


ioc_type: ipv4
ioc_value: 80.78.241.253
source: shodan
validated_at: 2026-04-02T18:28:41.647904
raw_response:
  {"ports": [80, 443, 2008, 3001, 3004], "vulns": ["CVE-2023-27522", "CVE-2020-11984", "CVE-2024-38476", "CVE-2020-1927", "CVE-2012-4360", "CVE-2020-13950", "CVE-2024-43394", "CVE-2023-25690", "CVE-2019-17567", "CVE-2024-27316", "CVE-2021-33193", "CVE-2025-23048", "CVE-2020-1934", "CVE-2024-47252", "CVE-2025-55753", "CVE-2020-13938", "CVE-2021-32791", "CVE-2022-22719", "CVE-2021-44224", "CVE-2024-43204", "CVE-2022-37436", "CVE-2011-1176", "CVE-2023-31122", "CVE-2020-9490", "CVE-2023-38709", "CVE-2022-28330", "CVE-2024-40898", "CVE-2025-59775", "CVE-2025-65082", "CVE-2025-58098", "CVE-2022-28615", "CVE-2007-4723", "CVE-2021-30641", "CVE-2021-39275", "CVE-2025-49630", "CVE-2023-45802", "CVE-2022-30556", "CVE-2024-38475", "CVE-2011-2688", "CVE-2022-26377", "CVE-2024-39573", "CVE-2013-0942", "CVE-2020-11993", "CVE-2022-22721", "CVE-2021-36160", "CVE-2025-53020", "CVE-2021-26691", "CVE-2024-42516", "CVE-2013-2765", "CVE-2021-34798", "CVE-2012-4001", "CVE-2024-38472", "CVE-2025-49812", "CVE-2020-35452", "CVE-2013-0941", "CVE-2021-32792", "CVE-2006-20001", "CVE-2024-24795", "CVE-2024-38473", "CVE-2013-4365", "CVE-2021-40438", "CVE-2021-32785", "CVE-2021-26690", "CVE-2009-0796", "CVE-2022-22720", "CVE-2009-2299", "CVE-2022-36760", "CVE-2012-3526", "CVE-2025-66200", "CVE-2021-32786", "CVE-2024-38474", "CVE-2022-28614", "CVE-2022-29404", "CVE-2022-23943", "CVE-2022-31813", "CVE-2024-38477", "CVE-2021-44790"], "hostnames": ["vbahelpers.ru", "80-78-241-253.cloudvps.regruhosting.ru"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:expressjs:express", "cpe:/a:nodejs:node.js", "cpe:/a:apache:http_server:2.4.41", "cpe:/a:openbsd:openssh:8.2p1"]}


ioc_type: ipv4
ioc_value: 80.78.245.223
source: shodan
validated_at: 2026-04-02T18:28:48.813131
raw_response:
  {"ports": [21, 22, 53, 80, 110, 123, 143, 465, 587, 993, 995], "vulns": ["CVE-2023-44487", "CVE-2024-39929", "CVE-2023-42116", "CVE-2022-3559", "CVE-2023-51766", "CVE-2025-67896", "CVE-2023-42117", "CVE-2025-23419", "CVE-2023-42115", "CVE-2023-42114", "CVE-2023-42119", "CVE-2021-23017", "CVE-2022-3620", "CVE-2022-37451", "CVE-2021-3618"], "hostnames": ["80-78-245-223.cloudvps.regruhosting.ru"], "tags": ["starttls", "eol-product", "self-signed"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:exim:exim:4.95", "cpe:/a:f5:nginx:1.18.0", "cpe:/o:linux:linux_kernel", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/a:ntp:ntp:3"]}


ioc_type: ipv4
ioc_value: 80.78.248.222
source: shodan
validated_at: 2026-04-02T18:28:58.119468
raw_response:
  {"ports": [21, 22, 25, 53, 80, 110, 123, 443, 465, 587, 993, 995], "vulns": ["CVE-2025-67896", "CVE-2022-3620", "CVE-2022-3559", "CVE-2021-23017", "CVE-2023-42114", "CVE-2023-42115", "CVE-2024-39929", "CVE-2021-3618", "CVE-2023-42119", "CVE-2023-44487", "CVE-2022-37451", "CVE-2023-51766", "CVE-2023-42116", "CVE-2023-42117", "CVE-2025-23419"], "hostnames": ["profdom.ru"], "tags": ["self-signed", "eol-product", "starttls"], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/a:f5:nginx:1.18.0", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:exim:exim:4.95", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/a:ntp:ntp:3"]}


ioc_type: ipv4
ioc_value: 80.78.251.231
source: shodan
validated_at: 2026-04-02T18:29:01.661382
raw_response:
  {"ports": [22, 80, 443], "vulns": ["CVE-2025-65082", "CVE-2011-2688", "CVE-2025-59775", "CVE-2025-58098", "CVE-2013-0942", "CVE-2025-55753", "CVE-2013-2765", "CVE-2012-4360", "CVE-2009-2299", "CVE-2007-4723", "CVE-2013-0941", "CVE-2012-4001", "CVE-2009-0796", "CVE-2025-66200", "CVE-2013-4365", "CVE-2011-1176", "CVE-2012-3526"], "hostnames": ["tamos.ru", "80-78-251-231.cloudvps.regruhosting.ru", "www.tamos.ru"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:8.4p1", "cpe:/o:debian:debian_linux", "cpe:/a:apache:http_server:2.4.65", "cpe:/o:linux:linux_kernel"]}


ioc_type: ipv4
ioc_value: 80.78.254.238
source: shodan
validated_at: 2026-04-02T18:29:10.643111
raw_response:
  {"ports": [21, 22, 25, 53, 110, 443, 465, 587, 993, 995, 1500], "vulns": ["CVE-2008-3844", "CVE-2019-6110", "CVE-2019-6111", "CVE-2018-15473", "CVE-2020-15778", "CVE-2025-26465", "CVE-2023-51385", "CVE-2007-2768", "CVE-2023-38408", "CVE-2020-14145", "CVE-2025-32728", "CVE-2017-15906", "CVE-2023-48795", "CVE-2021-36368", "CVE-2018-15919", "CVE-2023-51767", "CVE-2021-41617", "CVE-2019-6109", "CVE-2018-20685", "CVE-2016-20012"], "hostnames": ["www.esdgroup.ru", "80-78-254-238.cloudvps.regruhosting.ru", "red55188.rdock.ru", "esdgroup.ru"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx", "cpe:/a:openbsd:openssh:7.4"]}


ioc_type: ipv4
ioc_value: 89.108.115.235
source: shodan
validated_at: 2026-04-02T18:29:37.487782
raw_response:
  {"ports": [21, 22, 25, 53, 80, 110, 465, 993, 995, 1500], "vulns": ["CVE-2025-67896", "CVE-2020-28024", "CVE-2023-42114", "CVE-2020-28025", "CVE-2024-39929", "CVE-2022-37452", "CVE-2020-28007", "CVE-2020-28013", "CVE-2023-51766", "CVE-2020-28019", "CVE-2020-28021", "CVE-2025-23419", "CVE-2021-38371", "CVE-2020-28008", "CVE-2020-28026", "CVE-2023-42115", "CVE-2020-28011", "CVE-2020-8015", "CVE-2020-28017", "CVE-2022-37451", "CVE-2020-12783", "CVE-2020-28022", "CVE-2023-42117", "CVE-2020-28012", "CVE-2021-27216", "CVE-2020-28009", "CVE-2022-3559", "CVE-2020-28023", "CVE-2021-23017", "CVE-2020-28018", "CVE-2021-3618", "CVE-2023-42119", "CVE-2023-44487", "CVE-2020-28014", "CVE-2020-28016", "CVE-2020-28015", "CVE-2023-42116", "CVE-2020-28010"], "hostnames": ["89-108-115-235.cloudvps.regruhosting.ru"], "tags": ["self-signed", "eol-product", "starttls"], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/a:f5:nginx:1.18.0", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.2p1", "cpe:/a:exim:exim:4.93"]}


ioc_type: ipv4
ioc_value: 89.108.76.226
source: shodan
validated_at: 2026-04-02T18:29:51.837159
raw_response:
  {"ports": [22, 25, 80, 143, 443, 465, 587, 993, 7777, 8888], "vulns": ["CVE-2025-67896", "CVE-2019-16928", "CVE-2020-28024", "CVE-2023-42114", "CVE-2020-28025", "CVE-2024-39929", "CVE-2022-37452", "CVE-2020-28007", "CVE-2020-28013", "CVE-2019-13917", "CVE-2023-51766", "CVE-2020-28019", "CVE-2020-28021", "CVE-2025-23419", "CVE-2021-38371", "CVE-2020-28008", "CVE-2020-28026", "CVE-2023-42115", "CVE-2020-28011", "CVE-2020-8015", "CVE-2020-28017", "CVE-2022-37451", "CVE-2020-12783", "CVE-2020-28022", "CVE-2023-42117", "CVE-2020-28012", "CVE-2021-27216", "CVE-2020-28009", "CVE-2022-3559", "CVE-2020-28023", "CVE-2020-28018", "CVE-2019-15846", "CVE-2021-3618", "CVE-2023-42119", "CVE-2023-44487", "CVE-2020-28014", "CVE-2020-28016", "CVE-2020-28015", "CVE-2023-42116", "CVE-2020-28010"], "hostnames": ["89-108-76-226.cloudvps.regruhosting.ru"], "tags": ["self-signed", "eol-product", "starttls"], "cpes": ["cpe:/o:linux:linux_kernel", "cpe:/a:f5:nginx:1.20.2", "cpe:/o:debian:debian_linux", "cpe:/a:f5:nginx", "cpe:/a:exim:exim:4.92", "cpe:/a:openbsd:openssh:7.9p1"]}


ioc_type: ipv4
ioc_value: 89.23.107.188
source: shodan
validated_at: 2026-04-02T18:30:53.472319
raw_response:
  {"ports": [22, 443], "vulns": [], "hostnames": ["edgeflow.aero.abe2c2f23-frontier.amazon.de", "amazon.com.au", "origin-www.amazon.co.uk", "amazon.com", "huddles.amazon.com", "uedata.amazon.co.uk", "amzn.com", "uedata.amazon.com", "edgeflow-dp.aero.47cf2c8c9-frontier.amazon.com", "edgeflow.aero.47cf2c8c9-frontier.amazon.com", "buckeye-retail-website.amazon.com", "www.amzn.com", "www.amazon.jp", "edgeflow-dp.aero.04f01a85e-frontier.amazon.com.au", "www.amazon.com.au", "shop.business.amazon.com", "edgeflow.aero.04f01a85e-frontier.amazon.com.au", "www.amazon.de", "amazon.co.jp", "34834.ip-ptr.tech", "origin-www.amazon.com.au", "edgeflow-dp.aero.abe2c2f23-frontier.amazon.de", "www.amazon.co.uk", "edgeflow-dp.aero.bfbdc3ca1-frontier.amazon.co.uk", "corporate.amazon.com", "buybox.amazon.com", "edgeflow-dp.aero.4d5ad1d2b-frontier.amazon.co.jp", "origin2-www.amazon.co.jp", "www.amazon.co.jp", "origin-www.amazon.com", "amazon.co.uk", "origin2-www.amazon.com", "amazon.jp", "iphone.amazon.com", "origin-www.amazon.de", "amazon.de", "yp.amazon.com", "home.amazon.com", "edgeflow.aero.bfbdc3ca1-frontier.amazon.co.uk", "us.amazon.com", "www.amazon.com", "origin-www.amazon.co.jp", "edgeflow.aero.4d5ad1d2b-frontier.amazon.co.jp"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.2p1", "cpe:/o:debian:debian_linux", "cpe:/o:linux:linux_kernel"]}


ioc_type: ipv4
ioc_value: 185.163.45.5
source: otx
validated_at: 2026-04-02T18:32:31.594044
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS39798 mivocloud srl", "indicator": "185.163.45.5", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "urlhaus 23may", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 0, "passive_dns_count": 8, "malware_samples": [], "passive_dns": ["logtochase.online", "logchase.online", "bantamchickens.xyz", "bakingsupplies.xyz", "barnplans.xyz", "6385data925.xyz", "sverset.pl", "koperst.pl"]}


ioc_type: ipv4
ioc_value: 185.163.47.177
source: otx
validated_at: 2026-04-02T18:32:41.149195
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS39798 mivocloud srl", "indicator": "185.163.47.177", "tags": ["welivesecurity", "sample hashes", "backdoors", "apt", "malicious", "pterolnk", "pteropshell", "word template", "stealers", "office macro", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["thermicplastic.uk", "www.thermicplastic.uk", "process-client-issuance.online"]}


ioc_type: ipv4
ioc_value: 157.20.182.49
source: otx
validated_at: 2026-04-02T18:32:46.243065
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "", "country_code": "", "city": "", "asn": "ASNone ", "indicator": "157.20.182.49", "tags": ["remember", "february", "foudre", "reconnaissance", "proactive defense", "filehashsha256", "apt", "iranian apt", "epmm", "arenac2", "cve-2025-54068", "cve-2025-34291", "geopolitical tensions", "cve-2026-1281", "tonnerre", "http response", "iranian", "antsword", "filehashmd5", "time", "generatedbotid", "fmapp.dll", "command and control", "cve-2025-55182", "encoded url", "uwhi6jqzqh7", "url pattern", "java", "computername", "cve-2026-1731", "tsundere", "cve-2025-9316", "ssh tunnel", "ivanti epmm", "figure", "root", "tamecat", "noteworthy", "cyber espionage", "filehashsha1", "vulnerability exploitation", "keyc2", "tls fingerprinting", "cyberattacks", "tsundere botnet", "mois", "http request", "date", "persianc2", "cve-2024-55591"], "pulses": ["Unmasking an Attack Chain of MuddyWater", "MuddyWater Exposed: Inside an Iranian APT operation", "Iranian APT Infrastructure in Focus: Mapping State-Aligned Clusters During Geopolitical Escalation", "Ivanti EPMM Exploi", "HANDALA-Iranian Nexus Actor", "EbeeMar2026 Pt1", "Unmasking an Attack Chain of MuddyWater", "Malware Filter - Botnet List - 07-02-2026 (Part 2)", "MuddyWater Exposed: Inside an Iranian APT operation", "avault clone \"MuddyWater Exposed: Inside an Iranian APT operation\""], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["maistgroup.com", "backondswitch.com"]}


ioc_type: ipv4
ioc_value: 2.2.2.6
source: otx
validated_at: 2026-04-02T18:32:48.463650
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "France", "country_code": "FR", "city": null, "asn": "AS3215 orange s.a.", "indicator": "2.2.2.6", "tags": ["as852", "#supportsitewebsiteabuse #rootcertificatefailure #cryptographicf", "win64", "public url", "as8075", "telecom", "facebook", "proton", "seznam", "mexico", "google", "level3", "as15169", "indonesia", "vta", "lateral-movement", "ukraine", "credential-access", "twitter", "as3359", "privilege-escalation", "mini", "as20940", "geoip", "as16509", "ghost", "T1557.001", "cuba", "threat-intelligence", "media", "akamaias", "akamaiasn1", "amazon02", "win32", "high"], "pulses": ["Rare Tier 1 Persistence - Critical \"Patched\", Non Patched Vulnerabilities Remain bypassing Lockdown Mode", "Microsoft Disables NTLM in Windows to Enhance Security", "n0paste - Show paste: \\\"No Problems\\\" - dos meses del URLscan", "InQuest - 30-11-2023"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["nathanyao.shop", "magas.bslrpg.com"]}


ioc_type: ipv4
ioc_value: 2.2.3.6
source: otx
validated_at: 2026-04-02T18:32:50.712361
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "France", "country_code": "FR", "city": null, "asn": "AS3215 orange s.a.", "indicator": "2.2.3.6", "tags": ["win32", "seznam", "ukraine", "credential-access", "as20940", "as16509", "threat-intelligence", "media", "level3", "twitter", "akamaiasn1", "telecom", "win64", "facebook", "lateral-movement", "high", "mini", "indonesia", "geoip", "#supportsitewebsiteabuse #rootcertificatefailure #cryptographicf", "as8075", "cuba", "mexico", "T1557.001", "public url", "amazon02", "akamaias", "as3359", "google", "vta", "privilege-escalation", "as852", "as15169", "ghost", "proton"], "pulses": ["Rare Tier 1 Persistence - Critical \"Patched\", Non Patched Vulnerabilities Remain bypassing Lockdown Mode", "Microsoft Disables NTLM in Windows to Enhance Security", "n0paste - Show paste: \\\"No Problems\\\" - dos meses del URLscan"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["www.dns-exercise.dev"]}


ioc_type: ipv4
ioc_value: 65.20.97.203
source: otx
validated_at: 2026-04-02T18:32:53.910282
raw_response:
  {"pulse_count": 6, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "65.20.97.203", "tags": ["powersploit", "ck techniques", "fileobj", "https", "svr cyber", "encrypt", "persistence", "powershell", "hashes", "cert polska", "april", "service", "stix", "sorefang", "title", "simplehashvalue", "wellmail", "behavior", "mimikatz", "mitre att", "graphicalproton", "technique title", "attackpatterns", "diplomatic orbiter", "enterprise", "cyber actors", "ncsc", "wellmess", "cyboxcommon", "indicator", "cisa", "hash", "execution", "cyber", "cozybear", "shell"], "pulses": ["Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally | CISA", "AA23-347A Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally", "Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally | CISA", "Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally | CISA", "Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally | CISA", "Russian Foreign Intelligence Service (SVR)  Exploiting JetBrains TeamCity CVE Globally"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["mongo.licitador.es"]}


ioc_type: ipv4
ioc_value: 1.0.1.1
source: otx
validated_at: 2026-04-02T18:32:58.850595
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "China", "country_code": "CN", "city": null, "asn": "ASNone ", "indicator": "1.0.1.1", "tags": ["securitytrails", "pulses otx", "bazaar", "erlangen", "Palantir", "cf f4", "follow", "suspicious", "gmtn", "url age", "de note", "http", "search", "filehashsha1", "sha3384", "iana id", "wow64", "secure server", "calls", "zur foerderung", "form", "as680", "zip forward", "route", "cloudflare", "local", "february", "ck id", "tls web", "zip code", "contacted", "accept", "persistence", "virtual disk drive", "filenames c", "regsetvalueexa", "copy", "geo erlangen", "server", "mitre att", "yara detections", "unicode text", "exclude data", "size", "push", "general info", "phone", "certificate", "full name", "ck matrix"], "pulses": ["Passwords are for Treehouses", "Passwords are for Treehouses", "The Belasco Chain", "Cert-Gs2020", "Cellbrite Domain Irregularities", "SLIMWARE Simple Installer WIN 32 EXE", "Hybrid Managed Service Actor / provisioned insider", "Who is safe?", "\u201cBroken Seal\u201d DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)", "Research", "Habo Analysis System", "meg.ns.cloudflare.com #abuseofpower", "FBI Files | Tor device connection | Unique attack against (non -criminal) monitored targets  ~ Apple Jacked Targets", "credit Q Vashti Cloned Pulse ", "FBI Link (Ransomware)sent to a device. opened on its own. Why?", "Double Umbrella AS15169/AS21928: This evaluates a critical structural convergence between Google (AS15169) and T-Mobile USA (AS21928) within the global Tier-1 routing backbone", "Reputation Shielded C2 Pivot; High-Churn Wix Infrastructure with iCloud Exfil Adjacency", "zero trust", "Rare Tier 1 Persistence - Critical \"Patched\", Non Patched Vulnerabilities Remain bypassing Lockdown Mode", "hostasa.org"], "malware_count": 2, "passive_dns_count": 23, "malware_samples": ["3efcb5e3a506cd073d2df5f6e4b9f89055f527458ff87c65c4e7317f337ed5da", "aeb3d5ec1d144a7b2d51bdb603c052fd52700def


ioc_type: ipv4
ioc_value: 104.238.189.186
source: otx
validated_at: 2026-04-02T18:33:05.643913
raw_response:
  {"pulse_count": 25, "reputation": 0, "country": "France", "country_code": "FR", "city": "Aubervilliers", "asn": "AS20473 the constant company  llc", "indicator": "104.238.189.186", "tags": ["qakbot", "WhisperGate", "slapstick", "remcom", "powgoop", "armageddon", "lazagne", "crackmapexec", "shuckworm", "vbscript b", "tsunami", "ghostwriter", "malware", "sha256", "symantec", "wildfire", "Gamardeon", "defender", "alertinfo", "domain", "deviceid", "Cyclops", "ip address", "palo alto", "ddos", "stealer", "wiper", "kernel32", "c server", "g0047", "PartyTicket", "august", "muddywater", "dword", "russia", "explorer", "actinium", "ransomware", "filehashmd5", "virustotal", "redrum", "trickbot", "geopolitical conflict", "raccoon", "whispergate", "mimikatz", "mirai", "cyclopsblink c", "powersploit", "gafgyt"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "IOCs for the recent Cyber Activities of Russian Hackers Targeting Ukraine "], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 104.248.36.191
source: otx
validated_at: 2026-04-02T18:33:07.745420
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS14061 digitalocean  llc", "indicator": "104.248.36.191", "tags": ["cybersecurity", "november", "ck information", "url https", "powershell", "gamaredon", "threatactor/tridentursa", "telegram scheme", "gamaredon group", "summary", "telegram", "primary article", "Gamaredon", "sample", "mitre att", "threatactor/gamaredon", "crimea", "Gamaredon Group", "Trident Ursa", "domain", "threatactor/actinium", "threatactor.primitivebear", "blackberry", "ip address"], "pulses": ["20251015 : Cyber Threat Intelligence", "12102025-ESAF-698", "Gamaredon (Ab)uses Telegram to Target Ukrainian Organizations", "Gamaredon (Ab)uses Telegram to Target Ukrainian Organizations", "Gamaredon (Ab)uses Telegram to Target Ukrainian Organizations", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine"], "malware_count": 1, "passive_dns_count": 9, "malware_samples": ["55f741bc0615a64500ea50ad3e09df2d5da7ea17bd767b363b22eb07fbc94da1"], "passive_dns": ["delicious71.kolopartor.ru", "jonas71.bushiko.ru", "jacket71.sikoshi.ru", "aaa.stratist.ru", "visible.agaricuso.ru", "each.metallicas.ru", "71department.silvicolas.ru", "deceptive.alabarda.ru", "deceptive1.alabarda.ru"]}


ioc_type: ipv4
ioc_value: 109.200.159.45
source: otx
validated_at: 2026-04-02T18:33:17.940877
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Ukraine", "country_code": "UA", "city": "Simferopol", "asn": "AS6789 crelcom llc", "indicator": "109.200.159.45", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 1, "passive_dns_count": 1, "malware_samples": ["613e2a4461e311832b3805ea233c184e018e230ba5a12a64534d02ac56b89987"], "passive_dns": ["ip45-159-200-109.crelcom.ru"]}


ioc_type: ipv4
ioc_value: 109.234.38.232
source: otx
validated_at: 2026-04-02T18:33:23.307485
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": null, "asn": "AS207651 total security group  inc.", "indicator": "109.234.38.232", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 23, "malware_samples": [], "passive_dns": ["elektroraduga.direct.quickconnect.to", "www.riga-escort.com", "riga-escort.com", "www.pensacolamassagecenter.com", "pensacolamassagecenter.com", "7noch.ru", "www.7noch.ru", "backtohealthmassage.org", "www.backtohealthmassage.org", "nehaindependentescort.com", "www.nehaindepende


ioc_type: ipv4
ioc_value: 134.0.112.117
source: otx
validated_at: 2026-04-02T18:33:28.943830
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "134.0.112.117", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 14, "malware_samples": [], "passive_dns": ["api.goodtap.pw", "goodtap.pw", "www.goodtap.pw", "zoom-project.pw", "www.zoom-project.pw", "www.equlent.pw", "equlent.pw", "xn----7sbabc6bog4clj8c.xn--p1ai", "www.xn----7sbabc6bog4clj8c.xn--p1ai", "www.aidev.fun", "aidev.fun", "www.gradientmedia.ru", "gradientmedi


ioc_type: ipv4
ioc_value: 134.122.109.104
source: otx
validated_at: 2026-04-02T18:33:31.558378
raw_response:
  {"pulse_count": 29, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS14061 digitalocean  llc", "indicator": "134.122.109.104", "tags": ["malicious", "Nextray", "ioc", "phishing", "cyber security"], "pulses": ["IOC Records Provided by @NextRayAI", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOC Records \u2192Provided by @NextRayAI", "HIVE           (Pulse created by RVS_i_am)", "HIVE           (Pulse created by RVS_i_am)", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "IOC Records \u2192Provided by @NextRayAI", "IOC Records \u2192Provided by @NextRayAI"], "malware_count": 0, "passive_dns_count": 10, "malware_samples": [], "passive_dns": ["v83glmjhjsw.c.updraftclone.com", "scambaiting2020.3cx.co.uk", "www.wellsfargoverify.qhigh.com", "wellsfargoverify.qhigh.com", "wellsfargoverify.mymom.info", "www.wellsfargoverify.mymom.info", "www.wellsfargoverifyssssssss.fartit.com", "wellsfargoverifyssssssss.fartit.com", "www.134-122-109-104.cprapid.com", "mail.auguryanalytics.club"]}


ioc_type: ipv4
ioc_value: 137.184.116.179
source: otx
validated_at: 2026-04-02T18:33:38.278848
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS14061 digitalocean  llc", "indicator": "137.184.116.179", "tags": ["fatt", "Bruteforce", "apt", "mailoney", "powershell", "Honeypot", "dionaea", "LAMP", "telnet", "2026-02", "cloudflare tunnels", "malicious", "suricata", "sftp", "p0f", "Brute-Force", "honeypot", "cowrie", "tpot", "spearphishing", "sensor-tagged", "honeytrap", "tanner", "Automated", "sentrypeer", "OpenCTI", "ssh", "SSH"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "SSH Brute-Force Honeypot Live", "PurpleSynapz", "Honeypot Data \u2013 T-Pot - Sydney, Australia - February 2026", "SSH & Telnet \u2192 Attacker IPs - Australia - February 2026", "OpenCTI_Export_2026-02", "2026-02-03 Fail2Ban 477b400f-5837-4dcb-9960-07ec79539ca4", "LCIA HoneyNet Data - November 2025 - Honeytrap", "Sadfgfhj", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["test.ojrek.com", "rimsamerica.com"]}


ioc_type: ipv4
ioc_value: 138.68.161.53
source: otx
validated_at: 2026-04-02T18:33:38.571926
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS14061 digitalocean  llc", "indicator": "138.68.161.53", "tags": ["apt", "scanners", "vultr", "honeypot", "cloudflare tunnels", "portscan", "powershell", "spearphishing"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-03-11", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["e2e-dbaas-mongodb-lqx53-e5ca1bd7.mongo.ondigitalocean.com", "138-68-161-53.ipv4.nknlabs.io", "dev-tests.psychiatry-uk.com"]}


ioc_type: ipv4
ioc_value: 139.59.85.26
source: otx
validated_at: 2026-04-02T18:33:50.824619
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "India", "country_code": "IN", "city": "Bengaluru", "asn": "AS14061 digitalocean  llc", "indicator": "139.59.85.26", "tags": ["", "attack", "malicious", "webscanner, bruteforce, web app attack", "SSH", "webscan", "login", "honeypot", "Nextray", "ssh", "ioc", "Telnet", "phishing", "cyber security", "scanner", "cowrie", "probing", "scanning"], "pulses": ["Webscanners 2018-02-09  thru current day", "PurpleSynapz", "Ka's Honeypot visitors", "Ghosty", "Ghosty", "Ghosty", "Fakelabs Honeynet Project", "EVA Bad IP", "IOC Records Provided by @NextRayAI", "\u7f51\u7edc\u626b\u63cf\u4eea", "\u7f51\u7edc\u626b\u63cf\u4eea", "FakeLabs_hexa", "FakeLabs_hexa", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "srg", "srg", "IOC Records \u2192Provided by @NextRayAI"], "malware_count": 0, "passive_dns_count": 10, "malware_samples": [], "passive_dns": ["aviupbombon.com", "c6pto6csbotwyyqp362.cleavrdev.space", "yo7k31vuq6vywz6v362.cleavrdev.space", "krrish.cleavrdev.space", "dipak.cleavrdev.space", "www.travellershome.in", "flowkana.bloomstack.io", "demo.bloomstack.io", "manufacturing.bloomstack.io", "signals.in"]}


ioc_type: ipv4
ioc_value: 140.82.29.65
source: otx
validated_at: 2026-04-02T18:33:54.944441
raw_response:
  {"pulse_count": 11, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Miami", "asn": "AS20473 the constant company  llc", "indicator": "140.82.29.65", "tags": ["domain", "meduza", "exmatter", "lockbit", "leverage", "telegram", "february", "blackcat", "psexec", "threatactor/tridentursa", "august", "mega", "desktop", "lazagne", "mandiant", "pingcastle", "crimea", "trojan", "mitre att", "adrecon", "Gamaredon Group", "powershell", "gamaredon", "url https", "november", "threatactor.primitivebear", "microsoft", "gamaredon group", "monti", "star", "stealbit", "blackberry", "Gamaredon", "sharphound", "Trident Ursa", "primary article", "united", "fraud", "ck information", "winscp", "rhysida", "vidar", "ransomware", "summary", "raccoon", "ttps", "procdump", "cybersecurity", "sample", "anydesk"], "pulses": ["Scattered Spider laying new eggs - Sekoia.io Blog", "Scattered Spider laying new eggs - Sekoia.io Blog", "Scattered Spider laying new eggs - Sekoia.io Blog", "Scattered Spider laying new eggs - Sekoia.io Blog", "Gamaredon (Ab)uses Telegram to Target Ukrainian Organizations", "Gamaredon (Ab)uses Telegram to Target Ukrainian Organizations", "Gamaredon (Ab)uses Telegram to Target Ukrainian Organizations", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine"], "malware_count": 0, "passive_dns_count": 364, "malware_samples": [], "passive_dns": ["festiva.tech", "ntx.tshsuport.ml", "destroy.asierdo.ru", "fishitor.ru", "bahirdo.ru", "vagif.shop", "salary48.minhizo.ru", "bike.intercourse20.cavalierso.ru", "intercourse20.cavalierso.ru", "penknife59.quyenzo


ioc_type: ipv4
ioc_value: 141.164.45.200
source: otx
validated_at: 2026-04-02T18:33:57.240767
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Korea, Republic of", "country_code": "KR", "city": "Seoul", "asn": "AS20473 the constant company  llc", "indicator": "141.164.45.200", "tags": ["url https", "Gamaredon", "Gamaredon Group", "sample", "threatactor.primitivebear", "Trident Ursa", "domain", "threatactor/actinium", "threatactor/gamaredon", "threatactor/tridentursa", "ip address"], "pulses": ["Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine"], "malware_count": 0, "passive_dns_count": 21, "malware_samples": [], "passive_dns": ["despite.lotorgas.ru", "jonas71.bushiko.ru", "growind.ru", "shivati.ru", "stratist.ru", "sikoshi.ru", "jacket71.sikoshi.ru", "postrif.ru", "aaa.stratist.ru", "matsuro.ru", "murokashi.ru", "shikato.ru", "kolporast.ru", "sikotu.ru", "nishito.ru", "kuroshu.ru", "mortifa.ru", "mushiko.ru", "mamuto.ru", "akinot.ru"]}


ioc_type: ipv4
ioc_value: 141.98.233.17
source: otx
validated_at: 2026-04-02T18:34:06.468922
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS26636 quickpacket  llc", "indicator": "141.98.233.17", "tags": ["welivesecurity", "sample hashes", "backdoors", "apt", "malicious", "pterolnk", "pteropshell", "word template", "stealers", "office macro", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 1, "passive_dns_count": 2, "malware_samples": ["6e462ae24c6e55d20191efb4ec9565f81503d2e6f7702b1a3478a1ec9ee47ef4"], "passive_dns": ["gesul-ba.pro", "www.gesul-ba.pro"]}


ioc_type: ipv4
ioc_value: 143.110.168.51
source: otx
validated_at: 2026-04-02T18:34:09.730978
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS14061 digitalocean  llc", "indicator": "143.110.168.51", "tags": ["apt", "powershell", "spearphishing", "cloudflare tunnels"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 18, "malware_samples": [], "passive_dns": ["gitops.ryanwelch.co.uk", "staging.ryanwelch.co.uk", "www.ryanwelch.co.uk", "www.ryanwelch.me", "local.ryanwelch.co.uk", "ryantwr-transaction-sync-frontend-staging.ci.ryanwelch.co.uk", "le-22489223.ci.ryanwelch.co.uk", "ryanwelch.co.uk", "ryanwelch.me", "lyre-group-bitflo-frontend.ci.ryanwelch.co.uk", "le-17572127.ci.ryanwelch.co.uk", "www.bitflo.io", "bitflo.io", "ryantwr-butea-site.ci.ryanwelch.co.uk", "butea.co.uk", "www.butea.co.uk", "le-36955211.ci.ryanwelch.co.uk", "ryantwr-butea-site-staging.ci.ryanwelch.co.uk"]}


ioc_type: ipv4
ioc_value: 143.198.160.45
source: otx
validated_at: 2026-04-02T18:34:12.407209
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "North Bergen", "asn": "AS14061 digitalocean  llc", "indicator": "143.198.160.45", "tags": ["welivesecurity", "sample hashes", "backdoors", "apt", "malicious", "pterolnk", "pteropshell", "word template", "stealers", "office macro", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["libenet.online", "143-198-160-45.ipv4.nknlabs.io"]}


ioc_type: ipv4
ioc_value: 143.198.216.105
source: otx
validated_at: 2026-04-02T18:34:16.510014
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Singapore", "country_code": "SG", "city": "Singapore", "asn": "AS14061 digitalocean  llc", "indicator": "143.198.216.105", "tags": ["apt", "powershell", "spearphishing", "cloudflare tunnels"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["enroll-be.kantipurinfotech.com", "www.enroll-be.kantipurinfotech.com", "match.vldtt.com"]}


ioc_type: ipv4
ioc_value: 143.244.134.188
source: otx
validated_at: 2026-04-02T18:34:29.398869
raw_response:
  {"pulse_count": 43, "reputation": 0, "country": "India", "country_code": "IN", "city": "Bengaluru", "asn": "AS14061 digitalocean  llc", "indicator": "143.244.134.188", "tags": ["badrequest", "bruteforce", "attack", "webscanner", "webscanner, bruteforce, web app attack", "SSH", "webscan", "login", "honeypot", "ssh", "Telnet", "scanner", "cowrie", "probing", "scanning"], "pulses": ["Webscanners 2018-02-09  thru current day", "PurpleSynapz", "Webscanners with Bad Requests - HTTP Status 400 - 1/20/2018 thru current day", "Ka's Honeypot visitors", "Ghosty", "Ghosty", "Ghosty", "Fakelabs Honeynet Project", "Webscanners with Bad Requests - HTTP Status 400 - 1/20/2018 thru current day", "Webscanners with Bad Requests - HTTP Status 400 - 1/20/2018 thru current day", "Webscanners with Bad Requests - HTTP Status 400 - 1/20/2018 thru current day", "Webscanners with Bad Requests - HTTP Status 400 - 1/20/2018 thru current day", "Webscanners with Bad Requests - HTTP Status 400 - 1/20/2018 thru current day", "\u7f51\u7edc\u626b\u63cf\u4eea", "\u7f51\u7edc\u626b\u63cf\u4eea", "FakeLabs_hexa", "FakeLabs_hexa", "Network Scanners ipv4", "srg", "srg"], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["hrm.mistert.lk", "mistert.lk", "aswathywrites.com", "mcapi.mehar.io"]}


ioc_type: ipv4
ioc_value: 144.126.218.218
source: otx
validated_at: 2026-04-02T18:34:31.962579
raw_response:
  {"pulse_count": 34, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Santa Clara", "asn": "AS14061 digitalocean  llc", "indicator": "144.126.218.218", "tags": ["welivesecurity", "sample hashes", "malicious", "pterolnk", "pteropshell", "cyber security", "word template", "Nextray", "office macro", "ioc", "phishing", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "IOC Records Provided by @NextRayAI", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOC Records \u2192Provided by @NextRayAI", "HIVE           (Pulse created by RVS_i_am)", "HIVE           (Pulse created by RVS_i_am)", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "IOC Records \u2192Provided by @NextRayAI"], "malware_count": 1, "passive_dns_count": 2, "malware_samples": ["66ca69b0e697cd2646a039f2573e1c19facad91d07fb904b8015aaff72492196"], "passive_dns": ["lesson.classest.com", "trezrstart.com"]}


ioc_type: ipv4
ioc_value: 146.190.74.132
source: otx
validated_at: 2026-04-02T18:34:35.018163
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "146.190.74.132", "tags": ["apt", "powershell", "spearphishing", "cloudflare tunnels"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["remote21.apk-online.fr"]}


ioc_type: ipv4
ioc_value: 151.248.114.67
source: otx
validated_at: 2026-04-02T18:34:41.808475
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "151.248.114.67", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 72, "malware_samples": [], "passive_dns": ["marmosettoken.com", "acetobacter.online", "mamberis.ru", "maniola.online", "ariuma.ru", "coleopteras.online", "debarys.ru", "limenitidinae.online", "fusari.ru", "lovers.semara.ru", "tubercur.ru", "fortias.ru", "baryo.ru", "gromphadorhina.ru", "graphosoma.ru", "limenitis.ru", "nematoceras.ru", "merostomata.ru", "cyrestinae.ru", "dipteran.ru"]}


ioc_type: ipv4
ioc_value: 151.248.114.88
source: otx
validated_at: 2026-04-02T18:34:46.833629
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "151.248.114.88", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 128, "malware_samples": [], "passive_dns": ["showroom.preyai.site", "preyai.site", "support2.rbs-net.ru", "www.support2.rbs-net.ru", "support2.yvgrishin.ru", "my.yvgrishin.ru", "tubercur.ru", "kilogar.ru", "lovers.semara.ru", "alloy.vadilops.ru", "oderas.ru", "hurama.ru", "cyrestinae.online", "fortias.ru",


ioc_type: ipv4
ioc_value: 151.248.116.243
source: otx
validated_at: 2026-04-02T18:34:52.220461
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "151.248.116.243", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 1, "passive_dns_count": 34, "malware_samples": ["aecb2ef3d1fc996177dcaa554c81c5d9394c51098a6765c43b0fdc7600c30e08"], "passive_dns": ["3dlocator.ru", "www.3dlocator.ru", "www.3dlokator.ru", "3dlokator.ru", "myces.ru", "teroba.ru", "krashand.ru", "libertyeducation.ru", "xn--80aaah3ajhdqggh1e5b.xn--p1ai", "chainoftrust.space", "cli


ioc_type: ipv4
ioc_value: 151.248.117.250
source: otx
validated_at: 2026-04-02T18:35:03.211023
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "151.248.117.250", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047", "slapstick"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Gamaredon OSINT Dump"], "malware_count": 1, "passive_dns_count": 116, "malware_samples": ["00e5afc3cd0760434f9812ac569e8c00c27a82ef4312e6290d351a88498efa8d"], "passive_dns": ["www.storiesmoscow.ru", "storiesmoscow.ru", "cholerd.ru", "biblidinae.online", "acrididae.online", "shermano.ru", "mamberis.ru", "haromo.ru", "megatos.online", "debarys.ru", "fanniidae.online", "limulusa.online", "mantidae.online", "coleopteras.online", "libellulat.online", "


ioc_type: ipv4
ioc_value: 151.248.125.140
source: otx
validated_at: 2026-04-02T18:35:10.098863
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "151.248.125.140", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 145, "malware_samples": [], "passive_dns": ["voranfi.ru", "jipitor.ru", "bokujanai.ru", "alvarados.ru", "salt.utrado.ru", "kozikra.ru", "akunir.ru", "salmon12.perfume.warau.ru", "go9.regret.warau.ru", "country77.salary.nemoiti.ru", "bortogat.ru", "counter.vositra.ru", "horoton.ru", "printing65.luck.ouichi.ru", "prevented.registration.pirovot.ru", "kiesoud.ru", "timerto.ru", "country33.salary.nemoiti.ru", "priest30.allen.gribata.ru", "integer.relative.protimas.ru"]}


ioc_type: ipv4
ioc_value: 151.248.121.176
source: otx
validated_at: 2026-04-02T18:35:10.675582
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "151.248.121.176", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 119, "malware_samples": [], "passive_dns": ["cdn.onlyplanks.fun", "api.onlyplanks.fun", "onlyplanks.fun", "blaberidae.online", "acetobacter.online", "oderas.ru", "cholerd.ru", "dahmke.ru", "shermano.ru", "apidaet.online", "limenitidinae.online", "lophacris.online", "maniola.online", "arachnidas.online


ioc_type: ipv4
ioc_value: 155.138.138.195
source: otx
validated_at: 2026-04-02T18:35:12.504975
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Canada", "country_code": "CA", "city": "Toronto", "asn": "AS20473 the constant company  llc", "indicator": "155.138.138.195", "tags": ["Gamaredon", "domain", "Trident Ursa", "url https", "threatactor.primitivebear", "threatactor/tridentursa", "Gamaredon Group", "threatactor/actinium", "sample", "ip address", "threatactor/gamaredon"], "pulses": ["Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine"], "malware_count": 1, "passive_dns_count": 4, "malware_samples": ["f353c44ca82bebdabc151cb3c8145d76aa85c444ae4ebd9bd88027792da44cec"], "passive_dns": ["www.maiar.biz", "bgaccountinggroup.com", "myaccountec.com", "www2.becoya.com"]}


ioc_type: ipv4
ioc_value: 157.230.94.134
source: otx
validated_at: 2026-04-02T18:35:22.589831
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "North Bergen", "asn": "AS14061 digitalocean  llc", "indicator": "157.230.94.134", "tags": ["spearphishing", "webscan", "cloudflare tunnels", "powershell", "badrequest", "bruteforce", "webscanner", "probing", "apt"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "Webscanners with Bad Requests - HTTP Status 400 - 1/20/2018 thru current day", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 1, "passive_dns_count": 4, "malware_samples": ["d0b335a7d546602046b76c1fa5a73531de0f61e531432d593c31874b63077c4b"], "passive_dns": ["holdmyguns.org", "skuudle-shopify.thegenielab.com", "dev.knightsquad2server.com", "nc.thepauler.me"]}


ioc_type: ipv4
ioc_value: 157.245.201.196
source: otx
validated_at: 2026-04-02T18:35:41.027925
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Singapore", "country_code": "SG", "city": "Singapore", "asn": "AS14061 digitalocean  llc", "indicator": "157.245.201.196", "tags": ["spearphishing", "apt", "cloudflare tunnels", "powershell"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 2, "passive_dns_count": 0, "malware_samples": ["5d8a245273a6b7f8ff150e3d990b7bb6b5022e02d182f8b8e65a9054e7ef64bd", "33b034c4c64accab37b62085ee954117b3d3efe1146a977888bc78dd3fa0ac25"]}


ioc_type: ipv4
ioc_value: 159.203.14.8
source: otx
validated_at: 2026-04-02T18:35:55.794427
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Canada", "country_code": "CA", "city": "Toronto", "asn": "AS14061 digitalocean  llc", "indicator": "159.203.14.8", "tags": ["welivesecurity", "sample hashes", "malicious", "pterolnk", "pteropshell", "word template", "office macro", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 159.223.152.63
source: otx
validated_at: 2026-04-02T18:36:29.820381
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS14061 digitalocean  llc", "indicator": "159.223.152.63", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 159.223.226.57
source: otx
validated_at: 2026-04-02T18:36:47.477138
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS14061 digitalocean  llc", "indicator": "159.223.226.57", "tags": ["spearphishing", "cloudflare tunnels", "powershell", "notice", "info", "Bruteforce", "apt", "SSH", "Brute-Force"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "SSH Brute-Force IPs from fail2ban 2025-12-22", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 161.35.106.28
source: otx
validated_at: 2026-04-02T18:36:54.322357
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "North Bergen", "asn": "AS14061 digitalocean  llc", "indicator": "161.35.106.28", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "IOCs - 2022111346 - ANIA Threat Feeds - IP Segment 3"], "malware_count": 0, "passive_dns_count": 6, "malware_samples": [], "passive_dns": ["captain.development.datasource.r8rite.com", "connect.detechtiva.com", "pusher.detechtiva.com", "www.secure08b-verify.duckdns.org", "secure08b-verify.duckdns.org", "7-ph.com"]}


ioc_type: ipv4
ioc_value: 159.89.31.49
source: otx
validated_at: 2026-04-02T18:36:54.430286
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS14061 digitalocean  llc", "indicator": "159.89.31.49", "tags": ["cybersecurity", "november", "ck information", "url https", "powershell", "gamaredon", "threatactor/tridentursa", "telegram scheme", "gamaredon group", "trident ursa", "summary", "telegram", "ukraine", "primary article", "dns flux", "apt", "Gamaredon", "russia", "sample", "mitre att", "threatactor/gamaredon", "crimea", "Gamaredon Group", "Trident Ursa", "domain", "threatactor/actinium", "phishing", "maldocs", "threatactor.primitivebear", "blackberry", "ip address"], "pulses": ["Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Gamaredon (Ab)uses Telegram to Target Ukrainian Organizations", "Gamaredon (Ab)uses Telegram to Target Ukrainian Organizations", "Gamaredon (Ab)uses Telegram to Target Ukrainian Organizations", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa ( Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa ( Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 161.35.185.146
source: otx
validated_at: 2026-04-02T18:37:00.773632
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Clifton", "asn": "AS14061 digitalocean  llc", "indicator": "161.35.185.146", "tags": ["apt", "powershell", "spearphishing", "cloudflare tunnels"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["com-secofs.info", "actsm.online"]}


ioc_type: ipv4
ioc_value: 164.90.210.128
source: otx
validated_at: 2026-04-02T18:37:05.100877
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS14061 digitalocean  llc", "indicator": "164.90.210.128", "tags": ["apt", "powershell", "spearphishing", "cloudflare tunnels"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["memo.dev.bsx.co.il", "mrs-bot.dev.bsx.co.il", "baby.dev.bsx.co.il"]}


ioc_type: ipv4
ioc_value: 161.35.169.180
source: otx
validated_at: 2026-04-02T18:37:12.402608
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS14061 digitalocean  llc", "indicator": "161.35.169.180", "tags": ["spearphishing", "apt", "cloudflare tunnels", "powershell"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 164.92.115.188
source: otx
validated_at: 2026-04-02T18:37:23.137460
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS14061 digitalocean  llc", "indicator": "164.92.115.188", "tags": ["welivesecurity", "sample hashes", "backdoors", "apt", "malicious", "pterolnk", "pteropshell", "word template", "stealers", "office macro", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 165.227.208.207
source: otx
validated_at: 2026-04-02T18:37:40.097045
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Clifton", "asn": "AS14061 digitalocean  llc", "indicator": "165.227.208.207", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "IOCs - 2023491241 - ANIA Threat Feeds - IP Segment 3"], "malware_count": 0, "passive_dns_count": 6, "malware_samples": [], "passive_dns": ["chayellerose.com", "staging-smart.web-experto.com.ar", "www.serrageral.net.br", "serrageral.net.br", "www.supersaversguide.com", "supersaversguide.com"]}


ioc_type: ipv4
ioc_value: 165.22.120.122
source: otx
validated_at: 2026-04-02T18:37:41.962350
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS14061 digitalocean  llc", "indicator": "165.22.120.122", "tags": ["apt", "powershell", "spearphishing", "cloudflare tunnels"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 165.232.136.224
source: otx
validated_at: 2026-04-02T18:37:46.642670
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Santa Clara", "asn": "AS14061 digitalocean  llc", "indicator": "165.232.136.224", "tags": ["spearphishing", "apt", "cloudflare tunnels", "powershell"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns", "CI Army List"], "malware_count": 0, "passive_dns_count": 8, "malware_samples": [], "passive_dns": ["spotlightgrowth.com", "manage.dungeonbuds.com", "recipecoupons.ml", "play.dungeonbuds.com", "monitor.dungeonbuds.com", "165-232-136-224.cprapid.com", "www.165-232-136-224.cprapid.com", "puianase.oazoas.com"]}


ioc_type: ipv4
ioc_value: 167.172.139.39
source: otx
validated_at: 2026-04-02T18:37:49.484758
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "North Bergen", "asn": "AS14061 digitalocean  llc", "indicator": "167.172.139.39", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["ccubeacademy.com", "bitplusvpn.net", "masterb.net"]}


ioc_type: ipv4
ioc_value: 167.99.127.118
source: otx
validated_at: 2026-04-02T18:38:12.587528
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Clifton", "asn": "AS14061 digitalocean  llc", "indicator": "167.99.127.118", "tags": ["spearphishing", "apt", "cloudflare tunnels", "powershell"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 4, "passive_dns": ["www.growyourgiftmusic.com", "growyourgiftmusic.com", "oprisks.com", "www.oprisks.com"]}


ioc_type: ipv4
ioc_value: 167.99.138.16
source: otx
validated_at: 2026-04-02T18:38:15.861045
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS14061 digitalocean  llc", "indicator": "167.99.138.16", "tags": ["domain", "ukraine", "threatactor/tridentursa", "apt", "Gamaredon Group", "dns flux", "gamaredon", "url https", "threatactor.primitivebear", "phishing", "maldocs", "Gamaredon", "russia", "Trident Ursa", "threatactor/actinium", "sample", "trident ursa", "ip address", "threatactor/gamaredon"], "pulses": ["Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa ( Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa ( Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine"], "malware_count": 3, "passive_dns_count": 32, "malware_samples": ["1a1ac565ba08ac51eb6ef27d0fe47a03372112f476ad3008f6ead30dbdcee565", "c9939f994e25e1e935f101ee8bc4ce033aad8bea96d192dc700deb1d04ef7c66", "6c1799a8141219b8933cdee57b27dfbf2561e48c3e4ec77ead685330e9c8aa23"], "passive_dns": ["www.bogozi.com", "bogozi.com", "delicious71.kolopartor.ru", "james.joke.artisola.ru", "bihitras.ru", "molodosto.ru", "defiant71.kolopartor.ru", "despise71.kolopartor.ru", "kolopartor.ru", "despite.lotorgas.ru", "bushiko.ru", "kolporast.ru", "kuroshu.ru", "mortifa.ru", "murokashi.ru", "shikato.ru", "mamuto.ru", "matsuro.ru", "nishito.ru", "jacket71.sikoshi.ru"]}


ioc_type: ipv4
ioc_value: 176.118.164.124
source: otx
validated_at: 2026-04-02T18:38:36.753224
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS43830 digital energy llc", "indicator": "176.118.164.124", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 176.118.164.187
source: otx
validated_at: 2026-04-02T18:38:55.064257
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS43830 digital energy llc", "indicator": "176.118.164.187", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 92, "malware_samples": [], "passive_dns": ["sparkasse-verwaltung.com", "raiffeisen-verwaltung.com", "alert-volksbank.com", "codes-nordea.com", "bestsign-verwaltung.com", "bestsign-alert.com", "securego-vr.com", "lovers.semara.ru", "tubercur.ru", "kilogar.ru", "alloy.vadilops.ru", "lepidopteras.ru", "libellulidae.ru", 


ioc_type: ipv4
ioc_value: 176.118.164.159
source: otx
validated_at: 2026-04-02T18:38:57.646933
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS43830 digital energy llc", "indicator": "176.118.164.159", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047", "slapstick"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Gamaredon OSINT Dump"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["8db529765e5df53e6c9f2614f21b4233fe43714f3438a4a7ec04e454c3662ab1"]}


ioc_type: ipv4
ioc_value: 176.118.165.76
source: otx
validated_at: 2026-04-02T18:39:16.197042
raw_response:
  {"pulse_count": 25, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS43830 digital energy llc", "indicator": "176.118.165.76", "tags": ["qakbot", "WhisperGate", "slapstick", "remcom", "powgoop", "armageddon", "lazagne", "crackmapexec", "shuckworm", "vbscript b", "tsunami", "ghostwriter", "malware", "sha256", "symantec", "wildfire", "Gamardeon", "defender", "alertinfo", "domain", "deviceid", "Cyclops", "ip address", "palo alto", "ddos", "stealer", "wiper", "kernel32", "c server", "g0047", "PartyTicket", "august", "muddywater", "dword", "russia", "explorer", "actinium", "ransomware", "filehashmd5", "virustotal", "redrum", "trickbot", "geopolitical conflict", "raccoon", "whispergate", "mimikatz", "mirai", "cyclopsblink c", "powersploit", "gafgyt"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "IOCs for the recent Cyber Activities of Russian Hackers Targeting Ukraine "], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 176.57.208.203
source: otx
validated_at: 2026-04-02T18:39:21.239190
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "176.57.208.203", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 12, "malware_samples": [], "passive_dns": ["allikesneakers.com", "www.sneakersafe.us", "www.allikesneakers.com", "sneakersafe.us", "ddtxlmya.2woik27n0xly.ch", "www.booccca.com", "booccca.com", "humobot.tk", "www.humobot.tk", "l3af685e.justinstalledpanel.com", "www.artmarker.com.ua", "artmarker.com.ua"]}


ioc_type: ipv4
ioc_value: 178.128.215.84
source: otx
validated_at: 2026-04-02T18:39:33.775119
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Singapore", "country_code": "SG", "city": "Singapore", "asn": "AS14061 digitalocean  llc", "indicator": "178.128.215.84", "tags": ["spearphishing", "apt", "cloudflare tunnels", "powershell"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["stag-api.mynzuni.com"]}


ioc_type: ipv4
ioc_value: 178.20.44.214
source: otx
validated_at: 2026-04-02T18:39:38.688760
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS48282 hosting technology ltd", "indicator": "178.20.44.214", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 2, "passive_dns_count": 1, "malware_samples": ["04d283852248f29c46ec6c43498e6db938aa696afea5e4f6d0f0aaf2cb8586ae", "24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a"], "passive_dns": ["simtech.bitwolff.com"]}


ioc_type: ipv4
ioc_value: 178.21.11.23
source: otx
validated_at: 2026-04-02T18:39:49.851405
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "178.21.11.23", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 9, "malware_samples": [], "passive_dns": ["arkphys.online", "port.maxiark.ru", "wp.maxiark.ru", "static.maxiark.ru", "post-ch.site", "www.post-ch.site", "dmitry-bondarenko.xyz", "autocraft-sakh.ru", "via-ceramics.ru"]}


ioc_type: ipv4
ioc_value: 185.193.143.11
source: otx
validated_at: 2026-04-02T18:40:09.656954
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS43830 digital energy llc", "indicator": "185.193.143.11", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 185.193.143.70
source: otx
validated_at: 2026-04-02T18:40:29.743563
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS43830 digital energy llc", "indicator": "185.193.143.70", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 185.20.224.168
source: otx
validated_at: 2026-04-02T18:40:47.404692
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.20.224.168", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "primitivebear", "sha256", "ghostwriter", "github", "code", "path", "quietsieve", "runprogram", "span", "gamaredon group", "unit", "star", "russia", "button", "whispergate", "pterodo", "install", "armageddon", "enterprise", "iocs cluster", "primitive bear", "Gamardeon", "alliance"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 185.20.225.35
source: otx
validated_at: 2026-04-02T18:41:00.646553
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.20.225.35", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 1, "passive_dns_count": 233, "malware_samples": ["c180a719e7e835b3a11fec63f7bc09e514dcbdd3adb36c5f9f2b1adea003463c"], "passive_dns": ["www.pzles.ru", "pzles.ru", "l11fc91a.justinstalledpanel.com", "neat.trobona.ru", "luxury.clank.nomukou.ru", "delusion.teasagaki.ru", "navigation33.countries.hibigaru.ru", "wokoras.ru", "deluge.degrade.teasagaki.ru", "stopped95.famous.filorta.ru", "amid89.luxury.clank.nomukou.ru", "pride.nomukou.ru", "amazing.garbani.ru", "miwosaga.ru", "intent14.erostipa.ru", "lumber5.am.sumikko.ru", "stoop13.performed.pride.nomukou.ru", "designer.fishardo.ru", "relax.elitoras.ru", "source68.alternate.vadilops.


ioc_type: ipv4
ioc_value: 185.20.224.218
source: otx
validated_at: 2026-04-02T18:41:07.251798
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.20.224.218", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 185.20.226.9
source: otx
validated_at: 2026-04-02T18:41:07.674962
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.20.226.9", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "2022", "ukraine", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147", "wildfire", "Gamardeon", "quietsieve"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Gamaredon OSINT Dump"], "malware_count": 0, "passive_dns_count": 47, "malware_samples": [], "passive_dns": ["debarys.ru", "hurama.ru", "chelicerata.ru", "merostomata.ru", "ovinus.ru", "nematoceras.ru", "anisoptera.ru", "morphon.online", "megascolias.online", "noctuidaes.online", "gromphadorhina.ru", "dipteran.ru", "empusidae.ru", "heteroptera.ru", "polyphemus.ru", "arctiidae.ru", "asilidae.ru", "cerambycidae.online", "lycaenidae.online", "coliadinae.online"


ioc_type: ipv4
ioc_value: 185.225.19.16
source: otx
validated_at: 2026-04-02T18:41:25.434390
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Romania", "country_code": "RO", "city": "Iasi", "asn": "AS39798 mivocloud srl", "indicator": "185.225.19.16", "tags": ["welivesecurity", "sample hashes", "backdoors", "apt", "malicious", "pterolnk", "pteropshell", "word template", "stealers", "office macro", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 185.251.91.137
source: otx
validated_at: 2026-04-02T18:41:45.984717
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS35278 sprint", "indicator": "185.251.91.137", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 185.46.10.17
source: otx
validated_at: 2026-04-02T18:41:56.777365
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.10.17", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 119, "malware_samples": [], "passive_dns": ["185-46-10-17.cloudvps.regruhosting.ru", "secure-coplogic.com", "coliadinae.online", "arachnidas.online", "cholerd.ru", "limulusa.online", "apidaet.online", "maniola.online", "apaturinae.online", "cerambycidae.online", "mamberis.ru", "coleopteras.online", "oderas.ru", "gonepteryx.online", "fanniidae.online", "dionysi.online", "acrididae.online", "shermano.ru", "papiliot.online", "ariuma.ru"]}


ioc_type: ipv4
ioc_value: 185.46.10.143
source: otx
validated_at: 2026-04-02T18:41:59.294752
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.10.143", "tags": ["scanning host", "nsyt", "vj99", "ursnif", "asnone", "lockbit", "attack", "then brothers sabey", "worm", "media", "suspicious", "gmtn", "pragma", "comspec", "http", "view", "starizona", "search", "as16625 akamai", "rticon neutral", "filehashsha1", "historical", "dynamic_function_loading", "amazon02", "domain name", "related nids", "crlf line", "simda", "shell code", "Nanocore RAT", "wow64", "strong", "wc3 rpg", "missouri", "yara rule", "link", "cyberthreat", "asnone united", "cloudflare", "local", "february", "threat", "parallax rat", "sav.com", "generic windos", "tls web", "https://lawlink.com/documents/10935/blackbag-technologies-announ", "keepaliveyes", "contacted", "illegal"], "pulses": ["Pegasus - https://house.mo.gov/ | Brian Sabey HallRender [i cloned OctoSeek] T8", "apple retail dnspionage clone octoseek", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "NORAD TRACKING ", "NORAD TRACKING (by scamcheck) 2023-06-14", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "Apple | Worm:Win32/Benjamin | thebrotherssabey.com", "Tsara Brashears Dead campaign | ET | Emotet Botnet | Injection ", "SOC_BLOCK_NEW", "Pegasus - https://house.mo.gov/ | Brian Sabey HallRender", "Hijacker", "Metasploit | Ransomware | PinterestPots - Pin.it", "RansomEXX + Cyber attack \u2022 Premier Denver Recording Studio", "Sabey targeting | Gains access to premier Denver Recording Studio"], "malware_count": 2, "passive_dns_count": 4, "malware_samples": ["cf933577f15ab706b92f9c3155543028dcd69c997998e873535596a1e195e850", "ad1b00820e37caf297f087788e65194e7face3f5b0f019fa21fad921564dc407"], "passive_dns": ["learnms.ru", "myces.ru", "teroba.ru", "krashand.ru"]}


ioc_type: ipv4
ioc_value: 185.46.10.230
source: otx
validated_at: 2026-04-02T18:42:17.897621
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.10.230", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "primitivebear", "sha256", "ghostwriter", "github", "code", "path", "quietsieve", "runprogram", "span", "gamaredon group", "unit", "star", "russia", "button", "whispergate", "pterodo", "install", "armageddon", "enterprise", "iocs cluster", "primitive bear", "Gamardeon", "alliance"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 185.46.10.250
source: otx
validated_at: 2026-04-02T18:42:37.929279
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.10.250", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 185.46.10.28
source: otx
validated_at: 2026-04-02T18:42:45.938036
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.10.28", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 31, "malware_samples": [], "passive_dns": ["tubercur.ru", "brachycera.online", "sporog.ru", "megatos.online", "fortias.ru", "baryo.ru", "mucora.ru", "nematoceras.online", "coliadinae.ru", "metcalfas.online", "limenitis.ru", "gonepteryx.ru", "fanniidae.ru", "xiphosura.online", "lepidopteras.ru", "libellulidae


ioc_type: ipv4
ioc_value: 185.46.10.73
source: otx
validated_at: 2026-04-02T18:42:51.611184
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.10.73", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 53, "malware_samples": [], "passive_dns": ["ez-up.fun", "alloy.vadilops.ru", "hurama.ru", "fusari.ru", "fortias.ru", "mucora.ru", "baryo.ru", "libellulat.ru", "nematoceras.ru", "lepidopteras.ru", "libellulidae.ru", "limenitis.ru", "morphon.online", "megascolias.online", "lycaenidae.online", "libellulidae.onl


ioc_type: ipv4
ioc_value: 185.46.10.86
source: otx
validated_at: 2026-04-02T18:43:07.096270
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.10.86", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 129, "malware_samples": [], "passive_dns": ["avezaim.ru", "xn--b1afa1aggq.xn--p1ai", "www.xn--b1afa1aggq.xn--p1ai", "www.alfaspace.xyz", "alfaspace.xyz", "tubercur.ru", "lovers.semara.ru", "kilogar.ru", "alloy.vadilops.ru", "hurama.ru", "fortias.ru", "baryo.ru", "mucora.ru", "ovinus.ru", "limenitis.ru", "heteroptera.ru", "dipteran.ru", "merostomata.ru", "gromphadorhina.ru", "coliadinae.ru"]}


ioc_type: ipv4
ioc_value: 185.46.11.115
source: otx
validated_at: 2026-04-02T18:43:27.287495
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.11.115", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "2022", "ukraine", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147", "wildfire", "Gamardeon", "quietsieve"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Gamaredon OSINT Dump"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["cd057094c7509034b2e5fd074df21f8e96e745e521a8b866b52dfd8efa7939bd"]}


ioc_type: ipv4
ioc_value: 185.46.11.71
source: otx
validated_at: 2026-04-02T18:43:34.248836
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.11.71", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "primitivebear", "sha256", "ghostwriter", "github", "code", "path", "quietsieve", "runprogram", "span", "gamaredon group", "unit", "star", "russia", "button", "whispergate", "pterodo", "install", "armageddon", "enterprise", "iocs cluster", "primitive bear", "Gamardeon", "alliance"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 185.46.11.72
source: otx
validated_at: 2026-04-02T18:43:39.350375
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.11.72", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 1, "passive_dns_count": 62, "malware_samples": ["d646e2a0fb1e9d4650ac91ed68b8d9170a089305f280a7928b12ca1c9c425189"], "passive_dns": ["pronice.ru", "www.pronice.ru", "niceexpert.ru", "www.niceexpert.ru", "www.nicecentr.ru", "nicecentr.ru", "daynice.ru", "www.daynice.ru", "www.niceonline.ru", "niceonline.ru", "alloy.vadilops.ru",


ioc_type: ipv4
ioc_value: 185.46.8.12
source: otx
validated_at: 2026-04-02T18:43:53.034263
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.8.12", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 90, "malware_samples": [], "passive_dns": ["kallima.online", "limulusa.online", "lophacris.online", "haromo.ru", "papiliot.online", "cyrestinae.online", "megatos.online", "false.grafitto.ru", "cholerd.ru", "arachnidas.online", "biblidinae.online", "mamberis.ru", "sporog.ru", "maniola.online", "lovers.sema


ioc_type: ipv4
ioc_value: 185.46.9.133
source: otx
validated_at: 2026-04-02T18:43:59.263820
raw_response:
  {"pulse_count": 26, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.9.133", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "botnet", "russian", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "attack ddos"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "The Full List IPS Attacks DDos Russian", "DDoS and malware indicators 03/07/2022 UA-RU", "Russia Releases List of IPs Attacking Its Infrastructure with DDoS Attacks", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs"], "malware_count": 1, "passive_dns_count": 75, "malware_samples": ["6e9a6d65834852b773b6c8beed2add31b4156451b90ad4fa85a09461a72295eb"], "passive_dns": ["lexer.fountcore.tech", "www.fountcore.tech", "fountcore.tech", "askogr.ru", "www.askogr.ru", "git.askogr.ru", "nematoceras.online", "blaberidae.online", "oderas.ru", "lepidopteras.online", "hesperiidae.online", "papiliot.online", "dionysi.online", "putrif.ru", "golintras.site", "apidaet.online", "limenitidinae.online", "erati.ru", "lophacr


ioc_type: ipv4
ioc_value: 185.46.11.79
source: otx
validated_at: 2026-04-02T18:43:59.530915
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.11.79", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "2022", "ukraine", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147", "wildfire", "Gamardeon", "quietsieve"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Gamaredon OSINT Dump"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["3ea987f29a04e1f60c629700e0f7aa4f0b9253315785577a0ea95a222b0afc0d"]}


ioc_type: ipv4
ioc_value: 185.46.9.173
source: otx
validated_at: 2026-04-02T18:44:17.056779
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.9.173", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 185.46.9.81
source: otx
validated_at: 2026-04-02T18:44:31.985523
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "185.46.9.81", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 12, "malware_samples": [], "passive_dns": ["crypto-webtg.ddnsking.com", "dersagers.com", "box.dersagers.com", "apidaet.online", "putrif.ru", "hamadryas.online", "biblidinae.online", "cerambycidae.online", "chelicerata.online", "cholerd.ru", "blattodea.online", "dipteran.online"]}


