# source_validations

ioc_type: ipv4
ioc_value: 37.140.197.206
source: stevenblack
validated_at: 2026-04-02T20:12:09.698095
raw_response:
  {"hostnames_checked": ["limenitis.ru", "tubercur.ru", "libellulat.ru", "apaturinae.ru", "cholerd.ru", "libellulidae.online", "mucora.ru", "gonepteryx.online", "acrididae.ru", "neural.photophone.site", "apidaet.online", "fortias.ru", "cyrestinae.online", "blaberidae.online", "apaturinae.online", "brachycera.online", "limenitidinae.online", "baryo.ru", "37-140-197-206.cloudvps.regruhosting.ru", "nematoceras.online"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 45.134.255.131
source: stevenblack
validated_at: 2026-04-02T20:12:09.760487
raw_response:
  {"hostnames_checked": ["slovorti.ru", "claimed.striman.ru", "false.striman.ru", "bluera.ru", "perfection.baldasha.ru", "nearly.striman.ru", "www.gholam.ru", "necessity.striman.ru", "sand.striman.ru", "gholam.ru", "sally.striman.ru", "percy.striman.ru", "allied.striman.ru", "gloomy.striman.ru", "zeinare.ru", "bicyclelist.baldasha.ru", "clap.vositra.ru", "intercourse.vositra.ru", "principles.vositra.ru", "biblidinae.online"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 5.63.158.233
source: stevenblack
validated_at: 2026-04-02T20:12:09.869414
raw_response:
  {"hostnames_checked": ["api.tringle.work", "www.api.nskiphone-crm.this-is-web.ru", "www.api.tringle.work", "nng.this-is-web.ru", "nskiphone-crm.this-is-web.ru", "nskiphone.this-is-web.ru", "www.nng.this-is-web.ru", "www.wunder.this-is-web.ru", "api.nskiphone-crm.this-is-web.ru", "www.api.nskiphone.this-is-web.ru", "maxwell.this-is-web.ru", "wunder.this-is-web.ru", "test.this-is-web.ru", "api.nskiphone.this-is-web.ru", "www.test.this-is-web.ru", "www.nskiphone-crm.this-is-web.ru", "www.maxwell.this-is-web.ru", "aquism.this-is-web.ru", "www.nskiphone.this-is-web.ru", "www.aquism.this-is-web.ru"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 5.63.158.238
source: stevenblack
validated_at: 2026-04-02T20:12:09.874329
raw_response:
  {"hostnames_checked": ["mantidae.online", "promokotikbot.ru", "www.promokotikbot.ru", "5-63-158-238.cloudvps.regruhosting.ru", "brachycera.online", "noctuidaes.online", "apaturinae.online", "mycodar.ru", "limenitis.online", "fanniidae.online", "lycaenidae.online", "polyphemus.online", "libellulat.online", "asilidae.online", "hymenoptera.online", "debarys.ru", "meandrusas.online", "false.grafitto.ru", "apoxipodes.online", "melitaeas.online"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 80.78.251.191
source: stevenblack
validated_at: 2026-04-02T20:12:10.136899
raw_response:
  {"hostnames_checked": ["acrididae.online", "hierodula.online", "coliadinae.online", "apaturinae.online", "empusidae.online", "80-78-251-191.cloudvps.regruhosting.ru", "ddps-csr.ru", "fanniidae.online", "lycaenidae.online", "limenitidinae.online", "limulusa.online", "libellulat.online", "maniola.online", "cyrestinae.online", "korovin.site", "megatos.online", "ariuma.ru", "shermano.ru", "haromo.ru", "www.ddps-csr.ru"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 80.78.251.4
source: stevenblack
validated_at: 2026-04-02T20:12:10.171961
raw_response:
  {"hostnames_checked": ["acetobacter.online", "apidaet.online", "80-78-251-4.cloudvps.regruhosting.ru", "mycodar.ru", "coleopteras.online", "oderas.ru", "npp-trigla.ru", "alexandr-demchenko.ru", "polyphemus.online", "limenitidinae.online", "dipteran.online", "limulusa.online", "hamadryas.online", "megatos.online", "meandrusas.online", "tomond.ru", "false.grafitto.ru", "graphiuma.online", "www.alexandr-demchenko.ru", "kallima.online"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 80.78.253.196
source: stevenblack
validated_at: 2026-04-02T20:12:10.193028
raw_response:
  {"hostnames_checked": ["apidaet.online", "sporog.ru", "web.ust-land.ru", "www.ust-land.ru", "sqlpp1.xrbh.ru", "apaturinae.online", "www.pp1.xrbh.ru", "pp1.xrbh.ru", "www.sqlpp1.xrbh.ru", "www.crm.ust-land.ru", "ad.ust-land.ru", "crm.ust-land.ru", "fastpp1.xrbh.ru", "www.web.ust-land.ru", "limulusa.online", "www.widget.xrbh.ru", "www.ad.ust-land.ru", "80-78-253-196.cloudvps.regruhosting.ru", "ust-land.ru", "widget.xrbh.ru"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 80.78.253.86
source: stevenblack
validated_at: 2026-04-02T20:12:10.224644
raw_response:
  {"hostnames_checked": ["acrididae.online", "acetobacter.online", "lophacris.online", "coliadinae.online", "kilogar.ru", "80-78-253-86.cloudvps.regruhosting.ru", "sporog.ru", "telegrambotshopsodax64.site", "smtp.telegrambotshopsodax64.site", "mycodar.ru", "coleopteras.online", "oderas.ru", "tc.yeel.studio", "td-ledavto.ru", "libellulat.online", "01.fastpostsender.ru", "lovers.semara.ru", "shermano.ru", "aerogenosa.ru", "mamberis.ru"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 89.108.115.225
source: stevenblack
validated_at: 2026-04-02T20:12:10.355941
raw_response:
  {"hostnames_checked": ["wiki.clevertec.ru", "domfoodshop.ru", "rusfoodstroy.ru", "travel.endwork.today", "myfoodforum.ru", "postnet-dev.selftech.ru", "www.rusfoodstroy.ru", "yourfavorite.property", "www.rusfoodtorg.ru", "postamates.spatiality.website", "business.spatiality.website", "rusfoodtorg.ru", "domfoodstroy.ru", "www.domfoodstroy.ru", "www.domfoodshop.ru", "www.rusfoodforum.ru", "www.myfoodforum.ru", "rusfoodforum.ru", "property.spatiality.website", "dit.spatiality.website"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 89.108.115.232
source: stevenblack
validated_at: 2026-04-02T20:12:10.363484
raw_response:
  {"hostnames_checked": ["anisoptera.online", "morphinaes.online", "haromo.ru", "amid89.luxury.clank.nomukou.ru", "oderas.ru", "dahmke.ru", "dipteran.online", "lophacris.online", "stoop13.performed.pride.nomukou.ru", "polyphemus.online", "papiliot.online", "webinar.reutdent.ru", "lepidopteras.online", "putrif.ru", "shermano.ru", "hesperiidae.online", "luxury.clank.nomukou.ru", "acetobacter.online", "kallima.online", "biblidinae.online"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 89.108.115.235
source: stevenblack
validated_at: 2026-04-02T20:12:10.379351
raw_response:
  {"hostnames_checked": ["lk.kfsamara.com", "nobug.store", "oderas.ru", "domkuhon.ru", "povar.kukme.ru", "89-108-115-235.cloudvps.regruhosting.ru", "lk.kfsamara.store", "www.kfsamara.com", "kfsamara.com", "ivaservis.ru", "www.iva-servise.ru", "112z.ru", "www.kfbiz.online", "www.povar.kukme.ru", "iva-servise.ru", "www.lk.kfsamara.store", "repairfl.com", "www.domkuhon.ru", "www.lk.kfsamara.com", "www.nobug.store", "kfbiz.online"], "hostnames_count": 21, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 89.108.115.241
source: stevenblack
validated_at: 2026-04-02T20:12:10.403200
raw_response:
  {"hostnames_checked": ["ending.amieteku.ru", "deer-mouse.ssinapa.ru", "naughty.volotras.ru", "jeer.zamaniwa.ru", "jealousy.zamaniwa.ru", "jean.zamaniwa.ru", "kimige.ru", "analyticselmikeev.ru", "volotras.ru", "deep-settled.ssinapa.ru", "machic.ru", "deep-versed.ssinapa.ru", "deep-rootedness.ssinapa.ru", "jumper.zamaniwa.ru", "jessie.zamaniwa.ru", "deep-kiss.ssinapa.ru", "deep-lunged.ssinapa.ru", "zamaniwa.ru", "percent.volotras.ru", "deerstalkers.ssinapa.ru"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 89.108.65.157
source: stevenblack
validated_at: 2026-04-02T20:12:10.418814
raw_response:
  {"hostnames_checked": ["cholerd.ru", "putrif.ru", "coliadinae.online", "mantidae.online", "89-108-65-157.cloudvps.regruhosting.ru", "noctuidaes.online", "schastye.com", "blattodea.online", "metoshi.site", "mycodar.ru", "dahmke.ru", "oderas.ru", "lycaenidae.online", "gorimana.site", "dipteran.online", "devsite-lst.online", "hymenoptera.online", "ariuma.ru", "graphiuma.online", "shermano.ru", "apoxipodes.online"], "hostnames_count": 21, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 89.108.70.22
source: stevenblack
validated_at: 2026-04-02T20:12:10.436735
raw_response:
  {"hostnames_checked": ["reject50.released.ruchkalo.ru", "allen4.erostipa.ru", "priest.elitoras.ru", "although.coferto.ru", "getcode.tech", "relax.elitoras.ru", "masshir.ru", "getcodedev.ru", "api.resumeone.ru", "www.staging.getcode.tech", "www.getcode.tech", "resumeone.ru", "www.resumeone.ru", "print.nonima.ru", "lortova.ru", "cliraco.ru", "www.getcodedev.ru", "erostipa.ru", "elitoras.ru", "staging.getcode.tech"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 89.108.76.246
source: stevenblack
validated_at: 2026-04-02T20:12:10.484099
raw_response:
  {"hostnames_checked": ["dionysi.online", "nematoceras.online", "metcalfas.online", "libellulidae.online", "zongri.cn", "dahmke.ru", "mesant.online", "89-108-76-246.cloudvps.regruhosting.ru", "fusari.ru", "mantodeas.online", "eurypterida.online", "corolain.ru", "hymenoptera.online", "megatos.online", "goloser.ru", "danainae.online", "graphiuma.online", "bhack.simplex-software.ru", "www.zongri.cn", "aerogenosa.ru", "melitaeas.online"], "hostnames_count": 21, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 89.108.77.202
source: stevenblack
validated_at: 2026-04-02T20:12:10.554749
raw_response:
  {"hostnames_checked": ["hierodula.online", "artemmanicureshop.ru", "mantidae.online", "manikureshop.ru", "brachycera.online", "sand79.navy.mudarist.ru", "apaturinae.online", "www.manikureshop.online", "papiliot.online", "fanniidae.online", "lycaenidae.online", "cerambycidae.online", "limenitidinae.online", "maniola.online", "manikureshop.online", "hymenoptera.online", "gonepteryx.online", "megatos.online", "www.manikureshop.ru", "www.artemmanicureshop.ru"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 89.108.79.13
source: stevenblack
validated_at: 2026-04-02T20:12:10.661589
raw_response:
  {"hostnames_checked": ["acetobacter.online", "devrm.ru", "mantidae.online", "morphinaes.online", "devctl.online", "apaturinae.online", "empusidae.online", "melitaeas.online", "www.devicectl.online", "mycodar.ru", "coleopteras.online", "devicectl.online", "mvrm.ru", "89-108-79-13.cloudvps.regruhosting.ru", "polyphemus.online", "www.devctl.ru", "devctl.ru", "alloy.vadilops.ru", "tomond.ru", "false.grafitto.ru", "mamberis.ru"], "hostnames_count": 21, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 89.108.88.15
source: stevenblack
validated_at: 2026-04-02T20:12:10.788742
raw_response:
  {"hostnames_checked": ["cyrestinae.ru", "static.yourhotelapp.ru", "kilogar.ru", "acrididae.ru", "apidaet.online", "blattodea.ru", "brachycera.online", "morphinaes.online", "empusidae.online", "merostomata.online", "ws.yourhotelapp.ru", "apaturinae.ru", "hamadryas.online", "media.yourhotelapp.ru", "alloy.vadilops.ru", "lovers.semara.ru", "graphosoma.ru", "shermano.ru", "scorpiones.online", "melitaeas.online"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 89.23.107.188
source: stevenblack
validated_at: 2026-04-02T20:12:10.985711
raw_response:
  {"hostnames_checked": ["www.amazon.co.jp", "edgeflow-dp.aero.47cf2c8c9-frontier.amazon.com", "origin-www.amazon.co.uk", "34834.ip-ptr.tech", "vz99betvn.com", "origin-www.amazon.de", "www.amazon.com.au", "sekabeting.com", "amazon.co.jp", "yp.amazon.com", "lesnoygaff.ru", "www.amazon.de", "corporate.amazon.com", "edgeflow-dp.aero.04f01a85e-frontier.amazon.com.au", "edgeflow.aero.abe2c2f23-frontier.amazon.de", "uedata.amazon.co.uk", "amazon.jp", "www.amzn.com", "amazon.co.uk", "ufaclubs.com", "edgeflow.aero.bfbdc3ca1-frontier.amazon.co.uk", "home.amazon.com", "origin-www.amazon.com.au", "us.amazon.com", "amazon.de", "www.amazon.co.uk", "origin-www.amazon.com", "shop.business.amazon.com", "edgeflow.aero.04f01a85e-frontier.amazon.com.au", "www.amazon.jp", "buybox.amazon.com", "amazon.com.au", "footballbet18.com", "nl.atlanta-internet.ru", "www.amazon.com", "iphone.amazon.com", "edgeflow.aero.4d5ad1d2b-frontier.amazon.co.jp", "origin2-www.amazon.co.jp", "edgeflow-dp.aero.4d5ad1d2b-frontier.amazon.co.jp", "huddles.amazon.com", "uedata.amazon.com", "edgeflow.aero.47cf2c8c9-frontier.amazon.com", "amzn.com", "buckeye-retail-website.amazon.com", "edgeflow-dp.aero.abe2c2f23-frontier.amazon.de", "origin-www.amazon.co.jp", "edgeflow-dp.aero.bfbdc3ca1-frontier.amazon.co.uk", "origin2-www.amazon.com", "amazon.com"], "hostnames_count": 49, "matched_domains": ["uedata.amazon.com"], "match_count": 1, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 92.242.62.112
source: stevenblack
validated_at: 2026-04-02T20:12:11.053639
raw_response:
  {"hostnames_checked": ["mysussdtc.com", "myokkoshhhh.com", "ipureksjes.com", "myspurelmera.com", "myreditreskres.com", "myakshhpp.com", "mywoprelkes.com", "myces.ru", "krashand.ru", "teroba.ru", "newsihundred.site", "youthful-fermat.92-242-62-112.plesk.page", "myakoreklshdad.com", "rfitarmail.online", "mail.com-update.mysussdtc.com", "mypoloekrese.com", "servic-notifsecure.com", "kalllojolos.com", "myasrekantopres.com", "mail.web-service.com-verify.mysrpeksereemanre.com"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 92.242.62.132
source: stevenblack
validated_at: 2026-04-02T20:12:11.077072
raw_response:
  {"hostnames_checked": ["trade-coinbase.servicesectorupdate.com", "signinaccountscoinbase.com", "scirelinks.com", "92-242-62-132.cprapid.com", "www.trade-coinbase.servicesectorupdate.com", "payple.com.managerupdate.top", "amzn.com.managerupdate.top", "webdisk.scirelinks.top", "noreplyservice0009.top", "scirelinks.top", "amzonx.com.scirelinks.top", "managerupdate.top", "www.92-242-62-132.cprapid.com", "www.amzn.com.managerupdate.top", "www.payple.com.managerupdate.top", "www.noreplyservice0009.top", "www.amzonx.com.scirelinks.top", "ikev2.neoserver.site", "servicesectorupdate.com", "www.scirelinks.top"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 92.242.62.96
source: stevenblack
validated_at: 2026-04-02T20:12:11.150406
raw_response:
  {"hostnames_checked": ["payple.com.manage-srvicse-updateds.com", "payple.com.limited-svrvice-notif.net", "www.pypl.com.mngerupdte-verify-accnt.com", "www.payple.com.verfiyupdte-mngeraccount.com", "www.payple.com.limited-svrvice-notif.net", "payple.com.managers-verify-authrs-services.com", "manage-auths-securdes.com", "payple.com.verfiyupdte-mngeraccount.com", "doilyrete.site", "payple.com.managers-verify-auths-accnts.com", "www.payple.com.managers-verify-authrs-services.com", "www.payple.com.managers-verify-auths-accnts.com", "redytrcg.com", "secureupdte-accnt.com", "verfiyupdte-mngeraccount.com", "www.payple.com.managers-verify-autrhs-accnts.com", "payple.com.managers-verify-autrhs-accnts.com", "pypl.com.mngerupdte-verify-accnt.com", "paypled.com.manage-auths-securdes.com", "manage-srvicse-updateds.com"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 194.85.250.27
source: shodan
validated_at: 2026-04-06T00:04:30.391485
raw_response:
  {"ports": [21, 22, 25, 53, 80, 110, 143, 443, 465, 993, 995, 8443, 8880], "vulns": ["CVE-2025-26465", "CVE-2008-3844", "CVE-2007-2768", "CVE-2025-32728", "CVE-2023-38408", "CVE-2018-15919", "CVE-2019-6111", "CVE-2023-51385", "CVE-2020-14145", "CVE-2021-36368", "CVE-2018-20685", "CVE-2023-51767", "CVE-2019-6110", "CVE-2016-20012", "CVE-2021-41617", "CVE-2023-48795", "CVE-2020-15778", "CVE-2017-15906", "CVE-2019-6109", "CVE-2018-15473"], "hostnames": ["vps220.zmr.serverion.com"], "tags": ["starttls"], "cpes": ["cpe:/a:f5:nginx", "cpe:/a:postfix:postfix", "cpe:/a:openbsd:openssh:7.4"]}


ioc_type: ipv4
ioc_value: 194.85.250.28
source: shodan
validated_at: 2026-04-06T00:04:32.141964
raw_response:
  {"ports": [21, 22, 25, 53, 80, 110, 143, 443, 465, 993, 995, 8880], "vulns": ["CVE-2025-26465", "CVE-2008-3844", "CVE-2007-2768", "CVE-2025-32728", "CVE-2023-38408", "CVE-2018-15919", "CVE-2019-6111", "CVE-2023-51385", "CVE-2020-14145", "CVE-2007-3205", "CVE-2021-36368", "CVE-2018-15473", "CVE-2018-20685", "CVE-2023-51767", "CVE-2019-6110", "CVE-2016-20012", "CVE-2021-41617", "CVE-2024-3566", "CVE-2023-48795", "CVE-2020-15778", "CVE-2013-2220", "CVE-2017-15906", "CVE-2019-6109", "CVE-2024-5458"], "hostnames": ["uwmooidrenthemakelaar.nl", "vps220.zmr.serverion.com", "webmail.uwmooidrenthemakelaar.nl", "www.uwmooidrenthemakelaar.nl"], "tags": ["eol-product", "starttls"], "cpes": ["cpe:/a:f5:nginx", "cpe:/a:postfix:postfix", "cpe:/a:php:php:8.0.30", "cpe:/a:openbsd:openssh:7.4"]}


ioc_type: ipv4
ioc_value: 194.85.250.29
source: shodan
validated_at: 2026-04-06T00:04:33.924047
raw_response:
  {"ports": [21, 22, 25, 53, 80, 110, 143, 443, 465, 993, 995, 8443, 8880], "vulns": ["CVE-2025-32728", "CVE-2021-36368", "CVE-2018-15473", "CVE-2018-15919", "CVE-2023-51385", "CVE-2008-3844", "CVE-2021-41617", "CVE-2023-51767", "CVE-2020-15778", "CVE-2019-6111", "CVE-2025-26465", "CVE-2019-6110", "CVE-2018-20685", "CVE-2020-14145", "CVE-2023-38408", "CVE-2019-6109", "CVE-2007-2768", "CVE-2017-15906", "CVE-2023-48795", "CVE-2016-20012"], "hostnames": ["vps220.zmr.serverion.com"], "tags": ["starttls"], "cpes": ["cpe:/a:openbsd:openssh:7.4", "cpe:/a:f5:nginx", "cpe:/a:postfix:postfix"]}


ioc_type: ipv4
ioc_value: 176.65.144.25
source: otx
validated_at: 2026-04-06T00:05:04.124774
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Germany", "country_code": "DE", "city": null, "asn": "ASNone ", "indicator": "176.65.144.25", "tags": [], "pulses": [], "malware_count": 1, "passive_dns_count": 19, "malware_samples": ["170656bdfd095fc6aff0f2b756f55d6a56c6e727c4740deefea406d3798fd01a"], "passive_dns": ["artesanosreunidos.xyz", "xtream-play.top", "rohotmail.cdn-domain.net", "mytest.cdn-domain.com", "press.cdn-domain.com", "chp.cat12.eu", "calcio.cdn-domain.com", "base.cdn-domain.net", "sfr.cdn-domain.net", "cdn102.cdn-rtzhx13.online", "000012222.cdn-domain.com", "whatdoyou.cdn-domain.net", "jav1.cdn-domain.net", "cloudfront.cdn-domain.net", "loop.cdn-domain.net", "ssl.cdn-domain.com", "xxxbs.cdn-domain.net", "cdn.cdn-domain.com", "09.11.cdn-domain.net"]}


ioc_type: ipv4
ioc_value: 176.65.144.96
source: otx
validated_at: 2026-04-06T00:05:24.007541
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Germany", "country_code": "DE", "city": null, "asn": "ASNone ", "indicator": "176.65.144.96", "tags": ["portscan", "32-bit", "elf", "twitter", "iocs", "ClickFix", "mirai", "ClearFake", "SmartLoader", "AgentTesla", "arm", "ps1", "Formbook", "HijackLoader", "Loki", "rat", "Encoded", "msi", "exe", "doc", "dll", "powershell", "base64-loader", "AsyncRAT", "meterpreter", "GuLoader", "gs25181222", "censys", "Vidar", "ddos", "hta", "gs2519125", "xloader", "sshdkit", "ua-wget", "DDoSAgent", "DarkVisionRAT", "hajime", "Smoke Loader", "GetShell", "dcrat", "mirai botnet", "Rhadamanthys", "botnetdomain", "DarkTortilla", "backdoor", "mips", "Mozi", "ModiLoader", "gs2518122"], "pulses": ["Threatfox Recent Additions", "[GS-25-17111] Mirai Botnet IOCs - SEC-1275-1", "[GS-25-16106] Mirai Botnet IOCs - SEC-1275-1", "URLHaus data - 10-04-2025"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["9f007f30743c4b90ffeff92c889097625f9f6da6183c9b8bf432fed89c39b9d9"]}


ioc_type: ipv4
ioc_value: 176.65.144.25
source: stevenblack
validated_at: 2026-04-06T00:17:39.652278
raw_response:
  {"hostnames_checked": ["press.cdn-domain.com", "loop.cdn-domain.net", "cloudfront.cdn-domain.net", "cdn102.cdn-rtzhx13.online", "mytest.cdn-domain.com", "sfr.cdn-domain.net", "artesanosreunidos.xyz", "000012222.cdn-domain.com", "chp.cat12.eu", "rohotmail.cdn-domain.net", "ollie.cosmeticosonlinebrasil.com", "09.11.cdn-domain.net", "xxxbs.cdn-domain.net", "ssl.cdn-domain.com", "cdn.cdn-domain.com", "base.cdn-domain.net", "jav1.cdn-domain.net", "xtream-play.top", "calcio.cdn-domain.com", "whatdoyou.cdn-domain.net"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 92277}


ioc_type: ipv4
ioc_value: 37.221.64.224
source: otx
validated_at: 2026-04-08T06:08:41.435633
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.64.224", "tags": ["dns hijacking", "SSH", "Honeypot", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations", "SSH Honeypot IPs 2021 May"], "malware_count": 1, "passive_dns_count": 3, "malware_samples": ["dae58ef1b0c1c8b21b1da392a042f88e8a28931dd6a8df1012a7c0ac3bc3987f"], "passive_dns": ["www.c-ave.co", "admin.c-ave.co", "c-ave.co"]}


ioc_type: ipv4
ioc_value: 5.226.137.243
source: otx
validated_at: 2026-04-08T06:11:04.774378
raw_response:
  {"pulse_count": 31, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS25369 hydra communications ltd", "indicator": "5.226.137.243", "tags": ["ioc", "phishing", "ip address", "Nextray", "malicious", "dns hijacking", "cyber security"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations", "IOC Records Provided by @NextRayAI", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOC Records \u2192Provided by @NextRayAI", "HIVE           (Pulse created by RVS_i_am)", "HIVE           (Pulse created by RVS_i_am)", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "IOC Records \u2192Provided by @NextRayAI"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 77.83.197.40
source: otx
validated_at: 2026-04-08T06:15:27.506954
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS61046 hz hosting ltd", "indicator": "77.83.197.40", "tags": ["star", "conti", "id use", "ta0004", "header dropdown", "template", "trickbot", "footer", "csirt", "copy", "open", "cisa", "cobalt strike", "ip address", "span", "technique title", "zloader", "script", "remote desktop", "button", "enterprise", "dns hijacking", "cert", "cyber security", "contact", "team", "uscert", "meta", "u. s. computer emergency readiness", "admin hash", "path", "reload", "protocol", "link", "cyber risks", "kerberos", "icedid", "github", "main", "desktop", "cybersecurity", "product", "code", "form", "service", "body", "explore", "computer security"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations", "IoC Ransomware CONTI", "Conti Ransomware | CISA", "Conti Ransomware IOC"], "malware_count": 0, "passive_dns_count": 0}


ioc_type: ipv4
ioc_value: 77.83.197.49
source: otx
validated_at: 2026-04-08T06:18:35.059194
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS61046 hz hosting ltd", "indicator": "77.83.197.49", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 43, "malware_samples": [], "passive_dns": ["www.ready-padding.xyz", "www.valid-great.xyz", "programming-make.xyz", "innovation-make.xyz", "innovation-brains.xyz", "valid-great.xyz", "gorgeous-mining.xyz", "ready-padding.xyz", "main-tricky.xyz", "www.main-tricky.xyz", "perfect-beautiful.xyz", "www.perfect-beautiful.xyz", "winning-well.xyz", "www.winning-well.xyz", "valid-ready.xyz", "www.valid-ready.xyz", "www.youthful-land.xyz", "youthful-land.xyz", "www.main-win.xyz", "main-win.xyz"]}


ioc_type: ipv4
ioc_value: 77.83.197.51
source: otx
validated_at: 2026-04-08T06:18:57.022138
raw_response:
  {"pulse_count": 30, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS61046 hz hosting ltd", "indicator": "77.83.197.51", "tags": ["ioc", "phishing", "ip address", "Nextray", "malicious", "dns hijacking", "cyber security"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations", "IOC Records Provided by @NextRayAI", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOC Records \u2192Provided by @NextRayAI", "HIVE           (Pulse created by RVS_i_am)", "HIVE           (Pulse created by RVS_i_am)", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "IOC Records \u2192Provided by @NextRayAI"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 77.83.197.52
source: otx
validated_at: 2026-04-08T06:19:29.891083
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS61046 hz hosting ltd", "indicator": "77.83.197.52", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 9, "passive_dns": ["autoconfig.planesouthwest.com", "www.planesouthwest.com", "planesouthwest.com", "srnawave.com", "box.srnawave.com", "shoawdenko.com", "www.shoawdenko.com", "autoconfig.shoawdenko.com", "box.shoawdenko.com"]}


ioc_type: ipv4
ioc_value: 77.83.197.53
source: otx
validated_at: 2026-04-08T06:19:50.580967
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS61046 hz hosting ltd", "indicator": "77.83.197.53", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 8, "passive_dns": ["ftp.interrplex.com", "ubis0tf.com", "ftp.ubis0tf.com", "ftp.standardrnediaindex.com", "standardrnediaindex.com", "autoconfig.standardrnediaindex.com", "www.standardrnediaindex.com", "slide-transfer.net"]}


ioc_type: ipv4
ioc_value: 79.141.160.78
source: otx
validated_at: 2026-04-08T06:22:02.473083
raw_response:
  {"pulse_count": 25, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Chicago", "asn": "AS202015 hz hosting ltd", "indicator": "79.141.160.78", "tags": ["cve-2025-61882", "cl0p", "powershell", "clop", "zeroday", "0day", "cve-2023-0669", "tinymet", "vulnerability", "exploit", "cobalt strike", "sql injection", "ip address", "cryptomix", "ip addresses", "middle vps", "movit exploit", "dns hijacking", "oracle ebs", "facebook", "ta505", "group", "azure sql", "ransomware", "cyclops blink", "darkweb", "cve-2023-34362", "path", "june", "moveit transfer", "truebot", "sdbot", "fingerprint", "russia", "infrastructure", "july", "random", "suite", "research", "network analysis", "sept", "panama", "fingerprints", "march"], "pulses": ["CLOP RANSOMWARE: DISSECTING NETWORK - THE RAVEN FILE", "#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability", "IOC - FrostArmada: All thriller, no (malware) filler", "IOC - APT28 exploit routers to enable DNS hijacking operations", "BLOCK_2024", "BLOCK_2025_DIC", "CLOP RANSOMWARE: DISSECTING NETWORK", "EbeeNov2025 Pt1", "CLOP RANSOMWARE: DISSECTING NETWORK: THE RAVEN FILE", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "2024-DIC-10-Clon", "CLON IPIF", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Threat Trend Report on Ransomware", "MOVEit Indicators", "StopRansomware: CL0P Ransomware  Gang Exploits  CVE-2023-34362 MOVEit Vulnerability"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 79.141.161.67
source: otx
validated_at: 2026-04-08T06:22:08.307974
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Chicago", "asn": "AS202015 hz hosting ltd", "indicator": "79.141.161.67", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 6, "malware_samples": [], "passive_dns": ["besttriphotel.com", "whm.besttriphotel.com", "cheapflightsonline.besttriphotel.com", "www.cheapflightsonline.besttriphotel.com", "whm.cheapflightsonline.net", "cheapflightsonline.net"]}


ioc_type: ipv4
ioc_value: 79.141.161.71
source: otx
validated_at: 2026-04-08T06:23:07.827300
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Chicago", "asn": "AS202015 hz hosting ltd", "indicator": "79.141.161.71", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 23, "malware_samples": [], "passive_dns": ["www.cn.whattimezone.com", "www.dk.whattimezone.com", "www.cz.whattimezone.com", "www.de.whattimezone.com", "cpcalendars.whattimezone.com", "cpcontacts.whattimezone.com", "vn.whattimezone.com", "se.whattimezone.com", "tr.whattimezone.com", "pt.whattimezone.com", "fr.whattimezone.com", "de.whattimezone.com", "cz.whattimezone.com", "pl.whattimezone.com", "it.whattimezone.com", "jp.whattimezone.com", "cn.whattimezone.com", "dk.whattimezone.com", "nl.whattimezone.com", "es.whattimezone.com"]}


ioc_type: ipv4
ioc_value: 79.141.161.74
source: otx
validated_at: 2026-04-08T06:23:18.398917
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Chicago", "asn": "AS202015 hz hosting ltd", "indicator": "79.141.161.74", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 6, "malware_samples": [], "passive_dns": ["cpcontacts.miamicompanies.com", "cpcalendars.miamicompanies.com", "whm.miamicompanies.com", "www.topflcompanies.com.miamicompanies.com", "topflcompanies.com", "miamicompanies.com"]}


ioc_type: ipv4
ioc_value: 79.141.161.75
source: otx
validated_at: 2026-04-08T06:23:20.768173
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Chicago", "asn": "AS202015 hz hosting ltd", "indicator": "79.141.161.75", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 6, "malware_samples": [], "passive_dns": ["whm.portal-gosuslugi.ru", "portal-gosuslugi.ru", "www.udalenie-zuba.com.portal-gosuslugi.ru", "udalenie-zuba.com.portal-gosuslugi.ru", "whm.udalenie-zuba.com", "udalenie-zuba.com"]}


ioc_type: ipv4
ioc_value: 79.141.161.76
source: otx
validated_at: 2026-04-08T06:23:22.887422
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Chicago", "asn": "AS202015 hz hosting ltd", "indicator": "79.141.161.76", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 5, "malware_samples": [], "passive_dns": ["cpcalendars.holodnoe-serdce.ru", "cpcontacts.holodnoe-serdce.ru", "ns2.xtrafdns.net", "whm.holodnoe-serdce.ru", "holodnoe-serdce.ru"]}


ioc_type: ipv4
ioc_value: 79.141.161.78
source: otx
validated_at: 2026-04-08T06:23:29.620262
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Chicago", "asn": "AS202015 hz hosting ltd", "indicator": "79.141.161.78", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 1, "passive_dns_count": 2, "malware_samples": ["cd26364b12212d5cf50912f32c9181eac48b943b41afd79c6ab91ba973f2f45e"], "passive_dns": ["quick-bd-check.recordsfastfhl.com", "virtualcounselorbrowardcountyschools.educationlqx.com"]}


ioc_type: ipv4
ioc_value: 79.141.161.79
source: otx
validated_at: 2026-04-08T06:23:32.028132
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Chicago", "asn": "AS202015 hz hosting ltd", "indicator": "79.141.161.79", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["affordableextendedcarwarranty.autowarrantygyl.com", "criminal-records-ireland.recordsonlinert.com", "bexarcountyjudicialrecords.brecordsmjq.com", "findpeoplecornell.brecordsmjq.com"]}


ioc_type: ipv4
ioc_value: 79.141.161.82
source: otx
validated_at: 2026-04-08T06:23:41.331999
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Chicago", "asn": "AS202015 hz hosting ltd", "indicator": "79.141.161.82", "tags": ["clop", "cl0p", "powershell", "tinymet", "vulnerability", "cisa", "exploit", "cobalt strike", "sql injection", "ip address", "cryptomix", "enterprise", "movit exploit", "dns hijacking", "ta505", "group", "install", "dewmode", "azure sql", "get2", "ransomware", "flawedammyy", "path", "TA505", "moveit transfer", "fingerprint", "truebot", "sdbot", "russia", "flawedgrace", "february", "suite", "research", "service", "cl0p ransomware", "june", "ck techniques", "restrict", "panama"], "pulses": ["#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability", "IOC - APT28 exploit routers to enable DNS hijacking operations", "CLOP RANSOMWARE: DISSECTING NETWORK", "Clop Ransomware Likely Sitting on MOVEit Transfer Vulnerability (CVE-2023-34362) Since 2021", "StopRansomware: CL0P Ransomware  Gang Exploits  CVE-2023-34362 MOVEit Vulnerability", "StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability", "#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability | CISA", "#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability | CISA", "#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability | CISA"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 79.141.161.83
source: otx
validated_at: 2026-04-08T06:23:43.580022
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Chicago", "asn": "AS202015 hz hosting ltd", "indicator": "79.141.161.83", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 1, "passive_dns_count": 3, "malware_samples": ["5b65c7c2b8253af93b043a63cfd168e665b71002e877aefb756289de1f9ee95b"], "passive_dns": ["insgetjgy.com", "www.airlineticketspyj.com", "airlineticketspyj.com"]}


ioc_type: ipv4
ioc_value: 79.141.161.84
source: otx
validated_at: 2026-04-08T06:23:49.394941
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Chicago", "asn": "AS202015 hz hosting ltd", "indicator": "79.141.161.84", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 11, "malware_samples": [], "passive_dns": ["snoop-dogg-arrest-record.recordseasyrt.com", "otsego-county-criminal-records.recordsnowrt.com", "autowarrantyjgy.com", "chelsea-arrest-records.recordsnowrt.com", "recordsnowrt.com", "fort-wayne-criminal-records.recordsnowrt.com", "criminal-bd-check-maryland.recordsfindfhl.com", "chatham-county-recorders-court.recordseasyrt.com", "ccap-wisconsin-court-records.recordseasyrt.com", "guadalupe-county-arrest-records.recordseasyrt.com", "wilson-county-arrest-records.recordsnowrt.com"]}


ioc_type: ipv4
ioc_value: 79.141.173.96
source: otx
validated_at: 2026-04-08T06:23:56.885614
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.96", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 19, "malware_samples": [], "passive_dns": ["taddeocos.com", "nfmjarusioke.com", "fatimanorthyuul.com", "xasawosting.com", "salacercamarvyuaiman.com", "muchouitelebria.com", "lakeradomit.com", "horsaspafcar.com", "hearcatbook.com", "resuolyertteqeoin.com", "www.resuolyertteqeoin.com", "www.mudfasasalkolosdok.nl", "mudfasasalkolosdok.nl", "sluvfaerxergrotoe.nl", "www.sluvfaerxergrotoe.nl", "www.veralsnrtotoe.nl", "veralsnrtotoe.nl", "www.vudsdipazsdanenelo.nl", "vudsdipazsdanenelo.nl"]}


ioc_type: ipv4
ioc_value: 79.141.173.97
source: otx
validated_at: 2026-04-08T06:23:59.064344
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.97", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 20, "malware_samples": [], "passive_dns": ["samechelneluytremen.com", "fatimanohyuul.com", "faraamblo.com", "fatimanoul.com", "muchocoiltelebria.com", "muchocoilouitelebria.com", "filonasusaroltisdp.com", "horsaspafcap.com", "www.mishayeonoy.nl", "mishayeonoy.nl", "www.kfalirhyhyt.nl", "kfalirhyhyt.nl", "www.dulooisoso.nl", "dulooisoso.nl", "www.cetsolsetcheverkloas.nl", "cetsolsetcheverkloas.nl", "vudsdipazsdenelo.nl", "www.vudsdipazsdenelo.nl", "www.mudfasasalkosdok.nl", "mudfasasalkosdok.nl"]}


ioc_type: ipv4
ioc_value: 79.141.173.98
source: otx
validated_at: 2026-04-08T06:24:03.560825
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.98", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 22, "malware_samples": [], "passive_dns": ["sintyiroiylire.com", "samechelneluytre.com", "vaflasarp.com", "salacercamaiman.com", "hodergkaj.com", "pyloseulonutul.com", "kiolosalacerciman.com", "ahtstyrlonrtio.com", "sluverxergrotoe.nl", "nishyhonoy.nl", "www.nishyhonoy.nl", "peloikaschmsoso.nl", "www.peloikaschmsoso.nl", "vudsdipazenelo.nl", "www.vudsdipazenelo.nl", "www.mudfasasaosdok.nl", "mudfasasaosdok.nl", "www.peloimalasoso.nl", "peloimalasoso.nl", "www.peloikaschmalasoso.nl"]}


ioc_type: ipv4
ioc_value: 79.141.173.103
source: otx
validated_at: 2026-04-08T06:24:06.843777
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.103", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 22, "malware_samples": [], "passive_dns": ["samechelneluy.com", "guhihono.com", "relrirasai.com", "xodergkaj.com", "calyizionzinpo.com", "sodergkaj.com", "muchocoiltbria.com", "hourbastfuct.com", "hexacatbook.com", "favowykeopen.com", "www.tikerdedagt.nl", "tikerdedagt.nl", "www.slivikrotoe.nl", "slivikrotoe.nl", "www.cetsolsetcheoas.nl", "cetsolsetcheoas.nl", "cetsolsetchekloas.nl", "www.cetsolsetchekloas.nl", "www.vudsdenelo.nl", "vudsdenelo.nl"]}


ioc_type: ipv4
ioc_value: 79.141.173.122
source: otx
validated_at: 2026-04-08T06:24:27.720613
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.122", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 13, "malware_samples": [], "passive_dns": ["wertasoerianaa.com", "tanralruan.com", "seralruan.com", "poiwertasuia.com", "aramahgamyuch.com", "solowerwaleerty.com", "salacerciman.com", "kiokiolosalace.com", "horsaspafcal.com", "www.solchekloas.nl", "solchekloas.nl", "www.malamnsoso.nl", "malamnsoso.nl"]}


ioc_type: ipv4
ioc_value: 79.141.173.231
source: otx
validated_at: 2026-04-08T06:24:47.964989
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.231", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 17, "malware_samples": [], "passive_dns": ["mfarmturan.com", "lottyiryioiylire.com", "gugtuno.com", "opreteerianaa.com", "oerianaa.com", "activetu.com", "tarewiolovaraviubx.com", "poidarsamonov.com", "eretomimik.com", "registeranus.com", "reurtusthabt.com", "www.paraplanritaf.nl", "paraplanritaf.nl", "paraplanriryt.nl", "www.paraplanriryt.nl", "www.paraplanriafhgd.nl", "paraplanriafhgd.nl"]}


ioc_type: ipv4
ioc_value: 79.141.173.232
source: otx
validated_at: 2026-04-08T06:24:50.109616
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.232", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 8, "malware_samples": [], "passive_dns": ["baronertresuolin.com", "casawosting.com", "sasawosting.com", "pyloatanoul.com", "poidardsamonov.com", "faeraaebria.com", "proverkag.nl", "www.proverkag.nl"]}


ioc_type: ipv4
ioc_value: 79.141.173.233
source: otx
validated_at: 2026-04-08T06:24:52.434171
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.233", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 8, "malware_samples": [], "passive_dns": ["opreteryuerianaa.com", "sauloeraaebria.com", "saulogetoeraaebria.com", "pyloanoul.com", "www.mishonoy.nl", "mishonoy.nl", "reerarasai.nl", "www.reerarasai.nl"]}


ioc_type: ipv4
ioc_value: 185.117.88.22
source: otx
validated_at: 2026-04-08T06:24:54.606747
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Sweden", "country_code": "SE", "city": "Stockholm", "asn": "AS42708 glesys ab", "indicator": "185.117.88.22", "tags": ["windows", "ip address", "honeypot", "blacklist", "admin", "win", "dns hijacking", "tcp", "scan", "botnet", "Malicious IP", "mirai", "Honeypot", "RDP"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations", "Lion Team_Honeypots_RDP_IP 2023/03/26", "Scan port 3389 RDP (S3#)"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["chooseform.com"]}


ioc_type: ipv4
ioc_value: 185.117.88.30
source: otx
validated_at: 2026-04-08T06:25:05.527237
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Sweden", "country_code": "SE", "city": "Stockholm", "asn": "AS42708 glesys ab", "indicator": "185.117.88.30", "tags": ["dns hijacking", "ip address"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 7, "malware_samples": [], "passive_dns": ["ftoury.com", "www.momspost.com", "momspost.com", "ns1.fuckedblackgirls.com", "ns2.fuckedblackgirls.com", "fuckedblackgirls.com", "www.fuckedblackgirls.com"]}


ioc_type: ipv4
ioc_value: 77.83.197.44
source: otx
validated_at: 2026-04-08T12:03:57.739346
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS61046 hz hosting ltd", "indicator": "77.83.197.44", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 24, "malware_samples": [], "passive_dns": ["cd483.name300.sbs", "ns1.fg6jkds8hhvd1.site", "obshee-delo.biz", "finpb.org", "amazinginvezt.org", "investgas.net", "crypt-invezt.net", "btc-es.org", "success-finance.org", "btcbill.org", "investgs.net", "gas-invest.com", "gazivest.net", "btcbill.net", "priv-ik.com", "priv-ik.net", "pr-invest.org", "nbk-i.com", "nbk-invezt.com", "p-invezt.net"]}


ioc_type: ipv4
ioc_value: 185.117.88.29
source: otx
validated_at: 2026-04-08T12:04:09.660252
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Sweden", "country_code": "SE", "city": "Stockholm", "asn": "AS42708 glesys ab", "indicator": "185.117.88.29", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 7, "malware_samples": [], "passive_dns": ["schwepes.com", "www.ebonygirlsnaked.net", "ebonygirlsnaked.net", "www.nudebabe.pictures", "nudebabe.pictures", "www.youngpussynaked.com", "youngpussynaked.com"]}


ioc_type: ipv4
ioc_value: 185.237.166.235
source: otx
validated_at: 2026-04-08T12:05:27.665954
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS211598 ipservices limited", "indicator": "185.237.166.235", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["8b00c266794f7afff154d6e9555f28d9c48b35080d2a7c4597636a75d3531ac6"], "passive_dns": []}


ioc_type: ipv4
ioc_value: 64.44.154.240
source: otx
validated_at: 2026-04-08T12:08:54.689987
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20278 nexeon technologies  inc.", "indicator": "64.44.154.240", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["60a17a0c5a24f901a9b8c861a51ab0fb5071d484b0a9a5b57fda8710fc378493"]}


ioc_type: ipv4
ioc_value: 79.141.173.123
source: otx
validated_at: 2026-04-08T12:08:59.985691
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": null, "asn": "AS202015 hz hosting ltd", "indicator": "79.141.173.123", "tags": ["ip address", "dns hijacking"], "pulses": ["IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 0, "passive_dns_count": 14, "malware_samples": [], "passive_dns": ["seralrmtlkuan.com", "poisyuwertasuia.com", "aramahgamych.com", "headcatbook.com", "lorhkingvox.com", "letstyrlonrtio.com", "titfualirgfhtyhy.nl", "www.titfualirgfhtyhy.nl", "www.zalopsluvfagrotoe.nl", "zalopsluvfagrotoe.nl", "solmaschetnikloas.nl", "www.solmaschetnikloas.nl", "mudfasarlok.nl", "www.mudfasarlok.nl"]}


ioc_type: ipv4
ioc_value: 89.150.40.43
source: otx
validated_at: 2026-04-08T12:13:38.520038
raw_response:
  {"pulse_count": 8, "reputation": 0, "country": "Italy", "country_code": "IT", "city": "Orzinuovi", "asn": "AS28716 reti telematiche italiane s.p.a. (retelit s.p.a.)", "indicator": "89.150.40.43", "tags": ["targeted", "research", "cybersecurity", "infrastructure", "cylanceendpoint", "maritime", "pdns", "cve-2017-0199", "urls", "javascript", "vulnerability", "ip address", "cve-2017-11882", "sidewinder", "appendix", "sri lanka", "hashes", "classification", "nation-state", "stage", "phishing", "dns hijacking", "confidential", "shellcode", "espionage", "october", "sha256"], "pulses": ["SideWinder Utilizes New Infrastructure to Target Ports and Maritime Facilities in the Mediterranean Sea", "IOC - APT28 exploit routers to enable DNS hijacking operations", "SideWinder Utilizes New Infrastructure to Target Ports and Maritime Facilities in the Mediterranean Sea", "C&C-IP-List", "New SideWinder Attacks Target Maritime Facilities", "SideWinder Utilizes New Infrastructure to Target Ports and Maritime Facilities in the Mediterranean Sea", "SideWinder Utilizes New Infrastructure to Target Ports and Maritime Facilities in the Mediterranean Sea", "SideWinder Utilizes New Infrastructure to Target Ports and Maritime Facilities in the Mediterranean Sea"], "malware_count": 0, "passive_dns_count": 4, "passive_dns": ["salary-cutting.session-out.com", "session-out.com", "policy.session-out.com", "investigation04.session-out.com"]}


ioc_type: ipv4
ioc_value: 185.234.73.61
source: otx
validated_at: 2026-04-08T12:15:39.696627
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Poland", "country_code": "PL", "city": "Poznan", "asn": "AS206804 estnoc oy", "indicator": "185.234.73.61", "tags": ["russia", "apt28", "dns hijacking", "exploit", "oauth", "ip address", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["b20b90dc82fb4254ebf893c377dce753e3048ccec9d77026c1e7cf1e382db51d"]}


ioc_type: ipv4
ioc_value: 103.140.186.149
source: otx
validated_at: 2026-04-08T18:05:57.213533
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Singapore", "country_code": "SG", "city": "Ulu Bedok", "asn": "AS206804 estnoc oy", "indicator": "103.140.186.149", "tags": ["exploit", "apt28", "russia", "oauth", "ip address", "dns hijacking", "tp-link"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["1736d4c724074d5a8e58b10cfa84dd7e3492ddbdff72906ca36656f3e0d2cf15"]}


ioc_type: ipv4
ioc_value: 103.140.186.155
source: otx
validated_at: 2026-04-08T18:06:15.323223
raw_response:
  {"pulse_count": 5, "reputation": 0, "country": "Singapore", "country_code": "SG", "city": "Ulu Bedok", "asn": "AS206804 estnoc oy", "indicator": "103.140.186.155", "tags": ["field", "ip address", "feeds malicious", "china", "censys", "oauth", "info", "feed malware", "ssh host", "exploit", "feeds agent", "apt28", "malicious ip", "domain feed", "cobalt", "feed", "watermark", "tp-link", "precisionsec", "cobalt strike", "russia", "country", "october", "virus total", "iocs", "strong", "dns hijacking"], "pulses": ["APT28 exploit routers to enable DNS hijacking operations", "IOC - APT28 exploit routers to enable DNS hijacking operations", "Cobalt Strike Infrastructure Hunt: 85 Newly Discovered Undetected Servers.", "Threatfox Recent Additions", "Cobalt Strike Indicators of Compromise (IOC) Feed - PrecisionSec - Tacking 2024"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 146.185.233.101
source: otx
validated_at: 2026-04-17T18:03:50.054835
raw_response:
  {"pulse_count": 11, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS41390 rn data sia", "indicator": "146.185.233.101", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powershell", "ukraine", "cactus", "talos", "download", "span", "enterprise", "body", "remcos backdoor", "tetraloader", "find", "cobaltstrike", "reload", "hyperhosting", "metasploit", "form", "gthost", "phishing", "germany", "write"], "pulses": ["Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Interlock Ransomware IOCs", "Interlock Ransomware IOCs", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "InQuest - 05-04-2025", "InQuest - 04-04-2025", "InQuest - 03-04-2025", "InQuest - 02-04-2025", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "IOC - Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Russia-linked Gamaredon targets Ukraine with Remcos RAT"], "malware_count": 2, "passive_dns_count": 0, "malware_samples": ["134d02ddcc75a2d7e0e1824d430ba2e9a2a96682452fa6ec84660ed5d0a88023", "7ea77f4746f21e89df52c9a54c12135f3f45f7a342e8b1dba09abf2a7e8c4f15"]}


ioc_type: ipv4
ioc_value: 146.185.233.79
source: otx
validated_at: 2026-04-17T18:04:14.066896
raw_response:
  {"pulse_count": 6, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS41390 rn data sia", "indicator": "146.185.233.79", "tags": ["toymaker", "path", "button", "close", "link", "star", "copy", "small", "open", "main", "code", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "script", "footer", "powershell", "ukraine", "cactus", "download", "span", "enterprise", "body", "tetraloader", "find", "cobaltstrike", "reload", "hyperhosting", "metasploit", "form", "gthost", "phishing", "write"], "pulses": ["Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Interlock Ransomware IOCs", "Interlock Ransomware IOCs", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "IOC - Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Russia-linked Gamaredon targets Ukraine with Remcos RAT"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 146.185.233.90
source: otx
validated_at: 2026-04-17T18:04:25.472880
raw_response:
  {"pulse_count": 12, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS41390 rn data sia", "indicator": "146.185.233.90", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powershell", "ukraine", "cactus", "talos", "download", "span", "enterprise", "body", "remcos backdoor", "tetraloader", "find", "cobaltstrike", "reload", "hyperhosting", "metasploit", "form", "gthost", "phishing", "germany", "write"], "pulses": ["Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Interlock Ransomware IOCs", "Interlock Ransomware IOCs", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "InQuest - 05-04-2025", "InQuest - 04-04-2025", "InQuest - 03-04-2025", "InQuest - 02-04-2025", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "IOC - Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Russia-linked Gamaredon targets Ukraine with Remcos RAT", "Twitter Feed - malwrhunterteam - 03-03-2025"], "malware_count": 2, "passive_dns_count": 2, "malware_samples": ["502104d48d0a4735a6a051744277c9231f8da156311ec99367bca50b7a47a613", "0321758329ca44f1c9f7e15a37f081df39ba37598b1547d2f2bbc839b34f0b2b"], "passive_dns": ["id-39d4a.online", "lordseriala.uno"]}


ioc_type: ipv4
ioc_value: 146.185.233.96
source: otx
validated_at: 2026-04-17T18:04:42.503465
raw_response:
  {"pulse_count": 12, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS41390 rn data sia", "indicator": "146.185.233.96", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powershell", "ukraine", "cactus", "talos", "download", "span", "enterprise", "body", "remcos backdoor", "tetraloader", "find", "cobaltstrike", "reload", "hyperhosting", "metasploit", "form", "gthost", "phishing", "germany", "write"], "pulses": ["Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Interlock Ransomware IOCs", "Interlock Ransomware IOCs", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "InQuest - 05-04-2025", "InQuest - 04-04-2025", "InQuest - 03-04-2025", "InQuest - 02-04-2025", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Gamaredon Targets Troops via  Malware", "IOC - Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Russia-linked Gamaredon targets Ukraine with Remcos RAT"], "malware_count": 2, "passive_dns_count": 0, "malware_samples": ["cd229d29ef929feb9a74a6b265fd26caa3fd5be2d2150ba359336307799872be", "43a9f0a3963d700a6d586c65fc7fdd1bb562b861942c384e7767213cf1059ef9"], "passive_dns": []}


ioc_type: ipv4
ioc_value: 146.185.233.98
source: otx
validated_at: 2026-04-17T18:05:15.389743
raw_response:
  {"pulse_count": 11, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS41390 rn data sia", "indicator": "146.185.233.98", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powershell", "ukraine", "cactus", "talos", "download", "span", "enterprise", "body", "remcos backdoor", "tetraloader", "find", "cobaltstrike", "reload", "hyperhosting", "metasploit", "form", "gthost", "phishing", "germany", "write"], "pulses": ["Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Interlock Ransomware IOCs", "Interlock Ransomware IOCs", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "InQuest - 05-04-2025", "InQuest - 04-04-2025", "InQuest - 03-04-2025", "InQuest - 02-04-2025", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "IOC - Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Russia-linked Gamaredon targets Ukraine with Remcos RAT"], "malware_count": 0, "passive_dns_count": 0}


ioc_type: ipv4
ioc_value: 146.185.233.99
source: otx
validated_at: 2026-04-17T18:05:42.273859
raw_response:
  {"pulse_count": 6, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS41390 rn data sia", "indicator": "146.185.233.99", "tags": ["toymaker", "path", "button", "close", "link", "star", "copy", "small", "open", "main", "code", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "script", "footer", "powershell", "ukraine", "cactus", "download", "span", "enterprise", "body", "tetraloader", "find", "cobaltstrike", "reload", "hyperhosting", "metasploit", "form", "gthost", "phishing", "write"], "pulses": ["Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Interlock Ransomware IOCs", "Interlock Ransomware IOCs", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "IOC - Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Russia-linked Gamaredon targets Ukraine with Remcos RAT"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 146.185.239.33
source: otx
validated_at: 2026-04-17T18:06:15.042772
raw_response:
  {"pulse_count": 12, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS212496 good sia", "indicator": "146.185.239.33", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powershell", "ukraine", "cactus", "talos", "download", "span", "enterprise", "body", "remcos backdoor", "tetraloader", "find", "cobaltstrike", "reload", "hyperhosting", "metasploit", "form", "gthost", "phishing", "germany", "write"], "pulses": ["Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Interlock Ransomware IOCs", "Interlock Ransomware IOCs", "Threatfox Recent Additions", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "InQuest - 05-04-2025", "InQuest - 04-04-2025", "InQuest - 03-04-2025", "InQuest - 02-04-2025", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "IOC - Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Russia-linked Gamaredon targets Ukraine with Remcos RAT"], "malware_count": 0, "passive_dns_count": 0}


ioc_type: ipv4
ioc_value: 146.185.239.45
source: otx
validated_at: 2026-04-17T18:06:48.308879
raw_response:
  {"pulse_count": 12, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS212496 good sia", "indicator": "146.185.239.45", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powershell", "ukraine", "cactus", "talos", "download", "span", "enterprise", "body", "remcos backdoor", "tetraloader", "find", "cobaltstrike", "reload", "hyperhosting", "metasploit", "form", "gthost", "phishing", "germany", "write"], "pulses": ["Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Interlock Ransomware IOCs", "Interlock Ransomware IOCs", "Threatfox Recent Additions", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "InQuest - 05-04-2025", "InQuest - 04-04-2025", "InQuest - 03-04-2025", "InQuest - 02-04-2025", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "IOC - Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Russia-linked Gamaredon targets Ukraine with Remcos RAT"], "malware_count": 0, "passive_dns_count": 0}


ioc_type: ipv4
ioc_value: 146.185.239.56
source: otx
validated_at: 2026-04-17T18:07:58.681333
raw_response:
  {"pulse_count": 12, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS212496 good sia", "indicator": "146.185.239.56", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powershell", "ukraine", "cactus", "talos", "download", "span", "enterprise", "body", "remcos backdoor", "tetraloader", "find", "cobaltstrike", "reload", "hyperhosting", "metasploit", "form", "gthost", "phishing", "germany", "write"], "pulses": ["Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Interlock Ransomware IOCs", "Interlock Ransomware IOCs", "Threatfox Recent Additions", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "InQuest - 05-04-2025", "InQuest - 04-04-2025", "InQuest - 03-04-2025", "InQuest - 02-04-2025", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "IOC - Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Russia-linked Gamaredon targets Ukraine with Remcos RAT"], "malware_count": 0, "passive_dns_count": 0}


ioc_type: ipv4
ioc_value: 146.185.239.60
source: otx
validated_at: 2026-04-17T18:08:31.576710
raw_response:
  {"pulse_count": 12, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS212496 good sia", "indicator": "146.185.239.60", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powershell", "ukraine", "cactus", "talos", "download", "span", "enterprise", "body", "remcos backdoor", "tetraloader", "find", "cobaltstrike", "reload", "hyperhosting", "metasploit", "form", "gthost", "phishing", "germany", "write"], "pulses": ["Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Interlock Ransomware IOCs", "Interlock Ransomware IOCs", "Threatfox Recent Additions", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "InQuest - 05-04-2025", "InQuest - 04-04-2025", "InQuest - 03-04-2025", "InQuest - 02-04-2025", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "IOC - Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Russia-linked Gamaredon targets Ukraine with Remcos RAT"], "malware_count": 0, "passive_dns_count": 0}


ioc_type: ipv4
ioc_value: 80.66.79.155
source: otx
validated_at: 2026-04-17T18:08:49.593116
raw_response:
  {"pulse_count": 11, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS206336 grzegorz nagorka efiber", "indicator": "80.66.79.155", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powershell", "ukraine", "cactus", "talos", "download", "span", "enterprise", "body", "remcos backdoor", "tetraloader", "find", "cobaltstrike", "reload", "hyperhosting", "metasploit", "form", "gthost", "phishing", "germany", "write"], "pulses": ["Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Interlock Ransomware IOCs", "Interlock Ransomware IOCs", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "InQuest - 05-04-2025", "InQuest - 04-04-2025", "InQuest - 03-04-2025", "InQuest - 02-04-2025", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "IOC - Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Russia-linked Gamaredon targets Ukraine with Remcos RAT"], "malware_count": 2, "passive_dns_count": 0, "malware_samples": ["899a46e956e82b9da2b86eae8cbdec1e68521c708a87bce1a2ae11b20538eb55", "f028c4086990756ee37dee303015053c73ec1c4d358e3a6a50b3e88a6c7ffe8e"]}


ioc_type: ipv4
ioc_value: 80.66.79.159
source: otx
validated_at: 2026-04-17T18:09:07.243801
raw_response:
  {"pulse_count": 11, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS206336 grzegorz nagorka efiber", "indicator": "80.66.79.159", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powershell", "ukraine", "cactus", "talos", "download", "span", "enterprise", "body", "remcos backdoor", "tetraloader", "find", "cobaltstrike", "reload", "hyperhosting", "metasploit", "form", "gthost", "phishing", "germany", "write"], "pulses": ["Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Interlock Ransomware IOCs", "Interlock Ransomware IOCs", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "InQuest - 05-04-2025", "InQuest - 04-04-2025", "InQuest - 03-04-2025", "InQuest - 02-04-2025", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "IOC - Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Russia-linked Gamaredon targets Ukraine with Remcos RAT"], "malware_count": 2, "passive_dns_count": 0, "malware_samples": ["ecf7e135bcdcad3274e94c6ab918b683da619e91a9e0c68bd8d6355b33bfc5da", "121746df4264aca0c138d35bbe5e2c6eaaa60b72967a527687e83d7e2c653207"]}


ioc_type: ipv4
ioc_value: 80.66.79.195
source: otx
validated_at: 2026-04-17T18:09:40.492542
raw_response:
  {"pulse_count": 11, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS206336 grzegorz nagorka efiber", "indicator": "80.66.79.195", "tags": ["toymaker", "russia", "zip file", "path", "button", "close", "link", "cisco secure", "star", "copy", "small", "open", "main", "gamaredon", "code", "threat spotlight", "dll side", "lnk files", "contact", "remcos", "network iocs", "meta", "template", "dll sideloading", "github", "access", "script", "footer", "powershell", "ukraine", "cactus", "talos", "download", "span", "enterprise", "body", "remcos backdoor", "tetraloader", "find", "cobaltstrike", "reload", "hyperhosting", "metasploit", "form", "gthost", "phishing", "germany", "write"], "pulses": ["Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Interlock Ransomware IOCs", "Interlock Ransomware IOCs", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "InQuest - 05-04-2025", "InQuest - 04-04-2025", "InQuest - 03-04-2025", "InQuest - 02-04-2025", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "IOC - Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Russia-linked Gamaredon targets Ukraine with Remcos RAT"], "malware_count": 0, "passive_dns_count": 0, "passive_dns": []}


ioc_type: ipv4
ioc_value: 80.66.79.91
source: otx
validated_at: 2026-04-17T18:10:01.872760
raw_response:
  {"pulse_count": 12, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS206336 grzegorz nagorka efiber", "indicator": "80.66.79.91", "tags": ["toymaker", "russia", "SPAM-ITA", "zip file", "close", "x86-64", "link", "by", "bitbucket", "open", "LummaStealer", "main", "rat", "mips", "90775886812", "network iocs", "pw-90775886812", "footer", "zip", "ua-wget", "censys", "bitter", "hyperhosting", "metasploit", "gthost", "phishing", "elf", "SocGholish", "cisco secure", "arm", "APT", "GetShell", "star", "Mozi", "PythonStealer", "Metasploit", "threat spotlight", "WsgiDAV", "RemcosRAT", "meta", "template", "exe", "mirai", "ukraine", "cactus", "js", "dll", "Themida", "span", "body"], "pulses": ["Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Interlock Ransomware IOCs", "Interlock Ransomware IOCs", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "InQuest - 05-04-2025", "InQuest - 04-04-2025", "InQuest - 03-04-2025", "InQuest - 02-04-2025", "Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "IOC - Gamaredon campaign abuses LNK files to distribute Remcos backdoor", "Russia-linked Gamaredon targets Ukraine with Remcos RAT", "URLHaus data - 13-12-2024"], "malware_count": 3, "passive_dns_count": 36, "malware_samples": ["a73226550f0b97c3f25411ba62181aa011e8410dec4a1444412f40114704d4c2", "79af449339eb1410e8f3ed8d7fe7649b079e0143a06ef91cc78f296b0e927901", "7c50be91304ee573c2bc8823f67ea4f45a1988ceb73ffe5ebcaccaf59e5c1cce"], "passive_dns": ["lordwomanfilm.mom", "internet-seite.com", "gonzalonina.com", "blockedinparking.net", "travisbyrne.com", "cryptoriano.com", "shopeexcommerce.com", "hrazy.com", "filesnow.org", "ksa-cab.com", "mikeolie.com", "nutrl.com", "spiritvid.com", "tbgfilm.com", "greenmx.com", "filyze.net", "bigbarksmalldog.org", "msotrends.com", "design-reg.org", "getbrandaid.com"]}


ioc_type: ipv4
ioc_value: 213.139.205.23
source: otx
validated_at: 2026-04-17T18:10:06.214261
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS395092 shock hosting llc", "indicator": "213.139.205.23", "tags": ["russia", "system", "apt", "port", "meltingclaw", "cisco secure", "time", "rustclaw", "cyber", "open", "landing page top story", "ipaddress", "ipv4", "rust", "rustyclaw", "umbrella", "crypto cyber", "shadyhammock", "poland", "romcom", "hashes", "dustyhammock", "top story", "plink", "october", "ukraine", "threat", "malware", "polish", "domains", "singlecamper", "sha256", "uat5647", "defence"], "pulses": ["Ukrainian and Polish entities targeted with RomCom malware variants", "InQuest - 28-10-2024", "Remote Access Trojans Deployed using Gophish Framework", "InQuest - 27-10-2024", "InQuest - 26-10-2024", "InQuest - 25-10-2024", "InQuest - 24-10-2024", "InQuest - 23-10-2024", "UAT-5647 targets Ukrainian and Polish entities with RomCom malware variants", "Russian RomCom Targeting Ukrainian Government with New SingleCamper RAT Variant"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["apisolving.com"]}


ioc_type: ipv4
ioc_value: 23.94.207.116
source: otx
validated_at: 2026-04-17T18:10:08.995603
raw_response:
  {"pulse_count": 14, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS36352 colocrossing", "indicator": "23.94.207.116", "tags": ["russia", "system", "apt", "port", "meltingclaw", "cisco secure", "time", "cyber", "open", "landing page top story", "ipaddress", "ipv4", "rust", "rustyclaw", "umbrella", "crypto cyber", "shadyhammock", "romcom", "hashes", "top story", "dustyhammock", "plink", "october", "ukraine", "threat", "malware", "polish", "phishing", "domains", "singlecamper", "sha256", "uat5647", "defence"], "pulses": ["InQuest - 28-10-2024", "Remote Access Trojans Deployed using Gophish Framework", "InQuest - 27-10-2024", "InQuest - 26-10-2024", "InQuest - 25-10-2024", "InQuest - 24-10-2024", "InQuest - 23-10-2024", "UAT-5647 targets Ukrainian and Polish entities with RomCom malware variants", "Russian RomCom Targeting Ukrainian Government with New SingleCamper RAT Variant", "ETIC Cybersecurity  2024-07-02  Port Scan", "ETIC Cybersecurity  2024-07-01  Port Scan", "ETIC Cybersecurity  2024-06-28  Port Scan", "Twitter Feed - romonlyht - 22-12-2022", "Twitter Feed - KesaGataMe0 - 21-12-2022"], "malware_count": 0, "passive_dns_count": 9, "malware_samples": [], "passive_dns": ["pimestars.com", "aisagift.com", "giftofasia.com", "www.easternglow.top", "easternglow.top", "rdcservice.org", "elk-t1nett.cyou", "elk-t1nett.xyz", "elk-t1nett.icu"]}


ioc_type: ipv4
ioc_value: 91.92.242.87
source: otx
validated_at: 2026-04-17T18:10:16.801162
raw_response:
  {"pulse_count": 39, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Sistov", "asn": "ASNone ", "indicator": "91.92.242.87", "tags": ["russia", "osint-volley", "DugganUSA", "infostealer", "c2-infrastructure", "meltingclaw", "auto-updated", "rhadamanthys", "rustclaw", "blocked-ips", "asyncrat", "dragonforce", "dugganusa", "stealc", "rustyclaw", "commodity-rat", "shadyhammock", "stix-2.1", "supply-chain", "poland", "snipbot", "auto-generated", "romcom", "github", "clearfake", "ssl-enrichment", "unknown-malware", "dustyhammock", "LummaStealer, RedLine,...", "threat-intelligence", "isp-reputation", "ukraine", "pattern-38", "pattern-49", "mitre-attack", "pattern-32", "threatfox", "singlecamper", "automated", "automated-hunt"], "pulses": ["Ukrainian and Polish entities targeted with RomCom malware variants", "Inside SnipBot: The Latest RomCom Malware Variant", "DugganUSA Master Threat Feed - Live Blocked IPs with MITRE ATT&CK (Auto-Updated)", "ThreatFix_IP", "ThreatFix_IP", "ThreatFox Hunt: AsyncRAT IOCs - 2025-12-29", "Oz Batch: 50 IOCs (avg BDE: 85)", "ThreatFox Hunt: AsyncRAT IOCs - 2025-12-29", "OSINT Volley 2025-12-28 - ClearFake/Unknown malware/DragonForce", "OSINT Volley 2025-12-28 - ClearFake/Unknown malware/DragonForce", "OSINT Volley 2025-12-28 - ClearFake/Unknown malware/DragonForce", "OSINT Volley 2025-12-28 - ClearFake/Unknown malware/DragonForce", "OSINT Volley 2025-12-28 - ClearFake/Unknown malware/DragonForce", "OSINT Volley 2025-12-28 - ClearFake/Unknown malware/DragonForce", "OSINT Volley 2025-12-28 - ClearFake/Unknown malware/DragonForce", "OSINT Volley 2025-12-28 - ClearFake/Unknown malware/DragonForce", "OSINT Volley 2025-12-28 - ClearFake/Unknown malware/DragonForce", "OSINT Volley 2025-12-28 - ClearFake/Unknown malware/DragonForce", "OSINT Volley 2025-12-28 - ClearFake/Unknown malware/DragonForce", "OSINT Volley 2025-12-28 - ClearFake/Unknown malware/DragonForce"], "malware_count": 3, "passive_dns_count": 4, "malware_samples": 


ioc_type: ipv4
ioc_value: 192.227.190.127
source: otx
validated_at: 2026-04-17T18:10:19.492554
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS36352 colocrossing", "indicator": "192.227.190.127", "tags": ["russia", "system", "apt", "port", "meltingclaw", "cisco secure", "time", "cyber", "open", "landing page top story", "ipaddress", "ipv4", "rust", "rustyclaw", "umbrella", "crypto cyber", "shadyhammock", "romcom", "hashes", "top story", "dustyhammock", "plink", "october", "ukraine", "threat", "malware", "polish", "domains", "singlecamper", "sha256", "uat5647", "defence"], "pulses": ["InQuest - 28-10-2024", "Remote Access Trojans Deployed using Gophish Framework", "InQuest - 27-10-2024", "InQuest - 26-10-2024", "InQuest - 25-10-2024", "InQuest - 24-10-2024", "InQuest - 23-10-2024", "UAT-5647 targets Ukrainian and Polish entities with RomCom malware variants", "Russian RomCom Targeting Ukrainian Government with New SingleCamper RAT Variant"], "malware_count": 0, "passive_dns_count": 25, "malware_samples": [], "passive_dns": ["ergonomic-station.ru", "wirelesszone.top", "cypruspoxx.top", "correoargentinox.top", "tellmmcn.top", "dlhde-de.top", "adla1.top", "pos-st.top", "tellmmcb.top", "dhlzc.top", "tellmmwc.top", "tepcoxx.top", "telkomselxx.top", "tellmmcv.top", "claroxx.top", "smartcca.com", "posax.top", "tellmmxz.top", "tellmmxc.top", "estafexx.top"]}


ioc_type: ipv4
ioc_value: 91.92.254.218
source: otx
validated_at: 2026-04-17T18:10:25.858091
raw_response:
  {"pulse_count": 31, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Sistov", "asn": "ASNone ", "indicator": "91.92.254.218", "tags": ["russia", "system", "apt", "botnet", "port", "meltingclaw", "cisco secure", "time", "rustclaw", "cyber", "open", "scanner", "attack", "landing page top story", "ipaddress", "ipv4", "rust", "rustyclaw", "umbrella", "login", "crypto cyber", "shadyhammock", "poland", "romcom", "Telnet", "port 23", "hashes", "dustyhammock", "top story", "plink", "october", "ukraine", "threat", "malware", "SSH", "polish", "tcp/23", "telnet", "domains", "singlecamper", "sha256", "uat5647", "defence"], "pulses": ["Ukrainian and Polish entities targeted with RomCom malware variants", "Ka's Honeypot visitors", "IP Addresses Logged by the Rosethorn PotNet", "IPV4_Threat_Actors", "InQuest - 28-10-2024", "Remote Access Trojans Deployed using Gophish Framework", "InQuest - 27-10-2024", "InQuest - 26-10-2024", "InQuest - 25-10-2024", "InQuest - 24-10-2024", "InQuest - 23-10-2024", "UAT-5647 targets Ukrainian and Polish entities with RomCom malware variants", "Russian RomCom Targeting Ukrainian Government with New SingleCamper RAT Variant", "IP Address", "IP Address", "Honeypot Visitors (TCP/23) - 2024-05-12", "Honeypot Visitors (TCP/23) - 2024-05-11", "Honeypot Visitors (TCP/23) - 2024-05-10", "Honeypot Visitors (TCP/23) - 2024-05-09", "Honeypot Visitors (TCP/23) - 2024-05-08"], "malware_count": 0, "passive_dns_count": 17, "malware_samples": [], "passive_dns": ["devhubs.dev", "nebula.baby", "hgffdds.buzz", "splonloine.one", "postnordodk.xyz", "postnordodk.one", "bgpost1.icu", "dhl-dee.xyz", "dhl9de.one", "ptt4gov.one", "dhl5de.lat", "new-bgpost-bg.top", "qatarpost1qa.one", "pos-my7.one", "postnord7se.one", "posten9no.one", "dhl6de.one"]}


ioc_type: ipv4
ioc_value: 91.92.248.75
source: otx
validated_at: 2026-04-17T18:10:37.497676
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Sistov", "asn": "AS34368 zonata - natskovi & sie ltd.", "indicator": "91.92.248.75", "tags": ["russia", "system", "apt", "port", "meltingclaw", "cisco secure", "time", "rustclaw", "cyber", "open", "landing page top story", "ipaddress", "ipv4", "rust", "rustyclaw", "umbrella", "crypto cyber", "shadyhammock", "poland", "romcom", "hashes", "dustyhammock", "top story", "plink", "october", "ukraine", "threat", "malware", "polish", "domains", "singlecamper", "sha256", "uat5647", "defence"], "pulses": ["Ukrainian and Polish entities targeted with RomCom malware variants", "InQuest - 28-10-2024", "Remote Access Trojans Deployed using Gophish Framework", "InQuest - 27-10-2024", "InQuest - 26-10-2024", "InQuest - 25-10-2024", "InQuest - 24-10-2024", "InQuest - 23-10-2024", "UAT-5647 targets Ukrainian and Polish entities with RomCom malware variants", "Russian RomCom Targeting Ukrainian Government with New SingleCamper RAT Variant"], "malware_count": 1, "passive_dns_count": 11, "malware_samples": ["871e4a48c4c2ddf424dad4318a9d4d4386a9e1a92ead50b81303a5c5a840a172"], "passive_dns": ["adcreative.pictures", "maisonsdumonde.buzz", "meccanotecnicaveneta.buzz", "skilledcareers.buzz", "splicegroup.buzz", "angusmackinnon.buzz", "lathamconstruction.buzz", "comptoir-etancheite.buzz", "shannoncoiledsprings.buzz", "stockstotrade.buzz", "sweeneymcgann.buzz"]}


ioc_type: ipv4
ioc_value: 94.156.68.216
source: otx
validated_at: 2026-04-17T18:10:43.086002
raw_response:
  {"pulse_count": 11, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Karlovo", "asn": "AS31420 terasyst ltd", "indicator": "94.156.68.216", "tags": ["russia", "system", "apt", "port", "meltingclaw", "cisco secure", "time", "rustclaw", "cyber", "open", "landing page top story", "ipaddress", "ipv4", "rust", "rustyclaw", "umbrella", "crypto cyber", "shadyhammock", "poland", "romcom", "hashes", "dustyhammock", "top story", "plink", "october", "ukraine", "threat", "malware", "polish", "domains", "singlecamper", "sha256", "uat5647", "defence"], "pulses": ["Ukrainian and Polish entities targeted with RomCom malware variants", "InQuest - 28-10-2024", "Remote Access Trojans Deployed using Gophish Framework", "InQuest - 27-10-2024", "InQuest - 26-10-2024", "InQuest - 25-10-2024", "InQuest - 24-10-2024", "InQuest - 23-10-2024", "UAT-5647 targets Ukrainian and Polish entities with RomCom malware variants", "Russian RomCom Targeting Ukrainian Government with New SingleCamper RAT Variant", "Remcos RAT"], "malware_count": 0, "passive_dns_count": 26, "malware_samples": [], "passive_dns": ["creativeadb.com", "israeisost.xyz", "israeisost.pro", "israeisost.online", "copdaemi.top", "lorenzibo.top", "corrabos.life", "corrabodesigns.life", "bepoat.life", "bepoat.top", "corksm.top", "cocktailsb.life", "coraeos.xyz", "coraema.xyz", "diccionario.top", "coraeo.monster", "copdaems.life", "grupodirectorio.life", "coraeo.lat", "carreo.skin"]}


ioc_type: ipv4
ioc_value: 193.42.36.131
source: otx
validated_at: 2026-04-17T18:10:45.686998
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Poland", "country_code": "PL", "city": "Warsaw", "asn": "AS59711 hz hosting ltd", "indicator": "193.42.36.131", "tags": ["russia", "system", "apt", "port", "meltingclaw", "cisco secure", "time", "cyber", "open", "landing page top story", "ipaddress", "ipv4", "rust", "rustyclaw", "umbrella", "crypto cyber", "shadyhammock", "romcom", "hashes", "top story", "dustyhammock", "plink", "october", "ukraine", "threat", "malware", "polish", "domains", "singlecamper", "sha256", "uat5647", "defence"], "pulses": ["Remote Access Trojans Deployed using Gophish Framework", "UAT-5647 targets Ukrainian and Polish entities with RomCom malware variants", "Russian RomCom Targeting Ukrainian Government with New SingleCamper RAT Variant"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["akamaiedgekey.com"]}


ioc_type: ipv4
ioc_value: 23.137.253.43
source: otx
validated_at: 2026-04-17T18:10:49.725881
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "", "country_code": "", "city": "", "asn": "ASNone ", "indicator": "23.137.253.43", "tags": ["russia", "system", "apt", "port", "meltingclaw", "cisco secure", "time", "rustclaw", "cyber", "open", "landing page top story", "ipaddress", "ipv4", "rust", "rustyclaw", "umbrella", "crypto cyber", "shadyhammock", "poland", "romcom", "hashes", "dustyhammock", "top story", "plink", "october", "ukraine", "threat", "malware", "polish", "domains", "singlecamper", "sha256", "uat5647", "defence"], "pulses": ["Ukrainian and Polish entities targeted with RomCom malware variants", "InQuest - 28-10-2024", "Remote Access Trojans Deployed using Gophish Framework", "InQuest - 27-10-2024", "InQuest - 26-10-2024", "InQuest - 25-10-2024", "InQuest - 24-10-2024", "InQuest - 23-10-2024", "UAT-5647 targets Ukrainian and Polish entities with RomCom malware variants", "Russian RomCom Targeting Ukrainian Government with New SingleCamper RAT Variant"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["adbefnts.dev"]}


ioc_type: ipv4
ioc_value: 193.42.36.132
source: otx
validated_at: 2026-04-17T18:10:52.436339
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Poland", "country_code": "PL", "city": "Warsaw", "asn": "AS59711 hz hosting ltd", "indicator": "193.42.36.132", "tags": ["russia", "system", "apt", "port", "meltingclaw", "cisco secure", "time", "cyber", "open", "landing page top story", "ipaddress", "ipv4", "rust", "rustyclaw", "umbrella", "crypto cyber", "shadyhammock", "romcom", "hashes", "top story", "dustyhammock", "plink", "october", "ukraine", "threat", "malware", "polish", "domains", "singlecamper", "sha256", "uat5647", "defence"], "pulses": ["Remote Access Trojans Deployed using Gophish Framework", "UAT-5647 targets Ukrainian and Polish entities with RomCom malware variants", "Russian RomCom Targeting Ukrainian Government with New SingleCamper RAT Variant"], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["pjbprope.com", "dishamg.com", "store-images.org", "onmipackonline.com"]}


ioc_type: ipv4
ioc_value: 91.193.18.120
source: otx
validated_at: 2026-04-17T18:10:58.077087
raw_response:
  {"pulse_count": 11, "reputation": 0, "country": "Poland", "country_code": "PL", "city": "Warsaw", "asn": "AS59711 hz hosting ltd", "indicator": "91.193.18.120", "tags": ["cyber espionage", "apt", "backdoor", "media", "file", "tinyturla", "cisco secure", "turla", "threats", "secure endpoint", "c2 server", "back", "tinyturlang", "landing page top story", "ttng", "c2 script", "Windows Remote Management (WinRM)", "threat spotlight", "appliance", "umbrella", "Windows service container", "center", "tinyturla-ng", "turlapowerng", "ng", "chisel", "powershell", "top story", "cookie", "malware", "talos", "exfiltration", "turlapower-ng", "company", "cisco", "securex"], "pulses": ["New details on TinyTurla\u2019s post-compromise activity reveal full kill chain", "TinyTurla-NG: In-depth tooling and command and control analysis", "C&C-IP-List", "New details on TinyTurla\u2019s post-compromise activity reveal full kill chain", "TinyTurla\u2019s Post-Compromise Activity Reveal Full Kill Chain.", "New details on TinyTurla\u2019s post-compromise activity reveal full kill chain", "New details on TinyTurla\u2019s post-compromise activity reveal full kill chain", "New details on TinyTurla\u2019s post-compromise activity reveal full kill chain", "TinyTurla-NG: In-depth tooling and command and control analysis", "TinyTurla-NG in-depth tooling and command and control analysis", "TinyTurla-NG in-depth tooling and command and control analysis"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 194.33.45.167
source: otx
validated_at: 2026-04-30T00:02:20.342814
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS62240 clouvider limited", "indicator": "194.33.45.167", "tags": ["threat", "october", "compromise", "classification", "time", "crypto cyber", "defence", "sha1", "hashes", "cyber"], "pulses": ["Akira Ransomware Compilation", "Fog Ransomware Targets SonicWall VPNs"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["www.ildizimvakfi.com", "www.texatron.com"]}


ioc_type: ipv4
ioc_value: 184.107.5.46
source: otx
validated_at: 2026-04-30T00:02:40.568849
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Canada", "country_code": "CA", "city": null, "asn": "AS32613 iweb technologies inc.", "indicator": "184.107.5.46", "tags": ["threat", "october", "compromise", "classification", "time", "crypto cyber", "defence", "sha1", "hashes", "cyber"], "pulses": ["Akira Ransomware Compilation", "Fog Ransomware Targets SonicWall VPNs", "Increased Ransomware Activity Exploiting SonicWall SSL VPN"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 159.253.120.2
source: otx
validated_at: 2026-05-09T00:04:13.620307
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "ASNone ", "indicator": "159.253.120.2", "tags": ["com hijacking", "default", "urls", "filehashmd5", "filen", "proton", "redacted", "pgp fingerprint", "office", "programdata", "inprocserver32", "ips domain", "notdoor", "bypass", "outlook", "ipv6240e", "brute force", "yara", "beardshell", "uac0001", "compromise", "slovak", "simpleloader", "#supportsitewebsiteabuse #rootcertificatefailure #cryptographicf", "f tn", "windows", "covenant", "onedrivehealth", "microsoft", "defense evasion", "certua", "webdav", "czech republic", "romania", "filehashsha1", "filen cloud", "syria", "cve-2026-21509", "final", "cve202621509", "ssh", "europe", "cve20261281 cve", "eu", "ip address", "click", "microsoft office", "persistence", "cyber threat", "create tn"], "pulses": ["Danger Bulletin: Cyberattacks Against Ukraine and EU Countries Using CVE-2026-21509 Exploit", "Hybrid Managed Service Actor / provisioned insider", "Rare Tier 1 Persistence - Critical \"Patched\", Non Patched Vulnerabilities Remain bypassing Lockdown Mode", "zero trust", "151.101.0.22", "hostasa.org", "hostasa.org", "APT28s Stealthy Multi-Stage Campaign Leveraging CVE202621509 and Cloud C2 Infrastructure", "EbeeFeb2026 Pt2", "EbeeFeb2026 Pt1", "IOC - APT28\u2019s Stealthy Multi-Stage Campaign Leveraging CVE\u20112026\u201121509 and Cloud C2 Infrastructure", "Danger Bulletin: Cyberattacks Against Ukraine and EU Countries Using CVE-2026-21509 Exploit", "CVE-2026-21509: APT28 Actively Exploits Microsoft Office Vulnerability in Ukraine", "APT28: Geofencing as a Targeting Signal (CVE-2026-21509 Campaign)", "Microsoft Office 0-day Vulnerability Exploited By Threat Actors to Deploy  Malware", "\"Danger Bulletin\": UAC-0001 (APT28) carries out cyberattacks against Ukraine and EU countries using the CVE-2026-21509 exploit (CERT-UA#19542)", "\"\u0411\u044e\u043b\u0435\u0442\u0435\u043d\u044c \u043d\u0435\u0431\u0435\


ioc_type: ipv4
ioc_value: 162.220.234.41
source: otx
validated_at: 2026-05-09T00:04:16.307956
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Anderson", "asn": "AS26296 clearlink", "indicator": "162.220.234.41", "tags": ["february", "huntress", "download", "form", "sharepoint", "sentinel", "railway", "cloudflare", "microsoft", "service", "noirlegacy", "first", "ipaddress", "hunt", "telegram", "device code", "capture link", "trend micro", "win11", "phishing", "voice"], "pulses": ["IOC - Riding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure", "IOC - Riding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 162.220.234.66
source: otx
validated_at: 2026-05-09T00:04:18.871541
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Anderson", "asn": "AS26296 clearlink", "indicator": "162.220.234.66", "tags": ["february", "huntress", "download", "form", "sharepoint", "sentinel", "railway", "cloudflare", "microsoft", "service", "noirlegacy", "first", "ipaddress", "hunt", "telegram", "device code", "capture link", "trend micro", "win11", "phishing", "voice"], "pulses": ["IOC - Riding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure", "IOC - Riding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 162.220.232.57
source: otx
validated_at: 2026-05-09T00:04:24.313162
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Anderson", "asn": "AS26296 clearlink", "indicator": "162.220.232.57", "tags": ["february", "huntress", "download", "form", "sharepoint", "sentinel", "railway", "cloudflare", "microsoft", "service", "noirlegacy", "first", "ipaddress", "hunt", "telegram", "device code", "capture link", "trend micro", "win11", "phishing", "voice"], "pulses": ["IOC - Riding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure", "IOC - Riding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 107.189.19.48
source: otx
validated_at: 2026-05-17T06:05:47.915741
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS53667 frantech solutions", "indicator": "107.189.19.48", "tags": ["malicious", "gammadrop c2", "temp", "cloudflare", "gammaload ddns", "domains", "gammadrop", "malicious arj", "appdata", "gammaload", "malicious rar", "primary c2", "sha1", "ssl cert"], "pulses": ["IOC - Gamaredon\u2019s infection chain: Spoofed emails, GammaDrop and GammaLoad"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 5.181.2.158
source: otx
validated_at: 2026-05-17T06:05:50.842617
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "California", "asn": "AS57844 spdnet telekomunikasyon hizmetleri bilgi teknolojileri taahhut sanayi ve ticaret a.s.", "indicator": "5.181.2.158", "tags": ["malicious", "gammadrop c2", "temp", "cloudflare", "gammaload ddns", "domains", "gammadrop", "malicious arj", "appdata", "gammaload", "malicious rar", "primary c2", "sha1", "ssl cert"], "pulses": ["IOC - Gamaredon\u2019s infection chain: Spoofed emails, GammaDrop and GammaLoad"], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["azure-rift.live", "marithbranch.com", "connectglowsolana.com", "ingdiba.sergolamn.de"]}


ioc_type: ipv4
ioc_value: 194.58.66.82
source: otx
validated_at: 2026-05-17T06:06:08.119842
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Czechia", "country_code": "CZ", "city": null, "asn": "AS35112 llc dzhibien host", "indicator": "194.58.66.82", "tags": ["malicious", "gammadrop c2", "temp", "cloudflare", "gammaload ddns", "domains", "gammadrop", "malicious arj", "appdata", "gammaload", "malicious rar", "primary c2", "sha1", "ssl cert"], "pulses": ["IOC - Gamaredon\u2019s infection chain: Spoofed emails, GammaDrop and GammaLoad"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 31.59.58.9
source: shodan
validated_at: 2026-05-21T00:02:06.965248
raw_response:
  {"ports": [22, 3306], "vulns": ["CVE-2023-38408", "CVE-2007-2768", "CVE-2016-20012", "CVE-2023-51767", "CVE-2026-35387", "CVE-2023-51385", "CVE-2020-14145", "CVE-2008-3844", "CVE-2018-15473", "CVE-2018-20685", "CVE-2019-6110", "CVE-2025-26465", "CVE-2021-41617", "CVE-2019-6111", "CVE-2026-35388", "CVE-2026-35385", "CVE-2026-35386", "CVE-2026-35414", "CVE-2017-15906", "CVE-2019-6109", "CVE-2018-15919", "CVE-2020-15778", "CVE-2021-36368", "CVE-2023-48795", "CVE-2025-32728"], "hostnames": [], "tags": ["database"], "cpes": ["cpe:/a:mariadb:mariadb", "cpe:/a:openbsd:openssh:7.4"]}


ioc_type: ipv4
ioc_value: 37.221.65.134
source: shodan
validated_at: 2026-05-23T18:04:58.099720
raw_response:
  {"ports": [21, 22, 80, 110, 143, 465, 995, 8888], "vulns": ["CVE-2023-42119", "CVE-2026-40685", "CVE-2024-39929", "CVE-2023-42116", "CVE-2026-40686", "CVE-2023-42117", "CVE-2025-67896", "CVE-2023-42114", "CVE-2022-3620", "CVE-2023-42115", "CVE-2023-51766", "CVE-2022-37451", "CVE-2022-3559", "CVE-2026-40684", "CVE-2026-40687"], "hostnames": [], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:exim:exim:4.95", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/a:f5:nginx:1.28.0", "cpe:/a:f5:nginx"]}


ioc_type: ipv4
ioc_value: 37.221.65.195
source: shodan
validated_at: 2026-05-23T18:05:08.934268
raw_response:
  {"ports": [22, 80, 443, 465, 587, 995, 7777], "vulns": ["CVE-2023-42119", "CVE-2026-40685", "CVE-2024-39929", "CVE-2023-42116", "CVE-2026-40686", "CVE-2023-42117", "CVE-2025-67896", "CVE-2023-42114", "CVE-2022-3620", "CVE-2023-42115", "CVE-2023-51766", "CVE-2022-37451", "CVE-2022-3559", "CVE-2026-40684", "CVE-2026-40687"], "hostnames": ["ne6-2"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:exim:exim:4.95", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/a:f5:nginx", "cpe:/a:f5:nginx:1.28.1"]}


ioc_type: ipv4
ioc_value: 37.221.65.198
source: shodan
validated_at: 2026-05-23T18:05:10.709936
raw_response:
  {"ports": [21, 22, 110, 143, 465, 587, 7777], "vulns": ["CVE-2023-42117", "CVE-2023-42114", "CVE-2025-67896", "CVE-2022-37451", "CVE-2023-42115", "CVE-2026-40686", "CVE-2026-40684", "CVE-2024-39929", "CVE-2022-3620", "CVE-2022-3559", "CVE-2023-51766", "CVE-2023-42116", "CVE-2026-40687", "CVE-2023-42119", "CVE-2026-40685"], "hostnames": ["vds810-34"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:openbsd:openssh:8.9p1", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:exim:exim:4.95", "cpe:/a:f5:nginx"]}


ioc_type: ipv4
ioc_value: 37.221.65.77
source: shodan
validated_at: 2026-05-23T18:05:16.094354
raw_response:
  {"ports": [21, 22, 25, 110, 143, 443, 993, 7777], "vulns": ["CVE-2023-42117", "CVE-2023-42114", "CVE-2025-67896", "CVE-2022-37451", "CVE-2023-42115", "CVE-2026-40686", "CVE-2026-40684", "CVE-2024-39929", "CVE-2022-3620", "CVE-2022-3559", "CVE-2023-51766", "CVE-2023-42116", "CVE-2026-40687", "CVE-2023-42119", "CVE-2026-40685"], "hostnames": ["vps5-9"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx:1.28.2", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/a:exim:exim:4.95"]}


ioc_type: ipv4
ioc_value: 37.221.65.128
source: shodan
validated_at: 2026-05-23T18:05:19.976744
raw_response:
  {"ports": [21, 22, 53, 80, 443, 465], "vulns": ["CVE-2023-42117", "CVE-2023-42114", "CVE-2025-67896", "CVE-2022-37451", "CVE-2023-42115", "CVE-2026-40686", "CVE-2026-40684", "CVE-2024-39929", "CVE-2022-3620", "CVE-2022-3559", "CVE-2023-51766", "CVE-2023-42116", "CVE-2026-40687", "CVE-2023-42119", "CVE-2026-40685"], "hostnames": ["www.airmultystrike.com", "airmultystrike.com"], "tags": ["self-signed"], "cpes": ["cpe:/a:openbsd:openssh:8.9p1", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:exim:exim:4.95", "cpe:/a:f5:nginx"]}


ioc_type: ipv4
ioc_value: 37.221.65.178
source: shodan
validated_at: 2026-05-23T18:05:25.430207
raw_response:
  {"ports": [25, 53, 110, 123, 443, 587, 995], "vulns": ["CVE-2023-42117", "CVE-2023-42114", "CVE-2025-67896", "CVE-2022-37451", "CVE-2023-42115", "CVE-2026-40686", "CVE-2026-40684", "CVE-2024-39929", "CVE-2022-3620", "CVE-2022-3559", "CVE-2023-51766", "CVE-2023-42116", "CVE-2026-40687", "CVE-2023-42119", "CVE-2026-40685"], "hostnames": ["www.finquizpro.info", "vps-ig22.com", "finquizpro.info"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:ntp:ntp:3", "cpe:/a:exim:exim:4.95", "cpe:/a:f5:nginx"]}


ioc_type: ipv4
ioc_value: 37.221.65.204
source: shodan
validated_at: 2026-05-23T18:05:30.783936
raw_response:
  {"ports": [80], "vulns": ["CVE-2006-20001", "CVE-2024-42516", "CVE-2024-38473", "CVE-2024-39573", "CVE-2024-38475", "CVE-2013-4365", "CVE-2022-37436", "CVE-2022-26377", "CVE-2022-31813", "CVE-2025-49630", "CVE-2024-38476", "CVE-2023-38709", "CVE-2013-0941", "CVE-2022-30556", "CVE-2024-43204", "CVE-2024-38474", "CVE-2024-24795", "CVE-2022-28614", "CVE-2012-3526", "CVE-2024-27316", "CVE-2013-2765", "CVE-2009-2299", "CVE-2009-0796", "CVE-2022-28615", "CVE-2025-55753", "CVE-2023-25690", "CVE-2022-28330", "CVE-2011-2688", "CVE-2025-66200", "CVE-2025-65082", "CVE-2024-38472", "CVE-2013-0942", "CVE-2012-4001", "CVE-2023-27522", "CVE-2023-31122", "CVE-2025-59775", "CVE-2022-22720", "CVE-2024-40898", "CVE-2007-4723", "CVE-2022-36760", "CVE-2025-49812", "CVE-2024-38477", "CVE-2025-58098", "CVE-2024-47252", "CVE-2025-53020", "CVE-2025-23048", "CVE-2022-29404", "CVE-2022-23943", "CVE-2012-4360", "CVE-2023-45802", "CVE-2022-22721", "CVE-2024-43394", "CVE-2022-22719", "CVE-2011-1176"], "hostnames": ["md03"], "tags": [], "cpes": ["cpe:/a:apache:http_server:2.4.52"]}


ioc_type: ipv4
ioc_value: 37.221.65.19
source: shodan
validated_at: 2026-05-23T18:05:39.959216
raw_response:
  {"ports": [3128], "vulns": ["CVE-2023-46847", "CVE-2020-25097", "CVE-2016-2571", "CVE-2015-3455", "CVE-2021-31806", "CVE-2026-33526", "CVE-2019-12528", "CVE-2019-12519", "CVE-2014-7141", "CVE-2019-12529", "CVE-2016-4053", "CVE-2016-4052", "CVE-2020-11945", "CVE-2023-46728", "CVE-2020-15049", "CVE-2024-25617", "CVE-2016-3947", "CVE-2018-1000027", "CVE-2023-46846", "CVE-2018-1000024", "CVE-2023-5824", "CVE-2020-14058", "CVE-2019-12522", "CVE-2016-4554", "CVE-2018-19131", "CVE-2016-10002", "CVE-2019-12523", "CVE-2014-7142", "CVE-2019-18678", "CVE-2026-32748", "CVE-2016-4051", "CVE-2026-33515", "CVE-2021-28652", "CVE-2014-3609", "CVE-2020-8449", "CVE-2023-50269", "CVE-2024-45802", "CVE-2020-15811", "CVE-2014-0128", "CVE-2021-33620", "CVE-2019-18677", "CVE-2021-31807", "CVE-2016-4555", "CVE-2019-18676", "CVE-2020-8450", "CVE-2021-28116", "CVE-2020-8517", "CVE-2021-46784", "CVE-2021-31808", "CVE-2019-12526", "CVE-2019-12524", "CVE-2024-37894", "CVE-2016-4556", "CVE-2016-4553", "CVE-2019-18860", "CVE-2016-2569", "CVE-2023-49285", "CVE-2023-46724", "CVE-2014-6270", "CVE-2019-13345", "CVE-2020-24606", "CVE-2019-18679", "CVE-2019-12521", "CVE-2019-12520", "CVE-2016-3948", "CVE-2025-54574", "CVE-2025-59362", "CVE-2022-41318", "CVE-2021-28651", "CVE-2025-62168", "CVE-2020-15810", "CVE-2015-5400", "CVE-2016-2390", "CVE-2018-19132", "CVE-2023-49286", "CVE-2016-2570", "CVE-2016-4054"], "hostnames": [], "tags": ["proxy"], "cpes": ["cpe:/a:squid-cache:squid:3.3.8"]}


ioc_type: ipv4
ioc_value: 37.221.65.36
source: shodan
validated_at: 2026-05-23T18:05:52.274975
raw_response:
  {"ports": [21, 22, 53, 111, 443, 465, 995, 2082, 2083, 2086, 2087, 3306, 8181, 8443], "vulns": ["CVE-2020-7070", "CVE-2023-4807", "CVE-2021-23017", "CVE-2022-4900", "CVE-2023-0464", "CVE-2019-9511", "CVE-2009-1390", "CVE-2009-2299", "CVE-2012-4360", "CVE-2020-15778", "CVE-2019-9516", "CVE-2009-0796", "CVE-2007-2768", "CVE-2009-3765", "CVE-2024-3566", "CVE-2023-38408", "CVE-2020-14145", "CVE-2013-4365", "CVE-2007-4723", "CVE-2025-49812", "CVE-2025-59775", "CVE-2023-0466", "CVE-2022-31628", "CVE-2022-31629", "CVE-2023-3817", "CVE-2025-53020", "CVE-2025-26465", "CVE-2025-55753", "CVE-2025-66200", "CVE-2009-3766", "CVE-2025-23048", "CVE-2023-5678", "CVE-2019-20372", "CVE-2022-1292", "CVE-2026-33006", "CVE-2026-28390", "CVE-2026-33523", "CVE-2011-1176", "CVE-2008-3844", "CVE-2013-2765", "CVE-2025-65082", "CVE-2026-28388", "CVE-2023-0465", "CVE-2023-0215", "CVE-2024-43394", "CVE-2013-0941", "CVE-2025-69419", "CVE-2023-51385", "CVE-2026-28389", "CVE-2022-37454", "CVE-2025-69420", "CVE-2019-11048", "CVE-2026-35414", "CVE-2026-22796", "CVE-2022-4450", "CVE-2022-0778", "CVE-2026-35385", "CVE-2023-51767", "CVE-2022-2068", "CVE-2022-4304", "CVE-2025-68160", "CVE-2025-58098", "CVE-2024-0727", "CVE-2023-2650", "CVE-2017-8923", "CVE-2021-3711", "CVE-2021-3618", "CVE-2013-2220", "CVE-2026-33857", "CVE-2026-34059", "CVE-2021-4160", "CVE-2020-7068", "CVE-2018-16845", "CVE-2019-0190", "CVE-2007-3205", "CVE-2019-9513", "CVE-2011-2688", "CVE-2026-33007", "CVE-2026-35388", "CVE-2012-4001", "CVE-2024-42516", "CVE-2023-0286", "CVE-2022-2097", "CVE-2013-0942", "CVE-2026-28387", "CVE-2009-3767", "CVE-2025-69418", "CVE-2026-29169", "CVE-2026-24072", "CVE-2020-7069", "CVE-2024-43204", "CVE-2026-34032", "CVE-2026-35386", "CVE-2025-23419", "CVE-2012-3526", "CVE-2023-48795", "CVE-2024-47252", "CVE-2021-41617", "CVE-2023-44487", "CVE-2025-49630", "CVE-2026-22795", "CVE-2021-3712", "CVE-2026-35387", "CVE-2025-32728", "CVE-2025-69421", "CVE-2021-36368", "CVE-2016-20012", "CVE-2024-25117", "CVE-2019-


ioc_type: ipv4
ioc_value: 37.221.65.55
source: shodan
validated_at: 2026-05-23T18:06:02.957760
raw_response:
  {"ports": [22, 53, 80, 587, 993, 995], "vulns": ["CVE-2021-36368", "CVE-2019-6109", "CVE-2008-3844", "CVE-2007-2768", "CVE-2026-35386", "CVE-2020-14145", "CVE-2026-35385", "CVE-2026-35414", "CVE-2025-32728", "CVE-2023-48795", "CVE-2023-51385", "CVE-2019-6111", "CVE-2018-20685", "CVE-2018-15473", "CVE-2023-51767", "CVE-2021-41617", "CVE-2019-6110", "CVE-2020-15778", "CVE-2026-35387", "CVE-2018-15919", "CVE-2026-35388", "CVE-2025-26465", "CVE-2023-38408", "CVE-2017-15906", "CVE-2016-20012"], "hostnames": ["domain.com", "xcasino-hungary.com"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx", "cpe:/a:openbsd:openssh:7.4"]}


ioc_type: ipv4
ioc_value: 37.221.65.60
source: shodan
validated_at: 2026-05-23T18:06:06.507601
raw_response:
  {"ports": [22, 53, 80, 111, 143, 443, 993, 995, 2082, 2083, 2086, 2087, 2096], "vulns": ["CVE-2026-35388", "CVE-2026-35414", "CVE-2021-36368", "CVE-2021-41617", "CVE-2025-32728", "CVE-2025-26465", "CVE-2023-48795", "CVE-2023-51385", "CVE-2023-38408", "CVE-2008-3844", "CVE-2007-2768", "CVE-2026-35386", "CVE-2024-6387", "CVE-2016-20012", "CVE-2026-35385", "CVE-2026-35387", "CVE-2023-51767"], "hostnames": ["37-221-65-60.cprapid.com", "medelitelibrary.shop", "medvora.shop"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:apache:http_server", "cpe:/a:cpanel:cpanel", "cpe:/a:openbsd:openssh:8.7"]}


ioc_type: ipv4
ioc_value: 37.221.65.126
source: shodan
validated_at: 2026-05-23T18:06:42.227845
raw_response:
  {"ports": [21, 80], "vulns": ["CVE-2025-53020", "CVE-2022-22721", "CVE-2023-45802", "CVE-2025-55753", "CVE-2025-66200", "CVE-2006-20001", "CVE-2025-23048", "CVE-2013-0942", "CVE-2023-31122", "CVE-2024-38472", "CVE-2024-38473", "CVE-2022-30556", "CVE-2024-39573", "CVE-2026-29169", "CVE-2026-24072", "CVE-2024-27316", "CVE-2026-33857", "CVE-2026-34059", "CVE-2022-23943", "CVE-2023-25690", "CVE-2022-22719", "CVE-2026-33006", "CVE-2026-33523", "CVE-2024-38474", "CVE-2024-40898", "CVE-2022-36760", "CVE-2011-1176", "CVE-2024-43204", "CVE-2022-28614", "CVE-2009-2299", "CVE-2012-4360", "CVE-2026-34032", "CVE-2009-0796", "CVE-2013-2765", "CVE-2022-28330", "CVE-2022-29404", "CVE-2012-3526", "CVE-2024-47252", "CVE-2025-65082", "CVE-2024-38475", "CVE-2025-49630", "CVE-2024-43394", "CVE-2023-38709", "CVE-2013-0941", "CVE-2024-38476", "CVE-2011-2688", "CVE-2022-31813", "CVE-2026-33007", "CVE-2022-37436", "CVE-2013-4365", "CVE-2024-38477", "CVE-2022-28615", "CVE-2024-24795", "CVE-2023-27522", "CVE-2022-22720", "CVE-2012-4001", "CVE-2007-4723", "CVE-2022-26377", "CVE-2025-49812", "CVE-2025-59775", "CVE-2024-42516", "CVE-2025-58098"], "hostnames": ["phoenix-pass.xyz"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:apache:http_server:2.4.52", "cpe:/o:canonical:ubuntu_linux"]}


ioc_type: ipv4
ioc_value: 37.221.65.173
source: shodan
validated_at: 2026-05-23T18:06:52.922533
raw_response:
  {"ports": [22, 80], "vulns": ["CVE-2025-53020", "CVE-2022-22721", "CVE-2023-45802", "CVE-2025-55753", "CVE-2025-66200", "CVE-2006-20001", "CVE-2025-23048", "CVE-2013-0942", "CVE-2023-31122", "CVE-2024-38472", "CVE-2024-38473", "CVE-2022-30556", "CVE-2024-39573", "CVE-2026-29169", "CVE-2026-24072", "CVE-2024-27316", "CVE-2026-33857", "CVE-2026-34059", "CVE-2022-23943", "CVE-2023-25690", "CVE-2022-22719", "CVE-2026-33006", "CVE-2026-33523", "CVE-2024-38474", "CVE-2024-40898", "CVE-2022-36760", "CVE-2011-1176", "CVE-2024-43204", "CVE-2022-28614", "CVE-2009-2299", "CVE-2012-4360", "CVE-2026-34032", "CVE-2009-0796", "CVE-2013-2765", "CVE-2022-28330", "CVE-2022-29404", "CVE-2012-3526", "CVE-2024-47252", "CVE-2025-65082", "CVE-2024-38475", "CVE-2025-49630", "CVE-2024-43394", "CVE-2023-38709", "CVE-2013-0941", "CVE-2024-38476", "CVE-2011-2688", "CVE-2022-31813", "CVE-2026-33007", "CVE-2022-37436", "CVE-2013-4365", "CVE-2024-38477", "CVE-2022-28615", "CVE-2024-24795", "CVE-2023-27522", "CVE-2022-22720", "CVE-2012-4001", "CVE-2007-4723", "CVE-2022-26377", "CVE-2025-49812", "CVE-2025-59775", "CVE-2024-42516", "CVE-2025-58098"], "hostnames": ["yarrakhacklersin.com"], "tags": ["open-dir"], "cpes": ["cpe:/a:apache:http_server:2.4.52", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/o:canonical:ubuntu_linux"]}


ioc_type: ipv4
ioc_value: 37.221.65.185
source: shodan
validated_at: 2026-05-23T18:06:58.246158
raw_response:
  {"ports": [22, 25, 53, 110, 123, 443, 465, 587, 993, 995], "vulns": ["CVE-2023-42119", "CVE-2024-39929", "CVE-2023-42114", "CVE-2023-42117", "CVE-2023-42116", "CVE-2022-37451", "CVE-2025-67896", "CVE-2026-40685", "CVE-2026-40686", "CVE-2023-42115", "CVE-2023-51766", "CVE-2021-38371", "CVE-2022-3559", "CVE-2026-40684", "CVE-2026-40687", "CVE-2022-37452"], "hostnames": ["alexgamble"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:openbsd:openssh:8.4p1", "cpe:/o:linux:linux_kernel", "cpe:/a:ntp:ntp:3", "cpe:/a:exim:exim:4.94.2", "cpe:/a:f5:nginx", "cpe:/o:debian:debian_linux"]}


ioc_type: ipv4
ioc_value: 37.221.65.190
source: shodan
validated_at: 2026-05-23T18:07:01.754815
raw_response:
  {"ports": [21, 53, 80, 443, 3306], "vulns": ["CVE-2023-22059", "CVE-2024-21157", "CVE-2023-22092", "CVE-2024-21056", "CVE-2024-21212", "CVE-2024-21096", "CVE-2024-21236", "CVE-2024-20963", "CVE-2024-21160", "CVE-2024-21173", "CVE-2024-21165", "CVE-2024-20996", "CVE-2024-21055", "CVE-2024-20971", "CVE-2024-21198", "CVE-2024-20973", "CVE-2026-21964", "CVE-2024-21194", "CVE-2023-22110", "CVE-2024-21125", "CVE-2024-21049", "CVE-2025-50099", "CVE-2024-21134", "CVE-2024-21197", "CVE-2024-21159", "CVE-2024-21129", "CVE-2024-21241", "CVE-2024-20967", "CVE-2024-21135", "CVE-2025-50080", "CVE-2024-21193", "CVE-2024-20969", "CVE-2024-21127", "CVE-2024-21166", "CVE-2023-22111", "CVE-2024-21213", "CVE-2023-22064", "CVE-2025-50091", "CVE-2025-50084", "CVE-2024-21247", "CVE-2023-22097", "CVE-2023-22032", "CVE-2025-50081", "CVE-2025-50076", "CVE-2024-21163", "CVE-2024-20977", "CVE-2025-50092", "CVE-2025-50098", "CVE-2025-50079", "CVE-2025-50093", "CVE-2024-21171", "CVE-2025-50096", "CVE-2024-21087", "CVE-2023-22070", "CVE-2024-21062", "CVE-2023-22115", "CVE-2024-21051", "CVE-2023-22114", "CVE-2025-50097", "CVE-2024-20983", "CVE-2024-21237", "CVE-2024-21130", "CVE-2025-50077", "CVE-2025-50088", "CVE-2025-50100", "CVE-2024-21219", "CVE-2024-20965", "CVE-2025-50082", "CVE-2023-22066", "CVE-2024-21230", "CVE-2024-21231", "CVE-2024-21201", "CVE-2023-22103", "CVE-2023-22112", "CVE-2024-21050", "CVE-2024-21101", "CVE-2024-21102", "CVE-2024-21162", "CVE-2023-22068", "CVE-2023-22079", "CVE-2025-50101", "CVE-2023-22113", "CVE-2025-50078", "CVE-2024-21137", "CVE-2024-21047", "CVE-2024-21061", "CVE-2024-21207", "CVE-2024-21196", "CVE-2024-21203", "CVE-2024-21218", "CVE-2023-22078", "CVE-2025-50102", "CVE-2024-21199", "CVE-2025-50086", "CVE-2024-20961", "CVE-2025-50085", "CVE-2025-50083", "CVE-2025-50087", "CVE-2024-21069", "CVE-2024-21238", "CVE-2023-22065", "CVE-2024-21142", "CVE-2024-20981", "CVE-2024-20985", "CVE-2024-21200", "CVE-2023-22084", "CVE-2024-21239", "CVE-2025-50104"], "hostnames


ioc_type: ipv4
ioc_value: 87.121.85.124
source: shodan
validated_at: 2026-05-23T18:09:10.337958
raw_response:
  {"ports": [22, 6379, 8080, 27017], "vulns": ["CVE-2025-11979", "CVE-2025-13507", "CVE-2009-3766", "CVE-2025-14345", "CVE-2026-28387", "CVE-2009-3767", "CVE-2025-69418", "CVE-2026-4148", "CVE-2026-31789", "CVE-2009-1390", "CVE-2026-28390", "CVE-2026-4358", "CVE-2025-6712", "CVE-2025-14847", "CVE-2025-12657", "CVE-2024-6119", "CVE-2025-10060", "CVE-2026-1848", "CVE-2026-5170", "CVE-2009-3765", "CVE-2026-28388", "CVE-2026-1850", "CVE-2019-0190", "CVE-2025-15467", "CVE-2025-10061", "CVE-2026-22795", "CVE-2026-25610", "CVE-2025-13643", "CVE-2026-1849", "CVE-2025-69419", "CVE-2014-8180", "CVE-2026-31790", "CVE-2025-69421", "CVE-2026-28389", "CVE-2025-69420", "CVE-2025-12893", "CVE-2026-25609", "CVE-2026-22796", "CVE-2025-13644", "CVE-2026-4147", "CVE-2026-1847", "CVE-2026-25613", "CVE-2025-68160"], "hostnames": [], "tags": ["database"], "cpes": ["cpe:/a:mongodb:mongodb:8.0.9", "cpe:/a:openssl:openssl:3.0.13", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:redislabs:redis", "cpe:/a:openbsd:openssh:9.6p1"]}


ioc_type: ipv4
ioc_value: 87.121.85.221
source: shodan
validated_at: 2026-05-23T18:09:50.954722
raw_response:
  {"ports": [80, 443, 8080, 8888, 9000, 9443], "vulns": ["CVE-2013-0942", "CVE-2026-29169", "CVE-2026-24072", "CVE-2026-33857", "CVE-2026-34059", "CVE-2026-33006", "CVE-2026-33523", "CVE-2011-1176", "CVE-2009-2299", "CVE-2012-4360", "CVE-2026-34032", "CVE-2009-0796", "CVE-2013-2765", "CVE-2012-3526", "CVE-2013-0941", "CVE-2026-23918", "CVE-2011-2688", "CVE-2026-33007", "CVE-2013-4365", "CVE-2007-4723", "CVE-2012-4001"], "hostnames": [], "tags": [], "cpes": ["cpe:/a:angularjs:angular.js", "cpe:/a:portainer:portainer:2.33.6", "cpe:/o:debian:debian_linux", "cpe:/a:php:php:8.3.30", "cpe:/a:getbootstrap:bootstrap:3.4.1", "cpe:/a:f5:nginx", "cpe:/a:apache:http_server:2.4.66", "cpe:/a:openresty:openresty"]}


ioc_type: ipv4
ioc_value: 37.221.67.25
source: shodan
validated_at: 2026-05-23T18:10:29.778114
raw_response:
  {"ports": [21, 22, 80, 143, 443, 465, 587, 993, 3306, 7777, 8888], "vulns": ["CVE-2023-42117", "CVE-2023-42114", "CVE-2025-67896", "CVE-2023-42115", "CVE-2026-40686", "CVE-2025-30232", "CVE-2024-39929", "CVE-2022-3620", "CVE-2022-3559", "CVE-2026-40684", "CVE-2023-51766", "CVE-2023-42116", "CVE-2026-40687", "CVE-2023-42119", "CVE-2026-40685"], "hostnames": ["pocketoption.cx"], "tags": ["self-signed", "database", "starttls"], "cpes": ["cpe:/a:exim:exim:4.96", "cpe:/a:f5:nginx:1.28.3", "cpe:/o:debian:debian_linux", "cpe:/a:openbsd:openssh:9.2p1", "cpe:/a:oracle:mysql", "cpe:/a:f5:nginx", "cpe:/o:linux:linux_kernel"]}


ioc_type: ipv4
ioc_value: 87.121.84.18
source: shodan
validated_at: 2026-05-23T18:10:46.264436
raw_response:
  {"ports": [80], "vulns": ["CVE-2025-53020", "CVE-2022-22721", "CVE-2023-45802", "CVE-2025-55753", "CVE-2025-66200", "CVE-2006-20001", "CVE-2025-23048", "CVE-2013-0942", "CVE-2023-31122", "CVE-2024-38472", "CVE-2024-38473", "CVE-2022-30556", "CVE-2024-39573", "CVE-2026-29169", "CVE-2026-24072", "CVE-2024-27316", "CVE-2026-33857", "CVE-2026-34059", "CVE-2022-23943", "CVE-2023-25690", "CVE-2022-22719", "CVE-2026-33006", "CVE-2026-33523", "CVE-2024-38474", "CVE-2024-40898", "CVE-2022-36760", "CVE-2011-1176", "CVE-2024-43204", "CVE-2022-28614", "CVE-2009-2299", "CVE-2012-4360", "CVE-2026-34032", "CVE-2009-0796", "CVE-2013-2765", "CVE-2022-28330", "CVE-2022-29404", "CVE-2012-3526", "CVE-2024-47252", "CVE-2025-65082", "CVE-2024-38475", "CVE-2025-49630", "CVE-2024-43394", "CVE-2023-38709", "CVE-2013-0941", "CVE-2024-38476", "CVE-2011-2688", "CVE-2022-31813", "CVE-2026-33007", "CVE-2022-37436", "CVE-2013-4365", "CVE-2024-38477", "CVE-2022-28615", "CVE-2024-24795", "CVE-2023-27522", "CVE-2022-22720", "CVE-2012-4001", "CVE-2007-4723", "CVE-2022-26377", "CVE-2025-49812", "CVE-2025-59775", "CVE-2024-42516", "CVE-2025-58098"], "hostnames": [], "tags": ["scanner"], "cpes": ["cpe:/a:apache:http_server:2.4.52", "cpe:/o:canonical:ubuntu_linux"]}


ioc_type: ipv4
ioc_value: 87.121.84.53
source: shodan
validated_at: 2026-05-23T18:11:11.630695
raw_response:
  {"ports": [22, 3306, 27017], "vulns": ["CVE-2025-11979", "CVE-2025-13507", "CVE-2009-3766", "CVE-2025-14345", "CVE-2026-28387", "CVE-2009-3767", "CVE-2025-69418", "CVE-2026-4148", "CVE-2026-31789", "CVE-2009-1390", "CVE-2026-28390", "CVE-2026-4358", "CVE-2025-14847", "CVE-2025-12657", "CVE-2024-6119", "CVE-2025-10060", "CVE-2026-1848", "CVE-2026-5170", "CVE-2009-3765", "CVE-2026-28388", "CVE-2019-0190", "CVE-2025-15467", "CVE-2025-10061", "CVE-2026-22795", "CVE-2026-25610", "CVE-2025-13643", "CVE-2026-1849", "CVE-2025-69419", "CVE-2014-8180", "CVE-2026-31790", "CVE-2025-69421", "CVE-2026-28389", "CVE-2025-69420", "CVE-2025-12893", "CVE-2026-25609", "CVE-2026-22796", "CVE-2025-13644", "CVE-2026-4147", "CVE-2026-1847", "CVE-2026-25613", "CVE-2025-68160"], "hostnames": [], "tags": ["database"], "cpes": ["cpe:/a:mongodb:mongodb:7.0.21", "cpe:/a:mariadb:mariadb", "cpe:/a:openssl:openssl:3.0.13", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:9.6p1"]}


ioc_type: ipv4
ioc_value: 87.121.83.30
source: shodan
validated_at: 2026-05-23T18:11:15.171501
raw_response:
  {"ports": [80, 123, 443, 3000], "vulns": ["CVE-2015-7978", "CVE-2015-8138", "CVE-2015-7853", "CVE-2017-6458", "CVE-2016-7433", "CVE-2020-13817", "CVE-2016-2516", "CVE-2017-6460", "CVE-2018-7170", "CVE-2013-2220", "CVE-2015-7974", "CVE-2015-7852", "CVE-2016-7426", "CVE-2016-4956", "CVE-2016-4957", "CVE-2016-1551", "CVE-2016-7431", "CVE-2017-6463", "CVE-2016-2517", "CVE-2015-8140", "CVE-2016-4955", "CVE-2018-12327", "CVE-2016-7434", "CVE-2016-1547", "CVE-2014-9750", "CVE-2015-7701", "CVE-2015-7973", "CVE-2023-26555", "CVE-2007-3205", "CVE-2015-7975", "CVE-2015-7702", "CVE-2015-7705", "CVE-2015-7850", "CVE-2015-7976", "CVE-2023-26553", "CVE-2020-15025", "CVE-2014-9751", "CVE-2017-6464", "CVE-2016-4954", "CVE-2016-1548", "CVE-2015-8139", "CVE-2017-6455", "CVE-2015-5300", "CVE-2025-14178", "CVE-2015-3405", "CVE-2017-6459", "CVE-2018-7184", "CVE-2015-7691", "CVE-2016-7429", "CVE-2015-7871", "CVE-2017-6452", "CVE-2015-5146", "CVE-2025-14180", "CVE-2020-11868", "CVE-2015-7848", "CVE-2016-7427", "CVE-2015-7692", "CVE-2015-7704", "CVE-2016-9310", "CVE-2016-2518", "CVE-2017-6451", "CVE-2015-8158", "CVE-2019-8936", "CVE-2015-7703", "CVE-2016-9311", "CVE-2016-1549", "CVE-2016-9042", "CVE-2015-7851", "CVE-2018-7183", "CVE-2017-6462", "CVE-2016-2519", "CVE-2015-7979", "CVE-2016-9312", "CVE-2025-14177", "CVE-2016-7428", "CVE-2018-7182", "CVE-2015-7849", "CVE-2023-26552", "CVE-2023-26554", "CVE-2023-26551", "CVE-2016-4953", "CVE-2018-7185", "CVE-2015-7977", "CVE-2015-7854", "CVE-2016-1550", "CVE-2024-3566", "CVE-2015-7855", "CVE-2018-8956"], "hostnames": ["87.121.83.30.neterra.net"], "tags": ["self-signed"], "cpes": ["cpe:/a:ntp:ntp:4.2.8:p18", "cpe:/a:php:php:8.3.23", "cpe:/a:f5:nginx:1.28.0"]}


ioc_type: ipv4
ioc_value: 87.121.83.81
source: shodan
validated_at: 2026-05-23T18:11:16.931687
raw_response:
  {"ports": [37, 53, 80, 179, 443, 3000], "vulns": ["CVE-2025-23419", "CVE-2021-21702", "CVE-2022-31628", "CVE-2021-21706", "CVE-2021-3618", "CVE-2024-25117", "CVE-2013-2220", "CVE-2023-44487", "CVE-2022-31629", "CVE-2021-21704", "CVE-2022-37454", "CVE-2021-21707", "CVE-2007-3205", "CVE-2021-23017", "CVE-2017-8923", "CVE-2022-4900", "CVE-2021-21705", "CVE-2024-3566", "CVE-2021-21703", "CVE-2020-7071"], "hostnames": ["87.121.83.81.neterra.net"], "tags": ["self-signed", "eol-product"], "cpes": ["cpe:/a:php:php:7.3.24", "cpe:/a:f5:nginx:1.18.0"]}


ioc_type: ipv4
ioc_value: 196.251.69.72
source: shodan
validated_at: 2026-05-23T18:13:11.286360
raw_response:
  {"ports": [80], "vulns": ["CVE-2024-39573", "CVE-2017-7963", "CVE-2015-4604", "CVE-2015-4148", "CVE-2026-33523", "CVE-2014-3480", "CVE-2016-0736", "CVE-2013-2220", "CVE-2020-11985", "CVE-2014-0185", "CVE-2017-8923", "CVE-2014-0098", "CVE-2016-6291", "CVE-2018-17082", "CVE-2017-9224", "CVE-2015-4603", "CVE-2022-36760", "CVE-2025-58098", "CVE-2015-4642", "CVE-2016-3171", "CVE-2012-4360", "CVE-2014-4670", "CVE-2016-7413", "CVE-2026-33006", "CVE-2015-4026", "CVE-2015-3307", "CVE-2016-1903", "CVE-2013-3735", "CVE-2014-9652", "CVE-2015-2325", "CVE-2024-24795", "CVE-2017-9798", "CVE-2017-7272", "CVE-2015-2348", "CVE-2022-28615", "CVE-2015-5590", "CVE-2018-10548", "CVE-2012-1171", "CVE-2016-4542", "CVE-2016-7132", "CVE-2014-5459", "CVE-2016-9137", "CVE-2019-9639", "CVE-2015-5589", "CVE-2018-14851", "CVE-2015-6497", "CVE-2015-8994", "CVE-2014-3668", "CVE-2017-9788", "CVE-2016-4070", "CVE-2022-26377", "CVE-2016-9935", "CVE-2016-5768", "CVE-2013-7327", "CVE-2021-32785", "CVE-2017-7679", "CVE-2025-65082", "CVE-2013-0942", "CVE-2016-6174", "CVE-2014-9912", "CVE-2016-5387", "CVE-2015-7803", "CVE-2025-49812", "CVE-2015-4021", "CVE-2015-4147", "CVE-2019-9024", "CVE-2014-3487", "CVE-2022-22721", "CVE-2020-11579", "CVE-2011-1176", "CVE-2021-40438", "CVE-2014-0207", "CVE-2014-3523", "CVE-2016-9934", "CVE-2014-9705", "CVE-2014-0226", "CVE-2012-3526", "CVE-2015-0273", "CVE-2020-13938", "CVE-2015-2301", "CVE-2014-0231", "CVE-2016-5094", "CVE-2013-6712", "CVE-2014-5120", "CVE-2016-7126", "CVE-2015-3414", "CVE-2015-8873", "CVE-2017-7890", "CVE-2016-6296", "CVE-2024-3566", "CVE-2015-2787", "CVE-2011-4718", "CVE-2026-33007", "CVE-2018-10546", "CVE-2015-8865", "CVE-2014-4721", "CVE-2016-7124", "CVE-2014-9653", "CVE-2016-6295", "CVE-2016-7131", "CVE-2016-10397", "CVE-2015-8838", "CVE-2014-3538", "CVE-2017-11145", "CVE-2012-4001", "CVE-2025-59775", "CVE-2019-17567", "CVE-2016-7130", "CVE-2017-11628", "CVE-2015-4643", "CVE-2022-29404", "CVE-2019-10098", "CVE-2015-6833", "CVE-2014-0118", "CVE-201


ioc_type: ipv4
ioc_value: 196.251.70.22
source: shodan
validated_at: 2026-05-23T18:14:11.717824
raw_response:
  {"ports": [80], "vulns": ["CVE-2020-35452", "CVE-2021-39275", "CVE-2023-45802", "CVE-2024-38472", "CVE-2022-30556", "CVE-2022-4900", "CVE-2022-23943", "CVE-2009-2299", "CVE-2012-4360", "CVE-2009-0796", "CVE-2024-3566", "CVE-2020-1934", "CVE-2021-32785", "CVE-2013-4365", "CVE-2007-4723", "CVE-2019-9637", "CVE-2019-0196", "CVE-2025-49812", "CVE-2025-59775", "CVE-2017-7963", "CVE-2022-31628", "CVE-2022-31629", "CVE-2025-53020", "CVE-2022-22721", "CVE-2021-40438", "CVE-2025-55753", "CVE-2025-66200", "CVE-2025-23048", "CVE-2019-9638", "CVE-2019-9639", "CVE-2018-17189", "CVE-2023-25690", "CVE-2026-33006", "CVE-2026-33523", "CVE-2024-38474", "CVE-2024-40898", "CVE-2022-36760", "CVE-2011-1176", "CVE-2022-28614", "CVE-2013-2765", "CVE-2022-29404", "CVE-2025-65082", "CVE-2020-13938", "CVE-2021-44224", "CVE-2024-43394", "CVE-2021-32791", "CVE-2013-0941", "CVE-2015-9253", "CVE-2022-37436", "CVE-2022-22720", "CVE-2021-44790", "CVE-2019-9641", "CVE-2025-58098", "CVE-2017-8923", "CVE-2018-19396", "CVE-2020-11579", "CVE-2021-26690", "CVE-2019-9517", "CVE-2013-2220", "CVE-2026-33857", "CVE-2026-34059", "CVE-2019-0217", "CVE-2021-32792", "CVE-2022-28330", "CVE-2021-26691", "CVE-2019-0190", "CVE-2007-3205", "CVE-2023-38709", "CVE-2019-0197", "CVE-2018-17199", "CVE-2019-0220", "CVE-2017-7272", "CVE-2011-2688", "CVE-2026-33007", "CVE-2024-38477", "CVE-2024-24795", "CVE-2023-27522", "CVE-2012-4001", "CVE-2020-11984", "CVE-2022-26377", "CVE-2024-42516", "CVE-2006-20001", "CVE-2013-0942", "CVE-2023-31122", "CVE-2024-38473", "CVE-2019-0211", "CVE-2024-39573", "CVE-2026-29169", "CVE-2026-24072", "CVE-2019-10082", "CVE-2018-19395", "CVE-2019-10097", "CVE-2024-27316", "CVE-2022-22719", "CVE-2024-43204", "CVE-2026-34032", "CVE-2012-3526", "CVE-2024-47252", "CVE-2021-33193", "CVE-2024-38475", "CVE-2025-49630", "CVE-2020-9490", "CVE-2024-38476", "CVE-2022-31813", "CVE-2020-11993", "CVE-2021-32786", "CVE-2020-1927", "CVE-2019-10092", "CVE-2021-34798", "CVE-2024-25117", "CVE-2022-28615", "CVE-2019-


ioc_type: ipv4
ioc_value: 37.221.65.153
source: otx
validated_at: 2026-05-23T18:20:14.558422
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.153", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 44, "malware_samples": [], "passive_dns": ["aeqps.com", "rd91-0-azurenet.top", "smtracking.adeventor.net", "37-221-65-153.cprapid.com", "photoepinastic.store", "grandpashabet1385.com", "monagri.colecenter.37-221-65-153.plesk.page", "trusting-hopper.37-221-65-153.plesk.page", "www.trusting-hopper.37-221-65-153.plesk.page", "quizzical-lewin.37-221-65-153.plesk.page", "www.quizzical-lewin.37-221-65-153.plesk.page", "www.dreamy-blackburn.37-221-65-153.plesk.page", "dreamy-blackburn.37-221-65-153.plesk.page", "www.eloquent-perlman.37-221-65-153.plesk.page", "eloquent-perlman.37-221-65-153.plesk.page", "www.mystifying-margulis.37-221-65-153.plesk.page", "mystifying-margulis.37-221-65-153.plesk.page", "www.affectionate-napier.37-221-65-153.plesk.page", "affectionate-napier.37-221-65-153.plesk.page", "crazy-hugle.37-221-65-153.plesk.page"]}


ioc_type: ipv4
ioc_value: 37.221.65.149
source: otx
validated_at: 2026-05-23T18:20:49.136179
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.149", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 10, "malware_samples": [], "passive_dns": ["smtracking.venturahighway.com", "zs-yellow-03.top", "smtracking.thelifeman.com", "smtracking.sundar_abs.swp23.com", "smtracking.cresilonitleads.com", "smtracking.cistus.eu", "smtracking.efreightbroker.com", "smtracking.oxinsta.com", "smtracking.bayernland-email.eu", "t.zs-yellow-03.top"]}


ioc_type: ipv4
ioc_value: 37.221.65.77
source: otx
validated_at: 2026-05-23T18:22:44.877006
raw_response:
  {"pulse_count": 5, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.77", "tags": ["malware", "tsec", "urlhaus", "la-safe.org", "tpot19", "honeypot"], "pulses": ["ETIC Cybersecurity 2023-10-17 Port Scan", "ETIC Cybersecurity 2023-10-27 Port Scan", "URLHaus Malicious URL Blocklist 2023-09-24", "LCIA:HoneyNet:May 2023", "LCIA:HoneyNet:2023"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 37.221.65.16
source: otx
validated_at: 2026-05-23T18:24:13.771779
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.16", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 8, "malware_samples": [], "passive_dns": ["et-transfer1.com", "www.antai-infraction-stationnement.com", "www.ameli-espace-sante.com", "ameli-espace-sante.com", "antai-infraction-stationnement.com", "buytechnologiesstore.com", "malware-info.net", "www.malware-info.net"]}


ioc_type: ipv4
ioc_value: 37.221.65.19
source: otx
validated_at: 2026-05-23T18:25:14.718121
raw_response:
  {"pulse_count": 15, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.19", "tags": ["Skype", "tcp", "mirai", "Malicious IP", "scan", "tsec", "la-safe.org", "tpot19", "blacklist", "botnet", "honeypot"], "pulses": ["ETIC Cybersecurity 2023-06-23 Port Scan", "ETIC Cybersecurity 2023-07-09 Port Scan", "ETIC Cybersecurity 2023-07-10 Port Scan", "ETIC Cybersecurity 2023-07-11 Port Scan", "ETIC Cybersecurity 2023-07-12 Port Scan", "ETIC Cybersecurity 2023-07-13 Port Scan", "ETIC Cybersecurity 2023-07-14 Port Scan", "ETIC Cybersecurity 2023-07-15 Atac Web", "ETIC Cybersecurity 2023-07-16 Atac Web", "IOCs - 20237211810 - ANIA Threat Feeds - IP Segment 6", "2023-07-15 Fail2Ban 4107c14f-7279-4afe-95f0-186586980741", "LCIA:HoneyNet:2023", "LCIA:HoneyNet:June 2023", "Scan port 81 Skype (S3#)", "ETIC Cybersecurity 2023-06-24 Port Scan"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["planharmonia.com", "minebit.top"]}


ioc_type: ipv4
ioc_value: 37.221.65.20
source: otx
validated_at: 2026-05-23T18:25:32.712216
raw_response:
  {"pulse_count": 35, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.20", "tags": ["phishing", "scanners", "Nextray", "vultr", "ioc", "cyber security", "portscan", "malicious", "honeypot"], "pulses": ["IOC Records Provided by @NextRayAI", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-04-13", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOC Records \u2192Provided by @NextRayAI", "HIVE           (Pulse created by RVS_i_am)", "HIVE           (Pulse created by RVS_i_am)", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "IOC Records \u2192Provided by @NextRayAI"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 37.221.65.33
source: otx
validated_at: 2026-05-23T18:26:16.962493
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.33", "tags": ["cowrie", "asyncrat", "automated", "fatt", "unknown-stealer", "phishing", "mailoney", "unknown-malware", "p0f", "threatfox", "honeypot", "tpot", "tanner", "osint-volley", "c2-infrastructure", "dionaea", "honeytrap", "sentrypeer", "sensor-tagged", "suricata"], "pulses": ["Honeypot Data \u2013 T-Pot - Sydney, Australia - February 2026", "OSINT Volley 2026-02-06 - Unknown Stealer/Unknown malware/AsyncRAT", "Greek Public Services & Companies Phishing indicators"], "malware_count": 0, "passive_dns_count": 9, "malware_samples": [], "passive_dns": ["data.museum", "a.aenima.xyz", "acs-courrier.com", "acsexpresss.com", "icicleintricacy.info", "securs-doks.info", "messagerie-orange.top", "messagerievocale.life", "messagerie-orange.info"]}


ioc_type: ipv4
ioc_value: 37.221.65.41
source: otx
validated_at: 2026-05-23T18:26:55.150644
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.41", "tags": [], "pulses": [], "malware_count": 1, "passive_dns_count": 14, "malware_samples": ["7ce687a676031082093ff59f210d07272619acf843c91aac8e6c456b1ec4015b"], "passive_dns": ["my-accountrestore.com", "silly-ramanujan.37-221-65-41.plesk.page", "status-track.info", "m-netflix.com", "m-disney.com", "spotlfy-player.com", "canadarevenueplatform.com", "rbc-canada-security-alert-onlineverify.com", "slave.vipembed.com", "cdn.vipembed.com", "q3dl.com", "bots.q3dl.com", "2embed.co", "cabbage.lol"]}


ioc_type: ipv4
ioc_value: 37.221.65.57
source: otx
validated_at: 2026-05-23T18:27:39.090062
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.57", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 24, "malware_samples": [], "passive_dns": ["www.944z7awimb.com", "shxnvamb.com", "tqmwramb.com", "wksjxrmb.com", "nhhhgtmb.com", "www.7fh5owmb.com", "lkgjcymb.com", "www.c6jigemb.com", "5bywg3mb.com", "7fh5owmb.com", "eblv51wsmb.com", "82w065asmb.com", "www.ebecvuyb.com", "www.yivwoyaamb.com", "yivwoyaamb.com", "c6jigemb.com", "944z7awimb.com", "icwbzamb.com", "gtwvjduj.com", "ovyxylnk.com"]}


ioc_type: ipv4
ioc_value: 37.221.65.69
source: otx
validated_at: 2026-05-23T18:27:54.082383
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.69", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 222, "malware_samples": [], "passive_dns": ["lordfilmvee.lol", "lordfilmtck.lat", "lordfilmgrt.lat", "lordfilmwer.lat", "lordfilmmnq.lat", "lordfilmvbn.lat", "help-plp.com", "lordfilmvaz.lol", "lordfilmmax.lol", "lordfilmkat.lol", "lordfilmlea.lol", "lordfilmlip.lol", "lordfilmnod.lol", "lordfilmhat.lol", "lordfilmnap.lol", "lordfilmhum.lol", "lordfilmhip.lol", "lordfilmmud.lol", "lordfilmkip.lol", "lordfilmlag.lol"]}


ioc_type: ipv4
ioc_value: 37.221.65.81
source: otx
validated_at: 2026-05-23T18:28:09.892306
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.81", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 18, "malware_samples": [], "passive_dns": ["taxanualuol.serveftp.net", "renouvellement-en-ligne-sms.fr", "multa-por-pagar.es", "masante-enligne.fr", "mon-renouvellement-carte-sms.fr", "sms-assure-renouvellement-enligne.fr", "sms-renouveler-assure.fr", "www.espace-sms-contact.fr", "espace-sms-contact.fr", "www.espace-sms-enligne.fr", "espace-sms-enligne.fr", "multa-por-pagar.com", "mon-renouvellement-enligne.com", "hfzlfz.publicvm.com", "akas.tech", "www.37-221-65-81.cprapid.com", "37-221-65-81.cprapid.com", "mirror.simplaza.org"]}


ioc_type: ipv4
ioc_value: 37.221.65.92
source: otx
validated_at: 2026-05-23T18:29:05.430322
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.92", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 23, "malware_samples": [], "passive_dns": ["geometrlcs.com", "msd.futboldeveteranos.online", "login.futboldeveteranos.online", "sso.futboldeveteranos.online", "hgjuwqskaipfjernern.futboldeveteranos.online", "futboldeveteranos.online", "ulup.futboldeveteranos.online", "agence-chronopost.eu", "3ch.icu", "smtracking.instantmarketing.site", "smtracking.aistudios.com", "smtracking.infotrainingz.com", "smtracking.ihongfinancial.com", "smtracking.advanced-database-solutions.net", "smtracking.advanced-database-solutions.com", "smtracking.domainlistings.us", "smtracking.infowebinarz.com", "smtracking.viosmarketers.com", "smtracking.madeinindonesia.store", "smtracking.astuce-du-moment.fr"]}


ioc_type: ipv4
ioc_value: 37.221.65.94
source: otx
validated_at: 2026-05-23T18:29:11.225722
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.94", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 16, "malware_samples": [], "passive_dns": ["go.22bet15.com", "betbigcity.org", "freightmastersdhl.com", "insurancetempcover.com", "onlymodapk.com", "apkhives.com", "360seoservices.com", "grabapkfiles.com", "modcarparking.com", "apkregister.com", "instaapkeys.com", "www.mini-militia.com", "mini-militia.com", "gbinstaa.com", "thaiapk.net", "exsure.xyz"]}


ioc_type: ipv4
ioc_value: 37.221.65.102
source: otx
validated_at: 2026-05-23T18:29:29.044914
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.102", "tags": ["", "ransomware", "malware"], "pulses": ["ThreatFix"], "malware_count": 1, "passive_dns_count": 10, "malware_samples": ["4d0cc6010a58a2aa9cab880c750180424f45ed8c678d973b220e7517e7f2fa67"], "passive_dns": ["lomlvsst.com", "xn--ddouanement-dhl-relivraison-boc.com", "xn--ddouanements-dhl-bqb.com", "piblord.com", "abbarri.com", "dayinic.com", "fontaxo.com", "caravanproin.com", "www.netlflx.com", "netlflx.com"]}


ioc_type: ipv4
ioc_value: 37.221.65.103
source: otx
validated_at: 2026-05-23T18:29:31.307657
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.103", "tags": ["abuseipdb"], "pulses": ["Compiled Blocklist of AbuseIPDB: Most reported IP addresses - by skocherhan", "Aggregated Blocklist for AbuseIPDB: A list of the most reported IP addresses.", "Sources of Spam List"], "malware_count": 0, "passive_dns_count": 22, "malware_samples": [], "passive_dns": ["renouvellement-demande-espace-assure.com", "espace-demende-renouvellement-assure.com", "demande-assure-renouvellement-enligne.com", "assure-demande-renouvellement.fr", "homepornpics.top", "www.homemadepics.top", "homemadepics.top", "www.cutecamteens.top", "cutecamteens.top", "amzn-authenticate-secure.com", "delivery-secure.com", "usp-service-package.com", "www.quizzical-mendeleev.37-221-65-103.plesk.page", "quizzical-mendeleev.37-221-65-103.plesk.page", "authenticate-secure.com", "romantic-nightingale.37-221-65-103.plesk.page", "heirifur.de", "verifica-seguro.com", "www.verifica-seguro.com", "comprobacion-acceso-seguro.com"]}


ioc_type: ipv4
ioc_value: 37.221.65.105
source: otx
validated_at: 2026-05-23T18:29:33.789478
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.105", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 66, "malware_samples": [], "passive_dns": ["www.tpp-steptwo.tech", "tpp-steptwo.tech", "www.access-tpp.net", "access-tpp.net", "lordfilmcup.lol", "lordfilmgod.lat", "lordfilmfry.lol", "lordfilmgas.lol", "lordfilmdad.lol", "lordfilmdan.lol", "lordfilmgap.lol", "lordfilmfly.lol", "lordfilmcut.lol", "lordfilmdeo.lol", "lordfilmfog.lol", "lordfilmgum.lol", "lordfilmgeo.lol", "lordfilmcow.lol", "lordfilmgem.lol", "lordfilmhot.lat"]}


ioc_type: ipv4
ioc_value: 37.221.65.110
source: otx
validated_at: 2026-05-23T18:29:40.582258
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.110", "tags": ["ip address", "urls ftp", "mirai", "gs005", "gs003", "sha1", "sha256", "telnet", "compromise ipv4", "urls https", "botnet", "blacklist", "tcp/80", "mirai botnet", "iocs", "combinations", "seen", "ipv4 port", "http", "linux", "tcp/23", "malware url", "port 23", "urls http", "sha values", "hashes", "file name", "port 80", "toggle"], "pulses": ["IP Addresses Logged by the Rosethorn PotNet", "[GS-604] Mirai Botnet IOCs - SEC-1275-1", "Honeypot Visitors (TCP/23) - 2025-01-29", "Honeypot Visitors (TCP/23) - 2025-01-25", "Honeypot Visitors (TCP/23) - 2025-01-24", "[GS-518] Mirai Botnet IOCs - SEC-1275-1", "Threat Intel Report - W33-2024", "20240722 Most Active Threat Indicators", "20240718 Most Active Threat Indicators", "Honeypot Visitors (TCP/80) - 2024-07-16"], "malware_count": 0, "passive_dns_count": 7, "malware_samples": [], "passive_dns": ["vigialove.digital", "certexpress.digital", "poupamaisbr.digital", "decomplicahoje.digital", "www.ulys-paiementfr.com", "ulys-paiementfr.com", "espace-renouvellement-assure.com"]}


ioc_type: ipv4
ioc_value: 37.221.65.112
source: otx
validated_at: 2026-05-23T18:29:42.914135
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.112", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 13, "malware_samples": [], "passive_dns": ["connexion-securite.com", "ma-carte-vital.com", "hardcore-lewin.37-221-65-112.plesk.page", "www.hardcore-lewin.37-221-65-112.plesk.page", "netlfixwallet.fr", "procedure-ameli.com", "client-santes.com", "gifted-wright.37-221-65-112.plesk.page", "www.gifted-wright.37-221-65-112.plesk.page", "www.friendly-jackson.37-221-65-112.plesk.page", "friendly-jackson.37-221-65-112.plesk.page", "netflix-info-secure.com", "xenodochial-poitras.37-221-65-112.plesk.page"]}


ioc_type: ipv4
ioc_value: 37.221.65.122
source: otx
validated_at: 2026-05-23T18:29:48.457147
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.122", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 15, "malware_samples": [], "passive_dns": ["sevdigimsensin.ru", "www.elturco.ru", "elturco.ru", "www.kimler-geldi-kimler-gecti.ru", "kimler-geldi-kimler-gecti.ru", "domdrakona-tv.com", "uzaksehir-tv.com", "uzak-sehir.com", "www.adliyedosyatakip.org", "cezadosyagoruntuleme.org", "adliyeeportal.org", "adliyedosyatakip.org", "cuenta-renovacion-pt.com", "hapg2.top", "dyntivu.net"]}


ioc_type: ipv4
ioc_value: 37.221.65.142
source: otx
validated_at: 2026-05-23T18:29:55.105871
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.142", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 41, "malware_samples": [], "passive_dns": ["my-postlu.com", "lux-trustt.com", "lux-trusts.com", "s-luxtrust.com", "opulentora.info", "rbc-canada-onlinealert-secure.com", "assurancemaladie-verification.fr", "paiement-netflx.fr", "cpam-carterenouv.fr", "banquedefrance-secure.fr", "accountsecure-sg.fr", "cpamrenouv-carte.fr", "cpam-renouv.info", "accountsgsecure-pass.fr", "account-sgsecur.fr", "account-sgsecurpass.fr", "certificat-critairgouv.fr", "cartevitaleameli.fr", "cpam-vitalerenouv.fr", "accountsg-securpass.fr"]}


ioc_type: ipv4
ioc_value: 37.221.65.162
source: otx
validated_at: 2026-05-23T18:30:05.034299
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.162", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 10, "malware_samples": [], "passive_dns": ["37-221-65-162.plesk.page", "www.infovitale-sante.online", "infovitale-sante.online", "auth-accountsocietegeneral.com", "lucid-wescoff.37-221-65-162.plesk.page", "www.lucid-wescoff.37-221-65-162.plesk.page", "www.silly-colden.37-221-65-162.plesk.page", "silly-colden.37-221-65-162.plesk.page", "welcomsecurite.eu.com", "emellibghiti.org.uk"]}


ioc_type: ipv4
ioc_value: 37.221.65.173
source: otx
validated_at: 2026-05-23T18:30:08.171752
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.173", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 62, "malware_samples": [], "passive_dns": ["relaytrackmondial.com", "37-221-65-173.plesk.page", "naughty-banach.37-221-65-173.plesk.page", "www.naughty-banach.37-221-65-173.plesk.page", "www.reactivecreditagric.mom", "azalagric.mom", "redgbdesroh.mom", "gsdpvrfxo.mom", "carvefxsq.mom", "recavxrfs.mom", "sedcerditagr.mom", "agriverces.mom", "caservisec.mom", "credicmome.mom", "wloeskasptus-hu6.me", "chagrin.mom", "servicecdtagricol.mom", "reactivecreditagricle.mom", "reactivecreditagric.mom", "craimeunc.mom"]}


ioc_type: ipv4
ioc_value: 37.221.65.184
source: otx
validated_at: 2026-05-23T18:30:13.991329
raw_response:
  {"pulse_count": 13, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.184", "tags": ["ssh", "Bruteforce", "SSH", "sip", "gameprofitshack", "Honeypot", "Brute-Force", "astromust", "dilboostenergy", "scan", "sipvicious"], "pulses": ["SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "Automated Threat Intelligence - Scanning hosts for 2025-05-07", "{by GAME PROFITS STAGING} SERVER BRUTE FORCE ATTACHMENTS", "GAME PROFITS STAGING SERVER  BRUTE FORCE ATTACH", "2025-05-13 Fail2Ban e8e5826d-623a-4de8-98a6-1a1a120ed258"], "malware_count": 0, "passive_dns_count": 5, "malware_samples": [], "passive_dns": ["help-coastcapitaisavings.com", "novolocalpronet.shop", "novoservertech.shop", "localserver03.shop", "pyramid-download.help"]}


ioc_type: ipv4
ioc_value: 37.221.65.185
source: otx
validated_at: 2026-05-23T18:30:18.448675
raw_response:
  {"pulse_count": 19, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.185", "tags": ["SSH", "Telnet", "tcp", "mirai", "Malicious IP", "scan", "login", "scanner", "botnet", "cowrie", "tsec", "la-safe.org", "telnet", "tpot19", "blacklist", "honeypot", "bruteforce", "attack"], "pulses": ["Ka's Honeypot visitors", "srg", "srg", "LCIA:HoneyNet:2022", "LCIA:HoneyNet:December 2022", "TELNET - US Honeypot IoCs 2022-12-15", "Telnet honeypot logs for 2022-12-15", "TELNET - US Honeypot IoCs 2022-12-14", "TELNET - US Honeypot IoCs 2022-12-13", "TELNET - US Honeypot IoCs 2022-12-12", "TELNET - US Honeypot IoCs 2022-12-11", "Telnet honeypot logs for 2022-12-11", "Scan port 23 Telnet (S3#)", "TELNET - US Honeypot IoCs 2022-12-10", "TELNET - US Honeypot IoCs 2022-12-09", "TELNET - US Honeypot IoCs 2022-12-08", "TELNET - US Honeypot IoCs 2022-12-07", "TELNET - US Honeypot IoCs 2022-12-06", "Scan port 23 Telnet (S3#)"], "malware_count": 1, "passive_dns_count": 4, "malware_samples": ["8d009fbbf5f634e1f715385fde3da14e54cce967eea18d1de5c5df08f9a8094d"], "passive_dns": ["www.testspdd.org", "testspdd.org", "host.seosolution.life", "dhl-expressreschedule.one"]}


ioc_type: ipv4
ioc_value: 37.221.65.223
source: otx
validated_at: 2026-05-23T18:30:36.993152
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.223", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 25, "malware_samples": [], "passive_dns": ["serial.walkingdead.top", "lost-tv.top", "www.lost-tv.top", "misfits-tv.top", "mult.familyguytv.top", "familyguytv.top", "www.familyguytv.top", "breakingbadserial.top", "mp4club.top", "www.dnevnikivampira.top", "dnevnikivampira.top", "friends-druzya.ru", "www.friends-druzya.ru", "www.vikingi.top", "serial.vikingi.top", "vikingi.top", "www.grimmserial.top", "grimmserial.top", "doktorhaus.top", "www.doktorhaus.top"]}


ioc_type: ipv4
ioc_value: 37.221.65.226
source: otx
validated_at: 2026-05-23T18:30:40.244756
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.226", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 14, "malware_samples": [], "passive_dns": ["alfaplus.cam", "www.alfaplus.cam", "cazinovas.com", "www.cazinovas.com", "allianceventures.ru", "baashinux.cloud", "outlook.outlook.baashinux.cloud", "login.outlook.baashinux.cloud", "account.outlook.baashinux.cloud", "login.secure.baashinux.cloud", "www.secure.baashinux.cloud", "www.sandbox.mrftstlog.cloud", "login.sandbox.mrftstlog.cloud", "cronuxmaxx.com"]}


ioc_type: ipv4
ioc_value: 37.221.65.231
source: otx
validated_at: 2026-05-23T18:30:47.007089
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.231", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 38, "malware_samples": [], "passive_dns": ["arrowserial.top", "www.13reasonswhy.ru", "13reasonswhy.ru", "serial.dark-netflix.ru", "boys-tv.ru", "www.arcane-tv.top", "arcane-tv.top", "www.fargoserial.top", "fargoserial.top", "mult.gravityfalls.top", "desyatoekorolevstvo.ru", "kosti.top", "tv.igravkalmara.top", "serial.igravkalmara.top", "outlander.top", "besstyzhie-tv.ru", "blacklist-tv.top", "www.blacklist-tv.top", "ah2.slavison.ru", "besstyzhie.top"]}


ioc_type: ipv4
ioc_value: 37.221.65.235
source: otx
validated_at: 2026-05-23T18:30:51.936721
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.235", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 11, "malware_samples": [], "passive_dns": ["onlyfansta.com", "onlyfanski.com", "onlyfansmi.com", "alpha-business-partners.online", "ups-mypackage-europe.com", "rappel-infraction-dossier.info", "ups-es-track.com", "shipment-parcel-ups.com", "ups-expedition-parcel.com", "canadainstantransfer.com", "interac-onetimebenefits.info"]}


ioc_type: ipv4
ioc_value: 37.221.65.252
source: otx
validated_at: 2026-05-23T18:30:59.918607
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.65.252", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 39, "malware_samples": [], "passive_dns": ["spineflo.it.com", "laurent-chenot.com", "m1.laurent-chenot.com", "cdnnd.openxrt.site", "reeeeeetchkjkhjljhkjhkjhk.xyz", "locationone.co", "secondstance.co", "secondaryline.co", "greatcreate.net", "lifelabz.co", "momentl.co", "go.talentto.org", "beyondbest.co", "seven-nine.co", "deservingduo.org", "thirty-six.org", "divisionaly.co", "netimpressive.co", "talentto.org", "net-sense.net"]}


ioc_type: ipv4
ioc_value: 93.157.106.78
source: shodan
validated_at: 2026-05-24T00:02:29.751125
raw_response:
  {"ports": [21, 22, 25, 53, 143, 443, 465, 587, 993, 995, 7777, 8888], "vulns": ["CVE-2023-42117", "CVE-2023-42114", "CVE-2025-67896", "CVE-2023-42115", "CVE-2026-40686", "CVE-2026-40684", "CVE-2025-30232", "CVE-2024-39929", "CVE-2022-3620", "CVE-2022-3559", "CVE-2023-51766", "CVE-2023-42116", "CVE-2026-40687", "CVE-2023-42119", "CVE-2026-40685"], "hostnames": ["s1.kinopolice.com"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:exim:exim:4.96", "cpe:/a:f5:nginx:1.30.0", "cpe:/o:debian:debian_linux", "cpe:/a:openbsd:openssh:9.2p1", "cpe:/a:f5:nginx", "cpe:/o:linux:linux_kernel"]}


ioc_type: ipv4
ioc_value: 91.103.140.136
source: shodan
validated_at: 2026-05-24T00:03:00.659664
raw_response:
  {"ports": [443], "vulns": [], "hostnames": ["sf-api-token-service.itunes.apple.com", "api.music.apple.com", "pd.itunes.apple.com", "api.itunes.apple.com", "is1-ssl.mzstatic.com", "radio-activity.itunes.apple.com", "a5.mzstatic.com", "sp.itunes.apple.com", "upp.itunes.apple.com", "sync.itunes.apple.com", "s.mzstatic.com", "store.mzstatic.com", "b5.mzstatic.com", "s3.mzstatic.com", "itc.mzstatic.com", "search.itunes.apple.com", "b4.mzstatic.com", "api.apps.apple.com", "apps.apple.com", "images-mercury.mzstatic.com", "videos.apple.com", "b2.mzstatic.com", "is2-ssl.mzstatic.com", "s4.mzstatic.com", "se.itunes.apple.com", "api-edge.apps.apple.com", "accertify.mzstatic.com", "api.podcasts.apple.com", "sb.music.apple.com", "s1.mzstatic.com", "uts-api-siri.itunes.apple.com", "itunes.apple.com", "b3.mzstatic.com", "api.videos.apple.com", "atve.tv.apple.com", "amp-api-edge.music.apple.com", "api.edu.apple.com", "radio.itunes.apple.com", "s5.mzstatic.com", "b1.mzstatic.com", "a1.mzstatic.com", "configuration.apple.com", "su.itunes.apple.com", "books.apple.com", "assets-mercury.mzstatic.com", "apps.mzstatic.com", "radio-services.itunes.apple.com", "bookkeeper.itunes.apple.com", "a3.mzstatic.com", "api.books.apple.com", "music.apple.com", "init.itunes.apple.com", "radio-quickplay.itunes.apple.com", "is5-ssl.mzstatic.com", "sb.tv.apple.com", "tf-feedback.itunes.apple.com", "amp-api-edge.apps.apple.com", "metrics.mzstatic.com", "se-edge.itunes.apple.com", "is3-ssl.mzstatic.com", "desktop-store.itunes.apple.com", "tv.apple.com", "a4.mzstatic.com", "podcasts.apple.com", "edge.itunes.apple.com", "vocabulary.itunes.apple.com", "desktop-music-legacy.itunes.apple.com", "s2.mzstatic.com", "a2.mzstatic.com", "amp-api-search-edge.apps.apple.com", "is4-ssl.mzstatic.com", "siri-search.itunes.apple.com"], "tags": [], "cpes": []}


ioc_type: ipv4
ioc_value: 91.103.140.141
source: shodan
validated_at: 2026-05-24T00:03:05.993556
raw_response:
  {"ports": [443], "vulns": [], "hostnames": ["myvisualization.oracle.com", "sites.oracle.com", "itweb.oracle.com", "analytics.covid19.oracle.com", "biapps-fusioncrm.oracle.com", "securesites.oracle.com", "elocation.oracle.com", "m.oracle.com", "scm-fusioncrm.oracle.com", "restgwoci-dr.oracle.com", "appcenter.bronto.com", "myemm.oracle.com", "cn.forums.oracle.com", "container-registry.oracle.com", "restgwoci.oracle.com", "www.covid19-rx.org", "wwwcmsapi.oracle.com", "maps.oracle.com", "content.bronto.com", "mymobile.oracle.com", "blog.bronto.com", "wikis.oracle.com", "mysites-api.oracle.com", "covpn-site-portal.oracle.com", "salesaccelerator.oracle.com", "ideas.bronto.com", "mydevice.oracle.com", "partner.cloudmarketplace.oracle.com", "www-cs-02.oracle.com", "co19.oracle.com", "profile-api.oracle.com", "oradocs.oracle.com", "oracleassistant.oracle.com", "ocm-apis-cloud.oracle.com", "search-api.oracle.com", "search.oracle.com", "redwood.oracle.com", "pressroom.oracle.com", "covid-analytics.oracle.com", "people.us.oracle.com", "hcm-fusioncrm.oracle.com", "crm-fusioncrm.oracle.com", "oraassistant.oracle.com", "fin-fusioncrm.oracle.com", "oraassistant-dr.oracle.com", "linux.oracle.com", "myprocess.oracle.com", "cloudmarketplace.oracle.com", "blogs.bronto.com", "bronto.com", "kr.forums.oracle.com", "covid19-rx.org", "www.covid19rx.org", "careers.bronto.com", "my.oracle.com", "profile.oracle.com", "covpn-admin-portal.oracle.com", "www.blogs.oracle.com", "mysites.oracle.com", "www.bronto.com", "covpn.oracle.com", "ic-fusioncrm.oracle.com", "resources.bronto.com", "publicdocs.oracle.com", "myprofile.oracle.com", "hrservices.oracle.com", "events.oracle.com", "analystconnect.oracle.com", "covid19rx.org", "volunteer.oracle.com", "www.ateam-oracle.com", "orabuilder.oracle.com", "mybuilder.oracle.com", "bi-fusioncrm.oracle.com", "oramobile.oracle.com", "fusioncrm.oracle.com", "aria.us.oracle.com", "www.oracle.com", "www.oracleimg.com", "covid19.oracle.com", "ateam-oracle.com", "co


ioc_type: ipv4
ioc_value: 91.103.252.231
source: shodan
validated_at: 2026-05-24T00:07:04.909350
raw_response:
  {"ports": [22, 8443], "vulns": [], "hostnames": ["us.amazon.com", "uedata.amazon.com", "amzn.com", "p-nt-www-amazon-com-kalias.amazon.com", "p-y3-www-amazon-com-kalias.amazon.com", "corporate.amazon.com", "iphone.amazon.com", "test-www.amazon.com", "home.amazon.com", "mp3recs.amazon.com", "huddles.amazon.com", "www.amazon.com", "origin-www.amazon.com", "vm3943041.firstbyte.club", "yellowpages.amazon.com", "buybox.amazon.com", "buckeye-retail-website.amazon.com", "yp.amazon.com", "shop.business.amazon.com", "p-yo-www-amazon-com-kalias.amazon.com", "amazon.com", "konrad-test.amazon.com", "www.cdn.amazon.com", "www.amzn.com", "www.m.amazon.com"], "tags": [], "cpes": ["cpe:/o:debian:debian_linux", "cpe:/a:openbsd:openssh:9.2p1", "cpe:/o:linux:linux_kernel", "cpe:/a:amazon:amazon_cloudfront"]}


ioc_type: ipv4
ioc_value: 91.103.253.120
source: shodan
validated_at: 2026-05-24T00:08:27.161519
raw_response:
  {"ports": [22, 8443], "vulns": [], "hostnames": ["ya.ru", "yandex.kz", "yandex.net", "yandex.com", "yandex.jobs", "yandex.ee", "yandex.md", "yandex.com.ge", "yandex.lv", "yandex.it", "vm4114766.firstbyte.club", "yandex.ru", "yandex.by", "yandex.co.il", "yandex.az", "yandex.tj", "xn--d1acpjx3f.xn--p1ai", "yandex.com.am", "yandex.fr", "yandex.aero", "yandex.org", "yandex.uz", "yandex.com.tr", "yandex.lt", "yandex.de", "yandex.tr", "yandex.tm"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


ioc_type: ipv4
ioc_value: 91.103.253.199
source: shodan
validated_at: 2026-05-24T00:09:20.590808
raw_response:
  {"ports": [22, 80, 443], "vulns": ["CVE-2025-23419", "CVE-2023-44487"], "hostnames": ["admetrics.uadapp.yahoo.com", "es-us.noticias.yahoo.com", "video-api.sapi.yahoo.com", "s.aolcdn.com", "fr-ca.rogers.yahoo.com", "es-us.vida-estilo.yahoo.com", "cdn.js7k.com", "de.kino.yahoo.com", "commsdata.api.yahoo.com", "next.health.yahoo.com", "api.digitalhomeservices.yahoo.com", "gallery.tv.widgets.yahoo.com", "o.aolcdn.com", "br.financas.yahoo.com", "es-us.finanzas.yahoo.com", "ymail.com", "video.media.yql.yahoo.com", "de.nachrichten.yahoo.com", "s.yimg.com", "vm4117910.firstbyte.club", "ca.rogers.yahoo.com", "next.tech.yahoo.com", "cdn.launch3d.com"], "tags": ["eol-product"], "cpes": ["cpe:/a:apache:traffic_server", "cpe:/a:openbsd:openssh:9.6p1", "cpe:/a:f5:nginx:1.24.0", "cpe:/o:canonical:ubuntu_linux", "cpe:/o:linux:linux_kernel"]}


ioc_type: ipv4
ioc_value: 91.103.253.97
source: shodan
validated_at: 2026-05-24T00:10:40.324444
raw_response:
  {"ports": [22, 443], "vulns": [], "hostnames": ["ya.ru", "yandex.kz", "yandex.net", "yandex.com", "yandex.jobs", "yandex.ee", "yandex.md", "yandex.com.ge", "yandex.lv", "yandex.it", "yandex.ru", "yandex.by", "yandex.co.il", "yandex.az", "yandex.tj", "xn--d1acpjx3f.xn--p1ai", "vk.ru", "telegrambot.ru", "yandex.com.am", "yandex.fr", "yandex.aero", "yandex.org", "yandex.uz", "yandex.com.tr", "yandex.lt", "yandex.de", "yandex.tr", "yandex.tm"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


ioc_type: ipv4
ioc_value: 91.108.240.27
source: shodan
validated_at: 2026-05-24T00:12:01.479785
raw_response:
  {"ports": [443], "vulns": ["CVE-2025-53020", "CVE-2022-22721", "CVE-2023-45802", "CVE-2025-55753", "CVE-2025-66200", "CVE-2006-20001", "CVE-2025-23048", "CVE-2013-0942", "CVE-2023-31122", "CVE-2024-38472", "CVE-2024-38473", "CVE-2022-30556", "CVE-2024-39573", "CVE-2026-29169", "CVE-2026-24072", "CVE-2024-27316", "CVE-2026-33857", "CVE-2026-34059", "CVE-2022-23943", "CVE-2023-25690", "CVE-2022-22719", "CVE-2026-33006", "CVE-2026-33523", "CVE-2024-38474", "CVE-2024-40898", "CVE-2022-36760", "CVE-2011-1176", "CVE-2024-43204", "CVE-2022-28614", "CVE-2009-2299", "CVE-2012-4360", "CVE-2026-34032", "CVE-2009-0796", "CVE-2013-2765", "CVE-2022-28330", "CVE-2022-29404", "CVE-2012-3526", "CVE-2024-47252", "CVE-2025-65082", "CVE-2024-38475", "CVE-2025-49630", "CVE-2024-43394", "CVE-2023-38709", "CVE-2013-0941", "CVE-2024-38476", "CVE-2011-2688", "CVE-2022-31813", "CVE-2026-33007", "CVE-2022-37436", "CVE-2013-4365", "CVE-2024-38477", "CVE-2022-28615", "CVE-2024-24795", "CVE-2023-27522", "CVE-2022-22720", "CVE-2012-4001", "CVE-2007-4723", "CVE-2022-26377", "CVE-2025-49812", "CVE-2025-59775", "CVE-2024-42516", "CVE-2025-58098"], "hostnames": ["symptomaticselection-n2.aeza.network"], "tags": ["self-signed"], "cpes": ["cpe:/a:apache:http_server:2.4.52", "cpe:/o:canonical:ubuntu_linux"]}


ioc_type: ipv4
ioc_value: 91.108.241.107
source: shodan
validated_at: 2026-05-24T00:12:33.970868
raw_response:
  {"ports": [22, 443], "vulns": [], "hostnames": ["ya.ru", "yandex.kz", "yandex.net", "yandex.com", "yandex.jobs", "yandex.ee", "yandex.md", "onlinenet.ptr.network", "yandex.com.ge", "yandex.lv", "yandex.it", "yandex.ru", "yandex.by", "yandex.co.il", "yandex.az", "yandex.tj", "xn--d1acpjx3f.xn--p1ai", "yandex.com.am", "yandex.fr", "yandex.aero", "yandex.org", "yandex.uz", "yandex.com.tr", "yandex.lt", "yandex.de", "yandex.tr", "yandex.tm"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux"]}


ioc_type: ipv4
ioc_value: 91.108.241.253
source: shodan
validated_at: 2026-05-24T00:13:47.517468
raw_response:
  {"ports": [80, 443], "vulns": ["CVE-2025-53020", "CVE-2025-55753", "CVE-2025-66200", "CVE-2025-23048", "CVE-2013-0942", "CVE-2024-38472", "CVE-2024-38473", "CVE-2024-36387", "CVE-2024-39573", "CVE-2026-29169", "CVE-2026-24072", "CVE-2024-27316", "CVE-2026-33857", "CVE-2026-34059", "CVE-2026-33006", "CVE-2026-33523", "CVE-2024-38474", "CVE-2024-40898", "CVE-2011-1176", "CVE-2024-43204", "CVE-2009-2299", "CVE-2012-4360", "CVE-2026-34032", "CVE-2009-0796", "CVE-2013-2765", "CVE-2012-3526", "CVE-2024-47252", "CVE-2025-65082", "CVE-2024-38475", "CVE-2025-49630", "CVE-2024-43394", "CVE-2023-38709", "CVE-2013-0941", "CVE-2024-38476", "CVE-2011-2688", "CVE-2026-33007", "CVE-2013-4365", "CVE-2024-38477", "CVE-2024-24795", "CVE-2007-4723", "CVE-2012-4001", "CVE-2025-49812", "CVE-2025-59775", "CVE-2024-42516", "CVE-2025-58098"], "hostnames": ["vk.com", "stats.vk-portal.net", "m.vk.ru", "vk.me", "vk.cc", "vk.ru", "m.vk.com", "vk.design", "prizedflesh.ptr.network", "api.vk.ru", "api.vk.com", "vkontakte.com", "vk.link", "vkvideo.ru", "vkontakte.ru"], "tags": [], "cpes": ["cpe:/a:apache:http_server:2.4.58"]}


ioc_type: ipv4
ioc_value: 87.121.85.176
source: otx
validated_at: 2026-05-24T00:15:34.443020
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.85.176", "tags": ["dionaea", "Adbhoney", "mailoney", "sentrypeer", "sftp", "Redishoneypot", "honeytrap", "email", "tanner", "sip", "LAMP", "ipphoney", "heralding", "cisco", "conpot", "ssh", "malicious", "cowrie"], "pulses": ["LCIA HoneyNet Data - July 2025 - Redishoneypot", "LCIA HoneyNet Data - June 2025 - Redishoneypot"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 37.221.67.17
source: otx
validated_at: 2026-05-24T00:17:49.847827
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.67.17", "tags": ["cobalt strike", "sentinel misp", "twitter page", "strong", "date", "info", "november", "cobalt", "ransomware feed", "twitter", "emotet", "feed", "HotSpot", "iocs", "compromise", "precisionsec", "agent tesla", "nanocore rat"], "pulses": ["Cobalt Strike Indicators of Compromise (IOC) Feed - PrecisionSec - Tacking 2023", "2023\u5e74Cobalt Strike\u9ed1\u5ba2\u5de5\u5177\u653b\u51fb\u4e8b\u4ef6"], "malware_count": 0, "passive_dns_count": 6, "malware_samples": [], "passive_dns": ["vstcrack.download", "migs0kop-hizmetfleri.store", "mi3g.com", "paipaipy.icu", "paipiapy.cyou", "vfxmedchat.com"]}


ioc_type: ipv4
ioc_value: 37.221.67.179
source: otx
validated_at: 2026-05-24T00:17:53.686814
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.67.179", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 11, "malware_samples": [], "passive_dns": ["vortexnetwork.xyz", "027fg.lph1backhl.sclogins.net", "lpcoffeehouse.top", "lph1backh.site", "lphback.link", "www.lphbakend.xyz", "lphbakend.xyz", "host.leadoffers.xyz", "icakvantum.us", "rhx06.clicksign.cloud", "magibbstry.com"]}


ioc_type: ipv4
ioc_value: 37.221.67.219
source: otx
validated_at: 2026-05-24T00:18:02.816753
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.67.219", "tags": ["malspam email", "currc3adculo", "anna paula", "utf8", "msi file", "headers", "zip archive", "associated", "tuesday", "from email"], "pulses": ["test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "test CREATED 1 YEAR AGO by testivk1 clone", "IOC TCS- IP", "test", "test"], "malware_count": 0, "passive_dns_count": 18, "malware_samples": [], "passive_dns": ["digitalshop24h.com", "www.kvehun44.top", "kvehun44.top", "kvecma41.top", "www.kvecma41.top", "uwdvye410.top", "uwduvp48.top", "uwdurc47.top", "uwdhav38.top", "uwdmer37.top", "uwdxmi27.top", "uwdnyp110.top", "uwdjus18.top", "uwdwah17.top", "www.cranky-ellis.37-221-67-219.plesk.page", "cranky-ellis.37-221-67-219.plesk.page", "elated-cartwright.37-221-67-219.plesk.page", "infobestsite.online"]}


ioc_type: ipv4
ioc_value: 37.221.67.25
source: otx
validated_at: 2026-05-24T00:18:06.243877
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.67.25", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 32, "malware_samples": [], "passive_dns": ["pocket-option.my", "pocket-option.shop", "pocketoptions.org", "pocketoption.cloud", "pocketoption.live", "pocketoption.best", "pocket-option.in", "pocketoption.buzz", "www.pocketoption.at", "pocketoption.at", "pocket-option.forum", "realizadiplomas.com", "norvaba.site", "hogmix.site", "artmilan.site", "cleolift.com", "reveil-vintage-world.shop", "myhappylift.shop", "home-paradise-fr.shop", "alminsar.xyz"]}


ioc_type: ipv4
ioc_value: 37.221.67.254
source: otx
validated_at: 2026-05-24T00:18:28.305876
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.67.254", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 69, "malware_samples": [], "passive_dns": ["snaplitepanels.com", "luckytasmanian.com", "reftaxcra24.com", "taxrefcred24.com", "rbconline-regainacess.com", "gaixinhtv.com", "marblesthecat.com", "www.micredito.com.br", "htagink.com", "micredito.com.br", "bvsloan.com", "giftssellerkw.com", "www.giftssellerkw.com", "fun-piano.com", "surgeryriskfactors.com", "jennytexas.com", "www.jennytexas.com", "www.ymcaperucentenario.com", "ymcaperucentenario.com", "pumular.com"]}


ioc_type: ipv4
ioc_value: 87.121.84.117
source: otx
validated_at: 2026-05-24T00:18:50.483587
raw_response:
  {"pulse_count": 8, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.84.117", "tags": ["sftp", "sentrypeer", "adb", "ddos", "tanner", "LAMP", "sip", "honeypot", "mailoney", "cisco", "botnet", "ssh", "threatfox", "fatt", "Adbhoney", "p0f", "auto", "dropper", "suricata", "sensor-tagged", "malicious", "cowrie", "dionaea", "c2", "tpot", "android", "dugganusa", "honeytrap", "mirai", "scanner", "iot"], "pulses": ["TI Advisory No-ESAF-SOC-TI-2026-9", "LCIA HoneyNet Data - December 2025 - Honeytrap", "LCIA HoneyNet Data - December 2025 - Adbhoney", "Honeypot Data \u2013 T-Pot - Sydney, Australia - December 2025", "ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 December 2025", "Malware Filter - Botnet List - 18-12-2025 (Part 8)", "Mirai Botnet IOCs - Dec 3, 2025 | 80 C2 nodes", "Malware Host | Mirai | Botnet"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 87.121.84.127
source: otx
validated_at: 2026-05-24T00:18:56.924673
raw_response:
  {"pulse_count": 8, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.84.127", "tags": ["sftp", "sentrypeer", "tanner", "LAMP", "sip", "honeypot", "ipphoney", "mailoney", "cisco", "botnet", "ssh", "heralding", "attack", "fatt", "Adbhoney", "telnet", "p0f", "login", "suricata", "sensor-tagged", "malicious", "cowrie", "dionaea", "Telnet", "scan", "tcp", "tpot", "SSH", "Malicious IP", "blacklist", "honeytrap", "elasticpot", "mirai", "scanner"], "pulses": ["Malware Filter - Botnet List - 25-04-2026 (Part 41)", "Ka's Honeypot visitors", "LCIA HoneyNet Data - December 2025 - Honeytrap", "LCIA HoneyNet Data - December 2025 - Adbhoney", "Honeypot Data \u2013 T-Pot - Sydney, Australia - December 2025", "LCIA HoneyNet Data - April 2025 - Cowrie", "LCIA HoneyNet Data - April 2025 - Adbhoney", "Scan port 23 Telnet (S3#)"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["goodkitchen.pro"]}


ioc_type: ipv4
ioc_value: 87.121.84.166
source: otx
validated_at: 2026-05-24T00:19:13.864264
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.84.166", "tags": ["Mirai", "infostealer", "elf", "ready.apk", "32-bit", "exe", "moobot", "xworm", "mips", "botnetdomain", "HailBot", "arm", "ClearFake", "opendir", "censys", "shadowharvest", "gafgyt", "ps1", "ua-wget", "Mozi", "apk", "Ransomware", "stealer", "ECh0raix", "hajime", "LummaStealer", "mirai", "sh"], "pulses": ["urlhaus 30days", "Mirai", "URLHaus data - 06-05-2025"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["e8f7b4262f9ed0b04ea4303ab450fa2b4f08ebfaa74648ae96bbc729c02ce659"], "passive_dns": []}


ioc_type: ipv4
ioc_value: 87.121.84.18
source: otx
validated_at: 2026-05-24T00:19:31.310406
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.84.18", "tags": ["dionaea", "fatt", "sentrypeer", "honeytrap", "portscan", "p0f", "tanner", "digital ocean", "honeypot", "vultr", "suricata", "mailoney", "sensor-tagged", "scanners", "tpot", "cowrie"], "pulses": ["Honeypot Data \u2013 T-Pot - Sydney, Australia - April 2026", "Honeypot Data \u2013 T-Pot - Sydney, Australia - May 2026", "Vultr Paris (France) Port Scanning Hosts for 2026-05-14", "Vultr Paris (France) Port Scanning Hosts for 2026-04-14", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-04-14", "DigitalOcean London (UK) Port Scanning Hosts for 2026-04-14", "Vultr Paris (France) Port Scanning Hosts for 2026-04-13", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-04-13", "DigitalOcean London (UK) Port Scanning Hosts for 2026-04-13", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-05-13", "Vultr Paris (France) Port Scanning Hosts for 2026-05-13", "Vultr Paris (France) Port Scanning Hosts for 2026-05-12", "Vultr Paris (France) Port Scanning Hosts for 2026-04-12", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-04-12", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-04-12", "DigitalOcean London (UK) Port Scanning Hosts for 2026-04-12", "Vultr Paris (France) Port Scanning Hosts for 2026-04-11", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-04-11", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-04-11", "DigitalOcean Toronto (CA) Port Scanning Hosts for 2026-04-11"], "malware_count": 4, "passive_dns_count": 0, "malware_samples": ["617bbb68680a41752be3b73391688994c2b63ed02e538d6af8ddd545f95d1a37", "e979e0c752bf294d6b654bcf37b73294529a76cf01aa5abcffa9478cdccec181", "0a3ef431ef6aac9035870acc991bfa9c3b34e1be185656225c8a5016ad0a2890", "deec36025c1907b79d5095e22dbfbc5a65f0617771d0567b134382b6778707db"]}


ioc_type: ipv4
ioc_value: 87.121.84.23
source: otx
validated_at: 2026-05-24T00:19:34.218417
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.84.23", "tags": ["xml", "dropped-by-Phorpiex", "45-156-87-157", "2025", "elf", "phorpiex", "32-bit", "94-156-152-18", "exe", "RemcosRAT", "dropped-by-amadey", "msi", "lnk", "honeypot", "SnappyClient", "m68k", "SuperH", "botnet", "mips", "45-67-138-144", "webscanner", "140-233-190-47", "arm", "telnet", "arc", "df3d5ee897b28da580030a4776d2aec2d4d9b05667c6e1995fef8c41a5cd", "connectwise", "ClearFake", "opendir", "sparc", "01.10.2025", "badrequest", "bruteforce", "x86", "huge-file", "176-65-139-144", "PowerPC", "ua-wget", "f3f3ff3f0964ca6e8c550940145fae49e6b4135523e309400513d8cbb969", "Mozi", "8eca755b90ce60a452f0c94a522b120601a8c2baddf939531f72db0f93a9", "scan", "tcp", "Malicious IP", "11ed7be675889b8d19b2e8f44bb33d6733a9de2e092102b1e8c1f28469d6", "blacklist", "remcos", "c2-monitor-auto", "mirai", "791651d9ca0de1f77082de5a724fd0054b3daa5ff160a6eaf6e69a192588"], "pulses": ["Webscanners with Bad Requests - HTTP Status 400 - 1/20/2018 thru current day", "URLHaus data - 07-05-2026 (Part 3)", "URLHaus data - 06-05-2026 (Part 1)", "HoneyPot Connect 01.10.2025", "Malware Filter - Botnet List - 13-08-2025", "Malicious IP Addresses", "Scan port 23 Telnet (S3#)"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 87.121.84.29
source: otx
validated_at: 2026-05-24T00:20:28.520109
raw_response:
  {"pulse_count": 22, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.84.29", "tags": ["sftp", "LAMP", "honeypot", "Bruteforce", "botnet", "ssh", "heralding", "attack", "webscanner", "Brute-Force", "telnet", "login", "badrequest", "bruteforce", "malicious", "cowrie", "dionaea", "scanning", "Telnet", "scan", "tcp", "webscanner, bruteforce, web app attack", "Malicious IP", "SSH", "blacklist", "notice", "info", "honeytrap", "mirai", "scanner", "brute-force", "probing", "webscan"], "pulses": ["Webscanners 2018-02-09  thru current day", "Webscanners with Bad Requests - HTTP Status 400 - 1/20/2018 thru current day", "Ka's Honeypot visitors", "Ghosty", "Ghosty", "Ghosty", "LCIA HoneyNet Data - September 2025 - Honeytrap", "Scan port 8080 HTTP and proxy (S3#)", "LCIA HoneyNet Data - July 2025 - Cowrie", "Malware Filter - Botnet List - 30-07-2025", "2025-07-26 Fail2Ban 8d56a06d-0697-423c-90d9-126758a92bd8", "2025-07-23 Fail2Ban 0585114f-33a5-4847-a498-a5e55ca01408", "SSH brute force 20250715", "Malware Filter - Botnet List - 15-07-2025", "Honeypot Data - July 2025 - Cowrie", "Scan port 23 Telnet (S3#)", "SSH Brute-Force IPs from fail2ban 2025-07-24", "LCIA HoneyNet Data - June 2025 - Cowrie", "Scan port 23 Telnet (S3#)", "Scan port 23 Telnet (S3#)"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 87.121.84.38
source: otx
validated_at: 2026-05-24T00:20:45.892204
raw_response:
  {"pulse_count": 18, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.84.38", "tags": ["sentrypeer", "sftp", "Skype", "email", "tanner", "LAMP", "honeypot", "sip", "ipphoney", "mailoney", "cisco", "botnet", "ssh", "heralding", "fatt", "Automated", "2026-02", "p0f", "OpenCTI", "suricata", "sensor-tagged", "conpot", "bruteforce", "malicious", "cowrie", "dionaea", "HoneyPot", "scan", "tcp", "tpot", "Malicious IP", "blacklist", "Redishoneypot", "honeytrap", "elasticpot", "mirai", "2026-01"], "pulses": ["Honeypot Data \u2013 T-Pot - Sydney, Australia - February 2026", "LCIA HoneyNet Data - February 2026 - Honeytrap", "Honeypot Data - February 2026 - Honeytrap", "OpenCTI_Export_2026-02", "Honeypot Data \u2013 T-Pot - Sydney, Australia - January 2026", "Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 January 2026", "LCIA HoneyNet Data - January 2026 - Dionaea", "Honeypot Data - January 2026 - Honeytrap", "Honeypot Data - January 2026 - Tanner", "LCIA HoneyNet Data - January 2026 - Honeytrap", "OpenCTI_Export_2026-01", "LCIA HoneyNet Data - January 2026 - Tanner", "LCIA HoneyNet Data - January 2026 - Honeytrap", "Honeypot Data - January 2026 - Dionaea", "Honeypot Data - January 2026 - Tanner", "Malware Filter - Botnet List - 11-01-2026 (Part 4)", "Scan port 81 Skype (S3#)", "DecisionIP - 2500 Most actives IP on HoneyPots"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 87.121.84.47
source: otx
validated_at: 2026-05-24T00:20:48.856246
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.84.47", "tags": ["dionaea", "fatt", "sentrypeer", "honeytrap", "vulnerability-exploitation", "portscan", "p0f", "tanner", "digital ocean", "honeypot", "vultr", "suricata", "mailoney", "sensor-tagged", "exploit", "scanners", "tpot", "cowrie"], "pulses": ["Honeypot Data \u2013 T-Pot - Sydney, Australia - April 2026", "DigitalOcean London (UK) Port Scanning Hosts for 2026-04-06", "DigitalOcean Toronto (CA) Port Scanning Hosts for 2026-04-06", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-04-06", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-04-06", "Malware Filter - Botnet List - 06-04-2026 (Part 16)", "TSEC Honeypot: Exploit Attempt - Week of 2026-03-30", "DigitalOcean London (UK) Port Scanning Hosts for 2026-04-04", "DigitalOcean Singapore Port Scanning Hosts for 2026-04-04", "DigitalOcean Toronto (CA) Port Scanning Hosts for 2026-04-04", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-04-04", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-04-04", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-04-03", "Honeypot Data \u2013 T-Pot - Sydney, Australia - March 2026", "DigitalOcean London (UK) Port Scanning Hosts for 2026-03-31", "DigitalOcean Singapore Port Scanning Hosts for 2026-03-31", "DigitalOcean Toronto (CA) Port Scanning Hosts for 2026-03-31", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-03-31", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-03-31", "DigitalOcean London (UK) Port Scanning Hosts for 2026-03-30"], "malware_count": 10, "passive_dns_count": 4, "malware_samples": ["cba59bc1a57d72d452467fe9c92f9849211f081e66ac6c36d99c8e095eead60f", "1bb935b82759b360be241e1fbd0083889b8d1716bba650f4c786a98f4b6e50c0", "58c19ff70d5aa42de12550893b06726298e7e0f6e28364a4eb81590bb6699ad3", "8a4751a9340ea9d1293dadf7f6629879c2092d412790589b36b1807f6dfc294c", "2e272518326fa042d251231


ioc_type: ipv4
ioc_value: 87.121.84.83
source: otx
validated_at: 2026-05-24T00:20:51.563261
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.84.83", "tags": ["dionaea", "fatt", "mirai internet", "things", "sentrypeer", "honeytrap", "mirai", "ddos", "p0f", "tanner", "honeypot", "suricata", "mailoney", "sensor-tagged", "tpot", "cowrie"], "pulses": ["Honeypot Data \u2013 T-Pot - Sydney, Australia - March 2026", "\u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0431\u043e\u0442\u043d\u0435\u0442\u0430 Mirai (\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430 04.08.2025)", "Malware Filter - Botnet List - 04-08-2025"], "malware_count": 9, "passive_dns_count": 0, "malware_samples": ["366247e31aaac77f1c940c72db6623ade6c9826897efe9f93af1687296027882", "5a1e66bec23f8f935aab9fe3c0c428dd06fc23df3af6c844b3c84095a1f834d1", "ba8aca08138c86556e181b21774110aed20ee327e6584231f9e9859b4630973f", "9a76440735bf18a6a2fec1d42b7c743b931176a15fe5144a29bc530acbf86835", "cd8e0cf73181c23d645f3304f587aca639306a240f08a860268e3886a40a47ec", "d91ca295e8e1aa55d149750dd1b20f200f85b9e071fad1464ee7e927521bb36c", "aee83545d99a8c09ee085c1bcfe0af63fbe1878506d24157bf4c5874573b632d", "b2b0b370dc9c94c0ce1483f59178f88b7f38bab6e80829d1d57c4b55ab7dea13", "a05e249f3d481e7d22bffc3cb020663270ccdce45c7004e8c714aa1f680cc4fa"], "passive_dns": []}


ioc_type: ipv4
ioc_value: 87.121.84.89
source: otx
validated_at: 2026-05-24T00:21:27.186026
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.84.89", "tags": ["linux", "toggle", "mirai", "sha256", "sha1", "combinations", "compromise ipv4", "ipv4 port"], "pulses": ["[GS-614] Mirai Botnet IOCs - SEC-1275-1"], "malware_count": 6, "passive_dns_count": 0, "malware_samples": ["04da036d9f905136a296f5cc6cc180706372a08ac7c51b22767f83c1b406b568", "c334b5b948d49dd4a4771ff42806c58e40c768920b610d1c1ee2af425b7bb447", "f85ef135a79db3b0140941669eb3c24b29adcded1f4ac96ed4bb725e49b1b2cf", "56c326a226c871f94985045848c0a757e29a28fa20b1603e2be03de7621c889d", "be74c1f7c5796666ec06cec8b78e2e3476e217466beff6ed59cb8fe368404ff6", "1066d614d78166b268bb1be3959b8b248601f75c9c2dee02f2b654fbfbdf9e4a"]}


ioc_type: ipv4
ioc_value: 87.121.84.62
source: otx
validated_at: 2026-05-24T00:21:32.031667
raw_response:
  {"pulse_count": 6, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.84.62", "tags": ["web", "scanner", "automated", "honeypot", "attacker-ip", "voidtrap", "cloudflare"], "pulses": ["Cloudflare Honeypot Web Attack Hosts for 2026-04-17", "Cloudflare Honeypot Web Attack Hosts for 2026-04-13", "Cloudflare Honeypot Web Attack Hosts for 2026-04-05", "Cloudflare Honeypot Web Attack Hosts for 2026-04-02", "VoidTrap Live Threat Feed \u2014 2026-03-31", "Cloudflare Honeypot Web Attack Hosts for 2026-03-28"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["www.sendtuna.com", "zabbix-license.com"]}


ioc_type: ipv4
ioc_value: 87.121.84.8
source: otx
validated_at: 2026-05-24T00:21:36.721244
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.84.8", "tags": ["sentrypeer", "portscan", "tanner", "honeypot", "vultr", "digital ocean", "mailoney", "exploit", "scanners", "fatt", "p0f", "suricata", "sensor-tagged", "bruteforce", "cowrie", "dionaea", "tpot", "honeytrap", "vulnerability-exploitation"], "pulses": ["Honeypot Data \u2013 T-Pot - Sydney, Australia - April 2026", "Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 April 2026", "Honeypot Data \u2013 T-Pot - Sydney, Australia - May 2026", "Vultr Paris (France) Port Scanning Hosts for 2026-04-14", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-04-14", "DigitalOcean London (UK) Port Scanning Hosts for 2026-04-13", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-04-13", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-04-13", "Vultr Paris (France) Port Scanning Hosts for 2026-04-13", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-04-12", "Vultr Paris (France) Port Scanning Hosts for 2026-04-12", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-04-12", "DigitalOcean London (UK) Port Scanning Hosts for 2026-04-12", "TSEC Honeypot: Exploit Attempt - Week of 2026-04-06", "Vultr Paris (France) Port Scanning Hosts for 2026-04-11", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-04-11", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-04-11", "DigitalOcean Toronto (CA) Port Scanning Hosts for 2026-04-11", "DigitalOcean London (UK) Port Scanning Hosts for 2026-04-11", "Vultr Paris (France) Port Scanning Hosts for 2026-04-10"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.69.107
source: otx
validated_at: 2026-05-24T00:22:45.161366
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.107", "tags": ["ldap", "sftp", "sentrypeer", "email", "tanner", "LAMP", "sip", "Bruteforce", "ipphoney", "honeypot", "vnc", "mailoney", "cisco", "botnet", "heralding", "api key", "ssh", "join", "mssql", "Adbhoney", "smb", "oracle", "Brute-Force", "Honeypot", "telnet", "imap", "memcache", "qhoneypot", "ntp", "conpot", "elasticsearch", "graph summary", "malicious", "cowrie", "community", "dionaea", "value a", "first", "ftp", "postgres", "default company", "redis", "scan", "tcp", "dhcp", "SSH", "blacklist", "Malicious IP", "notice", "info"], "pulses": ["SSH Brute-Force Honeypot Live", "Fast Flux Network - Active C2", "Fast Flux Network - Active C2", "LCIA HoneyNet Data - November 2025 - Heralding", "LCIA HoneyNet Data - November 2025 - Honeytrap", "Insulin honeypots - 2025-11-04", "Scan port 8080 HTTP and proxy (S3#)", "Insulin honeypots - 2025-11-03", "LCIA HoneyNet Data - October 2025 - Honeytrap", "Scan port 8080 HTTP and proxy (S3#)", "2025-10-26 Fail2Ban ef35a6b7-843a-4c8b-8a1b-47593ef1af57", "Insulin honeypots - 2025-10-20", "Insulin honeypots - 2025-10-19", "Scan port 8080 HTTP and proxy (S3#)", "Insulin honeypots - 2025-10-12", "Insulin honeypots - 2025-10-11", "SSH Brute-Force IPs from fail2ban 2025-11-03", "Scan port 8080 HTTP and proxy (S3#)", "Insulin honeypots - 2025-10-06", "Insulin honeypots - 2025-10-05"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 196.251.69.126
source: otx
validated_at: 2026-05-24T00:24:44.036232
raw_response:
  {"pulse_count": 17, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.126", "tags": ["count", "Brute force", "SSL VPN"], "pulses": ["SSL VPN brute force attempts [150525]", "SSL VPN brute force attempts [140525]", "SSL VPN brute force attempts [130525]", "SSL VPN brute force attempts [120525]", "SSL VPN brute force attempts [120525]", "SSL VPN brute force attempts [090525]", "SSL VPN brute force attempts [080525]", "SSL VPN brute force attempts [070525]", "SSL VPN brute force attempts [060525]", "SSL VPN brute force attempts [180425]", "SSL VPN brute force attempts [170425]", "SSL VPN brute force attempts [110425]", "SSL VPN brute force attempts [100425]", "SSL VPN brute force attempts [090425]", "SSL VPN brute force attempts [080425]", "SSL VPN brute force attempts [070425]", "SSL VPN brute force attempts [030425]"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 196.251.69.130
source: otx
validated_at: 2026-05-24T00:25:31.649842
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.130", "tags": [], "pulses": ["\"AS401120 cheapy_host LLC\" clone credit skocherhan", "AS401120 cheapy_host LLC"], "malware_count": 0, "passive_dns_count": 30, "malware_samples": [], "passive_dns": ["6ayfaizcaliber.xyz", "6-ay-faizim.xyz", "6ayfaizspanning.xyz", "6ayfaizspan.xyz", "6ayfaizcalibration.xyz", "6-ay-faizsizs.xyz", "6aywaissiz.xyz", "6ayfaizresize.xyz", "6aypfizersiz.xyz", "6ayfaizcalibre.xyz", "6ayfaizcassette.xyz", "6-ay-faizim.fun", "ether-scan.xyz", "ertelemeli-faizsiz.xyz", "faizsiz-ertelemeli.xyz", "faizsiz-6-ay.xyz", "6-ay-faizsiz.xyz", "2025-ertelemeli-0-faiz.xyz", "0-faizsiz-ertelemeli.xyz", "0-faiz-ertelemeli.xyz"]}


ioc_type: ipv4
ioc_value: 196.251.69.157
source: otx
validated_at: 2026-05-24T00:28:17.381021
raw_response:
  {"pulse_count": 41, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.157", "tags": ["ldap", "sftp", "LAMP", "honeypot", "Bruteforce", "vnc", "nxdomain", "botnet", "cisco", "ssh", "api key", "us abuse", "join", "mssql", "oracle", "smb", "columns", "Brute-Force", "Honeypot", "china mobile", "telnet", "imap", "memcache", "block list", "qhoneypot", "ntp", "timeout", "elasticsearch", "company limited", "graph summary", "malicious", "cowrie", "community", "hk abusehandler", "hurricane us", "unknown", "value a", "first", "ftp", "hong kong", "postgres", "default company", "redis", "scan", "tcp", "dhcp", "network", "SSH", "Malicious IP", "blacklist"], "pulses": ["SSH Brute-Force Honeypot Live", "Fast Flux Network - Active C2", "Fast Flux Network - Active C2", "LCIA HoneyNet Data - November 2025 - Honeytrap", "Scan port 8080 HTTP and proxy (S3#)", "LCIA HoneyNet Data - October 2025 - Honeytrap", "Scan port 8080 HTTP and proxy (S3#)", "Scan port 8080 HTTP and proxy (S3#)", "Insulin honeypots - 2025-10-19", "Insulin honeypots - 2025-10-18", "Scan port 8080 HTTP and proxy (S3#)", "SSH Brute-Force IPs from fail2ban 2025-11-02", "Scan port 8080 HTTP and proxy (S3#)", "SSH Brute-Force IPs from fail2ban 2025-10-29", "LCIA HoneyNet Data - August 2025 - Honeytrap", "DShield Public Data Feed - 2025-08-30", "Scan port 8080 HTTP and proxy (S3#)", "2025-08-26 Fail2Ban 6969d76d-02b5-47be-8a5f-346a46967d6c", "DShield Public Data Feed - 2025-08-25", "DShield Public Data Feed - 2025-08-24"], "malware_count": 0, "passive_dns_count": 1, "passive_dns": ["block.mmms.eu"]}


ioc_type: ipv4
ioc_value: 196.251.69.164
source: otx
validated_at: 2026-05-24T00:28:26.038876
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.164", "tags": ["sftp", "LAMP", "honeypot", "risk", "cisco", "botnet", "ssh", "xamzexpires300", "active", "telnet", "tags", "malicious", "cowrie", "last seen", "first seen", "scan", "tcp", "type", "Malicious IP", "blacklist", "confidence", "honeytrap", "mirai", "status"], "pulses": ["LCIA HoneyNet Data - October 2025 - Cowrie", "444444444444444", "Malware Filter - Botnet List - 15-10-2025", "Scan port 23 Telnet (S3#)"], "malware_count": 6, "passive_dns_count": 1, "malware_samples": ["b0b201eb30e2cf51fdd32d1db26893678c4a67fa356a6ec60e191878d63ee60f", "b53589f9d2eac13f34b7ec2f5b3164b0182a9bf32be7b3d3640fdc6a55fa49b1", "9ccfb22cb15c55a87156cdf1ca5d3778be5c7a0579deef43d770be842e772ae5", "f54e6bbc192e6ec9eff9a71f70e9d6937b35c233c5eb9cc7e52edc7d37364f29", "dcd8f8af3d9aae2aba2762b589c1ab1d40edc660e181a95f28f60ddaee0f2385", "b8b98284f473a57520dc50255838af3ef0e1b8c6e80f089167b00c63a739e1be"], "passive_dns": ["highzshell.com"]}


ioc_type: ipv4
ioc_value: 196.251.69.18
source: otx
validated_at: 2026-05-24T00:29:02.050933
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.18", "tags": ["ldap", "sftp", "sentrypeer", "email", "tanner", "LAMP", "sip", "Bruteforce", "ipphoney", "honeypot", "vnc", "mailoney", "cisco", "botnet", "heralding", "api key", "ssh", "Crawler", "join", "webscanner", "Adbhoney", "smb", "oracle", "mssql", "Brute-Force", "Honeypot", "telnet", "imap", "memcache", "web app attack", "qhoneypot", "ntp", "conpot", "elasticsearch", "badrequest", "graph summary", "bruteforce", "malicious", "community", "cowrie", "dionaea", "scanning", "value a", "first", "ftp", "postgres", "default company", "redis", "scan", "webscanner, bruteforce, web app attack"], "pulses": ["SSH Brute-Force Honeypot Live", "Webscanners 2018-02-09  thru current day", "Webscanners with Bad Requests - HTTP Status 400 - 1/20/2018 thru current day", "Webscanners IPs 2024-04-08 thru current day", "Fast Flux Network - Active C2", "Fast Flux Network - Active C2", "Ghosty", "Ghosty", "Ghosty", "LCIA HoneyNet Data - November 2025 - Heralding", "LCIA HoneyNet Data - November 2025 - Honeytrap", "SSH & Telnet \u2192 Attacker IPs \u2013 Australia \u2013 November 2025", "Insulin honeypots - 2025-11-06", "Insulin honeypots - 2025-11-05", "LCIA HoneyNet Data - October 2025 - Honeytrap", "Scan port 8080 HTTP and proxy (S3#)", "Insulin honeypots - 2025-10-26", "2025-10-26 Fail2Ban ef35a6b7-843a-4c8b-8a1b-47593ef1af57", "Insulin honeypots - 2025-10-25", "Insulin honeypots - 2025-10-08"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["block.mmms.eu"]}


ioc_type: ipv4
ioc_value: 196.251.69.197
source: otx
validated_at: 2026-05-24T00:29:44.375339
raw_response:
  {"pulse_count": 13, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.197", "tags": ["blacklist", "scanning", "uk", "mirai", "web service", "tcp", "command and control", "web app attack", "webscan", "Crawler", "honeypot", "mdatp command", "botnet", "webscanner, bruteforce, web app attack", "probing", "scan", "Malicious IP", "webscanner"], "pulses": ["Webscanners 2018-02-09  thru current day", "Webscanners IPs 2024-04-08 thru current day", "Ghosty", "Ghosty", "Ghosty", "webscanners_pules", "webscanners_pules", "webscanners_pules", "webscanners_pules", "webscanners_pules", "Command and Control - March", "Scan port 8080 HTTP and proxy (S3#)", "Scan port 8080 HTTP and proxy (S3#)"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["alfaacclal.it", "irco-si.com"]}


ioc_type: ipv4
ioc_value: 87.121.84.86
source: otx
validated_at: 2026-05-24T06:01:35.325821
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Burgas", "asn": "AS34577 skat tv ltd.", "indicator": "87.121.84.86", "tags": ["suricata", "honeytrap", "tanner", "digital ocean", "p0f", "vultr", "honeypot", "cowrie", "tpot", "mailoney", "dionaea", "attacker-ip", "vulnerability-exploitation", "sentrypeer", "automated", "sensor-tagged", "voidtrap", "fatt", "exploit", "portscan", "scanner", "scanners"], "pulses": ["Honeypot Data \u2013 T-Pot - Sydney, Australia - May 2026", "Honeypot Data \u2013 T-Pot - Sydney, Australia - April 2026", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-05-19", "Vultr Paris (France) Port Scanning Hosts for 2026-05-19", "Vultr Paris (France) Port Scanning Hosts for 2026-05-16", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-05-13", "VoidTrap Live Threat Feed \u2014 2026-05-13", "DigitalOcean Toronto (CA) Port Scanning Hosts for 2026-05-09", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-05-09", "DigitalOcean Toronto (CA) Port Scanning Hosts for 2026-05-08", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-05-08", "DigitalOcean Toronto (CA) Port Scanning Hosts for 2026-05-06", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-05-06", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-05-06", "Vultr Paris (France) Port Scanning Hosts for 2026-05-06", "DigitalOcean Toronto (CA) Port Scanning Hosts for 2026-05-03", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-05-03", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-05-03", "Vultr Paris (France) Port Scanning Hosts for 2026-05-03", "TSEC Honeypot: Exploit Attempt - Week of 2026-04-27"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.69.154
source: otx
validated_at: 2026-05-24T06:01:41.716187
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.154", "tags": ["Amadey", "sh", "opendir", "ClickFix", "defacement", "mirai", "GREED", "sshdkit", "stego", "bitbucket", "hajime", "base64", "censys", "botnetdomain", "booking", "Ransomware", "RemcosRAT", "sha256", "backdoor", "ua-wget", "exe", "apk", "xml-opendir", "AsyncRAT", "QuasarRAT", "LummaStealer", "CoinMiner", "ClearFake", "ddos", "xenorat", "Triada", "shellcode", "hta", "5637", "github", "linux", "miner", "toggle", "jpg-base64-loader", "fbi.gov", "php", "Mozi", "WsgiDAV", "njRAT", "pw-5637", "RedLineStealer", "moobot", "infostealer", "sha1", "vbscript"], "pulses": ["[GS-611] Mirai Botnet IOCs - SEC-1275-1", "URLHaus data - 15-02-2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.69.205
source: otx
validated_at: 2026-05-24T12:01:11.045416
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.205", "tags": ["graph summary", "heralding", "join", "sftp", "dionaea", "mirai", "default company", "ftp", "ldap", "cisco", "tcp", "scan", "Bruteforce", "telnet", "whois lookups", "tpot", "SSH", "elasticsearch", "Honeypot", "bruteforce", "dhcp", "community", "blacklist", "memcache", "postgres", "api key", "smb", "oracle", "socks5", "Malicious IP", "honeypot", "qhoneypot", "malicious", "snmp", "botnet", "ntp", "LAMP", "mssql", "imap", "Brute-Force", "first", "value a", "ssh", "redis", "vnc", "cowrie", "honeytrap"], "pulses": ["SSH Brute-Force Honeypot Live", "\"AS401120 cheapy_host LLC\" clone credit skocherhan", "Fast Flux Network - Active C2", "Fast Flux Network - Active C2", "AS401120 cheapy_host LLC", "LCIA HoneyNet Data - November 2025 - Honeytrap", "SSH & Telnet \u2192 Attacker IPs \u2013 Australia \u2013 November 2025", "Dionaea \u2192 Attacker IPs \u2013 Australia \u2013 November 2025", "Scan port 8080 HTTP and proxy (S3#)", "LCIA HoneyNet Data - October 2025 - Honeytrap", "Scan port 8080 HTTP and proxy (S3#)", "Insulin honeypots - 2025-10-29", "2025-10-29 Fail2Ban aa7f60fd-2118-4668-b86c-a48aa1045abd", "Insulin honeypots - 2025-10-28", "Insulin honeypots - 2025-10-27", "2025-10-26 Fail2Ban ef35a6b7-843a-4c8b-8a1b-47593ef1af57", "Insulin honeypots - 2025-10-23", "Insulin honeypots - 2025-10-22", "Scan port 8080 HTTP and proxy (S3#)", "Insulin honeypots - 2025-10-17"], "malware_count": 0, "passive_dns_count": 13, "malware_samples": [], "passive_dns": ["block.mmms.eu", "fokpg.xyz", "pppsw.sbs", "ccxbq.sbs", "hugone.sbs", "kcones.sbs", "kccone.cfd", "kctwo.cfd", "kconeph.cfd", "bgulin.cfd", "kkcone.cfd", "kcone.art", "kcone.world"]}


ioc_type: ipv4
ioc_value: 196.251.69.234
source: otx
validated_at: 2026-05-24T12:02:31.386591
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.234", "tags": ["", "Remcos", "Pegasus", "ransomware", "malware", "Deimos", "CobaltStrike", "Qakbot", "Brute_Ratel_C4", "Sliver", "Mythic", "Supershell", "Havoc", "NetSupportRAT", "Interactsh", "C2", "Hookbot", "AsyncRAT", "Bianlian"], "pulses": ["ThreatFix", "Malware Filter - Botnet List - 17-09-2025", "Twitter Feed - drb_ra - 07-05-2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.69.241
source: otx
validated_at: 2026-05-24T12:02:50.609544
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.241", "tags": ["things", "mirai internet", "ddos", "mirai"], "pulses": ["\u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0431\u043e\u0442\u043d\u0435\u0442\u0430 Mirai (\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430 22.07.2025)", "\u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0431\u043e\u0442\u043d\u0435\u0442\u0430 Mirai (\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430 15.07.2025)", "\u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0431\u043e\u0442\u043d\u0435\u0442\u0430 Mirai (\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430 14.07.2025)"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 196.251.69.244
source: otx
validated_at: 2026-05-24T12:02:54.555913
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.244", "tags": ["things", "mirai internet", "ddos", "mirai"], "pulses": ["\u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0431\u043e\u0442\u043d\u0435\u0442\u0430 Mirai (\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430 22.07.2025)", "\u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0431\u043e\u0442\u043d\u0435\u0442\u0430 Mirai (\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430 15.07.2025)", "\u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0431\u043e\u0442\u043d\u0435\u0442\u0430 Mirai (\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430 14.07.2025)", "Threatfox Recent Additions"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["c1dd9f06c74fcb6f5e3fd75e7d1ce6bfe999791ab430a0b791139ae4b54b15f5"], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.69.253
source: otx
validated_at: 2026-05-24T12:03:32.342317
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.253", "tags": ["", "Remcos", "Pegasus", "ransomware", "malware", "Deimos", "CobaltStrike", "Qakbot", "Hak5_Cloud_C2", "Sliver", "Mythic", "Supershell", "Havoc", "Covenant", "Reverse_SSH", "NetSupportRAT", "Interactsh", "C2", "Hookbot", "AsyncRAT"], "pulses": ["ThreatFix", "Twitter Feed - drb_ra - 25-09-2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 196.251.69.35
source: otx
validated_at: 2026-05-24T12:04:11.907373
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.35", "tags": ["bangladesh", "france", "malware", "snakekeylogger", "ransomhub", "mexico", "date", "remcos", "clearfake", "united kingdom", "singapore", "masslogger", "germany", "mozi", "pink", "china", "agent tesla", "turkey", "ukraine", "panama", "mozi link", "asyncrat", "indonesia", "cobaltstrike"], "pulses": ["Malicious IP Addresses", "Threat Intel Report - W12-2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 196.251.69.42
source: otx
validated_at: 2026-05-24T12:04:17.374393
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.42", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 61, "malware_samples": [], "passive_dns": ["gobestachat.cc", "estafefatchat.cc", "mexestafeta7.cc", "mxestafetal.cc", "estafelatchat.cc", "estafetaqw.cc", "mxcgestafeta.cc", "mxoestafeta.cc", "mxestafetaj.cc", "mxestafetam.cc", "mexestafeta6.cc", "mexestafeta1.cc", "estafetaq.cc", "mxestafetak.cc", "mexestafeta9.cc", "mxestafetav.cc", "mxqestafeta.cc", "mxestafetai.cc", "mxwestafeta.cc", "mexestafeta2.cc"]}


ioc_type: ipv4
ioc_value: 196.251.69.57
source: otx
validated_at: 2026-05-24T12:04:37.523180
raw_response:
  {"pulse_count": 20, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.57", "tags": ["notice", "us abuse", "network", "hurricane us", "01.10.2025", "us none", "tcp", "scan", "brute-force", "Bruteforce", "info", "2025", "SSH", "bruteforce", "pgp sign", "sip", "unknown", "china mobile", "hong kong", "nxdomain", "company limited", "timeout", "columns", "sipvicious", "hk abusehandler", "block list", "Brute-Force", "HoneyNet Connect", "ssh", "RimbaSiber, ssh, scanners, honeypot"], "pulses": ["Automated Threat Intelligence - Scanning hosts for 2025-08-27", "HoneyPot Connect 01.10.2025", "2025-09-01 Fail2Ban 763c53d4-a9a6-40eb-a588-6ead9727e27d", "2025-09-01 Fail2Ban 9af5e0b1-8a90-4d71-851b-73c5182d4d76", "DShield Public Data Feed - 2025-08-30", "2025-08-29 Fail2Ban c10dc105-54d1-4d8d-83c9-b321c050adc8", "DShield Public Data Feed - 2025-08-25", "DShield Public Data Feed - 2025-08-24", "2025-08-22 Fail2Ban 6cf93f2a-ec3c-4e69-94ce-b551c2fa92ed", "2025-08-22 Fail2Ban a0d032de-2e67-40e5-b22f-60ba32b31048", "2025-08-19 Fail2Ban 8ec54eda-7d30-46ae-ae7b-8812b1e99384", "2025-08-19 Fail2Ban b27aa2e8-2a85-420d-988a-49b1ceca7926", "SSH brute force 20250807", "2025-08-07 Fail2Ban 797d8309-a952-4b2f-ac4e-63f45ac6b437", "2025-08-07 Fail2Ban 646f433a-9e47-44df-9d60-554d7b4bdbff", "Rimba Siber (Malaysia) SSH Attacker Hosts for 2025-08-07", "Malware Filter - Botnet List - 04-08-2025", "Rimba Siber (Malaysia) SSH Attacker Hosts for 2025-08-03", "SSH Brute-Force IPs from fail2ban 2025-08-14", "SSH Brute-Force IPs from fail2ban 2025-08-11"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 196.251.69.67
source: otx
validated_at: 2026-05-24T12:04:58.533944
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.67", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 8, "malware_samples": [], "passive_dns": ["ftp.1v0gfa6z0qycr6.dynv6.net", "1v0gfa6z0qycr6.dynv6.net", "89e4d9775c9135a69c3e7da17c2a8b38.ignorelist.com", "1ktrycprryrmyjaurrk3jjetxhk3qwyql1.ip-ddns.com", "ftp.dksgyfec986d16ccc20c05de9d7f2.abrdns.com", "04e4a306dbe9ae5dec6bb4e670e5fa09.abrdns.com", "1g9qmu4bs2770vf3z5cqisgr9j0g.abrdns.com", "e1j6o817uzlqds2cyxgepjpnvujf.ip-ddns.com"]}


ioc_type: ipv4
ioc_value: 196.251.69.72
source: otx
validated_at: 2026-05-24T12:05:01.048194
raw_response:
  {"pulse_count": 14, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.72", "tags": ["us abuse", "network", "hurricane us", "sftp", "dionaea", "01.10.2025", "us none", "cisco", "scan", "2025", "pgp sign", "sip", "unknown", "china mobile", "hong kong", "nxdomain", "malicious", "company limited", "LAMP", "timeout", "columns", "sipvicious", "hk abusehandler", "block list", "HoneyNet Connect", "ssh", "cowrie", "honeytrap"], "pulses": ["LCIA HoneyNet Data - November 2025 - Honeytrap", "LCIA HoneyNet Data - October 2025 - Honeytrap", "HoneyPot Connect 01.10.2025", "LCIA HoneyNet Data - September 2025 - Honeytrap", "LCIA HoneyNet Data - September 2025 - Honeytrap", "LCIA HoneyNet Data - September 2025 - Honeytrap", "Automated Threat Intelligence - Scanning hosts for 2025-07-28", "LCIA HoneyNet Data - September 2025 - Honeytrap", "LCIA HoneyNet Data - September 2025 - Honeytrap", "LCIA HoneyNet Data - September 2025 - Honeytrap", "Malware Filter - Botnet List - 06-09-2025", "LCIA HoneyNet Data - August 2025 - Honeytrap", "DShield Public Data Feed - 2025-08-30", "DShield Public Data Feed - 2025-08-24"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.69.75
source: otx
validated_at: 2026-05-24T12:05:20.772581
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.75", "tags": ["sentrypeer", "dcrat", "CoinMiner", "tanner", "sftp", "dionaea", "mirai", "email", "sshdkit", "dropper", "Amadey", "CobaltStrike", "cisco", "elf", "ClickFix", "booking", "GuLoader", "FakeCaptcha", "lnk", "Encoded", "ua-wget", "dropped-by-amadey", "sip", "ascii", "opendir", "c2-monitor-auto", "github", "xworm", "VIPKeylogger", "censys", "malicious", "sh", "LummaStealer", "LAMP", "exe", "hajime", "encrypted", "backdoor", "connectwise", "ssh", "AsyncRAT", "WsgiDAV", "cowrie", "honeytrap", "mailoney", "botnetdomain"], "pulses": ["LCIA HoneyNet Data - August 2025 - Tanner", "Malware Filter - Botnet List - 28-06-2025", "URLHaus data - 26-06-2025"], "malware_count": 2, "passive_dns_count": 2, "malware_samples": ["fafbf9e3465879773359ed35f6bd8252dbce5ac37f48beabdaaca81c7b718d4a", "2a12b76e0d03b0d7fbb62ef488eaaea1218d6d4ebdd6717f483d27c75cbe005b"], "passive_dns": ["www.onyxconnect.online", "onyxconnect.online"]}


ioc_type: ipv4
ioc_value: 196.251.69.84
source: otx
validated_at: 2026-05-24T12:05:23.455946
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.84", "tags": [], "pulses": ["\"AS401120 cheapy_host LLC\" clone credit skocherhan", "AS401120 cheapy_host LLC"], "malware_count": 0, "passive_dns_count": 15, "malware_samples": [], "passive_dns": ["www.onwin.girisbilgisi2025.com", "onwin.girisbilgisi2025.com", "www.sahabet.girisbilgisi2025.com", "sahabet.girisbilgisi2025.com", "grandpashabet.girisbilgisi2025.com", "www.pusulabet.girisbilgisi2025.com", "pusulabet.girisbilgisi2025.com", "pusulabeet990.com", "marsbahis1358.com", "casibom.girisbilgisi2025.com", "girisbilgisi2025.com", "jamaicapost.vip", "jmpost.top", "entell.net", "ccss.one"]}


ioc_type: ipv4
ioc_value: 196.251.69.97
source: otx
validated_at: 2026-05-24T12:05:51.768489
raw_response:
  {"pulse_count": 28, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.97", "tags": ["notice", "us abuse", "network", "heralding", "hurricane us", "dionaea", "mirai", "ftp", "01.10.2025", "ldap", "us none", "cisco", "tcp", "scan", "Bruteforce", "telnet", "info", "tpot", "2025", "SSH", "elasticsearch", "Honeypot", "bruteforce", "dhcp", "pgp sign", "blacklist", "sip", "memcache", "postgres", "unknown", "smb", "china mobile", "hong kong", "oracle", "vultr", "nxdomain", "scanners", "socks5", "Malicious IP", "honeypot", "qhoneypot", "malicious", "snmp", "company limited", "botnet", "ntp", "LAMP", "mssql", "timeout", "imap"], "pulses": ["SSH Brute-Force Honeypot Live", "\"AS401120 cheapy_host LLC\" clone credit skocherhan", "AS401120 cheapy_host LLC", "SSH & Telnet \u2192 Attacker IPs \u2013 Australia \u2013 November 2025", "LCIA HoneyNet Data - October 2025 - Honeytrap", "Scan port 8080 HTTP and proxy (S3#)", "2025-10-26 Fail2Ban ef35a6b7-843a-4c8b-8a1b-47593ef1af57", "Insulin honeypots - 2025-10-10", "Scan port 8080 HTTP and proxy (S3#)", "Insulin honeypots - 2025-10-09", "HoneyPot Connect 01.10.2025", "SSH Brute-Force IPs from fail2ban 2025-10-17", "Vultr Paris (France) SSH Attacker Hosts for 2025-09-21", "Scan port 8080 HTTP and proxy (S3#)", "Scan port 8080 HTTP and proxy (S3#)", "LCIA HoneyNet Data - August 2025 - Honeytrap", "DShield Public Data Feed - 2025-08-30", "Automated Threat Intelligence - Scanning hosts for 2025-07-01", "DShield Public Data Feed - 2025-08-24", "LCIA HoneyNet Data - July 2025 - Honeytrap"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 196.251.70.101
source: otx
validated_at: 2026-05-24T12:05:54.109656
raw_response:
  {"pulse_count": 6, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.101", "tags": ["01.10.2025", "LAMP", "cisco", "2025", "heralding", "HoneyNet Connect", "ssh", "sftp", "cowrie", "honeytrap", "malicious"], "pulses": ["LCIA HoneyNet Data - October 2025 - Honeytrap", "HoneyPot Connect 01.10.2025", "LCIA HoneyNet Data - September 2025 - Honeytrap", "LCIA HoneyNet Data - September 2025 - Honeytrap", "LCIA HoneyNet Data - September 2025 - Honeytrap", "LCIA HoneyNet Data - September 2025 - Honeytrap"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["amzaon.us"]}


ioc_type: ipv4
ioc_value: 196.251.70.121
source: otx
validated_at: 2026-05-24T12:06:28.852882
raw_response:
  {"pulse_count": 8, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.121", "tags": ["honeypot", "LAMP", "heralding", "ssh", "dionaea", "sftp", "cowrie", "RDP", "honeytrap", "malicious"], "pulses": ["LCIA HoneyNet Data - August 2025 - Honeytrap", "Malware Filter - Botnet List - 14-08-2025", "LCIA HoneyNet Data - July 2025 - Honeytrap", "RDP honeypot logs for 2025/07/14", "Malware Filter - Botnet List - 13-07-2025", "Malware Filter - Botnet List | 13/07/2025 { by CyberHunterAutoFeed", "LCIA HoneyNet Data - June 2025 - Honeytrap", "RDP honeypot logs for 2025/06/30"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.70.161
source: otx
validated_at: 2026-05-24T12:06:54.277249
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.161", "tags": ["abuse", "ipqs", "ipqualityscore", "fraud", "SSH", "RDP", "web attack", "honeypot", "bruteforce"], "pulses": ["IPQS Abusive IP List", "MALICIOUS IP IPQS", "MALICIOUS IP IPQS", "IP Addresses Logged by the Rosethorn PotNet"], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["esplugboxsend.info", "dsq-accountadf.ipv64.de", "kysn.in", "zoevip.in"]}


ioc_type: ipv4
ioc_value: 196.251.70.166
source: otx
validated_at: 2026-05-24T12:07:07.573316
raw_response:
  {"pulse_count": 5, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.166", "tags": ["01.10.2025", "sip", "sipvicious", "scan", "2025", "HoneyNet Connect", "ssh"], "pulses": ["Automated Threat Intelligence - Scanning hosts for 2025-08-22", "HoneyPot Connect 01.10.2025", "Malware Filter - Botnet List - 08-08-2025", "Malicious IP Addresses", "Automated Threat Intelligence - Scanning hosts for 2025-02-14"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.70.170
source: otx
validated_at: 2026-05-24T12:07:26.607383
raw_response:
  {"pulse_count": 8, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.170", "tags": ["pgp sign", "us none", "us abuse", "timeout", "columns", "sip", "scan", "unknown", "network", "hk abusehandler", "block list", "sipvicious", "china mobile", "hong kong", "ssh", "hurricane us", "nxdomain", "company limited"], "pulses": ["PurpleSynapz", "DShield Public Data Feed - 2025-08-30", "Automated Threat Intelligence - Scanning hosts for 2025-07-01", "DShield Public Data Feed - 2025-08-25", "DShield Public Data Feed - 2025-08-24", "Malware Filter - Botnet List - 23-08-2025", "Automated Threat Intelligence - Scanning hosts for 2025-03-26", "Malicious IP Addresses"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.70.176
source: otx
validated_at: 2026-05-24T12:07:30.805880
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.176", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 70, "malware_samples": [], "passive_dns": ["xserver-mail.com", "hooligans.ma", "rentigo.ma", "admin.berrachain.io", "www.rentigo.ma", "www.hooligans.ma", "metamaskconnect.io", "auth-sumup.com", "berrachain.io", "www.berrachain.io", "online-deutsche-bank.com", "netflixpayment.info", "metamaskverify.info", "metamaskconnect.app", "morochicbrand.com", "premium-membership.app", "ledger-upgrade.io", "exodus-safety.com", "morochic.store", "zoranet.io"]}


ioc_type: ipv4
ioc_value: 196.251.70.185
source: otx
validated_at: 2026-05-24T12:07:53.688328
raw_response:
  {"pulse_count": 38, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.185", "tags": ["sentrypeer", "us abuse", "network", "tanner", "heralding", "hurricane us", "sftp", "dionaea", "mirai", "email", "us none", "cisco", "tcp", "scan", "Bruteforce", "SSH", "Honeypot", "pgp sign", "blacklist", "sip", "unknown", "conpot", "china mobile", "hong kong", "nxdomain", "Malicious IP", "honeypot", "malicious", "company limited", "botnet", "LAMP", "timeout", "columns", "hk abusehandler", "Brute-Force", "block list", "ssh", "cowrie", "honeytrap", "mailoney"], "pulses": ["SSH Brute-Force Honeypot Live", "LCIA HoneyNet Data - September 2025 - Honeytrap", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "LCIA HoneyNet Data - August 2025 - Honeytrap", "LCIA HoneyNet Data - August 2025 - ConPot", "DShield Public Data Feed - 2025-08-30", "DShield Public Data Feed - 2025-08-25", "DShield Public Data Feed - 2025-08-24", "HoneyHole Network | Exploitation Attempts | Validated IOCs", "Scan port 8080 HTTP and proxy (S3#)", "LCIA HoneyNet Data - July 2025 - Honeytrap", "Scan port 8080 HTTP and proxy (S3#)", "Malware Filter - Botnet List - 30-07-2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.70.195
source: otx
validated_at: 2026-05-24T12:08:16.413048
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.195", "tags": [], "pulses": ["\"AS401120 cheapy_host LLC\" clone credit skocherhan", "AS401120 cheapy_host LLC"], "malware_count": 0, "passive_dns_count": 11, "malware_samples": [], "passive_dns": ["dhll-lnfo.cfd", "ervi-help.cfd", "pdhy.site", "fvcev.site", "commonauth.cloud", "commonauth.app", "commonoauthv2.services", "tariffrelief.info", "trbf.info", "backendfortrb.info", "tariffrelief.help"]}


ioc_type: ipv4
ioc_value: 196.251.70.221
source: otx
validated_at: 2026-05-24T12:08:34.442465
raw_response:
  {"pulse_count": 32, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.221", "tags": ["01.10.2025", "honeypot", "RimbaSiber", "tcp", "Bruteforce", "brute-force", "Brute-Force", "2025", "HoneyNet Connect", "ssh", "scanners", "SSH", "Honeypot", "bruteforce"], "pulses": ["SSH Brute-Force Honeypot Live", "HoneyPot Connect 01.10.2025", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Bruteforce Hosts for 2025-08-22", "2025-08-17 Fail2Ban 8f0cc9f4-aead-4737-9104-db9449ff8ebe", "Rimba Siber (Malaysia) SSH Attacker Hosts for 2025-08-16", "2025-08-10 Fail2Ban 5fe4aa10-0cdb-458e-a207-da3f6e23e406", "2025-08-10 Fail2Ban 1c4c02eb-858b-4337-a69c-a8f48d190b99", "SSH brute force 20250806", "2025-08-03 Fail2Ban fc3591eb-7c26-4254-a3ad-afa5d52342d6", "2025-08-03 Fail2Ban 91865274-1451-43d5-94f0-56a7d62ed30a", "SSH Bruteforce Hosts for 2025-07-31", "2025-07-31 Fail2Ban 34ced010-8e00-49af-af64-d4d72d52e1d8"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.70.234
source: otx
validated_at: 2026-05-24T12:08:52.494824
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.234", "tags": ["graph summary", "join", "mirai", "default company", "ftp", "01.10.2025", "ldap", "tcp", "scan", "Bruteforce", "telnet", "whois lookups", "2025", "SSH", "elasticsearch", "Honeypot", "dhcp", "community", "blacklist", "memcache", "postgres", "api key", "smb", "oracle", "socks5", "Brute Force", "Malicious IP", "honeypot", "qhoneypot", "snmp", "botnet", "ntp", "mssql", "imap", "Brute-Force", "first", "value a", "HoneyNet Connect", "ssh", "redis", "vnc"], "pulses": ["SSH Brute-Force Honeypot Live", "\"AS401120 cheapy_host LLC\" clone credit skocherhan", "Fast Flux Network - Active C2", "Fast Flux Network - Active C2", "AS401120 cheapy_host LLC", "Insulin honeypots - 2025-10-11", "Insulin honeypots - 2025-10-10", "Insulin honeypots - 2025-10-07", "Insulin honeypots - 2025-10-06", "Scan port 8080 HTTP and proxy (S3#)", "Insulin honeypots - 2025-10-04", "Insulin honeypots - 2025-10-03", "Insulin honeypots - 2025-10-02", "Insulin honeypots - 2025-09-30", "HoneyPot Connect 01.10.2025", "Insulin honeypots - 2025-09-29", "Insulin honeypots - 2025-09-28", "2025-09-28 Fail2Ban 9a977469-6c7f-42c1-a43e-7c709bff65d6", "SSH brute force src-ip Week 39", "SSH brute force src-ip Week 39"], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["block.mmms.eu", "indraline.de", "tvrceocprq.indraline.de"]}


ioc_type: ipv4
ioc_value: 196.251.70.248
source: otx
validated_at: 2026-05-24T12:09:06.149108
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.248", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 16, "malware_samples": [], "passive_dns": ["hasdhgsygasfsa.click", "196-251-70-248.plesk.page", "onlineyedekparcaci.com", "tokibasvuru.org", "atasoylogistic.com", "www.tiktok-help.com", "tiktok-help.com", "kampanyan.cyou", "toplukonutidaresi.xyz", "tokikonut.org", "tokiev.com", "toplukonutidaresi.com", "flrstlrkacirmayi1temmuz.xyz", "yonlen.click", "aqsven.click", "yondom62.click"]}


ioc_type: ipv4
ioc_value: 196.251.70.25
source: otx
validated_at: 2026-05-24T12:09:11.754623
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Techiman", "asn": "ASNone ", "indicator": "196.251.70.25", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 11, "malware_samples": [], "passive_dns": ["www.kolayonayli.com", "duyurumcebimde.com", "promosyonnoktasinda.com", "promosyonfaydalan.com", "kolayonayli.com", "yenisubelerimiz.com", "yenibilgilendirme.com", "duyuruhizlionay.com", "duyurumguncel.com", "bultenmerkezim.com", "firsatlarkaciyor.com"]}


ioc_type: ipv4
ioc_value: 196.251.70.29
source: otx
validated_at: 2026-05-24T12:09:49.999825
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.29", "tags": ["notice", "sip", "sipvicious", "scan", "Bruteforce", "Brute-Force", "info", "IP Maliciosa", "Threat Intelligence", "ssh", "SSH"], "pulses": ["\"AS401120 cheapy_host LLC\" clone credit skocherhan", "AS401120 cheapy_host LLC", "Automated Threat Intelligence - Scanning hosts for 2025-07-01", "2025-07-01 Fail2Ban 1072632b-00ee-4cd1-a89e-36fe15a50dd6", "2025-06-30 Fail2Ban 2d6823f1-2b68-458e-a6c9-8319bf41be77", "2025-06-30 Fail2Ban a8557ce3-4559-45dd-9f04-4b14843f69d5", "Malware Filter - Botnet List - 22-06-2025", "SSH Brute-Force IPs from fail2ban 2025-06-25", "SSH Brute-Force IPs from fail2ban 2025-06-18", "Threat IPs 2025-03-12"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 196.251.70.72
source: otx
validated_at: 2026-05-24T12:10:13.614867
raw_response:
  {"pulse_count": 5, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.72", "tags": ["botnet", "abuse", "port 5900", "ipqs", "ipqualityscore", "fraud", "tcp/5900", "vnc", "SSH", "RDP", "web attack", "honeypot", "bruteforce"], "pulses": ["IPQS Abusive IP List", "MALICIOUS IP IPQS", "MALICIOUS IP IPQS", "IP Addresses Logged by the Rosethorn PotNet", "Honeypot Visitors (TCP/5900) - 2025-04-03"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["gistaps012.cfd"]}


ioc_type: ipv4
ioc_value: 196.251.70.75
source: otx
validated_at: 2026-05-24T12:10:34.134826
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.75", "tags": ["abuse", "ipqs", "ipqualityscore", "fraud", "SSH", "RDP", "web attack", "honeypot", "bruteforce"], "pulses": ["IPQS Abusive IP List", "MALICIOUS IP IPQS", "MALICIOUS IP IPQS", "IP Addresses Logged by the Rosethorn PotNet"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["contatocertopt.com", "fiverr.protection9985.shop"]}


ioc_type: ipv4
ioc_value: 196.251.70.95
source: otx
validated_at: 2026-05-24T12:11:25.279991
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.95", "tags": [], "pulses": ["\"AS401120 cheapy_host LLC\" clone credit skocherhan", "AS401120 cheapy_host LLC"], "malware_count": 2, "passive_dns_count": 8, "malware_samples": ["8790906f199c6acd938fde3c3d09c740fe2d50829676c587a5c6cd56d9f5d7c3", "aa674d9deb1d19ec8e914b593bf8795bae2a5e7a4c7d66b370b9782e6fb112c7"], "passive_dns": ["www.importanteaviso.digital", "practical-beaver.196-251-70-95.plesk.page", "reglement-mondial-relay.com", "sad-hermann.196-251-70-95.plesk.page", "despachanterapidex.com", "despachanteservicos.com", "importanteaviso.digital", "docusignoutlook.com"]}


ioc_type: ipv4
ioc_value: 196.251.71.101
source: otx
validated_at: 2026-05-24T12:11:33.432335
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.71.101", "tags": [], "pulses": ["\"AS401120 cheapy_host LLC\" clone credit skocherhan", "AS401120 cheapy_host LLC"], "malware_count": 0, "passive_dns_count": 10, "malware_samples": [], "passive_dns": ["uzunsurelikampanya2025.shop", "kosubandisporzamani.shop", "kosununbandi2025.shop", "kapalicarsi.store", "k6simdi.shop", "k6otostore.shop", "yeniurunlerimizsizlerle.xyz", "sepettesongunfirsatlari.online", "yeniurunlerimizsizlerle.online", "yeniurunlersizlereozel.xyz"]}


ioc_type: ipv4
ioc_value: 196.251.71.111
source: otx
validated_at: 2026-05-24T12:11:49.798451
raw_response:
  {"pulse_count": 11, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.71.111", "tags": ["webscanner", "mdatp command", "web service", "command and control", "webscanner, bruteforce, web app attack", "web app attack", "uk", "Crawler", "webscan", "probing", "scanning"], "pulses": ["Webscanners 2018-02-09  thru current day", "Webscanners IPs 2024-04-08 thru current day", "Ghosty", "Ghosty", "Ghosty", "webscanners_pules", "webscanners_pules", "webscanners_pules", "webscanners_pules", "webscanners_pules", "Command and Control - March"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["proinvestmentcrypto.com"]}


ioc_type: ipv4
ioc_value: 196.251.71.128
source: otx
validated_at: 2026-05-24T12:12:00.387787
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.71.128", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 9, "malware_samples": [], "passive_dns": ["www.livraison-replanifiee.com", "www.uberates.com", "uberates.com", "reprogrammer-mondial.com", "livraison-replanifiee.com", "www.livraison-reprogrammee.com", "livraison-reprogrammee.com", "serene-cori.196-251-71-128.plesk.page", "simheractiveren-kpn.help"]}


ioc_type: ipv4
ioc_value: 196.251.71.147
source: otx
validated_at: 2026-05-24T12:12:06.056217
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.71.147", "tags": [], "pulses": ["\"AS401120 cheapy_host LLC\" clone credit skocherhan", "AS401120 cheapy_host LLC"], "malware_count": 0, "passive_dns_count": 14, "malware_samples": [], "passive_dns": ["journeymanmarbleworx.com", "sxxytj.com", "yckaiji.com", "pcmax.wqqudou.com", "ycvs.site", "lytu.site", "tayu.site", "prgyk.site", "dqtob.site", "ljnll.site", "yztte.site", "fanzung.icu", "hayxm.site", "zdwsa.site"]}


ioc_type: ipv4
ioc_value: 196.251.71.164
source: otx
validated_at: 2026-05-24T12:12:23.261797
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.71.164", "tags": ["DanaBot", "Remcos", "Pegasus", "Deimos", "CobaltStrike", "Qakbot", "Evilginx", "Brute_Ratel_C4", "Hak5_Cloud_C2", "Mythic", "Sliver", "Supershell", "Havoc", "Dcrat", "Reverse_SSH", "NetSupportRAT", "Interactsh", "EvilGoPhish", "C2", "Hookbot", "AsyncRAT"], "pulses": ["Twitter Feed - drb_ra - 21-05-2025"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["www.resgatelivelo.comercial.ws", "resgatelivelo.comercial.ws"]}


ioc_type: ipv4
ioc_value: 196.251.71.21
source: otx
validated_at: 2026-05-24T12:13:42.510591
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.71.21", "tags": [], "pulses": ["\"AS401120 cheapy_host LLC\" clone credit skocherhan", "AS401120 cheapy_host LLC"], "malware_count": 0, "passive_dns_count": 21, "malware_samples": [], "passive_dns": ["sahibinden.e-satislarim.com", "dikismakinesifirsativergisiz.icu", "merchantkep.com", "aksfsfgiris-anldk.com", "e-satislarim.com", "sahibinden.satis-ilanlarim.com", "annelergununeozel.xyz", "elbebek.xyz", "elbebek.online", "hosgeldinyaz-babymll.com", "ramazanaozel.com", "babymll.com", "t-anlkiadde.com", "t-aidtiade.com", "t-krtiade.com", "sahibinden.click", "satis-ilanlarim.com", "sok-kampanya.tgaklik-ashinda.com", "satis-kontroll.com", "sahibinden.store"]}


ioc_type: ipv4
ioc_value: 196.251.71.211
source: otx
validated_at: 2026-05-24T12:13:56.230977
raw_response:
  {"pulse_count": 19, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.71.211", "tags": ["notice", "sip", "tcp", "sipvicious", "scan", "brute-force", "Bruteforce", "Brute-Force", "info", "ssh", "SSH"], "pulses": ["Malware Filter - Botnet List - 30-10-2025", "Automated Threat Intelligence - Scanning hosts for 2025-06-13", "SSH brute force 20250710", "SSH brute force 20250707", "SSH brute force 20250702", "SSH Brute-Force IPs from fail2ban 2025-07-10", "2025-07-01 Fail2Ban 1072632b-00ee-4cd1-a89e-36fe15a50dd6", "2025-06-29 Fail2Ban 9624672d-3f8c-4d9a-a0d4-d2cd51f20d4f", "SSH brute force 20250628", "SSH brute force 20250624", "SSH brute force 20250623", "2025-06-23 Fail2Ban 4512ebc8-6c5f-4cad-9fc3-f89bd7435aca", "2025-06-23 Fail2Ban 0eee2180-0e24-4bc3-9bb8-9eae74a6037b", "Malware Filter - Botnet List - 22-06-2025", "2025-06-17 Fail2Ban b81d8666-46dc-4d44-9991-476482ec737f", "2025-06-15 Fail2Ban a4c6f89d-89e8-43d4-b5a5-0a4b5d567e46", "2025-06-15 Fail2Ban 96e3c4a6-a3a4-4748-a8b0-2f0c7992c169", "2025-06-15 Fail2Ban dfc449cb-8357-4b0d-aa69-cd5dcc519cbd", "SSH Brute-Force IPs from fail2ban 2025-06-18"], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["ledgerlive-io.com", "www.ledgerlive-io.com", "blissful-rhodes.196-251-71-211.plesk.page", "trezor-us.com"]}


ioc_type: ipv4
ioc_value: 196.251.71.215
source: otx
validated_at: 2026-05-24T12:14:11.340976
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.71.215", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 9, "malware_samples": [], "passive_dns": ["opencreatorfix02.dynu.net", "guce.yahoo.html-secure.com", "jornalistaaurelianoborgesmidia.com", "accounts.google.html-secure.com", "www.microsoftonline.html-secure.com", "html-secure.com", "logincdn.microsoftonline.html-secure.com", "ads.yahoo.html-secure.com", "kocakafalidergiplatform.xyz"]}


ioc_type: ipv4
ioc_value: 196.251.71.39
source: otx
validated_at: 2026-05-24T12:15:16.614966
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.71.39", "tags": ["Qakbot", "Dcrat", "Reverse_SSH", "Interactsh", "NetSupportRAT", "Havoc", "Supershell", "Remcos", "Sliver", "C2", "Brute_Ratel_C4", "AsyncRAT", "CobaltStrike", "Deimos", "Mythic"], "pulses": ["Twitter Feed - drb_ra - 29-06-2025"], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["www.elswegerif.nl", "elswegerif.nl", "id-comdilect.org"]}


ioc_type: ipv4
ioc_value: 196.251.71.57
source: otx
validated_at: 2026-05-24T12:15:50.946759
raw_response:
  {"pulse_count": 14, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.71.57", "tags": ["Brute force", "SSL VPN", "count"], "pulses": ["SSL VPN brute force attempts [120525]", "SSL VPN brute force attempts [120525]", "SSL VPN brute force attempts [090525]", "SSL VPN brute force attempts [080525]", "SSL VPN brute force attempts [070525]", "SSL VPN brute force attempts [060525]", "SSL VPN brute force attempts [180425]", "SSL VPN brute force attempts [170425]", "SSL VPN brute force attempts [110425]", "SSL VPN brute force attempts [100425]", "SSL VPN brute force attempts [090425]", "SSL VPN brute force attempts [080425]", "SSL VPN brute force attempts [070425]", "SSL VPN brute force attempts [030425]"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 196.251.71.79
source: otx
validated_at: 2026-05-24T12:16:35.388876
raw_response:
  {"pulse_count": 18, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.71.79", "tags": ["notice", "network", "graph summary", "heralding", "join", "dionaea", "sftp", "mirai", "default company", "01.10.2025", "us none", "cisco", "tcp", "scan", "Bruteforce", "whois lookups", "info", "2025", "SSH", "Honeypot", "community", "pgp sign", "blacklist", "Skype", "unknown", "api key", "china mobile", "hong kong", "nxdomain", "Malicious IP", "honeypot", "malicious", "company limited", "botnet", "LAMP", "timeout", "columns", "hk abusehandler", "Brute-Force", "first", "block list", "value a", "HoneyNet Connect", "ssh", "cowrie", "honeytrap"], "pulses": ["SSH Brute-Force Honeypot Live", "Fast Flux Network - Active C2", "Fast Flux Network - Active C2", "LCIA HoneyNet Data - October 2025 - Honeytrap", "Scan port 8080 HTTP and proxy (S3#)", "2025-10-26 Fail2Ban ef35a6b7-843a-4c8b-8a1b-47593ef1af57", "Scan port 8080 HTTP and proxy (S3#)", "Scan port 8080 HTTP and proxy (S3#)", "HoneyPot Connect 01.10.2025", "SSH Brute-Force IPs from fail2ban 2025-10-07", "LCIA HoneyNet Data - August 2025 - Honeytrap", "Scan port 81 Skype (S3#)", "DShield Public Data Feed - 2025-08-25", "LCIA HoneyNet Data - July 2025 - Honeytrap", "Malware Filter - Botnet List - 30-07-2025", "2025-06-30 Fail2Ban a8557ce3-4559-45dd-9f04-4b14843f69d5", "LCIA HoneyNet Data - June 2025 - Honeytrap", "Malware Filter - Botnet List - 29-06-2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.72.127
source: otx
validated_at: 2026-05-24T12:18:53.697454
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.72.127", "tags": ["sentrypeer", "dcrat", "akira", "cisos", "tanner", "coinminer", "IP Maliciosa", "heralding", "sftp", "dionaea", "france", "malware", "email", "qilin", "russia", "mexico", "grouped", "date", "Adbhoney", "clearfake", "united kingdom", "web app attack", "singapore", "Threat Intelligence", "brazil", "steam", "germany", "sip", "mozi", "agent tesla", "Crawler", "ukraine", "probing", "malicious", "sliver", "panama", "paraguay", "webscanner", "mozi link", "asyncrat", "indonesia", "service", "ssh", "cowrie", "mailoney", "february"], "pulses": ["Webscanners IPs 2024-04-08 thru current day", "webscanners_pules", "webscanners_pules", "webscanners_pules", "webscanners_pules", "webscanners_pules", "LCIA HoneyNet Data - May 2025 - H0neytr4p", "LCIA HoneyNet Data - April 2025 - H0neytr4p", "Threat Intel Report - W10-2025", "Threat IPs 2025-03-16"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 196.251.72.147
source: otx
validated_at: 2026-05-24T12:19:13.647982
raw_response:
  {"pulse_count": 5, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.72.147", "tags": ["botnet", "abuse", "port 5900", "ipqs", "ipqualityscore", "fraud", "tcp/5900", "vnc", "SSH", "RDP", "web attack", "honeypot", "bruteforce"], "pulses": ["IPQS Abusive IP List", "MALICIOUS IP IPQS", "MALICIOUS IP IPQS", "IP Addresses Logged by the Rosethorn PotNet", "Honeypot Visitors (TCP/5900) - 2025-04-03"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.72.159
source: otx
validated_at: 2026-05-24T12:20:03.909498
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.72.159", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 28, "malware_samples": [], "passive_dns": ["siparsnoktasi.click", "siparisvergelir.click", "vergelsinn.click", "cevrimiciozelkampanya.click", "fbyonlendir.click", "campanysepet.click", "kampanyasepetin.click", "redirectx.click", "yonlendirbiz.click", "avantajsepetin.click", "aldinaldin.click", "aldinaldincampanyasi.click", "aslindaguzelkampanya.sbs", "kapindasongunindirimigeldi.sbs", "redirectseervice.click", "sepetindelcampanya.click", "redirectsev.click", "sepettekampanyavar.click", "uygunfiyat.click", "orderproccess.click"]}


ioc_type: ipv4
ioc_value: 196.251.72.174
source: otx
validated_at: 2026-05-24T12:20:49.778250
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.72.174", "tags": [], "pulses": ["\"AS401120 cheapy_host LLC\" clone credit skocherhan", "AS401120 cheapy_host LLC"], "malware_count": 0, "passive_dns_count": 14, "malware_samples": [], "passive_dns": ["www.dgtese-sede.cfd", "mail.dgteoes-sede.cfd", "omanoropgov.lat", "possach.lat", "dgth0e-sede.cfd", "dgtsees-sede.cfd", "dgteoes-sede.cfd", "dgtese-sede.cfd", "fullcopeceoes-cll.cfd", "dgteos-sede.cfd", "dgtees-sede.cfd", "dgtns-es.cfd", "dgtis.cfd", "dgtws-es.cfd"]}


ioc_type: ipv4
ioc_value: 196.251.72.185
source: otx
validated_at: 2026-05-24T12:21:04.586620
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.72.185", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 19, "malware_samples": [], "passive_dns": ["trblnance.icu", "cagrimerkezim.online", "www.trbilgi.shop", "trbilgi.shop", "tokonutlar.icu", "wwwbinance.cyou", "trxbinance.icu", "mobilbinancetr.mom", "mobilbinancetr.click", "mbinancetr.icu", "wvwtrbinance.lat", "wvwtrbinance.click", "tribinence.com", "trbiinanc.com", "trbincance.cfd", "01010101081.xyz", "aktueller.icu", "101a.icu", "a101market.icu"]}


ioc_type: ipv4
ioc_value: 196.251.72.189
source: otx
validated_at: 2026-05-24T12:21:21.901343
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.72.189", "tags": ["decoy", "CoinMiner", "pawns", "rev-base64-loader", "DarkCloud", "Remcos", "SocGholish", "geofenced", "rar", "mirai", "sshdkit", "iproyal", "Deimos", "Mozi", "KoiStealer", "CobaltStrike", "ClearFake", "rat", "Qakbot", "elf", "mimikatz", "Evilginx", "GuLoader", "mips", "Brute_Ratel_C4", "32-bit", "lnk", "Encoded", "base64-loader", "bitbucket", "ua-wget", "Mythic", "Sliver", "gafgyt", "ascii", "powershell", "pw-uVtjpNSgTmwoK3gh", "Supershell", "opendir", "jpg-base64-loader", "base64", "xworm", "Formbook", "Havoc", "moobot", "arm", "Gh0stRAT", "censys", "USA", "sh"], "pulses": ["urlhaus 30days", "Threatfox Recent Additions", "URLHaus data - 25-04-2025", "Twitter Feed - drb_ra - 23-04-2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 196.251.72.192
source: otx
validated_at: 2026-05-24T12:21:39.886542
raw_response:
  {"pulse_count": 5, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.72.192", "tags": ["botnets", "persistence", "websocket", "tsundere", "ips ws", "npm", "ip address", "malware", "stealer", "hashmd5", "appdata", "darknet", "encryption", "librarian ghouls", "websocket c2", "c2 server", "filehashsha1", "tsundere botnet", "mysterious elephant", "phishing websites", "aes-256", "hashsha256", "tsundere bot", "c2 panel", "ethereum", "powershell", "filehashmd5", "msi", "javascript", "file", "123 stealer", "blockchain", "c2 address", "filehashsha256", "botnet", "node.js", "domains", "msi installer", "windows", "malware descriptions", "malware technologies", "microsoft windows", "loader", "koneko", "hashsha1", "cryptocurrencies", "first", "august", "infostealers"], "pulses": ["The Tsundere botnet uses the Ethereum blockchain to infect its targets", "EbeeNov2025 Pt4", "ppppppppppppppppp", "IOC - Blockchain and Node.js abused by Tsundere: an emerging botnet", "The Tsundere botnet uses the Ethereum blockchain to infect its targets | Securelist"], "malware_count": 2, "passive_dns_count": 0, "malware_samples": ["92ca650952a18f0e9b8a67efe24146e02904063a1202dd66a55f0a1629b3c47f", "bec12ed2f9290449367acc9c3ed926746baae9797b2bde71b28bf8ef97454fa2"]}


ioc_type: ipv4
ioc_value: 196.251.72.205
source: otx
validated_at: 2026-05-24T12:21:44.024116
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.72.205", "tags": ["things", "mirai internet", "ddos", "mirai"], "pulses": ["\"AS401120 cheapy_host LLC\" clone credit skocherhan", "AS401120 cheapy_host LLC", "\u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0431\u043e\u0442\u043d\u0435\u0442\u0430 Mirai (\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430 30.07.2025)", "\u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0431\u043e\u0442\u043d\u0435\u0442\u0430 Mirai (\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430 24.07.2025)", "\u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0431\u043e\u0442\u043d\u0435\u0442\u0430 Mirai (\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430 23.07.2025)", "\u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0431\u043e\u0442\u043d\u0435\u0442\u0430 Mirai (\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430 22.07.2025)", "Malware Filter - Botnet List - 24-07-2025"], "malware_count": 4, "passive_dns_count": 21, "malware_samples": ["0d2d316bc4937a2608e8d9a3030a545973e739805c3449b466984b27598fcdec", "20e66b9dcfbb9bb55d76c85e7bbebbac282ff7b23c64e43234beb38651518378", "b5390ebc8648d0c5745381503aa22e95adffddbffeba06d59973919f7ba16241", "97151aa6ac9e5a149c593ef4e370d443bc1fb2d4dc7b24e74243762150880e73"], "passive_dns": ["algic-shannon.196-251-72-205.plesk.page", "www.196-251-72-205.plesk.page", "www.mijn-formulier.jkub.com", "www.festive-heyrovsky.196-251-72-205.plesk.page", "196-251-72-205.plesk.page", "angry


ioc_type: ipv4
ioc_value: 196.251.72.237
source: otx
validated_at: 2026-05-24T12:23:14.457842
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.72.237", "tags": ["Remcos", "Deimos", "CobaltStrike", "01.10.2025", "Qakbot", "Evilginx", "2025", "Brute_Ratel_C4", "Sliver", "Mythic", "Supershell", "Havoc", "Dcrat", "Reverse_SSH", "Interactsh", "NetSupportRAT", "EvilGoPhish", "C2", "HoneyNet Connect", "AsyncRAT"], "pulses": ["HoneyPot Connect 01.10.2025", "Malware Filter - Botnet List - 08-09-2025", "Threatfox Recent Additions", "Twitter Feed - drb_ra - 23-04-2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 196.251.72.6
source: otx
validated_at: 2026-05-24T12:25:44.141637
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.72.6", "tags": ["sentrypeer", "LAMP", "sip", "cisco", "Adbhoney", "tanner", "ssh", "sftp", "cowrie", "dionaea", "mailoney", "email", "honeytrap", "malicious"], "pulses": ["\"AS401120 cheapy_host LLC\" clone credit skocherhan", "AS401120 cheapy_host LLC", "LCIA HoneyNet Data - September 2025 - Tanner", "LCIA HoneyNet Data - September 2025 - Honeyaml"], "malware_count": 0, "passive_dns_count": 15, "malware_samples": [], "passive_dns": ["www.tigo.bar", "www.pttt.click", "klhelp.com", "www.estafetay.cyou", "pttt.click", "ptt.homes", "www.ptt.baby", "pttt.bar", "www.estafetatg.vip", "tigom.icu", "estafetay.cyou", "ptt.baby", "tigo.bar", "estafetatg.vip", "ptt.bar"]}


ioc_type: ipv4
ioc_value: 196.251.72.82
source: otx
validated_at: 2026-05-24T12:26:23.745503
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.72.82", "tags": ["cve20222588 cve", "type indicator", "filehashmd5", "filehashsha1", "cve20121823 cve", "bash download", "cve20213156 cve", "cve20214034 cve", "sha256", "filehashsha256"], "pulses": ["EbeeDec2025 Pt1", "Inside Morte Loader: How Loader as a Service Builds Modern Botnets", "Malware Filter - Botnet List - 31-08-2025"], "malware_count": 5, "passive_dns_count": 4, "malware_samples": ["b600c9fb89eeb718cdafe33208e46b854debb630e4e00a538a3b16123dc8d97e", "4f9ff1577ba9e409ceb03ece0e66ee8c1dc7cd056f033e73e7f74f14254c4ca4", "1725e5786f9e64ab9a53e8c2828418187ea6ad2dec3630969b951d103920a468", "185e86a756475c65731c8eba1023d9c7e4abef6375b44986a238dd98756a749f", "429876910890d728d90564bf3816f57e5da11fe7203b9a5519043e43609df42a"], "passive_dns": ["webmaildoc.info", "www.webmaildocument.info", "webmaildocument.info", "hikylover.st"]}


ioc_type: ipv4
ioc_value: 196.251.72.9
source: otx
validated_at: 2026-05-24T12:26:48.704211
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.72.9", "tags": ["01.10.2025", "LAMP", "cisco", "Adbhoney", "2025", "HoneyNet Connect", "ssh", "redis", "sftp", "cowrie", "honeypot", "honeytrap", "malicious", "Redishoneypot"], "pulses": ["LCIA HoneyNet Data - October 2025 - Honeytrap", "LCIA HoneyNet Data - October 2025 - Redishoneypot", "Redis honeypot logs for 2025-10-12", "HoneyPot Connect 01.10.2025", "LCIA HoneyNet Data - September 2025 - Honeytrap", "LCIA HoneyNet Data - August 2025 - Honeytrap", "Malware Filter - Botnet List - 25-08-2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.72.96
source: otx
validated_at: 2026-05-24T12:26:57.675747
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.72.96", "tags": [], "pulses": ["Malware Filter - Botnet List - 30-09-2025"], "malware_count": 3, "passive_dns_count": 2, "malware_samples": ["ff01b928dcdd0a586d8d0be2514af99715b10d7af22978be24ef2bdd287894ad", "eb5e02b3e74123e66208be11515cd721df59b7ed1cc7515e72f242b41beb8d22", "8f175de63a6e7ee7e6d7729900efe2acf235937f06d82d7e132d4f17b2d63b83"], "passive_dns": ["mijni-cs-9876785678.sbs", "mijni-cs-web-consumer.sbs"]}


ioc_type: ipv4
ioc_value: 196.251.71.142
source: otx
validated_at: 2026-05-24T12:28:00.961105
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.71.142", "tags": [], "pulses": ["QuasarRAT"], "malware_count": 6, "passive_dns_count": 0, "malware_samples": ["b044e65ab1a421db361d1657c789548e7d5bef1785e4dba23882e7322f468d2e", "2383b97ef686b72097c44f7b83f4f0ed27e97fb378c3bcab610fc7ca1e9100b6", "b64f4ce87160ccf196a42334f23b99c28c5bfd910884e0d1caf9907d5fceb56b", "fe81d86ec955f11899104772a5836901ed32ac4939de9a09e0e75e12d8c720bf", "bfcfb297e627684383befe449638aacf9301c3d3ae67112abde298b4bfdc6ea8", "05f975e0fdf4faf66450f31b569b3af6051d870ee4178a81ec621eafb43138b4"], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.69.91
source: otx
validated_at: 2026-05-24T12:29:07.348572
raw_response:
  {"pulse_count": 39, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.91", "tags": ["notice", "us abuse", "network", "heralding", "hurricane us", "dionaea", "mirai", "ftp", "us none", "ldap", "tcp", "scan", "Bruteforce", "telnet", "info", "SSH", "elasticsearch", "Honeypot", "dhcp", "pgp sign", "blacklist", "memcache", "unknown", "postgres", "smb", "china mobile", "hong kong", "oracle", "nxdomain", "socks5", "Malicious IP", "honeypot", "qhoneypot", "malicious", "company limited", "snmp", "botnet", "ntp", "mssql", "timeout", "columns", "imap", "LAMP", "hk abusehandler", "Brute-Force", "block list", "ssh", "redis", "vnc", "honeytrap"], "pulses": ["SSH Brute-Force Honeypot Live", "Scan port 8080 HTTP and proxy (S3#)", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "DShield Public Data Feed - 2025-08-30", "Insulin honeypots - 2025-08-28", "Insulin honeypots - 2025-08-27", "DShield Public Data Feed - 2025-08-25", "DShield Public Data Feed - 2025-08-24", "SSH Brute-Force IPs from fail2ban 2025-08-24", "LCIA HoneyNet Data - July 2025 - Honeytrap", "Malware Filter - Botnet List - 30-07-2025", "Insulin honeypots - 2025-07-15", "Insulin honeypots - 2025-07-14"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.69.233
source: otx
validated_at: 2026-05-24T12:29:36.791925
raw_response:
  {"pulse_count": 37, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.233", "tags": ["commodity-rat", "isp-reputation", "stealc", "ssl-enrichment", "threatfox", "remcos", "webscanner, bruteforce, web app attack", "osint-volley", "stix-2.1", "pattern-32", "automated", "infostealer", "threat-intelligence", "supply-chain", "auto-updated", "c2-infrastructure", "github", "xworm", "blocked-ips", "probing", "mitre-attack", "dugganusa", "scanning", "pattern-38", "automated-hunt", "asyncrat", "rhadamanthys", "webscan", "pattern-49"], "pulses": ["Webscanners 2018-02-09  thru current day", "clone urlhaus 23may CREATED 11 MONTHS AGO MODIFIED 2 MONTHS AGO by skocherhan Public TLP:  Green REFERENCE: https://urlhaus.abuse.ch/downloads/json_online/", "ThreatFix_IP_262", "DugganUSA Master Threat Feed - Live Blocked IPs with MITRE ATT&CK (Auto-Updated)", "ThreatFox Hunt: Remcos IOCs - 2026-02-08", "ThreatFox Hunt: Remcos IOCs - 2026-02-08", "ThreatFox Hunt: Remcos IOCs - 2026-02-07", "ThreatFox Hunt: Remcos IOCs - 2026-02-07", "ThreatFox Hunt: Remcos IOCs - 2026-02-07", "ThreatFox Hunt: Remcos IOCs - 2026-02-07", "ThreatFox Hunt: Remcos IOCs - 2026-02-07", "ThreatFox Hunt: Remcos IOCs - 2026-02-07", "ThreatFox Hunt: Remcos IOCs - 2026-02-07", "OSINT Volley 2026-02-07 - AsyncRAT/XWorm/Remcos", "OSINT Volley 2026-02-07 - AsyncRAT/XWorm/Remcos", "OSINT Volley 2026-02-07 - AsyncRAT/XWorm/Remcos", "OSINT Volley 2026-02-07 - AsyncRAT/XWorm/Remcos", "OSINT Volley 2026-02-07 - AsyncRAT/XWorm/Remcos", "ThreatFox Hunt: Remcos IOCs - 2026-02-07", "OSINT Volley 2026-02-07 - AsyncRAT/XWorm/Remcos"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.71.192
source: otx
validated_at: 2026-05-24T18:01:58.178152
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.71.192", "tags": ["01.10.2025", "HoneyNet Connect", "2025"], "pulses": ["\"AS401120 cheapy_host LLC\" clone credit skocherhan", "AS401120 cheapy_host LLC", "HoneyPot Connect 01.10.2025", "Malware Filter - Botnet List - 04-09-2025"], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["sockeyehornes.top", "elernentfiresprinklers.sbs", "lexarhornes.sbs"]}


ioc_type: ipv4
ioc_value: 196.251.72.35
source: otx
validated_at: 2026-05-24T18:02:24.776281
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.72.35", "tags": [], "pulses": ["\"AS401120 cheapy_host LLC\" clone credit skocherhan", "AS401120 cheapy_host LLC", "Malware Filter - Botnet List - 23-10-2025"], "malware_count": 0, "passive_dns_count": 6, "malware_samples": [], "passive_dns": ["www.yuzyilkonut.com", "www.yuzyilinevleri.com", "yuzyilkonut.com", "yuzyilinevleri.com", "card-stop.digital", "finanz-online.sbs"]}


ioc_type: ipv4
ioc_value: 196.251.72.115
source: otx
validated_at: 2026-05-24T18:02:44.603572
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.72.115", "tags": ["probing", "ip monitor", "SSH", "Brute-Force", "Bruteforce", "webscanner, bruteforce, web app attack", "webscan", "info", "notice", "scanning"], "pulses": ["Webscanners 2018-02-09  thru current day", "Ghosty", "Ghosty", "Ghosty", "Malware Filter - Botnet List - 31-07-2025", "Malware Filter - Botnet List - 22-06-2025", "last 60 days firewall logs of attacking IPs to UK based Honeypot", "Server Scanning 20/05/2025", "SSH Brute-Force IPs from fail2ban 2025-06-01", "SSH Brute-Force IPs from fail2ban 2025-06-02"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.72.146
source: otx
validated_at: 2026-05-24T18:02:54.588126
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.72.146", "tags": ["Sliver", "C2", "Pegasus", "EvilGoPhish", "CobaltStrike", "Hookbot", "Hak5_Cloud_C2", "NetSupportRAT", "Evilginx", "Reverse_SSH", "Mythic", "Qakbot", "Interactsh", "Remcos", "Deimos", "Havoc", "Bianlian", "Dcrat", "Supershell", "AsyncRAT", "Covenant"], "pulses": ["Twitter Feed - drb_ra - 19-08-2025"], "malware_count": 3, "passive_dns_count": 1, "malware_samples": ["2f2cfdce5a84d30549251a95aaeb7dd314d586e88e51ea1403482d2e5404032b", "bb6c313c94a7ba44d0712ad96047cec2e63ee5fe9238a08262ef6977f78ce420", "c5758433ef16949fe40b872e9456eed40aa65c0d9c11d78b3a71046781485aee"], "passive_dns": ["crazydns.bumbleshrimp.com"]}


ioc_type: ipv4
ioc_value: 196.251.72.179
source: otx
validated_at: 2026-05-24T18:02:56.870161
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.72.179", "tags": ["hello", "intel mac", "android", "khtml", "close", "os x", "windows nt", "redacted", "win64", "linux x8664", "macintosh", "gecko", "ubuntu"], "pulses": ["SpiderDox"], "malware_count": 3, "passive_dns_count": 4, "malware_samples": ["5bbcf42c8e4ea59943c8e6bf3c635c1e941473360311cbdf0104a8dad8942189", "ee0fa1ccd9b24820fb9f105d9d2eff748080eff3359daef090914301b1f69278", "fde1ea33354a84e1c128c3eccfeb76418e2778b6352e65124c668ae07710b405"], "passive_dns": ["kolklokjkj.com", "www.kolklokjkj.com", "medicoolpart.com", "www.medicoolpart.com"]}


ioc_type: ipv4
ioc_value: 196.251.72.219
source: otx
validated_at: 2026-05-24T18:03:13.989469
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.72.219", "tags": ["", "Sliver", "Brute_Ratel_C4", "C2", "Pegasus", "malware", "EvilGoPhish", "CobaltStrike", "Hookbot", "NetSupportRAT", "Evilginx", "Reverse_SSH", "Mythic", "Qakbot", "Interactsh", "Remcos", "Deimos", "Havoc", "Dcrat", "Supershell", "ransomware", "AsyncRAT", "Covenant"], "pulses": ["ThreatFix", "Twitter Feed - drb_ra - 11-09-2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 196.251.69.80
source: otx
validated_at: 2026-05-24T18:03:45.464444
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.80", "tags": [], "pulses": [], "malware_count": 1, "passive_dns_count": 34, "malware_samples": ["7295a40983dbb75366270ba3615598c43fb220c40d7de08a06c41f0483db2c7a"], "passive_dns": ["zbymanga.com", "federalsecureus.com", "ricardo-verification.id912867.click", "twint.id912867.click", "amiendesgouvfr.click", "ammendesgouvfr.click", "mauritluspostmu.blog", "ammendesgouvfr.blog", "amiendesgouvfr.blog", "ameendes-gouv-fr.click", "amedes-gouv-fr.click", "amenddes-gouv-fr.click", "amenndes-gouv-fr.click", "amendess-gouv-fr.click", "amedes-gouv-fr.blog", "ameendes-gouv-fr.blog", "amenndes-gouv-fr.blog", "amenddes-gouv-fr.blog", "amendess-gouv-fr.blog", "amendsgouv-fr.click"]}


ioc_type: ipv4
ioc_value: 196.251.70.53
source: otx
validated_at: 2026-05-24T18:04:09.507276
raw_response:
  {"pulse_count": 12, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.53", "tags": ["Crawler", "indonesia", "mozi link", "malware", "paraguay", "singapore", "scanning", "date", "brazil", "ukraine", "february", "coinminer", "probing", "steam", "cisos", "russia", "webscanner", "grouped", "webscan", "web app attack", "sliver", "panama", "dcrat", "akira", "webscanner, bruteforce, web app attack", "germany", "agent tesla", "clearfake", "mozi", "france", "united kingdom", "asyncrat", "service", "qilin", "mexico"], "pulses": ["Webscanners 2018-02-09  thru current day", "Webscanners IPs 2024-04-08 thru current day", "Ghosty", "Ghosty", "Ghosty", "webscanners_pules", "webscanners_pules", "webscanners_pules", "webscanners_pules", "webscanners_pules", "Malicious IP Addresses", "Threat Intel Report - W10-2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.69.114
source: otx
validated_at: 2026-05-24T18:04:17.244512
raw_response:
  {"pulse_count": 14, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.114", "tags": ["admin", "timeout", "tcp", "network", "hong kong", "RDP", "botnet", "honeypot", "hk abusehandler", "us none", "Malicious IP", "Honeypot", "nxdomain", "us abuse", "mirai", "pgp sign", "blacklist", "hurricane us", "win", "columns", "company limited", "block list", "windows", "china mobile", "unknown", "scan"], "pulses": ["DShield Public Data Feed - 2025-08-30", "DShield Public Data Feed - 2025-08-25", "DShield Public Data Feed - 2025-08-24", "Scan port 3389 RDP (S3#)", "Scan port 3389 RDP (S3#)", "Scan port 3389 RDP (S3#)", "Scan port 3389 RDP (S3#)", "Scan port 3389 RDP (S3#)", "Scan port 3389 RDP (S3#)", "Scan port 3389 RDP (S3#)", "Malicious IP Addresses", "Scan port 3389 RDP (S3#)", "Lion Team_Honeypots_RDP_IP 2025/02/15", "Scan port 3389 RDP (S3#)"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.69.192
source: otx
validated_at: 2026-05-24T18:04:36.406676
raw_response:
  {"pulse_count": 6, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.192", "tags": ["heralding", "SSH", "sentrypeer", "fraud", "RDP", "email", "honeypot", "ssh", "tanner", "LAMP", "dionaea", "sip", "ipqualityscore", "sftp", "vnc", "malicious", "ipqs", "honeytrap", "web attack", "bruteforce", "abuse", "cowrie", "mailoney", "cisco"], "pulses": ["IPQS Abusive IP List", "MALICIOUS IP IPQS", "MALICIOUS IP IPQS", "LCIA HoneyNet Data - October 2025 - Heralding", "VNC honeypot logs for 2025/10/18", "Malware Filter - Botnet List - 21-07-2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.71.89
source: otx
validated_at: 2026-05-24T18:04:42.226509
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.71.89", "tags": [], "pulses": ["\"AS401120 cheapy_host LLC\" clone credit skocherhan", "AS401120 cheapy_host LLC", "Threatfox Recent Additions"], "malware_count": 0, "passive_dns_count": 41, "malware_samples": [], "passive_dns": ["akdirekt.asdjasdha.click", "akdirektonline.sadhaonline.click", "asdagbsdas.click", "asdagbsda.click", "asdasdahsad.click", "asdasdasdlk.click", "asdasbdasd.click", "sadgasgdasd.click", "sdasdgaasd.click", "sonlineislemler.click", "asdhasgda.click", "garantionlineislemler.click", "asdnabda.click", "asdnadga.click", "sajagdaesad.click", "asdjasdgala.click", "asdjasdha.click", "asdoahsdad.click", "adksdbavsasd.click", "denizfirsatlarikampanyalar.click"]}


ioc_type: ipv4
ioc_value: 176.65.134.11
source: otx
validated_at: 2026-05-24T18:05:07.792647
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Germany", "country_code": "DE", "city": null, "asn": "AS56325 diogelo ltd.", "indicator": "176.65.134.11", "tags": ["sentrypeer", "dosbot", "exe", "sshdkit", "gs2518120", "FakeCaptcha", "Tsunami", "32-bit", "ascii", "DanaBot", "DDoSAgent", "us none", "Formbook", "twitter", "rat", "tanner", "mirai", "us abuse", "Mozi", "pgp sign", "mips", "gs2519125", "ddos", "bitbucket", "xloader", "columns", "hta", "unknown", "VIPKeylogger", "iocs", "connectwise", "elf", "Sliver", "PDF", "encrypted", "LummaStealer", "DarkVisionRAT", "skid", "base64-loader", "xworm", "botnet iocs", "network", "ClickFix", "hk abusehandler", "ua-wget", "SmartLoader", "powershell", "censys", "ModiLoader", "Loki"], "pulses": ["Honeypot Data \u2013 T-Pot - Sydney, Australia - December 2025", "DShield Public Data Feed - 2025-08-25", "DShield Public Data Feed - 2025-08-24", "[GS-25-17111] Mirai Botnet IOCs - SEC-1275-1", "[GS-25-16106] Mirai Botnet IOCs - SEC-1275-1", "URLHaus data - 10-04-2025", "URLHaus data - 09-04-2025"], "malware_count": 1, "passive_dns_count": 1, "malware_samples": ["1041604dd92cbfba9229e58b967209fff1bbfb1b176f653a30e88ce36730e727"], "passive_dns": ["serkanbas57.sbs"]}


ioc_type: ipv4
ioc_value: 176.65.134.16
source: otx
validated_at: 2026-05-24T18:05:24.113758
raw_response:
  {"pulse_count": 41, "reputation": 0, "country": "Germany", "country_code": "DE", "city": null, "asn": "AS56325 diogelo ltd.", "indicator": "176.65.134.16", "tags": ["Crawler", "sentrypeer", "scanning", "honeypot", "ssh", "tanner", "LAMP", "dionaea", "sip", "probing", "sftp", "webscanner", "webscan", "badrequest", "web app attack", "malicious", "honeytrap", "exploits", "webscanner, bruteforce, web app attack", "apache", "bruteforce", "cowrie", "cisco"], "pulses": ["Webscanners 2018-02-09  thru current day", "Webscanners with Bad Requests - HTTP Status 400 - 1/20/2018 thru current day", "Webscanners IPs 2024-04-08 thru current day", "Ghosty", "Ghosty", "Ghosty", "TI Advisory No-ESAF-SOC-TI-2026-9", "TI Advisory No-ESAF-SOC-TI-2026-9", "TI Advisory No-ESAF-SOC-TI-2026-9", "LCIA HoneyNet Data - October 2025 - Tanner", "LCIA HoneyNet Data - October 2025 - Honeytrap", "Apache honeypot logs for 25/Oct/2025", "Threat Hunting Retrospective Hunt Observation", "Malware Filter - Botnet List - 01-09-2025", "LCIA HoneyNet Data - August 2025 - Cowrie", "webscanners_pules", "webscanners_pules", "webscanners_pules", "webscanners_pules", "webscanners_pules"], "malware_count": 8, "passive_dns_count": 0, "malware_samples": ["9b31738ae85376fe0d438d7df790a8bc08586ef4d3edaf4871f16e5f7ce4a0e1", "d1bb6b5fc330f5da4b04ce29fb3cf48d5d378dfe20fb287a9ce107fc22cbb2e5", "dac057166874890039efab75c398dcb50427750ba65379398ebf453a318f7b8c", "c86f1c249611ef501653e6b568a1a54d0a230c8c49f6d0e8a7c49f5adc1c1562", "c148d3e5a156e9a278e4a0b978f353ebdbdb495dfd6105afb1c9856c8adb1418", "61f037f1d56b55e1740c790a9091e1eeabeebcf248e7d15d8e634ab95fdb5bc1", "6b83f279280a9ace47d1eeaf071a535d00d98a5c9b751ff69098834d5f2da385", "4d53bd0501dbd5684517e7b46558982d41bd1677b0adf2fbe9a859b255af4e88"], "passive_dns": []}


ioc_type: ipv4
ioc_value: 176.65.134.3
source: otx
validated_at: 2026-05-24T18:05:44.051855
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "Germany", "country_code": "DE", "city": null, "asn": "AS56325 diogelo ltd.", "indicator": "176.65.134.3", "tags": ["tpot", "tcp", "sentrypeer", "digital ocean", "galah", "suricata", "botnet", "honeypot", "Malicious IP", "p0f", "tanner", "mirai", "dionaea", "blacklist", "portscan", "fatt", "http", "honeytrap", "sensor-tagged", "automated", "vultr", "scanner", "scanners", "cowrie", "mailoney", "scan"], "pulses": ["RaspiNAS \u2014 Galah HTTP Honeypot (Live)", "Honeypot Data \u2013 T-Pot - Sydney, Australia - April 2026", "Honeypot Data \u2013 T-Pot - Sydney, Australia - May 2026", "Scan port 8080 HTTP and proxy (S3#)", "Vultr Paris (France) Port Scanning Hosts for 2026-04-23", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-04-23", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-04-23", "DigitalOcean Toronto (CA) Port Scanning Hosts for 2026-04-23", "DigitalOcean London (UK) Port Scanning Hosts for 2026-04-23", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-05-22", "Vultr Paris (France) Port Scanning Hosts for 2026-04-22", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-04-22", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-04-22", "DigitalOcean London (UK) Port Scanning Hosts for 2026-04-22", "Vultr Paris (France) Port Scanning Hosts for 2026-04-21", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-04-21", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-05-21", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-05-20", "Vultr Paris (France) Port Scanning Hosts for 2026-04-20", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-04-20"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 176.65.134.34
source: otx
validated_at: 2026-05-24T18:05:48.031868
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "Germany", "country_code": "DE", "city": null, "asn": "AS56325 diogelo ltd.", "indicator": "176.65.134.34", "tags": ["SSH", "ids", "scanning", "fingerprinting", "fraud", "RDP", "suricata", "honeypot", "ipqualityscore", "portscan", "ipqs", "vultr", "honeytrap", "2026-05-13", "reconnaissance", "msp-cti", "scanners", "web attack", "bruteforce", "abuse"], "pulses": ["Vultr Paris (France) Port Scanning Hosts for 2026-04-23", "IPQS Abusive IP List", "Vultr Paris (France) Port Scanning Hosts for 2026-04-22", "Vultr Paris (France) Port Scanning Hosts for 2026-04-21", "Vultr Paris (France) Port Scanning Hosts for 2026-04-20", "Vultr Paris (France) Port Scanning Hosts for 2026-05-19", "Vultr Paris (France) Port Scanning Hosts for 2026-04-19", "Vultr Paris (France) Port Scanning Hosts for 2026-05-18", "Vultr Paris (France) Port Scanning Hosts for 2026-04-18", "Vultr Paris (France) Port Scanning Hosts for 2026-04-17", "Vultr Paris (France) Port Scanning Hosts for 2026-05-16", "Vultr Paris (France) Port Scanning Hosts for 2026-04-16", "Vultr Paris (France) Port Scanning Hosts for 2026-05-15", "Vultr Paris (France) Port Scanning Hosts for 2026-05-14", "Vultr Paris (France) Port Scanning Hosts for 2026-04-14", "Vultr Paris (France) Port Scanning Hosts for 2026-04-13", "Vultr Paris (France) Port Scanning Hosts for 2026-05-13", "Honeypot Port Scanning \u2014 2026-05-13", "Honeypot Reconnaissance \u2014 2026-05-13", "Honeypot IDS Alerts \u2014 2026-05-13"], "malware_count": 1, "passive_dns_count": 2, "malware_samples": ["35a977d920a9f16566ef922b0e2230c8ec6917d932cb1a58f6bbd49f27e5ffee"], "passive_dns": ["hydroqc-remboursement.com", "fixupsinfo.com"]}


ioc_type: ipv4
ioc_value: 176.65.134.4
source: otx
validated_at: 2026-05-24T18:05:50.736848
raw_response:
  {"pulse_count": 8, "reputation": 0, "country": "Germany", "country_code": "DE", "city": null, "asn": "AS56325 diogelo ltd.", "indicator": "176.65.134.4", "tags": ["01.10.2025", "tpot", "sentrypeer", "suricata", "honeypot", "p0f", "tanner", "ciscoasa", "ssh", "2025", "LAMP", "dionaea", "HoneyNet Connect", "sftp", "fatt", "dugganusa", "malicious", "monthly", "honeytrap", "sensor-tagged", "blocklist", "cowrie", "mailoney", "cisco"], "pulses": ["Tor Exit Node", "Network Blocklists 2025-12-14 #2", "Honeypot Data \u2013 T-Pot \u2013 Sydney, Australia \u2013 November 2025", "CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 November 2025", "LCIA HoneyNet Data - October 2025 - H0neytr4p", "LCIA HoneyNet Data - October 2025 - Ciscoasa", "HoneyPot Connect 01.10.2025", "Malware Filter - Botnet List - 15-09-2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 176.65.134.19
source: otx
validated_at: 2026-05-24T18:05:57.342603
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Germany", "country_code": "DE", "city": null, "asn": "AS56325 diogelo ltd.", "indicator": "176.65.134.19", "tags": ["PowerPC", "stealer", "sentrypeer", "fake_ssa", "exe", "32-bit", "ascii", "176-65-139-20", "Formbook", "rat", "emotet", "tanner", "mirai", "Mozi", "ChromeElevator", "coinminer", "steam", "february", "Jwr", "mips", "sparc", "plugin", "130-12-180-119-8080", "ACRStealer", "xml", "grouped", "Macquarie", "hta", "Tofsee", "clearfake", "ConnectBack", "NatWest", "asyncrat", "132-243-173-111-3000", "qilin", "connectwise", "elf", "LummaStealer", "encrypted", "d854e4", "NetSupport", "singapore", "date", "cred.dll", "Westpac", "ua-wget", "phishing", "Raiffeisen", "ukraine", "rmm"], "pulses": ["Twitter Feed - sicehice - 19-04-2026", "URLHaus data - 14-04-2026 (Part 4)", "Honeypot Data \u2013 T-Pot - Sydney, Australia - March 2026", "Vultr Paris (France) Port Scanning Hosts for 2026-03-17", "DigitalOcean Singapore Port Scanning Hosts for 2026-03-17", "Malicious IP Addresses", "Threat Intel Report - W10-2025"], "malware_count": 1, "passive_dns_count": 1, "malware_samples": ["2c25d0736813e54e7030d6b524e532f73c36c9b5f07d38734dce2ec3e6edce5b"], "passive_dns": ["surenenlineas.com"]}


ioc_type: ipv4
ioc_value: 176.65.142.35
source: otx
validated_at: 2026-05-24T18:06:10.536718
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Germany", "country_code": "DE", "city": null, "asn": "ASNone ", "indicator": "176.65.142.35", "tags": [], "pulses": ["Threatfox Recent Additions"], "malware_count": 0, "passive_dns_count": 54, "malware_samples": [], "passive_dns": ["ucuzaaldinaldin.net.tr", "karaca-market.biz.tr", "ekstra-karaca.biz.tr", "kacmazgunler.biz.tr", "yazkampanyasi.biz.tr", "guncel-nisanfirsat.biz.tr", "crfr-sa.org.tr", "ceptefirsatnoktasi.biz.tr", "kacmazgunler.com.tr", "parngvensecure-onay.com.tr", "aktuel-nisan.com.tr", "firsat-bufirsat.org.tr", "ceptenisan.org.tr", "sokdahaucuzuyok.com.tr", "nisan-bitti.com.tr", "pasaj-nisanzamani.net.tr", "enucuzsayfasi.org.tr", "cepte-ekstra.biz.tr", "nisan-bitti.info.tr", "soktacep.com.tr"]}


ioc_type: ipv4
ioc_value: 93.157.106.122
source: otx
validated_at: 2026-05-24T18:06:40.254879
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "", "country_code": "", "city": "", "asn": "AS35913 dedipath", "indicator": "93.157.106.122", "tags": [], "pulses": ["IOCs - 2022111347 - ANIA Threat Feeds - IP Segment 4"], "malware_count": 1, "passive_dns_count": 170, "malware_samples": ["866e223ef4ae556bdb6ddae42fc028225df84c4a432a5202f1d7317ccae119ca"], "passive_dns": ["www.dealzfind.com", "www.rakutendealz.com", "checkout.leaf-masque.com", "checkout.revoltboxers.com", "www.trycupidonic.store", "www.securedealsnet.com", "checkout.flytex-officiel.com", "checkout.shopcabaia.com", "www.offers.kg", "checkout.getquietlab.now", "checkout.shoptoddla.com", "checkout.ouvra.shop", "checkout.sereniumitalia.com", "shopplateful.com", "www.2pay.ws", "mysafedeals1.com", "chefpreserve.us", "checkout.shopfincut.com", "www.vanmuldertools.com", "vanmuldertools.com"]}


ioc_type: ipv4
ioc_value: 93.157.106.131
source: otx
validated_at: 2026-05-24T18:07:02.193526
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "", "country_code": "", "city": "", "asn": "AS35913 dedipath", "indicator": "93.157.106.131", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 44, "malware_samples": [], "passive_dns": ["z525.com", "www.z525.com", "skytechbits.com", "profilemaven.com", "www.smoothieadore.com", "smoothieadore.com", "procardo.com", "sizeinfosec.com", "yakoubben.com", "slotjp99link.com", "pumpkincarvingcraze.com", "smartelegance99.com", "ochoquilates.com", "slotter99i.com", "slotjp99jos.com", "pusatfreebetug.com", "snapshottube.com", "oceanofverticals.com", "slotjuniortogel.com", "www.slotjuniortogel.com"]}


ioc_type: ipv4
ioc_value: 93.157.106.181
source: otx
validated_at: 2026-05-24T18:07:28.119058
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "", "country_code": "", "city": "", "asn": "AS35913 dedipath", "indicator": "93.157.106.181", "tags": ["abuseipdb"], "pulses": ["Compiled Blocklist of AbuseIPDB: Most reported IP addresses - by skocherhan", "Aggregated Blocklist for AbuseIPDB: A list of the most reported IP addresses.", "ETIC Cybersecurity  2024-07-10  Port Scan", "ETIC Cybersecurity  2024-07-01  Port Scan"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 93.157.106.194
source: otx
validated_at: 2026-05-24T18:07:35.710744
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "", "country_code": "", "city": "", "asn": "AS35913 dedipath", "indicator": "93.157.106.194", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 26, "malware_samples": [], "passive_dns": ["inshotapk.com", "airportterminalmaps.com", "phuongdostore.com", "juraganhobi.com", "evilgeniusforabettertomorrow.com", "baikagency.com", "note-ables.com", "medicalfacilitycleaning.com", "mediasharks.com", "dgvpets.com", "bestclothdiaperscanada.com", "eurosportsdirecttv.com", "baikacademy.com", "www.baikacademy.com", "www.design4stars.com", "design4stars.com", "freshlooktub.com", "www.freshlooktub.com", "s1288pokerblog.com", "bestwesterntacomadome.com"]}


ioc_type: ipv4
ioc_value: 93.157.106.204
source: otx
validated_at: 2026-05-24T18:07:40.417542
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "", "country_code": "", "city": "", "asn": "AS35913 dedipath", "indicator": "93.157.106.204", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 48, "malware_samples": [], "passive_dns": ["eliteagencytravel.com", "developedafrica.com", "redwolf88.com", "gettingwholesystem.com", "getnewswire.com", "texture-propertiesdxb.com", "www.texture-propertiesdxb.com", "delightceylon.com", "www.delightceylon.com", "www.key-golf.com", "www.jobsindoha.com", "adx-crm.com", "oritotos.com", "kisanteam.com", "info-amelie.com", "ourquranschool.com", "affinni.com", "www.tecxco.com", "tecxco.com", "mouigvvri.click"]}


ioc_type: ipv4
ioc_value: 93.157.106.222
source: otx
validated_at: 2026-05-24T18:07:52.546264
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "", "country_code": "", "city": "", "asn": "AS35913 dedipath", "indicator": "93.157.106.222", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 16, "malware_samples": [], "passive_dns": ["thisisthebestdomain.xyz", "panel.thisisthebestdomain.xyz", "xpisechki.vip", "xlapka.xyz", "m.pisechki.net", "pornolapka.club", "pisechki.org", "pornogarem.com", "www.pisechki.pics", "pisechki.onl", "m.pornolapka.link", "pornolapka.onl", "pisechki.xyz", "pornolapka.art", "pornolapka.xyz", "pisechki.pics"]}


ioc_type: ipv4
ioc_value: 93.157.106.244
source: otx
validated_at: 2026-05-24T18:08:53.004277
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "", "country_code": "", "city": "", "asn": "AS35913 dedipath", "indicator": "93.157.106.244", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 17, "malware_samples": [], "passive_dns": ["x.pornovek.xyz", "pornopalka.art", "m.pornopalka.click", "xpalka.xyz", "pornopalka.cc", "xpalka.club", "m.pornovek.club", "x.pornovek.club", "pornopalka.pro", "binohedopardo.site", "binohedotarxo.site", "binohedotardo.site", "binohedotarto.site", "binohedoparto.site", "sadetti23r2.xyz", "sadorkedior2.xyz", "kadorkedir2.xyz"]}


ioc_type: ipv4
ioc_value: 93.157.106.78
source: otx
validated_at: 2026-05-24T18:09:19.363442
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "", "country_code": "", "city": "", "asn": "AS35913 dedipath", "indicator": "93.157.106.78", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 31, "malware_samples": [], "passive_dns": ["tvturklive.org", "turkruhd.link", "italyruhd.com", "turkruhd.click", "turkruhd.biz", "italyru.net", "tv2.turkruhd.top", "tv7.turkruhd.click", "www.tv6.turkruhd.click", "italyru.com", "tvturk.live", "serials.best", "turk24ru.com", "tv6.turkruhd.click", "tv.turkruhd.link", "turkruhd.info", "tv1.turkruhd.xyz", "tv3.turkruhd.link", "tv2.turkruhd.link", "italyru.org"]}


ioc_type: ipv4
ioc_value: 91.103.140.191
source: otx
validated_at: 2026-05-24T18:11:04.055973
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "France", "country_code": "FR", "city": "Paris", "asn": "AS39894 aufeminin s.a.", "indicator": "91.103.140.191", "tags": ["lazarus", "manuscrypt", "stealer", "virustotal", "github account", "telegram", "project", "evolution", "execution", "description", "malware", "threat intel", "alliance", "github", "figure", "javascript", "bitcoin", "blog domain", "cloud", "fake github", "hack", "github security", "slow", "command", "korean", "rn stealer", "rn loader", "slow pisces", "february", "discord", "linkedin", "dafom", "manipulation", "wallet", "security", "deserialization", "april", "python", "tools", "rn", "c2 server", "stratofear", "safe", "malicious", "value", "north korea", "jumpcloud", "tradertraitor", "research", "july"], "pulses": ["Who is TraderTraitor?", "Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["www.doshik.ru"]}


ioc_type: ipv4
ioc_value: 91.103.140.225
source: otx
validated_at: 2026-05-24T18:11:40.308015
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "France", "country_code": "FR", "city": "Paris", "asn": "AS39894 aufeminin s.a.", "indicator": "91.103.140.225", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 13, "malware_samples": [], "passive_dns": ["itx5-secure.smartadserver.com", "smart.hola.com", "itx5-itx4-eqx.smartadserver.com", "www.smartadserver.com", "ww651.smartadserver.com", "www.sasqos.com", "itx5-eqx.smartadserver.com", "www7.smartadserver.com", "network.aufeminin.com", "ww400.smartadserver.com", "itx5-itx4.smartadserver.com", "itx5.smartadserver.com", "smartadserver.com"]}


ioc_type: ipv4
ioc_value: 91.103.140.42
source: otx
validated_at: 2026-05-24T18:12:46.692980
raw_response:
  {"pulse_count": 42, "reputation": 0, "country": "France", "country_code": "FR", "city": "Paris", "asn": "AS39894 aufeminin s.a.", "indicator": "91.103.140.42", "tags": ["brute force", "Brute-Force", "SSH", "honeypot", "Bruteforce", "ssh", "Honeypot", "DDoS", "cowrie", "RTBH"], "pulses": ["IP Addresses Logged by the Rosethorn PotNet", "Fakelabs Honeynet Project", "Uzaktan Tetiklenen Kara Delik", "SSH BruteForce", "SSH BruteForce", "SSH BruteForce", "SSH BruteForce", "SSH BruteForce", "SSH BruteForce", "SSH BruteForce", "SSH BruteForce", "SSH BruteForce", "SSH BruteForce", "SSH BruteForce", "SSH_BruteForce_V1", "SSH_BruteForce_V1", "IPV4_Threat_Actors", "Automated Threat Intelligence - Brute-force hosts for 2024-09-02", "IP Address", "IP Address"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 91.103.140.6
source: otx
validated_at: 2026-05-24T18:13:04.858910
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "France", "country_code": "FR", "city": "Paris", "asn": "AS39894 aufeminin s.a.", "indicator": "91.103.140.6", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 41, "malware_samples": [], "passive_dns": ["online.dachaogorod.store", "eqx-secure.smartadserver.com", "cdn.adfrika.com", "smart2.allocine.fr", "smart.allocine.fr", "smart.idealista.pt", "ads.publicidad.net", "mobile.smartadserver.com", "itx5-eqx.smartadserver.com", "itx5-itx4-eqx.smartadserver.com", "eqx-itx4.smartadserver.com", "aufeminin.com", "ww251.bz-berlin.de", "sm.actinside.com", "network.wewomen.be", "network.wewomen.ca", "ww302.smartadserver.com", "ww62.smartadserver.com", "ww881.smartadserver.com", "network.sofeminine.co.uk"]}


ioc_type: ipv4
ioc_value: 91.103.140.90
source: otx
validated_at: 2026-05-24T18:14:01.056869
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "France", "country_code": "FR", "city": "Paris", "asn": "AS39894 aufeminin s.a.", "indicator": "91.103.140.90", "tags": ["honeypot", "portscan", "scanner", "digital ocean", "ssh", "bruteforce", "scanners", "voidtrap", "attacker-ip", "automated"], "pulses": ["DigitalOcean Toronto (CA) SSH Bruteforce Hosts for 2026-04-06", "DigitalOcean Toronto (CA) Port Scanning Hosts for 2026-04-06", "Malware Filter - Botnet List - 06-04-2026 (Part 17)", "VoidTrap Live Threat Feed \u2014 2026-04-06"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["aezaaafn.morij2024.com"]}


ioc_type: ipv4
ioc_value: 91.103.252.108
source: otx
validated_at: 2026-05-24T18:14:20.202740
raw_response:
  {"pulse_count": 45, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.108", "tags": ["cyber security", "ioc", "phishing", "malicious", "Nextray"], "pulses": ["PurpleSynapz", "IOC Records Provided by @NextRayAI", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOC Records \u2192Provided by @NextRayAI", "HIVE           (Pulse created by RVS_i_am)", "HIVE           (Pulse created by RVS_i_am)", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "IOC Records \u2192Provided by @NextRayAI"], "malware_count": 0, "passive_dns_count": 500, "malware_samples": [], "passive_dns": ["kirekhari.lol", "reaks.ru", "www.job0.ru", "job0.ru", "servisq.site", "creahost.ru", "www.creahost.ru", "magazinovna.ru", "www.magazinovna.ru", "xn---1-6kcp4axv.xn--p1ai", "www.xn---1-6kcp4axv.xn--p1ai", "www.board-21.ru", "board-21.ru", "1rc.su", "www.1rc.su", "www.reklamnaya.com", "reklamnaya.com", "xn--80affa9amdj.xn--p1ai", "www.xn--80affa9amdj.xn--p1ai", "www.vremena.site"]}


ioc_type: ipv4
ioc_value: 91.103.252.111
source: otx
validated_at: 2026-05-24T18:14:22.555213
raw_response:
  {"pulse_count": 11, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.111", "tags": ["DDoS", "RTBH"], "pulses": ["Uzaktan Tetiklenen Kara Delik", "ETIC Cybersecurity  2024-10-03  Port Scan", "ETIC Cybersecurity  2024-10-02  Port Scan", "ETIC Cybersecurity  2024-08-31  Port Scan", "ETIC Cybersecurity  2024-08-30  Port Scan", "ETIC Cybersecurity  2024-08-23  Port Scan", "ETIC Cybersecurity  2024-08-22  Port Scan", "ETIC Cybersecurity  2024-08-21  Port Scan", "ETIC Cybersecurity  2024-08-18  Port Scan", "ETIC Cybersecurity  2024-08-17  Port Scan", "ETIC Cybersecurity  2024-08-16  Port Scan"], "malware_count": 0, "passive_dns_count": 9, "malware_samples": [], "passive_dns": ["shadow.starzee.site", "ru.shiny.work", "yooloo.ru", "tvvt.ru", "lae20bae.justinstalledpanel.com", "megogoqhhpdom.site", "tvzavrffdpplus.site", "ldd4cb12.justinstalledpanel.com", "l624629d.justinstalledpanel.com"]}


ioc_type: ipv4
ioc_value: 91.103.252.114
source: otx
validated_at: 2026-05-24T18:14:24.902894
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.114", "tags": ["PowerPC", "t1134 access", "stealer", "DarkGate", "crimson rat", "exe", "lummac2", "remote access", "quasar", "gcleaner", "rar", "hancitor", "wshrat", "wannacry", "32-bit", "ascii", "pwd-beta", "botnet", "redline", "qbot", "Formbook", "motorola", "emotet", "pw-123456", "racealer", "jenxcus", "mirai", "any.run", "first", "Mozi", "report", "february", "hawkeye", "bladabindi", "mips", "sparc", "script", "houdini", "azorult", "PrivateLoader", "december", "TA577", "streamline", "orcusrat", "track them", "lumma", "agenttesla", "asyncrat", "apk", "32"], "pulses": ["IOCS202312212258", "IOCS202312171728", "ACTIVIDAD MALICIOSA | Relacionada con RecordBreaker 20-11-2023", "URLHaus data - 10-11-2023"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["tronearn.xyz"]}


ioc_type: ipv4
ioc_value: 91.103.252.115
source: otx
validated_at: 2026-05-24T18:14:27.291662
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.115", "tags": [], "pulses": ["IOCs - 20225111358 - ANIA Threat Feeds - IP Segment 1", "IOCs - 20225111358 - ANIA Threat Feeds - IP Segment 2", "IOCs - 20225111358 - ANIA Threat Feeds - IP Segment 3"], "malware_count": 0, "passive_dns_count": 6, "malware_samples": [], "passive_dns": ["m.akini.ru", "evrika.center", "api.akini.ru", "crm.akini.ru", "akini.ru", "l4eb5d5f.justinstalledpanel.com"]}


ioc_type: ipv4
ioc_value: 91.103.252.116
source: otx
validated_at: 2026-05-24T18:14:29.544031
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.116", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 13, "malware_samples": [], "passive_dns": ["thenameoffather.space", "grands.biz", "ultmate.diskstation.org", "nownowdo.monster", "supportmarketing.link", "greathelp.icu", "dontmind.cyou", "checkout2020.xyz", "znode12.maxichain.ru", "znode04.maxichain.ru", "znode1.znamen.tk", "le2dc2fe.justinstalledpanel.com", "lae59727.justinstalledpanel.com"]}


ioc_type: ipv4
ioc_value: 91.103.252.120
source: otx
validated_at: 2026-05-24T18:14:34.351288
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.120", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 12, "malware_samples": [], "passive_dns": ["praca-vezi.com", "naif-chicken.com", "kfc-me.com", "www.naif-chicken.com", "albaek24.com", "blaxinas.com", "la08254f.justinstalledpanel.com", "l8206b5d.justinstalledpanel.com", "l8c8aedc.justinstalledpanel.com", "www.velo-track.ru", "velo-track.ru", "royal-arome.ru"]}


ioc_type: ipv4
ioc_value: 91.103.252.166
source: otx
validated_at: 2026-05-24T18:15:11.937299
raw_response:
  {"pulse_count": 14, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.166", "tags": [], "pulses": ["ETIC Cybersecurity  2024-10-05  Port Scan", "ETIC Cybersecurity  2024-09-21  Port Scan", "ETIC Cybersecurity  2024-09-20  Port Scan", "ETIC Cybersecurity  2024-09-19  Port Scan", "ETIC Cybersecurity  2024-09-02  Port Scan", "ETIC Cybersecurity  2024-09-02  Port Scan", "ETIC Cybersecurity  2024-09-01  Port Scan", "ETIC Cybersecurity  2024-08-31  Port Scan", "ETIC Cybersecurity  2024-08-24  Port Scan", "ETIC Cybersecurity  2024-08-23  Port Scan", "ETIC Cybersecurity  2024-08-18  Port Scan", "ETIC Cybersecurity  2024-08-18  Port Scan", "ETIC Cybersecurity  2024-08-17  Port Scan", "ETIC Cybersecurity  2024-08-16  Port Scan"], "malware_count": 0, "passive_dns_count": 16, "malware_samples": [], "passive_dns": ["www.tiviguide.com", "tiviguide.com", "toureiffell.online", "dubai-headaut.online", "savethechildrennow.online", "tomocrudit.dynamicperiodictable.com", "legolland.constantinedoukas.com", "fidellllty.online", "fidelllty.online", "tdomerltrade.online", "headaut.online", "fndobonk.online", "fndobenk.online", "fndo.online", "soncyast.site", "soncyast.online"]}


ioc_type: ipv4
ioc_value: 91.103.252.182
source: otx
validated_at: 2026-05-24T18:15:30.351483
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.182", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 68, "malware_samples": [], "passive_dns": ["nodirtyaddictions.com", "attirestop.com", "avvardbc.com", "jeffreydstephens.com", "aithesuperpower.com", "kelowna-childcare.com", "stargate-defi.com", "tedswoodworking-projects.com", "besttruckpicks.com", "nursinghomez.com", "haveliamarniwas.com", "libelula360.com", "kushtiatravels.com", "aimorroco.com", "fulusrealtor.com", "terrenosencolima.com", "carskida.com", "servicosparana.com", "rajapunggamarsada.com", "monzofinancial.com"]}


ioc_type: ipv4
ioc_value: 91.103.252.185
source: otx
validated_at: 2026-05-24T18:15:35.086603
raw_response:
  {"pulse_count": 13, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.185", "tags": [], "pulses": ["ETIC Cybersecurity  2024-10-04  Port Scan", "ETIC Cybersecurity  2024-10-04  Port Scan", "ETIC Cybersecurity  2024-10-02  Port Scan", "ETIC Cybersecurity  2024-09-12  Port Scan", "ETIC Cybersecurity  2024-09-12  Port Scan", "ETIC Cybersecurity  2024-09-11  Port Scan", "ETIC Cybersecurity  2024-09-10  Port Scan", "ETIC Cybersecurity  2024-08-31  Port Scan", "ETIC Cybersecurity  2024-08-23  Port Scan", "ETIC Cybersecurity  2024-08-22  Port Scan", "ETIC Cybersecurity  2024-08-22  Port Scan", "ETIC Cybersecurity  2024-08-17  Port Scan", "ETIC Cybersecurity  2024-08-17  Port Scan"], "malware_count": 0, "passive_dns_count": 6, "malware_samples": [], "passive_dns": ["rabbitmq.yelm.io", "yelm.io", "australiansupers.com", "ifccorporation.com", "dhl-services.info", "gov-claim-dashboard.com"]}


ioc_type: ipv4
ioc_value: 91.103.252.189
source: otx
validated_at: 2026-05-24T18:15:37.387454
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.189", "tags": ["elf", "stealer", "c2", "RemcosRAT", "encrypted", "exe", "malware", "64", "32-bit", "ascii", "CobaltStrike", "Lumma", "botnet", "Stealc", "dll", "rat", "pw-123456", "mirai", "Mozi", "discord", "infostealer", "mips", "RecordBreaker", "upx", "hajime", "pw: epsilon-beta", "AveMariaRAT", "arm7", "RedLineStealer", "Vidar", "pw-1593", "GuLoader", "32"], "pulses": ["SarlackLab C2 Tracking", "URLHaus data - 10-09-2023"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["comradefox.store", "nikimiboom.online"]}


ioc_type: ipv4
ioc_value: 91.103.252.19
source: otx
validated_at: 2026-05-24T18:15:40.104722
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.19", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 186, "malware_samples": [], "passive_dns": ["saawariyamarketing.com", "trwmembership.com", "surascollection.com", "one-daysightseeing.com", "77-percent.com", "edalni.com", "warriors-mu.com", "expertosuniversitarios.com", "jewelleryretouch.com", "gotherealworld.com", "feedbacksea.com", "fashionsaddiction.com", "vpntvbrasil.com", "videogamesstars.com", "mindsetwhizz.com", "xn--xxchange-b1a.com", "sashisworld.com", "www.sashisworld.com", "www.whiteposh.com", "whiteposh.com"]}


ioc_type: ipv4
ioc_value: 91.103.252.198
source: otx
validated_at: 2026-05-24T18:15:45.749063
raw_response:
  {"pulse_count": 13, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.198", "tags": ["DDoS", "RTBH"], "pulses": ["Uzaktan Tetiklenen Kara Delik", "ETIC Cybersecurity  2024-10-05  Port Scan", "ETIC Cybersecurity  2024-10-04  Port Scan", "ETIC Cybersecurity  2024-10-03  Port Scan", "ETIC Cybersecurity  2024-09-01  Port Scan", "ETIC Cybersecurity  2024-08-31  Port Scan", "Wala", "ETIC Cybersecurity  2024-08-22  Port Scan", "ETIC Cybersecurity  2024-08-21  Port Scan", "ETIC Cybersecurity  2024-08-21  Port Scan", "ETIC Cybersecurity  2024-08-18  Port Scan", "ETIC Cybersecurity  2024-08-17  Port Scan", "ETIC Cybersecurity  2024-08-16  Port Scan"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["poligon-project.site"]}


ioc_type: ipv4
ioc_value: 91.103.252.21
source: otx
validated_at: 2026-05-24T18:16:16.182773
raw_response:
  {"pulse_count": 35, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.21", "tags": ["Bruteforce", "Honeypot", "Brute-Force", "SSH"], "pulses": [" SSH Brute-Force Honeypot Live", " SSH Brute-Force Honeypot Live", " SSH Brute-Force Honeypot Live", " SSH Brute-Force Honeypot Live", " SSH Brute-Force Honeypot Live", "test_pulse", "SSH-Honeypot", "SSH-Honeypot", "SSH-Honeypot", "SSH-Honeypot", "SSH-Honeypot", "IP_SSH                             (Pulse curated by sec.pin.soc)", "IP_SSH                      (Pulse curated by sec.pin.soc)", "IP_SSH                      (Pulse curated by sec.pin.soc)", "IP_SSH                      (Pulse curated by sec.pin.soc)", "IP_SSH                      (Pulse curated by sec.pin.soc)", "IP_SSH                      (Pulse curated by sec.pin.soc)", "IP_SSH                   (Pulse curated by sec.pin.soc)", "IP_SSH                   (Pulse curated by sec.pin.soc)", "IP_SSH                             (Pulse curated by sec.pin.soc)"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 91.103.252.214
source: otx
validated_at: 2026-05-24T18:16:19.521034
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.214", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 107, "malware_samples": [], "passive_dns": ["ahmedceo.com", "s3-api.pleasenever.click", "xpanel.server-nl.pleasenever.click", "it13.intelvpn.site", "online-garant.ml", "www.online-garant.ml", "bonga-token.ru", "www.bonga-token.ru", "www.haykakan-mod.ml", "haykakan-mod.ml", "10k-podischik.tk", "www.10k-podischik.tk", "www.doc0.magazis.ru", "doc0.magazis.ru", "www.queenv.ru", "queenv.ru", "www.kolsch.ru", "kolsch.ru", "w-studio.ga", "www.ajento.ru"]}


ioc_type: ipv4
ioc_value: 91.103.252.216
source: otx
validated_at: 2026-05-24T18:16:23.830055
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.216", "tags": ["c2"], "pulses": ["SarlackLab C2 Tracking"], "malware_count": 1, "passive_dns_count": 59, "malware_samples": ["a2b78a987ed1b81520492b9ac278466ad2726d01c05cbf7d9d7bcee005243dee"], "passive_dns": ["nrzpanel.ebizme.top", "smartcomplex.site", "filesname.brainygate.site", "astanaguide.brainygate.site", "astanadop1.brainygate.site", "amlastana.brainygate.site", "orbis-zalog.brainygate.site", "astanadop.brainygate.site", "orbis.brainygate.site", "orbis1.brainygate.site", "swissformverif1.brainygate.site", "rangefinancereports.brainygate.site", "orbispf.brainygate.site", "orbis-dicts.brainygate.site", "astana-checkspr.brainygate.site", "astana-verifysign.brainygate.site", "astana-spr.brainygate.site", "swiss-mintos.brainygate.site", "rf-pf.brainygate.site", "swisssprlink.brainygate.site"]}


ioc_type: ipv4
ioc_value: 91.103.252.227
source: otx
validated_at: 2026-05-24T18:16:32.911182
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.227", "tags": [], "pulses": ["spam phishing source"], "malware_count": 0, "passive_dns_count": 8, "malware_samples": [], "passive_dns": ["ftp.promosoft24.info", "cloud.promosoft24.info", "phpmyadmin.promosoft24.info", "promosoft24.info", "zabbix.promosoft24.info", "pbx.promosoft24.info", "otrs.promosoft24.info", "rustem1.promosoft24.info"]}


ioc_type: ipv4
ioc_value: 91.103.252.231
source: otx
validated_at: 2026-05-24T18:16:40.799439
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.231", "tags": [], "pulses": ["BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "2024-DIC-10-Clon", "CLON IPIF", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL"], "malware_count": 0, "passive_dns_count": 6, "malware_samples": [], "passive_dns": ["www.us10.malefashionable.su", "us10.malefashionable.su", "us7.malefashionable.su", "www.us7.malefashionable.su", "www.us2.malefashionable.su", "us2.malefashionable.su"]}


ioc_type: ipv4
ioc_value: 91.103.252.232
source: otx
validated_at: 2026-05-24T18:16:43.465033
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.232", "tags": [], "pulses": ["spam phishing source"], "malware_count": 0, "passive_dns_count": 66, "malware_samples": [], "passive_dns": ["wa49vc.com", "vy82vm.com", "qn92vh.com", "ye40dp.com", "kf63bq.com", "lhup1.com", "lhup11.com", "vfq921.com", "whychristiansgetsick.org", "8433oo.com", "8433dd.com", "8433ss.com", "8433uu.com", "8433ii.com", "8433nn.com", "8433mm.com", "8433gg.com", "8433cc.com", "8433tt.com", "8433bb.com"]}


ioc_type: ipv4
ioc_value: 91.103.252.243
source: otx
validated_at: 2026-05-24T18:17:07.550778
raw_response:
  {"pulse_count": 32, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.243", "tags": ["cyber security", "ioc", "phishing", "malicious", "Nextray"], "pulses": ["IOC Records Provided by @NextRayAI", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOC Records \u2192Provided by @NextRayAI", "HIVE           (Pulse created by RVS_i_am)", "HIVE           (Pulse created by RVS_i_am)", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "IOC Records \u2192Provided by @NextRayAI", "IOC Records \u2192Provided by @NextRayAI"], "malware_count": 0, "passive_dns_count": 6, "malware_samples": [], "passive_dns": ["bmosecure.danielsawyers.com", "eqba.danielsawyers.com", "www.danielsawyers.com", "eqsecure.danielsawyers.com", "bmo.danielsawyers.com", "danielsawyers.com"]}


ioc_type: ipv4
ioc_value: 91.103.252.248
source: otx
validated_at: 2026-05-24T18:17:12.025001
raw_response:
  {"pulse_count": 32, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.248", "tags": ["cyber security", "ioc", "phishing", "malicious", "Nextray"], "pulses": ["IOC Records Provided by @NextRayAI", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOC Records \u2192Provided by @NextRayAI", "HIVE           (Pulse created by RVS_i_am)", "HIVE           (Pulse created by RVS_i_am)", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "IOC Records \u2192Provided by @NextRayAI", "IOC Records \u2192Provided by @NextRayAI"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["hoteling-fr.com"]}


ioc_type: ipv4
ioc_value: 91.103.252.25
source: otx
validated_at: 2026-05-24T18:17:29.168259
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.25", "tags": ["cuba", "akamaiasn1", "geoip", "C2", "indonesia", "as15169", "facebook", "win32", "media", "ghost", "proton", "twitter", "Rhadamanthys", "as852", "ukraine", "mini", "level3", "telecom", "seznam", "as3359", "as16509", "as8075", "akamaias", "google", "Stealer", "public url", "amazon02", "as20940", "win64", "mexico"], "pulses": ["agressive extra", "n0paste - Show paste: \\\"No Problems\\\" - dos meses del URLscan", "Rhadamanthys Stealer C2s"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 91.103.252.252
source: otx
validated_at: 2026-05-24T18:17:34.309544
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.252", "tags": [], "pulses": ["spam phishing source", "IOCs - 20222121426 - ANIA Threat Feeds - IP Segment 1", "IOCs - 20221291345 - ANIA Threat Feeds - IP Segment 2"], "malware_count": 0, "passive_dns_count": 5, "malware_samples": [], "passive_dns": ["smart.kors.club", "cloud.kors.club", "click.kors.club", "webapp.kors.club", "storage.kors.club"]}


ioc_type: ipv4
ioc_value: 91.103.252.253
source: otx
validated_at: 2026-05-24T18:17:36.693441
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.253", "tags": [], "pulses": ["spam phishing source"], "malware_count": 0, "passive_dns_count": 14, "malware_samples": [], "passive_dns": ["ca.bellax.ink", "dexmine.net", "securecommbanksupport.com", "securecommbank.com", "supportcommbank.com", "verify-mycomm.com", "commbank-auth.com", "mycommverify.com", "mycommauth.com", "authcommbank.net", "authapplepay.net", "reverifycommbank.com", "authcommbank.com", "vendas06.pmnfs.cloud"]}


ioc_type: ipv4
ioc_value: 91.103.252.31
source: otx
validated_at: 2026-05-24T18:17:46.758322
raw_response:
  {"pulse_count": 13, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.31", "tags": ["elf", "stealer", "c2", "RemcosRAT", "LummaStealer", "encrypted", "doc", "dropped-by-amadey", "xworm", "exe", "64", "32-bit", "MarsStealer", "CobaltStrike", "Lumma", "CoinMiner", "arm", "Stealc", "Formbook", "RedLine", "rat", "DarkCloud", "mirai", "Mozi", "gafgyt", "raccoonv2", "Smoke Loader", "mips", "RecordBreaker", "hajime", "SocGholish", "AgentTesla", "smokeloader", "Amadey", "dcrat", "healer", "dropped-by-PrivateLoader", "RedLineStealer", "GuLoader", "ArkeiStealer", "32", "dropped-by-SmokeLoader", "opendir"], "pulses": ["BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "2024-DIC-10-Clon", "CLON IPIF", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Raccoon Stealer v2 / RecordBreaker C2 Servers as of 03.08.2023", "Threatview.io IP Blocklist", "URLHaus data - 26-07-2023"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["lab89158.justinstalledpanel.com"]}


ioc_type: ipv4
ioc_value: 91.103.252.32
source: otx
validated_at: 2026-05-24T18:17:49.164617
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.32", "tags": ["elf", "2023", "doc", "encrypted", "dropped-by-amadey", "xmrig", "every link", "exe", "rar", "f801 e8ff", "gcleaner", "64", "32-bit", "njRAT", "ascii", "CoinMiner", "arm", "pgp fingerprint", "Stealc", "Formbook", "Rhadamanthys", "RedLine", "dll", "dropped-by-SmokeLoader", "vbs", "intel", "motorola", "mirai", "Mozi", "gafgyt", "e9a3 a602", "fabookie", "mips", "Loki", "d2c7", "sparc", "RecordBreaker", "Password-protected", "hajime", "info", "PrivateLoader", "BABADEDA", "urls", "glupteba", "SocGholish", "AgentTesla", "smokeloader", "Amadey", "remcos", "RTF"], "pulses": ["AS210644 Aeza International Ltd", "Digital Side - URLs", "URLHaus data - 06-07-2023"], "malware_count": 0, "passive_dns_count": 43, "malware_samples": [], "passive_dns": ["lada-asia.ru", "smiw.online", "7nr.online", "0smi.online", "0new.online", "8top.online", "vdemo.online", "angliki.online", "sportlot.online", "3eda.online", "eda9.online", "9eda.online", "6eda.online", "vip0.online", "6bz.online", "dog0.online", "qtur.online", "9med.online", "my.poptec.site", "www.my.poptec.site"]}


ioc_type: ipv4
ioc_value: 91.103.252.36
source: otx
validated_at: 2026-05-24T18:17:55.963843
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.36", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 42, "malware_samples": [], "passive_dns": ["bundlers.pro", "panakeksvapp.top", "hostglobal.ws", "www.co-host.ru", "viraz.site", "price-domain.ru", "new3.online", "4new.online", "8smi.online", "9sad.online", "6doc.online", "doc6.online", "uef.su", "cmsnow.ru", "informsports.online", "gitarra.online", "eda4.online", "0eda.online", "7eda.online", "8eda.online"]}


ioc_type: ipv4
ioc_value: 91.103.252.38
source: otx
validated_at: 2026-05-24T18:17:58.549492
raw_response:
  {"pulse_count": 40, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.38", "tags": ["Brute-Force", "SSH", "honeypot", "Bruteforce", "ssh", "Honeypot", "cowrie"], "pulses": ["Fakelabs Honeynet Project", "FakeLabs_hexa", "FakeLabs_hexa", " SSH Brute-Force Honeypot Live", " SSH Brute-Force Honeypot Live", " SSH Brute-Force Honeypot Live", " SSH Brute-Force Honeypot Live", " SSH Brute-Force Honeypot Live", "test_pulse", "SSH-Honeypot", "SSH-Honeypot", "SSH-Honeypot", "SSH-Honeypot", "SSH-Honeypot", "IP_SSH                      (Pulse curated by sec.pin.soc)", "IP_SSH                      (Pulse curated by sec.pin.soc)", "IP_SSH                      (Pulse curated by sec.pin.soc)", "IP_SSH                      (Pulse curated by sec.pin.soc)", "IP_SSH                      (Pulse curated by sec.pin.soc)", "IP_SSH                   (Pulse curated by sec.pin.soc)"], "malware_count": 0, "passive_dns_count": 6, "malware_samples": [], "passive_dns": ["ariba-cosmetics.com", "brassic-tv.com", "orange-new-black.online", "www.once-upon-time.com", "once-upon-time.com", "91.103.252.38"]}


ioc_type: ipv4
ioc_value: 91.103.252.47
source: otx
validated_at: 2026-05-24T18:18:04.664160
raw_response:
  {"pulse_count": 13, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.47", "tags": ["DDoS", "RTBH"], "pulses": ["Uzaktan Tetiklenen Kara Delik", "ETIC Cybersecurity  2024-10-04  Port Scan", "ETIC Cybersecurity  2024-10-02  Port Scan", "ETIC Cybersecurity  2024-10-02  Port Scan", "ETIC Cybersecurity  2024-09-21  Port Scan", "ETIC Cybersecurity  2024-09-20  Port Scan", "ETIC Cybersecurity  2024-09-01  Port Scan", "ETIC Cybersecurity  2024-08-31  Port Scan", "Wala", "ETIC Cybersecurity  2024-08-22  Port Scan", "ETIC Cybersecurity  2024-08-22  Port Scan", "ETIC Cybersecurity  2024-08-21  Port Scan", "ETIC Cybersecurity  2024-08-16  Port Scan"], "malware_count": 0, "passive_dns_count": 237, "malware_samples": [], "passive_dns": ["anubislogin.com", "healthydiets4u.com", "escort-agency-israel.com", "mover-az.com", "ranjithreviews.com", "thehealthdiscover.com", "smiranol.com", "riyadhcallgirls.com", "aumente-suasvendaonline.com", "shibblackinu.com", "buzzwisemedia.com", "vikasguptamd.com", "agrogaiaenterprises.com", "micalearning.com", "carpetvibe.com", "freakfstyle.com", "hengriunchina.com", "billyyouththeatre.com", "leman-watches.com", "swaginfotech.com"]}


ioc_type: ipv4
ioc_value: 91.103.252.48
source: otx
validated_at: 2026-05-24T18:18:07.359929
raw_response:
  {"pulse_count": 8, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.48", "tags": ["crimson rat", "lummac2", "remote access", "quasar", "gcleaner", "hancitor", "wshrat", "wannacry", "redline", "qbot", "emotet", "racealer", "jenxcus", "any.run", "first", "february", "hawkeye", "bladabindi", "chatgpt", "houdini", "azorult", "december", "orcusrat", "track them", "lumma", "agenttesla", "asyncrat", "dunihi", "belarus", "xworm", "api quotas", "rats", "matiex", "ursnif", "ficker", "netwire", "wannycry", "powershell", "orcus rat", "ukraine", "eternalblue", "seen", "ryuk", "macos", "darkcomet", "april", "xtremerat", "september", "smokeloader", "oski"], "pulses": ["Malware Command and Control IPs", "Malware Command and Control IPs  [Copied from otxrobot_ip]", "IOCS202312212258", "IOC202310090007", "IOC202310090007", "readline", "readline", "RedLine Stealer C2 Collection - 2021 -2023"], "malware_count": 3, "passive_dns_count": 0, "malware_samples": ["d49b1079f69dd292e6256a4a474c4c5a259c4c617ba18d8db1149be90ce3cc7b", "407750d15ff5f78fc422c5df88c1ee42183d07cf1c990079cbd96391dafdf67e", "f3df85b3a75f90c07d09453cca13f42fa520384aee82f2f7677052ec889f886f"], "passive_dns": []}


ioc_type: ipv4
ioc_value: 91.103.252.49
source: otx
validated_at: 2026-05-24T18:18:12.548152
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.49", "tags": [], "pulses": ["BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "2024-DIC-10-Clon", "CLON IPIF", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL"], "malware_count": 0, "passive_dns_count": 7, "malware_samples": [], "passive_dns": ["www.molodoi-gazeta.ru", "molodoi-gazeta.ru", "www.spbdrive.ru", "spbdrive.ru", "www.ceed.ru", "ceed.ru", "vpn.vgrd.ru"]}


ioc_type: ipv4
ioc_value: 91.103.252.52
source: otx
validated_at: 2026-05-24T18:18:17.805801
raw_response:
  {"pulse_count": 15, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.52", "tags": ["MassLogger", "shellscript", "crimson rat", "exe", "quasar", "remote access", "gcleaner", "hancitor", "wshrat", "wannacry", "32-bit", "redline", "qbot", "Formbook", "emotet", "racealer", "jenxcus", "mirai", "first", "any.run", "Mozi", "february", "hawkeye", "bladabindi", "chatgpt", "mips", "sparc", "ddos", "houdini", "azorult", "PowerShellDropboxStealer", "track them", "agenttesla", "urlhaus", "asyncrat", "32", "dunihi", "belarus", "elf", "encrypted", "LummaStealer", "ps", "xworm", "api quotas", "rats", "matiex", "njRAT", "ursnif", "Stealc", "ficker"], "pulses": ["BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "2024-DIC-10-Clon", "CLON IPIF", "_CLON_2024_NOV11", "AS210644 Aeza International Ltd", "SOC_BLOCK_NEW", "IOC202310090007", "IOC202310090007", "URLHaus Malicious URL Blocklist 2023-09-24", "SOC2022ALL", "URLHaus data - 21-08-2023"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["worklink-es.com"]}


ioc_type: ipv4
ioc_value: 91.103.252.59
source: otx
validated_at: 2026-05-24T18:18:20.050175
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.59", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 14, "malware_samples": [], "passive_dns": ["live.theliveevent.fun", "player.sportea.eu", "live.cr7soccers.pro", "live.sportsbest.online", "live.rsoccerlink.site", "live.nbastream.online", "nba2k23.site", "natashamoseley.com", "armand-travel.ru", "l0333c7e.justinstalledpanel.com", "l9e04872.justinstalledpanel.com", "l0c8d313.justinstalledpanel.com", "l08cdab8.justinstalledpanel.com", "leeabef7.justinstalledpanel.com"]}


ioc_type: ipv4
ioc_value: 91.103.252.61
source: otx
validated_at: 2026-05-24T18:18:23.102233
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.61", "tags": ["c2"], "pulses": ["SarlackLab C2 Tracking", "Malware Command and Control IPs", "Malware Command and Control IPs  [Copied from otxrobot_ip]"], "malware_count": 1, "passive_dns_count": 10, "malware_samples": ["29f3ce59957ace30eaf03a694303432e83f2935d8f9506d7a3831de43c6b95b8"], "passive_dns": ["tkkhkk.fun", "admin.tkkhkk.fun", "sub.tkkhkk.fun", "vanillafoto.ru", "www.vanillafoto.ru", "wego.land", "www.wego.land", "www.pokatuha.su", "xn--80aa2apevhq.xn--p1ai", "pokatuha.su"]}


ioc_type: ipv4
ioc_value: 91.103.252.62
source: otx
validated_at: 2026-05-24T18:18:25.528947
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.62", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 21, "malware_samples": [], "passive_dns": ["leagueswave.com", "waveleague.com", "procsbattles.com", "tourneystrike.com", "tournamentflight.com", "line-leagues.com", "line-league.com", "line-tournament.com", "linetournament.com", "tournamentwave.com", "shadowcups.com", "wavetournament.com", "leaguewave.com", "waveleaguecs.com", "waveleagues.com", "tourneyleagues.com", "tournleagues.com", "tournleague.com", "gamertourn.com", "35kopeek.ru"]}


ioc_type: ipv4
ioc_value: 91.103.252.65
source: otx
validated_at: 2026-05-24T18:18:42.433815
raw_response:
  {"pulse_count": 16, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.65", "tags": ["stealer", "DarkGate", "shellscript", "crimson rat", "exe", "quasar", "remote access", "gcleaner", "hancitor", "wshrat", "wannacry", "32-bit", "ascii", "redline", "qbot", "Formbook", "rat", "emotet", "racealer", "jenxcus", "mirai", "first", "any.run", "Mozi", "february", "hawkeye", "bladabindi", "chatgpt", "mips", "sparc", "IcedID", "houdini", "azorult", "track them", "agenttesla", "asyncrat", "apk", "32", "dunihi", "belarus", "elf", "c2", "LummaStealer", "encrypted", "RaccoonStealer", "xworm", "api quotas", "Phobos", "rats", "matiex"], "pulses": ["BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "2024-DIC-10-Clon", "CLON IPIF", "_CLON_2024_NOV11", "AS210644 Aeza International Ltd", "SOC_BLOCK_NEW", "IOC202310090007", "IOC202310090007", "URLHaus data - 02-10-2023", "SOC2022ALL", "Raccoon Stealer v2 / RecordBreaker C2 Servers as of 03.08.2023", "Threat Intel Report - W6-2023.pdf"], "malware_count": 0, "passive_dns_count": 8, "malware_samples": [], "passive_dns": ["testers.site", "goodbegining.shop", "sybusab.com", "www.decentform.com", "decentform.com", "mail-rassilki.ru", "my.standartpay.ru", "mail-rassilka.ru"]}


ioc_type: ipv4
ioc_value: 91.103.252.69
source: otx
validated_at: 2026-05-24T18:18:45.011169
raw_response:
  {"pulse_count": 5, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.69", "tags": [], "pulses": ["IOCs - 202312212054 - ANIA Threat Feeds - IP Segment 0", "IOCs - 202312212116 - ANIA Threat Feeds - IP Segment 2", "IOCs - 202312212121 - ANIA Threat Feeds - IP Segment 3", "IOCs - 202312212128 - ANIA Threat Feeds - IP Segment 4", "IOCs - 202312212134 - ANIA Threat Feeds - IP Segment 5"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["osago.space", "l0f26799.justinstalledpanel.com"]}


ioc_type: ipv4
ioc_value: 91.103.252.81
source: otx
validated_at: 2026-05-24T18:18:51.987367
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.81", "tags": [], "pulses": ["IOCs - 20225111358 - ANIA Threat Feeds - IP Segment 1", "IOCs - 20225111358 - ANIA Threat Feeds - IP Segment 2", "IOCs - 20225111358 - ANIA Threat Feeds - IP Segment 3"], "malware_count": 0, "passive_dns_count": 13, "malware_samples": [], "passive_dns": ["dubz.ru", "www.2ads.space", "momsale.ru", "www.momsale.ru", "2ads.space", "xn----8sbcc4adlugdb0bnr.xn--p1ai", "www.xn----8sbcc4adlugdb0bnr.xn--p1ai", "www.day0.ru", "day0.ru", "news-kuban.ru", "www.news-kuban.ru", "xn-----6kcbbaydda6chtelaimg1bfr3t.xn--p1ai", "www.xn-----6kcbbaydda6chtelaimg1bfr3t.xn--p1ai"]}


ioc_type: ipv4
ioc_value: 91.103.252.88
source: otx
validated_at: 2026-05-24T18:18:54.524176
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.88", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 32, "malware_samples": [], "passive_dns": ["www.shemaproezda.com", "fiis.ru", "volkov-lohovod.xyz", "www.volkov-lohovod.xyz", "faunaplyus.ru", "www.faunaplyus.ru", "www.fiis.ru", "shemaproezda.com", "winhelp24.ru", "www.winhelp24.ru", "azimutnt.ru", "www.avtrak-kirovec.ru", "avtrak-kirovec.ru", "eko-str.ru", "www.eko-str.ru", "domostroy-mag.ru", "www.domostroy-mag.ru", "www.carlifeonline.ru", "carlifeonline.ru", "blumm.ru"]}


ioc_type: ipv4
ioc_value: 91.103.252.97
source: otx
validated_at: 2026-05-24T18:19:11.819455
raw_response:
  {"pulse_count": 19, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS202306 hostglobal.plus ltd", "indicator": "91.103.252.97", "tags": ["webscan", "probing", "webscanner, bruteforce, web app attack", "scanning"], "pulses": ["Webscanners 2018-02-09  thru current day", "Ghosty", "Ghosty", "Ghosty", "Threatfox Recent Additions", "\u7f51\u7edc\u626b\u63cf\u4eea", "\u7f51\u7edc\u626b\u63cf\u4eea", "<script src=\"https://otx.alienvault.com/pulse/5a7e3e70c44e7b48947593a7.js\"></script>", "<script src=\"https://otx.alienvault.com/pulse/5a7e3e70c44e7b48947593a7.js\"></script>", "<script src=\"https://otx.alienvault.com/pulse/5a7e3e70c44e7b48947593a7.js\"></script>", "<script src=\"https://otx.alienvault.com/pulse/5a7e3e70c44e7b48947593a7.js\"></script>", "<script src=\"https://otx.alienvault.com/pulse/5a7e3e70c44e7b48947593a7.js\"></script>", "<script src=\"https://otx.alienvault.com/pulse/5a7e3e70c44e7b48947593a7.js\"></script>", "<script src=\"https://otx.alienvault.com/pulse/5a7e3e70c44e7b48947593a7.js\"></script>", "<script src=\"https://otx.alienvault.com/pulse/5a7e3e70c44e7b48947593a7.js\"></script>", "<script src=\"https://otx.alienvault.com/pulse/5a7e3e70c44e7b48947593a7.js\"></script>", "<script src=\"https://otx.alienvault.com/pulse/5a7e3e70c44e7b48947593a7.js\"></script>", "<script src=\"https://otx.alienvault.com/pulse/5a7e3e70c44e7b48947593a7.js\"></script>", "web2"], "malware_count": 0, "passive_dns_count": 8, "malware_samples": [], "passive_dns": ["arglobaltraders.com", "communityusercreate.com", "l434ce11.justinstalledpanel.com", "l6e292f1.justinstalledpanel.com", "xploid.ru", "titbeat.ru", "l61e3228.justinstalledpanel.com", "l159f0ad.justinstalledpanel.com"]}


ioc_type: ipv4
ioc_value: 91.103.253.105
source: otx
validated_at: 2026-05-24T18:19:22.255138
raw_response:
  {"pulse_count": 12, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS51765 oy crea nova hosting solution ltd", "indicator": "91.103.253.105", "tags": ["port 80", "tcp/80", "http", "botnet"], "pulses": ["IP Addresses Logged by the Rosethorn PotNet", "IPV4_Threat_Actors", "IP Address", "IP Address", "My Test Pulse", "My Test Pulse", "My Test Pulse", "My Test Pulse", "My Test Pulse", "My Test Pulse", "Malicious IP address", "Honeypot Visitors (TCP/80) - 2024-01-08"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 91.103.253.120
source: otx
validated_at: 2026-05-24T18:19:36.357160
raw_response:
  {"pulse_count": 8, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS51765 oy crea nova hosting solution ltd", "indicator": "91.103.253.120", "tags": ["DDoS", "RTBH"], "pulses": ["Uzaktan Tetiklenen Kara Delik", "ETIC Cybersecurity  2024-09-01  Port Scan", "ETIC Cybersecurity  2024-08-31  Port Scan", "ETIC Cybersecurity  2024-08-22  Port Scan", "ETIC Cybersecurity  2024-08-21  Port Scan", "ETIC Cybersecurity  2024-08-17  Port Scan", "ETIC Cybersecurity  2024-08-16  Port Scan", "ETIC Cybersecurity  2024-08-16  Port Scan"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 91.103.253.14
source: otx
validated_at: 2026-05-24T18:19:57.374817
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS51765 oy crea nova hosting solution ltd", "indicator": "91.103.253.14", "tags": ["virustotal"], "pulses": ["FAKEUPDATES by ThreatFox"], "malware_count": 0, "passive_dns_count": 13, "malware_samples": [], "passive_dns": ["bluegaslamp.org", "devcodejs.org", "chestedband.org", "jqueryns.com", "backendjs.org", "dailytickyclock.org", "linedgreen.org", "drilledgas.org", "windowlight.org", "jqscr.com", "surelytheme.org", "libertader.org", "greedyfines.org"]}


ioc_type: ipv4
ioc_value: 91.103.253.169
source: otx
validated_at: 2026-05-24T18:20:26.212523
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS51765 oy crea nova hosting solution ltd", "indicator": "91.103.253.169", "tags": [], "pulses": ["IOCs - 2023117223 - ANIA Threat Feeds - IP Segment 0", "IOCs - 2023117224 - ANIA Threat Feeds - IP Segment 2", "IOCs - 2023117225 - ANIA Threat Feeds - IP Segment 5", "IOCs - 2023117225 - ANIA Threat Feeds - IP Segment 6"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["4ed74b59df583dee2719ac8a6bacb6a5133796132a9c25baa252414886837720"], "passive_dns": []}


ioc_type: ipv4
ioc_value: 91.103.253.18
source: otx
validated_at: 2026-05-24T18:20:36.351543
raw_response:
  {"pulse_count": 32, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS51765 oy crea nova hosting solution ltd", "indicator": "91.103.253.18", "tags": ["", "brute force", "vultr", "honeypot", "ransomware", "la-safe.org", "tsec", "ssh", "malware", "scanners", "tpot19", "cowrie"], "pulses": ["ThreatFix", "Fakelabs Honeynet Project", "LCIA:HoneyNet:2024", "Automated Threat Intelligence - Brute-force hosts for 2024-05-20", "2024-06-08 Fail2Ban 61a1fadb-68d2-40c7-9aeb-f7b8701878ba", "2024-05-13 Fail2Ban cd85b4a8-7f47-4322-b783-99f5b6770809", "2024-05-11 Fail2Ban 331e5bda-3e37-4a20-8776-20aab76b3ba0", "2024-05-06 Fail2Ban 855198d9-51b9-44c3-ad60-b97a400a2f93", "Vultr Warsaw (Poland) SSH Attacker Hosts for 2024-04-26", "2024-04-26 Fail2Ban 3fe8dd52-ccb6-48c7-a070-fd937ebf1209", "2024-04-26 Fail2Ban 4039021e-35d7-46b8-be46-53b8dfd89c4c", "2024-04-24 Fail2Ban ede57a89-cded-4a79-8fb9-d6a01ffdb30a", "Vultr Paris (France) SSH Attacker Hosts for 2024-04-21", "Vultr Warsaw (Poland) SSH Attacker Hosts for 2024-04-20", "Automated Threat Intelligence - Brute-force hosts for 2024-02-15", "2024-04-08 Fail2Ban 229bf7e4-3b27-4ca8-a2d4-30fb4a0acfab", "Vultr Paris (France) SSH Attacker Hosts for 2024-04-02", "2024-04-01 Fail2Ban 13d45012-7a32-4650-93e1-a113fc445c58", "Vultr Paris (France) SSH Attacker Hosts for 2024-03-31", "Vultr Paris (France) SSH Attacker Hosts for 2024-03-27"], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["qkaz.ru", "kinoyataq.pro", "kinolaska.pro", "25tem.kinolaska.pro"]}


ioc_type: ipv4
ioc_value: 91.103.253.23
source: otx
validated_at: 2026-05-24T18:22:05.297515
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS51765 oy crea nova hosting solution ltd", "indicator": "91.103.253.23", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 12, "malware_samples": [], "passive_dns": ["barc-iportal.com", "15ultra.info", "turvallisuus028642-op-fi.info", "turvatoimet-fi.info", "turvatoimet-suomi.info", "stata-agressor.com", "host-host-file8.com", "galandskiyher1.com", "privacy-tools-for-you-453.com", "host-file-host6.com", "file-file-file1.com", "host-file-file0.com"]}


ioc_type: ipv4
ioc_value: 91.103.253.31
source: otx
validated_at: 2026-05-24T18:22:37.223563
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS51765 oy crea nova hosting solution ltd", "indicator": "91.103.253.31", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 17, "malware_samples": [], "passive_dns": ["www.mail.hitmotop.me", "ficbook.fun", "www.ficbook.fun", "www.ficbook.online", "ficbook.space", "ficbook.su", "fanfici.ru", "ficbook.online", "promodj.me", "www.promodj.me", "www.ficbook.life", "ficbook.life", "ficbook.pw", "hitmotop.me", "ficbook.site", "fanfici.online", "info-gosalemvideo.shop"]}


ioc_type: ipv4
ioc_value: 91.103.253.42
source: otx
validated_at: 2026-05-24T18:22:52.183255
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS51765 oy crea nova hosting solution ltd", "indicator": "91.103.253.42", "tags": [], "pulses": ["AS210644 Aeza International Ltd"], "malware_count": 0, "passive_dns_count": 500, "malware_samples": [], "passive_dns": ["www.theoffshorejobs.com", "theoffshorejobs.com", "www.kotijobs.com", "www.speedyquip.com", "speedyquip.com", "www.oneelevenforsythe.com", "oneelevenforsythe.com", "cloudiste.com", "www.punck.net", "punck.net", "www.mrlibw.com", "mrlibw.com", "www.flirtzer.com", "flirtzer.com", "www.roboticjointcentres.com", "roboticjointcentres.com", "www.anwarkazi.com", "coin-connect.com", "ilmubahasainggris.com", "electricien-mirecourt.com"]}


ioc_type: ipv4
ioc_value: 91.103.253.91
source: otx
validated_at: 2026-05-24T18:23:34.482601
raw_response:
  {"pulse_count": 22, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS51765 oy crea nova hosting solution ltd", "indicator": "91.103.253.91", "tags": [], "pulses": ["IOCs - 202312212139 - ANIA Threat Feeds - IP Segment 6", "ETIC Cybersecurity 2024-01-11 Port Scan", "ETIC Cybersecurity 2024-01-10 Port Scan", "ETIC Cybersecurity 2024-01-09 Port Scan", "ETIC Cybersecurity 2024-01-08 Port Scan", "ETIC Cybersecurity 2024-01-07 Port Scan", "ETIC Cybersecurity 2024-01-06 Port Scan", "ETIC Cybersecurity 2024-01-05 Port Scan", "ETIC Cybersecurity 2024-01-04 Port Scan", "ETIC Cybersecurity 2024-01-03 Port Scan", "ETIC Cybersecurity 2024-01-02 Port Scan", "ETIC Cybersecurity 2024-01-01 Port Scan", "ETIC Cybersecurity 2023-12-30 Port Scan", "ETIC Cybersecurity 2023-12-19 Port Scan", "ETIC Cybersecurity 2023-12-28 Port Scan", "ETIC Cybersecurity 2023-12-27 Port Scan", "ETIC Cybersecurity 2023-12-26 Port Scan", "ETIC Cybersecurity 2023-12-25 Port Scan", "ETIC Cybersecurity 2023-12-24 Port Scan", "ETIC Cybersecurity 2023-12-22 Port Scan"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 91.108.240.97
source: otx
validated_at: 2026-05-25T00:05:59.216015
raw_response:
  {"pulse_count": 5, "reputation": 0, "country": "Australia", "country_code": "AU", "city": "Sydney", "asn": "AS213296 sia singularity telecom", "indicator": "91.108.240.97", "tags": [], "pulses": ["ETIC Cybersecurity  2024-08-07  Port Scan", "ETIC Cybersecurity  2024-08-07  Port Scan", "ETIC Cybersecurity  2024-08-06  Port Scan", "ETIC Cybersecurity  2024-08-03  Port Scan", "ETIC Cybersecurity  2024-08-02  Port Scan"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["vpn.killymon.ru", "killymon.ru"]}


ioc_type: ipv4
ioc_value: 91.108.241.176
source: otx
validated_at: 2026-05-25T00:11:37.568854
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Australia", "country_code": "AU", "city": "Sydney", "asn": "AS213296 sia singularity telecom", "indicator": "91.108.241.176", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 14, "malware_samples": [], "passive_dns": ["terra-calm-us.com", "extremefasttradingcomputers.com", "ymjgolf.com", "egardengadgets.com", "amandamanopo.com", "orilliaconcrete.com", "gesundheitdealer.com", "parmjiat.com", "studiossiat.com", "viking-kingdom.com", "techlaird.com", "sidumlince.com", "insolesera.com", "floridalotguy.com"]}


ioc_type: ipv4
ioc_value: 91.108.241.189
source: otx
validated_at: 2026-05-25T00:11:48.531483
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Australia", "country_code": "AU", "city": "Sydney", "asn": "AS213296 sia singularity telecom", "indicator": "91.108.241.189", "tags": ["Bruteforce", "Brute-Force", "Honeypot", "SSH"], "pulses": ["SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "Cloned SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH Brute-Force Honeypot Live", "SSH BruteForce", "SSH_BruteForce_V1", "SSH_BruteForce_V1", "SSH BruteForce", "SSH BruteForce", "SSH BruteForce", "SSH BruteForce", "SSH BruteForce", "SSH BruteForce", "SSH BruteForce", "SSH BruteForce"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 37.221.67.14
source: shodan
validated_at: 2026-05-25T18:00:50.787464
raw_response:
  {"ports": [22, 25, 123, 443, 587], "vulns": ["CVE-2025-67896", "CVE-2023-42117", "CVE-2026-40687", "CVE-2024-39929", "CVE-2023-51766", "CVE-2022-37451", "CVE-2023-42119", "CVE-2023-42115", "CVE-2022-3559", "CVE-2026-40685", "CVE-2023-42114", "CVE-2026-40686", "CVE-2026-40684", "CVE-2022-3620", "CVE-2023-42116"], "hostnames": ["vps-ig23.com"], "tags": ["starttls", "self-signed"], "cpes": ["cpe:/a:f5:nginx", "cpe:/a:ntp:ntp:3", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/a:exim:exim:4.95"]}


ioc_type: ipv4
ioc_value: 196.251.69.82
source: shodan
validated_at: 2026-05-25T18:01:07.523646
raw_response:
  {"ports": [22, 80, 3306], "vulns": ["CVE-2009-2299", "CVE-2022-31629", "CVE-2012-3526", "CVE-2024-47252", "CVE-2025-58098", "CVE-2024-38477", "CVE-2009-0796", "CVE-2021-40438", "CVE-2026-34032", "CVE-2025-65082", "CVE-2019-9517", "CVE-2020-1927", "CVE-2011-1176", "CVE-2012-4001", "CVE-2021-26690", "CVE-2021-33193", "CVE-2019-0190", "CVE-2022-28330", "CVE-2019-10092", "CVE-2025-66200", "CVE-2013-2220", "CVE-2022-30556", "CVE-2018-17189", "CVE-2023-38709", "CVE-2022-22719", "CVE-2022-22720", "CVE-2022-22721", "CVE-2021-32785", "CVE-2024-38475", "CVE-2025-59775", "CVE-2018-19395", "CVE-2020-11579", "CVE-2020-1934", "CVE-2024-24795", "CVE-2019-9639", "CVE-2020-9490", "CVE-2026-29169", "CVE-2021-36160", "CVE-2013-4365", "CVE-2020-35452", "CVE-2024-43394", "CVE-2022-28615", "CVE-2023-45802", "CVE-2019-0211", "CVE-2019-17567", "CVE-2022-31813", "CVE-2019-9638", "CVE-2023-31122", "CVE-2021-32792", "CVE-2024-25117", "CVE-2022-31628", "CVE-2017-7272", "CVE-2022-23943", "CVE-2019-0220", "CVE-2019-0197", "CVE-2021-39275", "CVE-2024-43204", "CVE-2024-38473", "CVE-2015-9253", "CVE-2006-20001", "CVE-2026-24072", "CVE-2023-27522", "CVE-2022-36760", "CVE-2020-11984", "CVE-2026-33857", "CVE-2024-39573", "CVE-2022-29404", "CVE-2019-9641", "CVE-2019-10098", "CVE-2019-0217", "CVE-2021-44224", "CVE-2025-49812", "CVE-2019-10082", "CVE-2012-4360", "CVE-2026-33006", "CVE-2017-7963", "CVE-2024-42516", "CVE-2007-4723", "CVE-2024-38472", "CVE-2019-10081", "CVE-2019-0196", "CVE-2017-8923", "CVE-2007-3205", "CVE-2026-33523", "CVE-2026-34059", "CVE-2013-0941", "CVE-2019-0215", "CVE-2021-34798", "CVE-2025-55753", "CVE-2025-49630", "CVE-2026-33007", "CVE-2021-26691", "CVE-2019-10097", "CVE-2020-13938", "CVE-2024-40898", "CVE-2021-44790", "CVE-2018-19396", "CVE-2021-32786", "CVE-2022-28614", "CVE-2024-3566", "CVE-2013-2765", "CVE-2011-2688", "CVE-2020-11993", "CVE-2013-0942", "CVE-2022-4900", "CVE-2025-53020", "CVE-2024-38474", "CVE-2024-27316", "CVE-2023-25690", "CVE-2022-37436", "CVE-2021-32791", 


ioc_type: ipv4
ioc_value: 196.251.69.212
source: shodan
validated_at: 2026-05-25T18:01:26.699967
raw_response:
  {"ports": [22, 80], "vulns": ["CVE-2020-35452", "CVE-2021-39275", "CVE-2023-45802", "CVE-2024-38472", "CVE-2022-30556", "CVE-2022-4900", "CVE-2022-23943", "CVE-2009-2299", "CVE-2012-4360", "CVE-2020-15778", "CVE-2009-0796", "CVE-2007-2768", "CVE-2024-3566", "CVE-2020-1934", "CVE-2023-38408", "CVE-2020-14145", "CVE-2021-32785", "CVE-2013-4365", "CVE-2007-4723", "CVE-2019-9637", "CVE-2019-0196", "CVE-2025-49812", "CVE-2025-59775", "CVE-2017-7963", "CVE-2022-31628", "CVE-2022-31629", "CVE-2025-26465", "CVE-2025-53020", "CVE-2022-22721", "CVE-2021-40438", "CVE-2025-55753", "CVE-2025-66200", "CVE-2025-23048", "CVE-2019-9638", "CVE-2019-9639", "CVE-2018-17189", "CVE-2023-25690", "CVE-2026-33006", "CVE-2026-33523", "CVE-2024-38474", "CVE-2024-40898", "CVE-2022-36760", "CVE-2011-1176", "CVE-2008-3844", "CVE-2022-28614", "CVE-2013-2765", "CVE-2022-29404", "CVE-2025-65082", "CVE-2020-13938", "CVE-2021-44224", "CVE-2024-43394", "CVE-2021-32791", "CVE-2013-0941", "CVE-2015-9253", "CVE-2023-51385", "CVE-2022-37436", "CVE-2026-35414", "CVE-2022-22720", "CVE-2021-44790", "CVE-2019-9641", "CVE-2023-51767", "CVE-2026-35385", "CVE-2025-58098", "CVE-2017-8923", "CVE-2018-19396", "CVE-2020-11579", "CVE-2021-26690", "CVE-2019-9517", "CVE-2013-2220", "CVE-2026-33857", "CVE-2026-34059", "CVE-2019-0217", "CVE-2021-32792", "CVE-2022-28330", "CVE-2021-26691", "CVE-2019-0190", "CVE-2007-3205", "CVE-2023-38709", "CVE-2019-0197", "CVE-2018-17199", "CVE-2019-0220", "CVE-2017-7272", "CVE-2011-2688", "CVE-2026-33007", "CVE-2024-38477", "CVE-2024-24795", "CVE-2023-27522", "CVE-2012-4001", "CVE-2020-11984", "CVE-2026-35388", "CVE-2022-26377", "CVE-2024-42516", "CVE-2006-20001", "CVE-2013-0942", "CVE-2023-31122", "CVE-2024-38473", "CVE-2019-0211", "CVE-2024-39573", "CVE-2026-29169", "CVE-2026-24072", "CVE-2019-10082", "CVE-2018-19395", "CVE-2019-10097", "CVE-2024-27316", "CVE-2022-22719", "CVE-2024-43204", "CVE-2026-34032", "CVE-2026-35386", "CVE-2012-3526", "CVE-2023-48795", "CVE-2024-47252", "CVE-2


ioc_type: ipv4
ioc_value: 80.76.49.19
source: shodan
validated_at: 2026-05-25T18:02:16.944298
raw_response:
  {"ports": [21, 80, 135, 137, 443, 445, 3306, 3389, 5985], "vulns": ["CVE-2024-38475", "CVE-2023-5678", "CVE-2009-2299", "CVE-2023-6129", "CVE-2007-3205", "CVE-2025-59775", "CVE-2012-3526", "CVE-2024-47252", "CVE-2026-33523", "CVE-2026-34059", "CVE-2009-3765", "CVE-2025-58098", "CVE-2013-0941", "CVE-2024-38477", "CVE-2009-0796", "CVE-2025-55753", "CVE-2025-49630", "CVE-2026-33007", "CVE-2024-36387", "CVE-2024-40898", "CVE-2024-43204", "CVE-2026-34032", "CVE-2025-65082", "CVE-2024-24795", "CVE-2024-38473", "CVE-2024-5458", "CVE-2026-24072", "CVE-2026-29169", "CVE-2024-3566", "CVE-2011-1176", "CVE-2012-4001", "CVE-2013-2765", "CVE-2011-2688", "CVE-2013-4365", "CVE-2009-1390", "CVE-2023-5363", "CVE-2009-3767", "CVE-2026-33857", "CVE-2019-0190", "CVE-2024-43394", "CVE-2024-39573", "CVE-2013-0942", "CVE-2025-66200", "CVE-2024-0727", "CVE-2025-53020", "CVE-2024-38474", "CVE-2024-27316", "CVE-2023-38709", "CVE-2025-49812", "CVE-2012-4360", "CVE-2026-33006", "CVE-2024-42516", "CVE-2009-3766", "CVE-2007-4723", "CVE-2024-38472", "CVE-2024-38476", "CVE-2024-6119", "CVE-2025-23048", "CVE-2013-2220"], "hostnames": [], "tags": ["database", "self-signed"], "cpes": ["cpe:/a:mariadb:mariadb", "cpe:/a:php:php:8.0.30", "cpe:/a:openssl:openssl:3.1.3", "cpe:/a:apache:http_server:2.4.58"]}


ioc_type: ipv4
ioc_value: 80.76.49.159
source: shodan
validated_at: 2026-05-25T18:03:21.024711
raw_response:
  {"ports": [22, 80, 135, 445, 3001, 3389, 4321, 5357, 5432, 5985, 6379, 8080], "vulns": ["CVE-2013-0942", "CVE-2026-29169", "CVE-2026-24072", "CVE-2026-33857", "CVE-2026-34059", "CVE-2026-33006", "CVE-2026-33523", "CVE-2011-1176", "CVE-2009-2299", "CVE-2012-4360", "CVE-2026-34032", "CVE-2009-0796", "CVE-2013-2765", "CVE-2012-3526", "CVE-2013-0941", "CVE-2026-23918", "CVE-2011-2688", "CVE-2026-33007", "CVE-2013-4365", "CVE-2007-4723", "CVE-2012-4001", "CVE-2020-0796"], "hostnames": [], "tags": ["self-signed", "database", "eol-os"], "cpes": ["cpe:/a:golang:go", "cpe:/a:postgresql:postgresql", "cpe:/a:caddyserver:caddy", "cpe:/o:debian:debian_linux", "cpe:/a:php:php:8.3.30", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:apache:http_server:2.4.66", "cpe:/a:openbsd:openssh:9.6p1", "cpe:/a:redislabs:redis:7.4.8"]}


ioc_type: ipv4
ioc_value: 80.76.49.233
source: shodan
validated_at: 2026-05-25T18:04:02.288715
raw_response:
  {"ports": [80, 135, 443, 445, 5357, 5985, 8818, 47001], "vulns": ["CVE-2024-25117", "CVE-2019-9511", "CVE-2022-31628", "CVE-2019-11049", "CVE-2017-8923", "CVE-2022-31629", "CVE-2007-3205", "CVE-2021-21704", "CVE-2020-7067", "CVE-2019-13224", "CVE-2019-11046", "CVE-2025-23419", "CVE-2019-11045", "CVE-2020-7069", "CVE-2020-7068", "CVE-2021-21702", "CVE-2020-0796", "CVE-2019-11050", "CVE-2020-7063", "CVE-2020-7059", "CVE-2021-23017", "CVE-2020-7066", "CVE-2019-9513", "CVE-2019-11047", "CVE-2021-3618", "CVE-2024-3566", "CVE-2020-7062", "CVE-2019-19246", "CVE-2021-21705", "CVE-2019-20372", "CVE-2020-7065", "CVE-2020-7064", "CVE-2023-44487", "CVE-2019-11041", "CVE-2020-7071", "CVE-2020-7061", "CVE-2022-4900", "CVE-2019-11039", "CVE-2019-9516", "CVE-2021-21706", "CVE-2019-11043", "CVE-2019-11036", "CVE-2019-11042", "CVE-2019-11048", "CVE-2019-11040", "CVE-2020-7060", "CVE-2019-11044", "CVE-2020-7070", "CVE-2019-11038", "CVE-2021-21703", "CVE-2021-21707", "CVE-2022-37454", "CVE-2013-2220"], "hostnames": [], "tags": ["eol-product", "self-signed"], "cpes": ["cpe:/a:php:php:7.3.4", "cpe:/a:f5:nginx:1.15.11"]}


ioc_type: ipv4
ioc_value: 91.108.242.168
source: shodan
validated_at: 2026-05-25T18:05:34.112364
raw_response:
  {"ports": [443], "vulns": [], "hostnames": ["pro.radeon.com", "shop-us-en.amd.com", "mars.amd.com", "connect-sit.amd.com", "radeon.com", "shop-eu-fr.amd.com", "download.amd.com", "search.amd.com", "products.amd.com", "shop-eu-de.amd.com", "gpuopen.com", "shop-ca-en.amd.com", "shop.amd.com", "amd.com", "www.amd.com", "instinct.radeon.com", "drivers.amd.com", "creators.radeon.com", "support.amd.com", "connect.amd.com", "shop-eu-en.amd.com", "support-sit.amd.com", "www.gpuopen.com", "explore.amd.com", "verification.amd.com", "www.radeon.com", "account.amd.com", "gaming.radeon.com"], "tags": [], "cpes": []}


ioc_type: ipv4
ioc_value: 91.184.240.72
source: shodan
validated_at: 2026-05-25T18:08:41.112171
raw_response:
  {"ports": [80, 443, 8000, 8080], "vulns": ["CVE-2025-55753", "CVE-2025-66200", "CVE-2013-0942", "CVE-2026-29169", "CVE-2026-24072", "CVE-2025-14178", "CVE-2013-2220", "CVE-2026-33857", "CVE-2026-34059", "CVE-2026-33006", "CVE-2025-14177", "CVE-2026-33523", "CVE-2025-14180", "CVE-2011-1176", "CVE-2009-2299", "CVE-2012-4360", "CVE-2026-34032", "CVE-2009-0796", "CVE-2013-2765", "CVE-2012-3526", "CVE-2025-23419", "CVE-2025-65082", "CVE-2024-3566", "CVE-2007-3205", "CVE-2013-0941", "CVE-2011-2688", "CVE-2026-33007", "CVE-2013-4365", "CVE-2007-4723", "CVE-2012-4001", "CVE-2025-59775", "CVE-2025-58098"], "hostnames": ["mendon-lite.ptr.network", "pma.tonmendon.com", "www.pma.tonmendon.com", "reserved-by-avm.ptr.network"], "tags": ["eol-product"], "cpes": ["cpe:/a:apache:http_server:2.4.65", "cpe:/a:encode:uvicorn", "cpe:/a:php:php:8.3.26", "cpe:/a:f5:nginx:1.25.3", "cpe:/a:python:python", "cpe:/a:jquery:jquery"]}


ioc_type: ipv4
ioc_value: 91.184.241.108
source: shodan
validated_at: 2026-05-25T18:09:08.315146
raw_response:
  {"ports": [22, 443], "vulns": [], "hostnames": ["s.aolcdn.com", "commsdata.api.yahoo.com", "es-us.vida-estilo.yahoo.com", "next.health.yahoo.com", "s.yimg.com", "zero.ptr.network", "de.nachrichten.yahoo.com", "video-api.sapi.yahoo.com", "ymail.com", "o.aolcdn.com", "cdn.launch3d.com", "gallery.tv.widgets.yahoo.com", "de.kino.yahoo.com", "cdn.js7k.com", "video.media.yql.yahoo.com", "next.tech.yahoo.com", "es-us.noticias.yahoo.com", "fr-ca.rogers.yahoo.com", "api.digitalhomeservices.yahoo.com", "ca.rogers.yahoo.com", "br.financas.yahoo.com", "es-us.finanzas.yahoo.com", "admetrics.uadapp.yahoo.com"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:9.6p1", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:apache:traffic_server"]}


ioc_type: ipv4
ioc_value: 91.184.242.200
source: shodan
validated_at: 2026-05-25T18:12:24.576706
raw_response:
  {"ports": [443, 16050], "vulns": [], "hostnames": ["myvisualization.oracle.com", "sites.oracle.com", "itweb.oracle.com", "analytics.covid19.oracle.com", "biapps-fusioncrm.oracle.com", "securesites.oracle.com", "elocation.oracle.com", "m.oracle.com", "scm-fusioncrm.oracle.com", "restgwoci-dr.oracle.com", "appcenter.bronto.com", "myemm.oracle.com", "cn.forums.oracle.com", "container-registry.oracle.com", "restgwoci.oracle.com", "www.covid19-rx.org", "wwwcmsapi.oracle.com", "maps.oracle.com", "content.bronto.com", "mymobile.oracle.com", "blog.bronto.com", "wikis.oracle.com", "mysites-api.oracle.com", "covpn-site-portal.oracle.com", "salesaccelerator.oracle.com", "ideas.bronto.com", "mydevice.oracle.com", "partner.cloudmarketplace.oracle.com", "www-cs-02.oracle.com", "co19.oracle.com", "profile-api.oracle.com", "oradocs.oracle.com", "oracleassistant.oracle.com", "ocm-apis-cloud.oracle.com", "search-api.oracle.com", "search.oracle.com", "redwood.oracle.com", "pressroom.oracle.com", "covid-analytics.oracle.com", "people.us.oracle.com", "hcm-fusioncrm.oracle.com", "crm-fusioncrm.oracle.com", "oraassistant.oracle.com", "fin-fusioncrm.oracle.com", "oraassistant-dr.oracle.com", "linux.oracle.com", "myprocess.oracle.com", "cloudmarketplace.oracle.com", "blogs.bronto.com", "bronto.com", "kr.forums.oracle.com", "covid19-rx.org", "www.covid19rx.org", "careers.bronto.com", "my.oracle.com", "profile.oracle.com", "covpn-admin-portal.oracle.com", "www.blogs.oracle.com", "mysites.oracle.com", "www.bronto.com", "covpn.oracle.com", "ic-fusioncrm.oracle.com", "resources.bronto.com", "publicdocs.oracle.com", "myprofile.oracle.com", "hrservices.oracle.com", "events.oracle.com", "analystconnect.oracle.com", "covid19rx.org", "volunteer.oracle.com", "www.ateam-oracle.com", "orabuilder.oracle.com", "mybuilder.oracle.com", "bi-fusioncrm.oracle.com", "oramobile.oracle.com", "fusioncrm.oracle.com", "aria.us.oracle.com", "www.oracle.com", "www.oracleimg.com", "covid19.oracle.com", "ateam-oracle.co


ioc_type: ipv4
ioc_value: 91.184.243.102
source: shodan
validated_at: 2026-05-25T18:13:54.217051
raw_response:
  {"ports": [443, 3000, 4444, 8443], "vulns": [], "hostnames": ["yandex.com", "yandex.uz", "yandex.co.il", "delicatesweater.ptr.network", "ya.ru", "yandex.aero", "yandex.ee", "yandex.net", "yandex.ru", "yandex.lv", "yandex.it", "yandex.fr", "yandex.tr", "yandex.tj", "yandex.md", "yandex.com.am", "yandex.com.ge", "yandex.kz", "yandex.com.tr", "yandex.lt", "yandex.org", "xn--d1acpjx3f.xn--p1ai", "yandex.by", "yandex.az", "yandex.tm", "yandex.de", "yandex.jobs"], "tags": ["self-signed"], "cpes": ["cpe:/a:google:web_server", "cpe:/a:ntop:ntopng", "cpe:/o:canonical:ubuntu_linux", "cpe:/o:canonical:ubuntu_linux:24.04.4", "cpe:/a:ntop:ntopng:6.6.260324"]}


ioc_type: ipv4
ioc_value: 91.184.243.134
source: shodan
validated_at: 2026-05-25T18:14:20.977265
raw_response:
  {"ports": [443], "vulns": [], "hostnames": ["nocord-tools.ru", "appmetrica.com", "fizard.ru", "www.catboost.ai", "yandexlauncher.com", "yaconnect.com", "market.ru", "thequestion.com", "www.yandex", "yandex-launcher.com", "www.nocord-tools.ru", "yandexdatafactory.com", "appmetrica.ru", "yandex.com.ru", "yandex.market", "yandexdatafactory.ru", "outstep.ru", "www.lunnen.pro", "thequestion.ru", "www.yadi.sk", "yandex.travel", "www.cubits.ru", "123.ya.rs", "boxbot-tools.ru", "eda.rest", "wiki-front.eva.yandex-team.ru", "upset-science.ptr.network", "www.catboost.yandex", "cubits.ru", "www.mutedwear.ru", "junion.ru", "alisa.ai", "pragmahome.ru", "yandex.market.ru", "vigoda.yandex.ru", "edu.ya.rs", "vygoda.ya.ru", "catboost.org", "yandex.video", "www.junion.ru", "www.outstep.ru", "mutedwear.ru", "beta.wiki.yandex-team.ru", "tuvio.ru", "yaconnect.ru", "wiki.eva.yandex-team.ru", "www.fizard.ru", "vigoda.ya.ru", "homsly-dom.com", "yandex.tr", "body-core.ru", "split.ru", "www.boxbot-tools.ru", "www.drive.yandex", "www.catboost.org", "www.tuvio.ru", "appmetrica.io", "www.raskat-sport.ru", "lunnen.pro", "scantobuy.ru", "raskat-sport.ru"], "tags": [], "cpes": []}


ioc_type: ipv4
ioc_value: 37.221.66.8
source: otx
validated_at: 2026-05-25T18:15:58.138531
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.66.8", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 76, "malware_samples": [], "passive_dns": ["mainmide.online", "nevertell2.duckdns.org", "msgshr.com", "alternatifw88id.com", "unnionbannk.lovesalubrity.com", "suncoastcrediitumion.mixiricanews.com", "unionnbaank.lovesalubrity.com", "firlsthorilzon.neuralatlantic.com", "filrtshorlizon.denaira.com", "firstshorlizon.denaira.com", "filrthorlizon.sportbettingtoffer.com", "filrtsrhorizon.rebanos.com", "flrstihorilzon.eliotweber.com", "firstshorizon.allforblm.com", "firltshorlzon.thefoodsafetyresources.com", "firlsthorlzon.warwickfitness.org", "firtsthorizzon.propertyhuntercr.com", "bioprost.mainenterprises.com", "firstshorilzon.nangirril.com", "firlstshorlzon.techychief.com"]}


ioc_type: ipv4
ioc_value: 37.221.66.11
source: otx
validated_at: 2026-05-25T18:16:18.276178
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.66.11", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 45, "malware_samples": [], "passive_dns": ["www.securitication.cam", "securitication.cam", "securityadd.cam", "shpotech.cam", "gamblerunity.com", "unlfyfcu.sndanalytics.com", "sunncolastcrelditunlion.rudygiulianic.com", "vsecu.bit-die.com", "synlcolastlcredltunlon.cougarbearbobcat.com", "suncoastcerdltunlon.cougarbearbobcat.com", "unifyfcu.stercula.com", "unilfyfcu.bit-die.com", "unifyfcu.bit-die.com", "unlfyfcu.bit-die.com", "vseccu.bit-die.com", "vseccu.sndanalytics.com", "unifyfcu.sndanalytics.com", "vsecu.sndanalytics.com", "suncoastcrledltunloin.fbaprofitmastery.com", "suncoastcerdltunilon.fbaprofitmastery.com"]}


ioc_type: ipv4
ioc_value: 37.221.66.13
source: otx
validated_at: 2026-05-25T18:16:28.991982
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.66.13", "tags": [], "pulses": ["Cobalt Strike - C2 - Direcciones IPs - Julio 2023"], "malware_count": 0, "passive_dns_count": 12, "malware_samples": [], "passive_dns": ["sportslivehub.com", "dev.sportslivehub.com", "stage.sportslivehub.com", "test.sportslivehub.com", "www.sportslivehub.com", "decnetralaand.myagrimate.com", "decnterlaand.alexrumak.com", "decentratend.alexrumak.com", "suffollkcfu.chheung.com", "suffolkscfu.profitscene.com", "suffolfcfu.profitscene.com", "suffoloscfu.chheung.com"]}


ioc_type: ipv4
ioc_value: 37.221.67.7
source: otx
validated_at: 2026-05-25T18:17:03.399645
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.67.7", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 13, "malware_samples": [], "passive_dns": ["www.ashleyxcosmetics.info", "admin.ashleyxcosmetics.info", "ashleyxcosmetics.info", "xn--netflix-korltozs-qmbd.com", "netfllx.co", "netflix-korlatozas.com", "sharp-perlman.37-221-67-7.plesk.page", "personal-olb.net", "www.personalolb.net", "personalolb.net", "personalolb-login.com", "www.personalolb-login.com", "tdtrust.ac.ug"]}


ioc_type: ipv4
ioc_value: 37.221.67.12
source: otx
validated_at: 2026-05-25T18:17:08.411397
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.67.12", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 15, "malware_samples": [], "passive_dns": ["eloquent-vaughan.37-221-67-12.plesk.page", "deutschepost-web.de", "www.goofy-bouman.37-221-67-12.plesk.page", "goofy-bouman.37-221-67-12.plesk.page", "www.es-amazon.com", "m12.mediaworldscreative.com", "www.ctt-e.com", "www.receber-ctt.com", "es-amazon.com", "pacotes-ctt.com", "receber-ctt.com", "ctt-e.com", "authscotia-loginscotia.com", "terstlow.org.uk", "noane.club"]}


ioc_type: ipv4
ioc_value: 37.221.67.14
source: otx
validated_at: 2026-05-25T18:17:14.170644
raw_response:
  {"pulse_count": 21, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.67.14", "tags": ["auto-generated security"], "pulses": ["jan2,2025 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2.2025clone-Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan 2 25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan 2 25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan 2 25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan 2 25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan 2 25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan 2 25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "1/2/25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "1/2/25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "1/2/25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "1/2/25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "1/2/25 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2,2025 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2,2025 clone Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2.2025clone-Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2.2025clone-Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2.2025clone-Auto-generated Pulse CREATED 1 YEAR AGO MODIFIED 1 YEAR AGO by AlessandroFiori", "jan2.2025clone-Auto-generated Pulse CREATED 1


ioc_type: ipv4
ioc_value: 37.221.67.16
source: otx
validated_at: 2026-05-25T18:17:22.777871
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS200019 alexhost srl", "indicator": "37.221.67.16", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 43, "malware_samples": [], "passive_dns": ["fininsite.xyz", "rthelp.live", "connexion-abonnement.com", "paiement-mon-abonnement.com", "www-mondialrelay.com", "colis-mondialrelay.net", "www.colis-mondialrelay.net", "aqhelp.info", "brhelp.info", "cshelp38.info", "mscare.online", "wdcare.live", "mfcare.live", "mfcare.info", "dhelp.online", "fhelp.online", "fcare.online", "ihelp.live", "mecare.live", "bhelp.live"]}


ioc_type: ipv4
ioc_value: 196.251.69.12
source: otx
validated_at: 2026-05-25T18:17:52.314481
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.12", "tags": ["", "Reverse_SSH", "ransomware", "Remcos", "Hookbot", "C2", "Havoc", "Supershell", "Qakbot", "malware", "Mythic", "CobaltStrike", "Interactsh", "Hak5_Cloud_C2", "Deimos", "AsyncRAT", "Pegasus", "Sliver", "NetSupportRAT", "Dcrat"], "pulses": ["ThreatFix", "Twitter Feed - skocherhan - 05-09-2025", "Twitter Feed - drb_ra - 04-09-2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.69.52
source: otx
validated_at: 2026-05-25T18:18:02.938182
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.52", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 16, "malware_samples": [], "passive_dns": ["cip-govpko.cc", "www.cip-govpko.cc", "correo-uy-shop.cc", "vip-correoo-uy.cc", "ccorreo-gov-py.cc", "ccreo-shop.cc", "correoshop.cc", "www.ccorreo-gov-py.cc", "ccreoshops.cc", "www.correoo-uy.cc", "correoo-uy.cc", "www.correo-uy-shop.cc", "www.ccorreo-uy.cc", "www.vip-correoo-uy.cc", "ccorreo-uy.cc", "tcsex-presss.cc"]}


ioc_type: ipv4
ioc_value: 196.251.70.2
source: otx
validated_at: 2026-05-25T18:22:44.154831
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.2", "tags": ["us abuse", "columns", "us none", "hurricane us", "timeout", "pgp sign", "unknown", "2025", "malicious", "heralding", "china mobile", "block list", "dionaea", "hong kong", "01.10.2025", "nxdomain", "company limited", "network", "hk abusehandler", "LAMP", "honeytrap", "HoneyNet Connect"], "pulses": ["\"AS401120 cheapy_host LLC\" clone credit skocherhan", "AS401120 cheapy_host LLC", "HoneyPot Connect 01.10.2025", "IP Addresses Logged by the Rosethorn PotNet", "DShield Public Data Feed - 2025-08-30", "DShield Public Data Feed - 2025-08-25", "DShield Public Data Feed - 2025-08-24", "LCIA HoneyNet Data - July 2025 - Honeytrap", "Malware Filter - Botnet List - 30-07-2025", "Malware Filter - Botnet List - 26-06-2025"], "malware_count": 0, "passive_dns_count": 16, "malware_samples": [], "passive_dns": ["esafeta.work", "ausuposts.top", "mxnpost.top", "norderay.top", "postenapp.lol", "businessesposte.lol", "imposten.lat", "indiapost.biz", "esafeta.bar", "postcorp.lol", "posta.life", "posten.lat", "posten24.date", "correoes.biz", "esta-feta.date", "estafeta.date"]}


ioc_type: ipv4
ioc_value: 196.251.70.32
source: otx
validated_at: 2026-05-25T18:23:04.188314
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.32", "tags": [], "pulses": ["\"AS401120 cheapy_host LLC\" clone credit skocherhan", "AS401120 cheapy_host LLC"], "malware_count": 0, "passive_dns_count": 10, "passive_dns": ["dundenbugunealisveris.online", "buguneozelindirimler.online", "kusursuzalisvrlerburada.online", "herkesburayabaksin.xyz", "supurgedeindirimlerburada.xyz", "kirkdortkereucuzlukaddresi.xyz", "pihilipsmaxdikeysupurge.xyz", "herkesburayabaksin.online", "supurgedeindirimbuhafta.online", "kirkdortkereucuzlukaddresi.online"]}


ioc_type: ipv4
ioc_value: 196.251.70.132
source: otx
validated_at: 2026-05-25T18:24:18.257887
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.132", "tags": ["us abuse", "columns", "us none", "hurricane us", "timeout", "pgp sign", "unknown", "2025", "malicious", "heralding", "china mobile", "block list", "dionaea", "hong kong", "01.10.2025", "nxdomain", "company limited", "network", "hk abusehandler", "LAMP", "honeytrap", "HoneyNet Connect"], "pulses": ["HoneyPot Connect 01.10.2025", "DShield Public Data Feed - 2025-08-30", "DShield Public Data Feed - 2025-08-25", "DShield Public Data Feed - 2025-08-24", "LCIA HoneyNet Data - July 2025 - Honeytrap", "Malware Filter - Botnet List - 30-07-2025", "Malware Filter - Botnet List - 10-07-2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 196.251.70.162
source: otx
validated_at: 2026-05-25T18:24:51.082400
raw_response:
  {"pulse_count": 14, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.162", "tags": ["count", "Brute force", "SSL VPN"], "pulses": ["SSL VPN brute force attempts [120525]", "SSL VPN brute force attempts [120525]", "SSL VPN brute force attempts [090525]", "SSL VPN brute force attempts [080525]", "SSL VPN brute force attempts [070525]", "SSL VPN brute force attempts [060525]", "SSL VPN brute force attempts [180425]", "SSL VPN brute force attempts [170425]", "SSL VPN brute force attempts [110425]", "SSL VPN brute force attempts [100425]", "SSL VPN brute force attempts [090425]", "SSL VPN brute force attempts [080425]", "SSL VPN brute force attempts [070425]", "SSL VPN brute force attempts [030425]"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 38.150.0.118
source: otx
validated_at: 2026-05-25T18:27:02.160094
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS174 cogent communications", "indicator": "38.150.0.118", "tags": ["gafgyt", "Formbook", "gz", "eilf", "ascii", "connectwise", "Stealc", "32-bit", "bin", "Loda", "malware", "mirai", "elf", "MassLogger", "js", "PowerPC", "SimpleHelp", "WeedHack", "sparc", "cnc", "botnetdomain", "ddos", "rat", "opendir", "tar", "backdoor", "triage", "arm", "lnk", "gitlab", "PhantomStealer", "Malgent", "SuperH", "P2Pinfect", "WsgiDAV", "encrypted", "USA", "Mozi", "hajime", "zip", "jar", "ua-wget", "QuasarRAT", "CobaltStrike", "fbf543", "Vidar", "mango", "AgentTesla", "botnet", "DDoSAgent"], "pulses": ["URLHaus data - 05-02-2026 (Part 2)", "URLHaus data - 24-01-2026 (Part 1)"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 80.76.49.24
source: otx
validated_at: 2026-05-25T18:28:10.772659
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "80.76.49.24", "tags": ["Qakbot", "Evilginx", "Interactsh", "Reverse_SSH", "C2", "Deimos", "AsyncRAT", "NetSupportRAT", "Havoc", "Pegasus", "Bianlian", "Sliver", "Mythic", "Remcos", "CobaltStrike", "Dcrat", "EvilGoPhish", "Hookbot"], "pulses": ["Threatfox Recent Additions", "Twitter Feed - drb_ra - 03-05-2025"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["jumitsegumies.cam"]}


ioc_type: ipv4
ioc_value: 80.76.49.30
source: otx
validated_at: 2026-05-25T18:28:13.107276
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "80.76.49.30", "tags": ["cvss", "grouped", "mozi", "week", "clearfake", "redline stealer", "compromise", "malicious", "remcos", "asyncrat", "iocs", "april", "clickfix", "cvss base", "malware", "urls http", "telegram", "android", "interlock", "date"], "pulses": ["Threatfox Recent Additions", "Threat Intel Report - W16-2025"], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["nb-fidelityinvestments.help", "kriokaterro.com", "zinceskes.cam", "tj-rlj.com"]}


ioc_type: ipv4
ioc_value: 80.76.49.32
source: otx
validated_at: 2026-05-25T18:28:22.570678
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "80.76.49.32", "tags": ["", "Reverse_SSH", "ransomware", "Remcos", "Hookbot", "C2", "Havoc", "Supershell", "Qakbot", "Evilginx", "malware", "Mythic", "CobaltStrike", "Interactsh", "Hak5_Cloud_C2", "AsyncRAT", "Pegasus", "Sliver", "NetSupportRAT", "Dcrat", "EvilGoPhish"], "pulses": ["ThreatFix", "Twitter Feed - drb_ra - 03-06-2025"], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["xhoost.info", "deresnchan.cam", "shenxianzhai.com", "www.shenxianzhai.com"]}


ioc_type: ipv4
ioc_value: 80.76.49.43
source: otx
validated_at: 2026-05-25T18:28:36.278787
raw_response:
  {"pulse_count": 5, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "80.76.49.43", "tags": ["", "malware", "feed", "rah623925", "window", "ransomware"], "pulses": ["ThreatFix_URL", "TI Advisory No-ESAF-SOC-TI-2026-9", "ThreatFix", "Twitter Feed - skocherhan - 23-12-2025", "Malware Filter - Botnet List - 23-12-2025 (Part 7)"], "malware_count": 3, "passive_dns_count": 1, "malware_samples": ["00c3310e279edb4a0fbbebe241e1da8771d0af2b4e1f3c7c388c42da8cc96926", "1a51fd80ef3f10ff31e3097b044860b42ef3cd82fe602848e6ed58c86991e267", "2f24035b58de327075339b53cbb4cbaf44728a9689f1029d1471042a7ffeda1d"], "passive_dns": ["svergbalent.cam"]}


ioc_type: ipv4
ioc_value: 80.76.49.45
source: otx
validated_at: 2026-05-25T18:28:45.155457
raw_response:
  {"pulse_count": 35, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "80.76.49.45", "tags": ["dugganusa", "DugganUSA", "remcos", "c2-infrastructure", "threatfox", "LummaStealer, RedLine,...", "vidar", "auto-generated", "asyncrat", "unknown-malware", "pattern-49", "netsupportmanager-rat", "osint-volley", "commodity-rat", "automated-hunt", "automated"], "pulses": ["ThreatFix_IP", "ThreatFox Hunt: Remcos IOCs - 2026-01-16", "Oz Batch: 50 IOCs (avg BDE: 85)", "ThreatFox Hunt: Remcos IOCs - 2026-01-16", "Oz Batch: 50 IOCs (avg BDE: 85)", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/Vidar", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/Vidar", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/Vidar", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/Vidar", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/Vidar", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/NetSupportManager RAT"], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["timeshamers.cam", "huishou818.com", "www.huishou818.com"]}


ioc_type: ipv4
ioc_value: 80.76.49.60
source: otx
validated_at: 2026-05-25T18:29:27.547127
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "80.76.49.60", "tags": ["honeypot", "cowrie", "ssh", "brute force"], "pulses": ["Fakelabs Honeynet Project", "Automated Threat Intelligence - Brute-force hosts for 2024-05-09"], "malware_count": 2, "passive_dns_count": 0, "malware_samples": ["6c86bcacb9b6327ab09ebf85b541ccaf67d2a686d4e752b7411f3fd2bad55735", "cdcd685099278e0925bb718a7574e9dc0622ecde144b6cb7f38bd2eeb2381a76"]}


ioc_type: ipv4
ioc_value: 80.76.49.73
source: otx
validated_at: 2026-05-25T18:29:32.325254
raw_response:
  {"pulse_count": 6, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "80.76.49.73", "tags": ["ssh", "brute force"], "pulses": ["Threatfox Recent Additions", "Automated Threat Intelligence - Brute-force hosts for 2024-07-01", "ETIC Cybersecurity  2024-05-06  Port Scan", "ETIC Cybersecurity  2024-05-05  Port Scan", "ETIC Cybersecurity  2024-05-04  Port Scan", "ETIC Cybersecurity  2024-05-03  Port Scan"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["kointgunies.cam", "www.zgqfyl.com"]}


ioc_type: ipv4
ioc_value: 91.184.243.216
source: shodan
validated_at: 2026-05-26T00:04:24.852450
raw_response:
  {"ports": [10443], "vulns": [], "hostnames": ["yp.amazon.com", "p-nt-www-amazon-com-kalias.amazon.com", "p-yo-www-amazon-com-kalias.amazon.com", "shop.business.amazon.com", "amazon.com", "yellowpages.amazon.com", "p-y3-www-amazon-com-kalias.amazon.com", "www.amzn.com", "buybox.amazon.com", "gleamingtitle.ptr.network", "home.amazon.com", "mp3recs.amazon.com", "uedata.amazon.com", "us.amazon.com", "iphone.amazon.com", "amzn.com", "www.m.amazon.com", "www.amazon.com", "corporate.amazon.com"], "tags": [], "cpes": []}


ioc_type: ipv4
ioc_value: 91.184.243.217
source: shodan
validated_at: 2026-05-26T00:04:26.633637
raw_response:
  {"ports": [443, 1080, 2087, 2222, 4443, 9443], "vulns": [], "hostnames": ["vkuservideo.net", "vkuseraudio.net", "vkuseraudio.ru", "www.microsoft.com", "vkuseraudio.com", "storage-1.yandexcloud.net", "website-1.yandexcloud.net", "modernamber.ptr.network", "vkuserdocs.ru", "www.apple.com.cn", "images.apple.com", "userapi.com", "s3.ua.yandexcloud.net", "storage-2.yandexcloud.net", "storage.ua.yandexcloud.net", "storage.pe.yandexcloud.net", "vkuservideo.ru", "i.s-microsoft.com", "vkuservideo.com", "staticview.microsoft.com", "wwwqa.microsoft.com", "website.yandexcloud.net", "storage-internal.cloud.yandex.net", "vkuserphoto.ru", "storage.yandexcloud.net", "website.ua.yandexcloud.net", "s3.yandexcloud.net", "microsoft.com", "www.apple.com", "c.s-microsoft.com", "privacy.microsoft.com"], "tags": [], "cpes": ["cpe:/a:amazon:elastic_load_balancing", "cpe:/a:f5:nginx"]}


ioc_type: ipv4
ioc_value: 91.186.217.148
source: shodan
validated_at: 2026-05-26T00:06:15.568851
raw_response:
  {"ports": [22, 80, 8080], "vulns": ["CVE-2024-45802", "CVE-2026-32748", "CVE-2023-49288", "CVE-2021-23017", "CVE-2021-3618", "CVE-2024-25617", "CVE-2023-50269", "CVE-2026-33515", "CVE-2025-23419", "CVE-2024-25111", "CVE-2023-46848", "CVE-2023-49285", "CVE-2024-37894", "CVE-2024-23638", "CVE-2023-46728", "CVE-2023-44487", "CVE-2026-33526", "CVE-2023-46847", "CVE-2025-54574", "CVE-2023-5824", "CVE-2023-46724", "CVE-2025-59362", "CVE-2025-62168", "CVE-2023-49286", "CVE-2023-46846"], "hostnames": ["reserved-by-avm.ptr.network", "obsolete-fog.ptr.network"], "tags": ["proxy", "eol-product"], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx:1.18.0", "cpe:/a:squid-cache:squid:5.9", "cpe:/o:linux:linux_kernel", "cpe:/a:openbsd:openssh:8.9p1"]}


ioc_type: ipv4
ioc_value: 91.186.217.62
source: shodan
validated_at: 2026-05-26T00:07:35.161066
raw_response:
  {"ports": [80, 443, 1701, 8443], "vulns": ["CVE-2023-45802", "CVE-2024-38472", "CVE-2023-4807", "CVE-2023-0464", "CVE-2009-1390", "CVE-2009-2299", "CVE-2012-4360", "CVE-2009-0796", "CVE-2009-3765", "CVE-2013-4365", "CVE-2007-4723", "CVE-2025-49812", "CVE-2025-59775", "CVE-2023-0466", "CVE-2023-3817", "CVE-2025-53020", "CVE-2025-55753", "CVE-2025-66200", "CVE-2009-3766", "CVE-2025-23048", "CVE-2023-5678", "CVE-2023-25690", "CVE-2023-43622", "CVE-2026-33006", "CVE-2026-28390", "CVE-2026-33523", "CVE-2024-40898", "CVE-2024-38474", "CVE-2011-1176", "CVE-2013-2765", "CVE-2025-65082", "CVE-2026-28388", "CVE-2023-0465", "CVE-2023-0215", "CVE-2024-43394", "CVE-2013-0941", "CVE-2025-69419", "CVE-2026-28389", "CVE-2026-23918", "CVE-2025-69420", "CVE-2026-22796", "CVE-2022-4450", "CVE-2022-4304", "CVE-2025-68160", "CVE-2025-58098", "CVE-2024-0727", "CVE-2023-2650", "CVE-2026-33857", "CVE-2026-34059", "CVE-2019-0190", "CVE-2023-38709", "CVE-2011-2688", "CVE-2026-33007", "CVE-2024-38477", "CVE-2024-24795", "CVE-2023-27522", "CVE-2012-4001", "CVE-2024-42516", "CVE-2023-0286", "CVE-2013-0942", "CVE-2026-28387", "CVE-2009-3767", "CVE-2024-38473", "CVE-2024-36387", "CVE-2023-31122", "CVE-2024-39573", "CVE-2025-69418", "CVE-2026-29169", "CVE-2026-24072", "CVE-2024-27316", "CVE-2024-43204", "CVE-2026-34032", "CVE-2012-3526", "CVE-2024-47252", "CVE-2024-38475", "CVE-2025-49630", "CVE-2026-22795", "CVE-2025-69421", "CVE-2024-38476"], "hostnames": ["hbrew.ru", "cdnjs.cloudflare.com", "reserved-by-avm.ptr.network"], "tags": [], "cpes": ["cpe:/a:openssl:openssl:1.1.1s", "cpe:/o:debian:debian_linux", "cpe:/a:cloudflare:cloudflare", "cpe:/a:apache:http_server:2.4.66", "cpe:/a:apache:http_server:2.4.55"]}


ioc_type: ipv4
ioc_value: 91.186.217.64
source: shodan
validated_at: 2026-05-26T00:07:36.922008
raw_response:
  {"ports": [22, 443, 1080, 3128], "vulns": ["CVE-2024-45802", "CVE-2026-32748", "CVE-2023-49288", "CVE-2021-23017", "CVE-2021-3618", "CVE-2024-25617", "CVE-2023-50269", "CVE-2026-33515", "CVE-2025-23419", "CVE-2024-25111", "CVE-2023-46848", "CVE-2023-49285", "CVE-2024-37894", "CVE-2024-23638", "CVE-2023-46728", "CVE-2023-44487", "CVE-2026-33526", "CVE-2023-46847", "CVE-2025-54574", "CVE-2023-5824", "CVE-2023-46724", "CVE-2025-59362", "CVE-2025-62168", "CVE-2023-49286", "CVE-2023-46846"], "hostnames": ["reserved-by-avm.ptr.network", "fallentheowl.space"], "tags": ["proxy", "eol-product"], "cpes": ["cpe:/o:debian:debian_linux", "cpe:/a:openbsd:openssh:9.2p1", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx:1.18.0", "cpe:/a:squid-cache:squid:5.9", "cpe:/o:linux:linux_kernel"]}


ioc_type: ipv4
ioc_value: 194.85.251.102
source: shodan
validated_at: 2026-05-26T00:14:50.313607
raw_response:
  {"ports": [22, 27017], "vulns": ["CVE-2023-3817", "CVE-2021-3711", "CVE-2022-2097", "CVE-2009-3766", "CVE-2026-28387", "CVE-2021-3449", "CVE-2023-5678", "CVE-2023-4807", "CVE-2021-23840", "CVE-2009-3767", "CVE-2025-69418", "CVE-2022-1292", "CVE-2021-4160", "CVE-2023-0464", "CVE-2009-1390", "CVE-2020-1971", "CVE-2026-28390", "CVE-2009-3765", "CVE-2026-28388", "CVE-2019-0190", "CVE-2023-0465", "CVE-2023-0215", "CVE-2026-22795", "CVE-2021-3712", "CVE-2025-69419", "CVE-2025-69421", "CVE-2026-28389", "CVE-2025-69420", "CVE-2021-23841", "CVE-2026-22796", "CVE-2020-1967", "CVE-2022-4450", "CVE-2022-0778", "CVE-2023-0466", "CVE-2022-2068", "CVE-2022-4304", "CVE-2025-68160", "CVE-2024-0727", "CVE-2023-2650", "CVE-2023-0286"], "hostnames": [], "tags": ["database", "eol-product"], "cpes": ["cpe:/a:mongodb:mongodb:4.4.13", "cpe:/a:openbsd:openssh:8.2p1", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:openssl:openssl:1.1.1f"]}


ioc_type: ipv4
ioc_value: 194.85.251.197
source: shodan
validated_at: 2026-05-26T00:16:15.348387
raw_response:
  {"ports": [22, 443], "vulns": [], "hostnames": ["yandex.com", "yandex.uz", "yandex.co.il", "ya.ru", "yandex.aero", "yandex.ee", "yandex.net", "yandex.ru", "yandex.lv", "yandex.it", "yandex.fr", "yandex.tr", "yandex.tj", "yandex.md", "yandex.com.am", "yandex.com.ge", "yandex.kz", "yandex.com.tr", "yandex.lt", "yandex.org", "xn--d1acpjx3f.xn--p1ai", "yandex.by", "yandex.az", "yandex.tm", "yandex.de", "yandex.jobs"], "tags": [], "cpes": ["cpe:/a:openbsd:openssh:8.9p1", "cpe:/o:canonical:ubuntu_linux"]}


ioc_type: ipv4
ioc_value: 196.251.69.112
source: otx
validated_at: 2026-05-26T00:18:46.653725
raw_response:
  {"pulse_count": 5, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.112", "tags": ["LummaStealer", "dcrat", "bash", "ua-wget", "exe", "search", "c2-monitor-auto", "linux", "backdoor", "xworm", "Mozi", "PlugX", "CoinMiner", "hajime", "rev-base64-loader", "elf", "wget", "ascii", "RedLineStealer", "hta", "gafgyt", "sshdkit", "botnet-backend", "ddos", "Formbook", "moobot", "github", "donutloader", "AsyncRAT", "WsgiDAV", "mirai internet", "orchard", "censys", "botnetdomain", "publicsrc", "Encoded", "iocs", "CobaltStrike", "bash botnet-backend publicsrc mirai", "botnet iocs", "gs523", "QuasarRAT", "Gh0stRAT", "MassLogger", "things", "RemcosRAT", "rat", "dropped-by-amadey", "mirai", "base64-loader"], "pulses": ["\u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0431\u043e\u0442\u043d\u0435\u0442\u0430 Mirai (\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430 07.07.2025)", "\u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0431\u043e\u0442\u043d\u0435\u0442\u0430 Mirai (\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430 04.07.2025)", "\u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0431\u043e\u0442\u043d\u0435\u0442\u0430 Mirai (\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430 03.07.2025)", "URLHaus data - 29-06-2025", "URLHaus data - 28-06-2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 196.251.69.222
source: otx
validated_at: 2026-05-26T00:19:42.595047
raw_response:
  {"pulse_count": 5, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": null, "asn": "ASNone ", "indicator": "196.251.69.222", "tags": ["Covenant", "malicious", "dionaea", "sftp", "Supershell", "Pegasus", "cowrie", "Interactsh", "mailoney", "Deimos", "Remcos", "Sliver", "Havoc", "AsyncRAT", "honeytrap", "LAMP", "email", "tanner", "Qakbot", "CobaltStrike", "sip", "Hak5_Cloud_C2", "cisco", "Hookbot", "NetSupportRAT", "ssh", "sentrypeer", "Mythic", "C2"], "pulses": ["LCIA HoneyNet Data - August 2025 - Tanner", "LCIA HoneyNet Data - August 2025 - H0neytr4p", "Malware Filter - Botnet List - 07-08-2025", "Threatfox Recent Additions", "Twitter Feed - drb_ra - 08-05-2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 196.251.70.222
source: otx
validated_at: 2026-05-26T00:20:05.814294
raw_response:
  {"pulse_count": 6, "reputation": 0, "country": "Ghana", "country_code": "GH", "city": "Accra", "asn": "ASNone ", "indicator": "196.251.70.222", "tags": ["HoneyNet Connect", "hk abusehandler", "pgp sign", "malicious", "heralding", "dionaea", "hurricane us", "china mobile", "unknown", "nxdomain", "us none", "2025", "hong kong", "honeytrap", "LAMP", "01.10.2025", "timeout", "company limited", "columns", "network", "block list"], "pulses": ["HoneyPot Connect 01.10.2025", "DShield Public Data Feed - 2025-08-30", "DShield Public Data Feed - 2025-08-25", "LCIA HoneyNet Data - July 2025 - Honeytrap", "Malware Filter - Botnet List - 30-07-2025", "Malware Filter - Botnet List - 26-06-2025"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 80.76.49.97
source: otx
validated_at: 2026-05-26T00:20:44.552865
raw_response:
  {"pulse_count": 5, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "80.76.49.97", "tags": ["Evilginx", "EvilGoPhish", "NetSupportRAT", "Qakbot", "CobaltStrike", "Remcos", "C2", "abuseipdb", "Havoc", "AsyncRAT"], "pulses": ["Threatfox Recent Additions", "Twitter Feed - drb_ra - 27-12-2024", "Threatview.io OSINT Threat Feed", "Compiled Blocklist of AbuseIPDB: Most reported IP addresses - by skocherhan", "Aggregated Blocklist for AbuseIPDB: A list of the most reported IP addresses."], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 80.76.49.103
source: otx
validated_at: 2026-05-26T00:21:18.893346
raw_response:
  {"pulse_count": 13, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "80.76.49.103", "tags": ["ssh", "brute force"], "pulses": ["Automated Threat Intelligence - Brute-force hosts for 2024-07-01", "ETIC Cybersecurity  2024-08-19  Port Scan", "ETIC Cybersecurity  2024-08-17  Port Scan", "ETIC Cybersecurity  2024-08-16  Port Scan", "ETIC Cybersecurity  2024-08-15  Port Scan", "ETIC Cybersecurity  2024-08-14  Port Scan", "ETIC Cybersecurity  2024-08-12  Port Scan", "ETIC Cybersecurity  2024-08-11  Port Scan", "ETIC Cybersecurity  2024-08-11  Port Scan", "ETIC Cybersecurity  2024-08-10  Port Scan", "ETIC Cybersecurity  2024-08-10  Port Scan", "ETIC Cybersecurity  2024-08-08  Port Scan", "ETIC Cybersecurity  2024-08-08  Port Scan"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 80.76.49.114
source: otx
validated_at: 2026-05-26T00:21:39.067692
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "80.76.49.114", "tags": ["auto-generated", "LummaStealer, RedLine,...", "DugganUSA"], "pulses": ["ThreatFix_IP", "ThreatFix_IP", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)", "Oz Batch: 50 IOCs (avg BDE: 85)"], "malware_count": 1, "passive_dns_count": 3, "malware_samples": ["698a5b26281ff59ad91d24f22781c2b68b971f5bf20d1b700dd2cf7ca2f5e11d"], "passive_dns": ["basb24ao.anondns.net", "huh168.com", "www.huh168.com"]}


ioc_type: ipv4
ioc_value: 80.76.49.141
source: otx
validated_at: 2026-05-26T00:22:39.922098
raw_response:
  {"pulse_count": 8, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "80.76.49.141", "tags": ["probing", "web app attack", "Crawler", "webscanner", "abuseipdb"], "pulses": ["Webscanners IPs 2024-04-08 thru current day", "webscanners_pules", "webscanners_pules", "webscanners_pules", "webscanners_pules", "webscanners_pules", "Compiled Blocklist of AbuseIPDB: Most reported IP addresses - by skocherhan", "Aggregated Blocklist for AbuseIPDB: A list of the most reported IP addresses."], "malware_count": 0, "passive_dns_count": 5, "malware_samples": [], "passive_dns": ["atlantacreators.io", "webforgestudioatl.com", "amixrent.cam", "antegouwu.com", "www.antegouwu.com"]}


ioc_type: ipv4
ioc_value: 80.76.49.159
source: otx
validated_at: 2026-05-26T00:23:57.795918
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "80.76.49.159", "tags": ["honeypot", "phpMyAdmin"], "pulses": ["phpMyAdmin honeypot logs for 2026-03-29", "phpMyAdmin honeypot logs for 2026-03-21", "phpMyAdmin honeypot logs for 2026-03-17", "phpMyAdmin honeypot logs for 2026-03-15", "phpMyAdmin honeypot logs for 2026-03-14", "phpMyAdmin honeypot logs for 2026-03-11", "phpMyAdmin honeypot logs for 2026-03-09", "phpMyAdmin honeypot logs for 2026-03-07", "phpMyAdmin honeypot logs for 2026-03-06", "phpMyAdmin honeypot logs for 2026-03-05", "phpMyAdmin honeypot logs for 2026-03-04", "phpMyAdmin honeypot logs for 2026-03-02", "phpMyAdmin honeypot logs for 2026-03-01", "phpMyAdmin honeypot logs for 2026-02-28", "phpMyAdmin honeypot logs for 2026-02-27", "phpMyAdmin honeypot logs for 2026-02-26", "phpMyAdmin honeypot logs for 2026-02-25", "phpMyAdmin honeypot logs for 2026-02-24", "phpMyAdmin honeypot logs for 2026-02-23", "phpMyAdmin honeypot logs for 2026-02-20"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 80.76.49.171
source: otx
validated_at: 2026-05-26T00:24:51.880631
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "80.76.49.171", "tags": ["Evilginx", "EvilGoPhish", "brute force", "NetSupportRAT", "Qakbot", "CobaltStrike", "Remcos", "C2", "ssh", "Havoc", "AsyncRAT"], "pulses": ["Automated Threat Intelligence - Brute-force hosts for 2025-11-25", "Threatfox Recent Additions", "Twitter Feed - drb_ra - 27-12-2024", "Threatview.io OSINT Threat Feed"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 80.76.49.172
source: otx
validated_at: 2026-05-26T00:25:09.107572
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "80.76.49.172", "tags": ["", "LummaStealer", "ransomware", "Xworm", "RAT", "malware"], "pulses": ["ThreatFix", "Threatfox Recent Additions", "Twitter Feed - K_N1kolenko - 14-04-2025"], "malware_count": 2, "passive_dns_count": 0, "malware_samples": ["24b470e81029c81ee03253cbec066b30f4ffba943849c6e8e0eb97899c98d7aa", "5eeed9e7dd5a1ae6bd8847dcb723d998c38fa5a6e3db2367d8eafc1cc670e18c"]}


ioc_type: ipv4
ioc_value: 80.76.49.178
source: otx
validated_at: 2026-05-26T00:25:53.666502
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "80.76.49.178", "tags": ["police", "agent tesla", "mylobot", "csrmirteam", "vidar", "lumma", "indonesia", "mozi lin", "greed mirai", "february", "south africa", "jaff", "date", "tech mahindra", "asyncrat", "mozi", "malware", "paraguay", "ra world", "germany", "steam", "greed mi", "ukraine", "threat report", "mirai", "finaldraft", "blacklist host", "remcos"], "pulses": ["Threat Intel Report - W07-2025"], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["gokeol.cam", "www.ours96.com", "ours96.com"]}


ioc_type: ipv4
ioc_value: 80.76.49.217
source: otx
validated_at: 2026-05-26T00:27:39.772984
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "80.76.49.217", "tags": ["abuseipdb"], "pulses": ["Compiled Blocklist of AbuseIPDB: Most reported IP addresses - by skocherhan", "Aggregated Blocklist for AbuseIPDB: A list of the most reported IP addresses.", "ETIC Cybersecurity  2024-07-19  Port Scan", "ETIC Cybersecurity  2024-07-18  Port Scan", "ETIC Cybersecurity  2024-07-18  Port Scan", "ETIC Cybersecurity  2024-07-17  Port Scan", "ETIC Cybersecurity  2024-07-16  Port Scan", "ETIC Cybersecurity  2024-07-15  Port Scan", "ETIC Cybersecurity  2024-07-14  Port Scan", "ETIC Cybersecurity  2024-07-13  Port Scan", "ETIC Cybersecurity  2024-07-12  Port Scan", "ETIC Cybersecurity  2024-07-11  Port Scan", "ETIC Cybersecurity  2024-07-10  Port Scan", "ETIC Cybersecurity  2024-07-09  Port Scan", "ETIC Cybersecurity  2024-07-08  Port Scan", "ETIC Cybersecurity  2024-07-07  Port Scan", "ETIC Cybersecurity  2024-07-05  Port Scan", "ETIC Cybersecurity  2024-07-04  Port Scan", "ETIC Cybersecurity  2024-07-03  Port Scan", "ETIC Cybersecurity  2024-07-02  Port Scan"], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["hayermal.cam", "szaquamate.com", "www.szaquamate.com"]}


ioc_type: ipv4
ioc_value: 80.76.49.227
source: otx
validated_at: 2026-05-26T00:27:50.290904
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "80.76.49.227", "tags": ["latest spambot", "turkey", "malicious", "enterprise", "android", "singapore", "change healthcare", "csrmirteam", "ransomware", "lumma", "indonesia", "week", "telegram", "defender", "clearfake", "amadey", "romania", "date", "microsoft", "tech mahindra", "asyncrat", "mozi", "april", "mexico", "iocs", "malware", "paraguay", "germany", "ukraine", "threat report", "stealc", "grouped", "brazil", "blacklist host", "group", "compromise", "xworm", "ip country"], "pulses": ["Threatfox Recent Additions", "Threat Intel Report - W15-2025", "Threat Intel Report - W04-2025"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["szbluejay.com", "www.szbluejay.com"]}


ioc_type: ipv4
ioc_value: 80.76.49.239
source: otx
validated_at: 2026-05-26T00:28:28.196712
raw_response:
  {"pulse_count": 18, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "80.76.49.239", "tags": [], "pulses": ["ETIC Cybersecurity  2024-05-13  Port Scan", "ETIC Cybersecurity  2024-05-12  Port Scan", "ETIC Cybersecurity  2024-05-11  Port Scan", "ETIC Cybersecurity  2024-05-10  Port Scan", "ETIC Cybersecurity  2024-05-09  Port Scan", "ETIC Cybersecurity  2024-05-08  Port Scan", "ETIC Cybersecurity  2024-05-07  Port Scan", "ETIC Cybersecurity  2024-05-06  Port Scan", "ETIC Cybersecurity  2024-05-05  Port Scan", "ETIC Cybersecurity  2024-05-04  Port Scan", "ETIC Cybersecurity  2024-05-03  Port Scan", "ETIC Cybersecurity  2024-05-02  Port Scan", "ETIC Cybersecurity  2024-05-01  Port Scan", "ETIC Cybersecurity  2024-04-30  Port Scan", "ETIC Cybersecurity  2024-04-29  Port Scan", "Cybersec - Clone", "Cybersec - Clone", "ETIC Cybersecurity  2024-04-28  Port Scan"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["givfwer.link", "www.pc1to5.com"]}


ioc_type: ipv4
ioc_value: 80.76.49.98
source: otx
validated_at: 2026-05-26T00:28:41.665248
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "80.76.49.98", "tags": ["scanners", "portscan", "honeypot", "vultr", "digital ocean"], "pulses": ["DigitalOcean Toronto (CA) Port Scanning Hosts for 2026-04-26", "Vultr Tokyo (Japan) Port Scanning Hosts for 2026-04-26", "Vultr Melbourne (Australia) Port Scanning Hosts for 2026-04-26"], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["nequiprestamo.com", "campeslijuies.cam", "llxy-suit.com", "www.llxy-suit.com"]}


ioc_type: ipv4
ioc_value: 80.76.49.247
source: otx
validated_at: 2026-05-26T00:28:52.204263
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "80.76.49.247", "tags": ["OriginLogger", "Stealc", "seznam", "ua-wget", "exe", "AgentTesla", "linux", "android", "akamaiasn1", "Mozi", "cuba", "mini", "Photo.scr", "twitter", "as16509", "geoip", "botnet_config", "CoinMiner", "public url", "indonesia", "32", "37.27.82.196", "as852", "shellscript", "media", "as20940", "elf", "hajime", "iframe", "SocGholish", "win32", "amazon02", "gafgyt", "geofenced", "PoseidonStealer", "akamaias", "win64", "Formbook", "moobot", "kaji", "VenomRAT", "AsyncRAT", "as15169", "arm", "compromise ipv4", "CHE", "as8075", "craxsrat", "botnetdomain", "domain port"], "pulses": ["n0paste - Show paste: \\\"No Problems\\\" - dos meses del URLscan", "[REINDEX-4.1] Mirai Botnet IOCs - SEC-1275-1", "URLHaus data - 28-06-2024"], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["xijinping.mov", "souhousha.com", "www.souhousha.com"]}


ioc_type: ipv4
ioc_value: 176.65.144.3
source: otx
validated_at: 2026-05-26T00:31:22.551208
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "Germany", "country_code": "DE", "city": null, "asn": "ASNone ", "indicator": "176.65.144.3", "tags": ["sectoprat", "brute ratel", "ckloader", "qdoor", "cobalt strike"], "pulses": ["few more", "DarkCloud Malware Targets  Windows Devices"], "malware_count": 10, "passive_dns_count": 0, "malware_samples": ["9fc5a5341beddb0c3b6571749b1d57395d348e0bb531c95bb4cdfa881129dab1", "d37100aed854346212869f2a2a6d3d299ae21e6fd8b6e090f3e4908d8e53128c", "4c3b5c7e179dcb7ec97a9212785fc62c1387717a94398d8f9e06c303875f7dad", "e94a5d867470ecbde3df39a5ae8f69fd2000c9bd57183169953751544b3a4fbf", "e25450236e49bbb61e175e39eb46a2f3a1258e8ba8fe7a2c6d8b2f17e85cc167", "c5963972b61874eb1381324ed1bfefa927fc2acacc6ad789356e3bc32b92ebd1", "a8729d9a5ca053dedecdffa637ebce4ea360465979eb5f3f850ea8ca41d349db", "e9c775996d508887553a42f6d22b0b327e1b3a474d0dae1bcfd009b42d88c20b", "f3bf5325e924b63689966201e357e13731db33d2d81a9af5bcd006eabc743f1e", "c7fab89a328f3940ab4cd1de2d13a3aafd950e57ec9260273443571e66a7b567"], "passive_dns": []}


ioc_type: ipv4
ioc_value: 91.184.241.23
source: otx
validated_at: 2026-05-26T12:16:42.720732
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS57456 intek mytischi", "indicator": "91.184.241.23", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 22, "malware_samples": [], "passive_dns": ["www.top-mobile.org", "www.rechroad.com", "top-mobile.org", "www.web.dreamteam.run", "web.dreamteam.run", "www.happybuyertoday.shop", "www.dreamteam.run", "happybuyertoday.shop", "parking-pro.org", "dreamteam.run", "check.dreamteam.run", "www.check.dreamteam.run", "webmail.dreamteam.run", "mail.dreamteam.run", "www.perfectplanefor.com", "www.afprimi.com", "mail.indeed.al", "perfectplanefor.com", "road-recharga.com", "afprimi.com"]}


ioc_type: ipv4
ioc_value: 91.184.241.84
source: otx
validated_at: 2026-05-26T12:18:06.205784
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS57456 intek mytischi", "indicator": "91.184.241.84", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 10, "malware_samples": [], "passive_dns": ["msv.sceniconline.com", "iranselenophile.top", "milad.oborenstein.com", "msv.damianwegner.com", "milad.parallelsw.com", "msv.clipfaktory.com", "milad.millercave.com", "milad.nerdinator.net", "milad.synapseitech.com", "milad.thecastcaddy.com"]}


ioc_type: ipv4
ioc_value: 91.184.242.171
source: otx
validated_at: 2026-05-26T12:21:45.798689
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS34859 zyn line llc", "indicator": "91.184.242.171", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 14, "malware_samples": [], "passive_dns": ["www.cenesel.click", "www.eelehym.click", "www.gegmott.click", "www.fedlexi.click", "nerrand.click", "ophimet.click", "www.ophimet.click", "www.sierial.click", "sierial.click", "www.ulciaph.click", "ulciaph.click", "www.lyriene.click", "lyriene.click", "amandinetv.com"]}


ioc_type: ipv4
ioc_value: 91.184.243.129
source: otx
validated_at: 2026-05-26T18:07:35.698010
raw_response:
  {"pulse_count": 36, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS34859 zyn line llc", "indicator": "91.184.243.129", "tags": ["netsupportmanager-rat", "vidar", "c2-infrastructure", "asyncrat", "threatfox", "dugganusa", "unknown-malware", "window", "osint-volley", "feed", "automated", "credential-theft", "pattern-49", "automated-hunt", "rah623925", "LummaStealer, RedLine,...", "stealer"], "pulses": ["ThreatFix_URL", "ThreatFix_IP", "ThreatFox Hunt: Vidar IOCs - 2026-01-16", "ThreatFox Hunt: Vidar IOCs - 2026-01-16", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-16 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-15 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-15 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-15 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-15 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-15 - Unknown malware/AsyncRAT/NetSupportManager RAT", "OSINT Volley 2026-01-15 - Unknown malware/AsyncRAT/NetSupportManager RAT", "ThreatFox Hunt: Vidar IOCs - 2026-01-15", "OSINT Volley 2026-01-15 - Unknown malware/AsyncRAT/Vidar"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 91.186.217.112
source: otx
validated_at: 2026-05-26T18:24:15.957464
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Iran, Islamic Republic of", "country_code": "IR", "city": null, "asn": "AS1239 sprint", "indicator": "91.186.217.112", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 38, "malware_samples": [], "passive_dns": ["kinozo.cam", "zagonka1.top", "rezka-ag.homes", "lordfilmru.ink", "lordfilm-03.top", "kinokrad.one", "kinopubs.top", "kinogo-go.top", "hdvideobox.cam", "lordfilmz.link", "hdrezka.hair", "ns2.awmzone.net", "ns.awmzone.net", "kinotaznet47.kinoza.link", "ru.movielab.live", "zetflixcam49.kinozi.link", "ru.zetflix.cam", "lordserialxn60.kinozi.link", "kinokrad9.cam", "c2-lordfilm.top"]}


ioc_type: ipv4
ioc_value: 91.92.40.70
source: otx
validated_at: 2026-05-27T00:12:29.726103
raw_response:
  {"pulse_count": 0, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Sofia", "asn": "AS25211 euro crypt eood", "indicator": "91.92.40.70", "tags": [], "pulses": [], "malware_count": 0, "passive_dns_count": 15, "malware_samples": [], "passive_dns": ["holliganbet1285.com", "jojobet10041.com", "holiganbet7210.com", "jojobeti1146.com", "1587nakitbahis.com", "joiobet1317.com", "joiobet1486.com", "mholiganbet1166.com", "mavibet461.com", "jojobeti1148.com", "932mavibett.com", "mpusulabet1162.com", "1425nakitbahis.com", "joiobet1335.com", "mpusulabet1078.com"]}


ioc_type: ipv4
ioc_value: 91.92.42.120
source: otx
validated_at: 2026-05-27T00:13:45.278874
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Bulgaria", "country_code": "BG", "city": "Sofia", "asn": "AS25211 euro crypt eood", "indicator": "91.92.42.120", "tags": ["sakura http", "clientsetup"], "pulses": ["Malware Filter - Botnet List - 24-05-2026 (Part 6)", "tfhncf", "tfhncf", "SERHFGB", "SERHFGB", "cygujctgyj", "mohammedrizwandddddddd"], "malware_count": 0, "passive_dns_count": 6, "malware_samples": [], "passive_dns": ["margaery.tishenko.dev", "giga-chill.ru", "www.weather.tishenko.dev", "www.margaery.tishenko.dev", "weather.tishenko.dev", "www.giga-chill.ru"]}


ioc_type: ipv4
ioc_value: 146.19.213.251
source: shodan
validated_at: 2026-05-27T12:00:50.341381
raw_response:
  {"ports": [22, 80, 143, 443, 587, 8888], "vulns": ["CVE-2023-42117", "CVE-2023-42114", "CVE-2025-67896", "CVE-2022-37451", "CVE-2023-42115", "CVE-2026-40686", "CVE-2026-40684", "CVE-2024-39929", "CVE-2022-3620", "CVE-2022-3559", "CVE-2023-51766", "CVE-2023-42116", "CVE-2026-40687", "CVE-2023-42119", "CVE-2026-40685"], "hostnames": ["vps27.com"], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx:1.28.3", "cpe:/o:canonical:ubuntu_linux", "cpe:/a:f5:nginx", "cpe:/a:openbsd:openssh:8.9p1", "cpe:/a:exim:exim:4.95"]}


ioc_type: ipv4
ioc_value: 159.253.120.118
source: shodan
validated_at: 2026-05-27T12:01:06.918115
raw_response:
  {"ports": [80], "vulns": ["CVE-2021-44224", "CVE-2021-30641", "CVE-2022-28614", "CVE-2007-4723", "CVE-2025-49630", "CVE-2024-47252", "CVE-2021-32786", "CVE-2020-35452", "CVE-2024-40898", "CVE-2020-13938", "CVE-2011-2688", "CVE-2019-17567", "CVE-2025-23048", "CVE-2022-28330", "CVE-2024-27316", "CVE-2022-26377", "CVE-2020-9490", "CVE-2021-33193", "CVE-2022-22721", "CVE-2022-31813", "CVE-2024-43394", "CVE-2023-45802", "CVE-2023-38709", "CVE-2021-32785", "CVE-2025-65082", "CVE-2024-38472", "CVE-2020-11993", "CVE-2009-2299", "CVE-2021-26691", "CVE-2012-3526", "CVE-2021-40438", "CVE-2011-1176", "CVE-2024-38477", "CVE-2022-23943", "CVE-2021-39275", "CVE-2021-36160", "CVE-2022-29404", "CVE-2020-13950", "CVE-2024-38473", "CVE-2023-25690", "CVE-2024-43204", "CVE-2025-53020", "CVE-2024-38475", "CVE-2012-4001", "CVE-2022-36760", "CVE-2022-28615", "CVE-2024-24795", "CVE-2021-26690", "CVE-2022-22719", "CVE-2020-11984", "CVE-2013-2765", "CVE-2020-1927", "CVE-2025-49812", "CVE-2022-22720", "CVE-2025-58098", "CVE-2025-59775", "CVE-2006-20001", "CVE-2023-31122", "CVE-2021-34798", "CVE-2024-42516", "CVE-2025-55753", "CVE-2020-1934", "CVE-2013-0942", "CVE-2021-32792", "CVE-2024-38474", "CVE-2021-44790", "CVE-2021-32791", "CVE-2013-4365", "CVE-2024-39573", "CVE-2022-30556", "CVE-2023-27522", "CVE-2013-0941", "CVE-2025-66200", "CVE-2022-37436", "CVE-2009-0796", "CVE-2012-4360", "CVE-2024-38476"], "hostnames": ["maquina1.elbahospedagemcloud.online"], "tags": [], "cpes": ["cpe:/o:canonical:ubuntu_linux", "cpe:/a:apache:http_server:2.4.41"]}


ioc_type: ipv4
ioc_value: 176.123.10.114
source: shodan
validated_at: 2026-05-27T12:01:59.174643
raw_response:
  {"ports": [21, 22, 80, 110, 111, 443, 465, 587, 995, 2083, 2086, 2087, 2096], "vulns": ["CVE-2025-26465", "CVE-2023-38408", "CVE-2008-3844", "CVE-2023-51767", "CVE-2024-6387", "CVE-2025-32728", "CVE-2023-51385", "CVE-2021-36368", "CVE-2007-2768", "CVE-2023-48795", "CVE-2016-20012", "CVE-2021-41617", "CVE-2026-35414"], "hostnames": ["176-123-10-114.forexcracked.com", "autodiscover.forexcracked.com", "mail.forexcracked.com", "forexcracked.com", "www.forexcracked.com", "webdisk.forexcracked.com"], "tags": ["starttls"], "cpes": ["cpe:/a:litespeedtech:litespeed_web_server", "cpe:/a:exim:exim:4.99.1", "cpe:/a:cpanel:cpanel", "cpe:/a:cpanel:whm", "cpe:/a:openbsd:openssh:8.7", "cpe:/a:pureftpd:pure-ftpd", "cpe:/a:exim:exim:4.99.2"]}


ioc_type: ipv4
ioc_value: 176.123.10.61
source: shodan
validated_at: 2026-05-27T12:02:11.972656
raw_response:
  {"ports": [21, 22, 53, 80, 110, 587], "vulns": ["CVE-2025-26465", "CVE-2025-67896", "CVE-2008-3844", "CVE-2020-15778", "CVE-2007-2768", "CVE-2026-35386", "CVE-2023-48795", "CVE-2021-41617", "CVE-2023-38408", "CVE-2026-35387", "CVE-2020-14145", "CVE-2025-32728", "CVE-2023-51385", "CVE-2021-36368", "CVE-2016-20012", "CVE-2026-35414", "CVE-2026-35388", "CVE-2023-51767", "CVE-2026-35385", "CVE-2019-16905"], "hostnames": [], "tags": ["self-signed", "starttls"], "cpes": ["cpe:/a:f5:nginx:1.28.0", "cpe:/a:exim:exim:4.98.2", "cpe:/a:openbsd:openssh:8.0"]}


