WatchmanHQ

Hunting: Look, don't block.

Release 20261012T180322Z · built 2026-10-12 18:03 UTC · valid until 2026-10-15 18:03 UTC

Linked to suspicious activity but not proven enough to block: a single mention, an older report, shared infrastructure, or something still waiting for validation. Search your logs for these and investigate any hit. Do not block them.

This page lists the indicators that are only on Hunting. Everything on Blocking is worth hunting for too.

5,203 indicators. Numbers in the Sources column link to the original reports.

Indicator (defanged)TypeReported asBlock scopeFirst reportedListSources
colnsdital[.]comDomainPhishingSearch only2026-04-23HuntingInfoblox Threat Intel [1]
d[.]herbosfinx[.]comDomainMalware downloadSearch only2026-04-23HuntingInfoblox Threat Intel [1]
d[.]ruelomamuy[.]comDomainMalware downloadSearch only2026-04-23HuntingInfoblox Threat Intel [1]
d[.]santafebuno[.]topDomainMalware downloadSearch only2026-04-23HuntingInfoblox Threat Intel [1]
verifysuper[.]comDomainMalware downloadSearch only2026-04-23HuntingInfoblox Threat Intel [1]
zawsterris[.]comDomainMalware downloadSearch only2026-04-23HuntingInfoblox Threat Intel [1]
1210678[.]pinturasboreal[.]clDomainMalware downloadSearch only2026-04-22HuntingCensys [1]
1635108[.]tepartners[.]com[.]auDomainMalware downloadSearch only2026-04-22HuntingCensys [1]
4rekchj[.]foodiqr[.]com[.]auDomainMalware downloadSearch only2026-04-22HuntingCensys [1]
67g108w2[.]nzmpl[.]co[.]nzDomainMalware downloadSearch only2026-04-22HuntingCensys [1]
726h53[.]foodiqr[.]com[.]auDomainMalware downloadSearch only2026-04-22HuntingCensys [1]
alvincurren[.]comDomainMalware downloadSearch only2026-04-22HuntingCensys [1]
aunz06[.]azurewebsites[.]netDomainMalware downloadSearch only2026-04-22HuntingCensys [1]
aunz261[.]azurewebsites[.]netDomainMalware downloadSearch only2026-04-22HuntingCensys [1]
controlescolar[.]clDomainMalware downloadSearch only2026-04-22HuntingCensys [1]
foodiqr[.]com[.]auDomainMalware downloadSearch only2026-04-22HuntingCensys [1]
lesliepower[.]clDomainMalware downloadSearch only2026-04-22HuntingCensys [1]
noveltyproject[.]com[.]sgDomainMalware downloadSearch only2026-04-22HuntingCensys [1]
nzmpl[.]co[.]nzDomainMalware downloadSearch only2026-04-22HuntingCensys [1]
nznov28[.]azurewebsites[.]netDomainMalware downloadSearch only2026-04-22HuntingCensys [1]
orgid[.]comDomainCompromised siteSearch only2026-04-22HuntingCensys [1]
portal[.]microsoftonline[.]com[.]orgid[.]comDomainCommand and controlSearch only2026-04-22HuntingCensys [1] [2]
postimg[.]ccDomainPhishingSearch only2026-04-22HuntingCensys [1]
usanov98904[.]azurewebsites[.]netDomainMalware downloadSearch only2026-04-22HuntingCensys [1]
view[.]alvincurren[.]comDomainMalware downloadSearch only2026-04-22HuntingCensys [1]
103[.]96[.]117[.]68IP addressListed by researchersSearch only2026-04-22HuntingCensys [1]
13[.]77[.]50[.]113IP addressPhishingSearch only2026-04-22HuntingCensys [1]
168[.]61[.]217[.]214IP addressPhishingSearch only2026-04-22HuntingCensys [1]
192[.]250[.]232[.]195IP addressListed by researchersSearch only2026-04-22HuntingCensys [1]
20[.]36[.]106[.]98IP addressPhishingSearch only2026-04-22HuntingCensys [1]
66[.]29[.]144[.]201IP addressListed by researchersSearch only2026-04-22HuntingCensys [1]
69[.]48[.]190[.]10IP addressListed by researchersSearch only2026-04-22HuntingCensys [1]
75[.]102[.]20[.]7IP addressListed by researchersSearch only2026-04-22HuntingCensys [1]
158[.]247[.]193[.]100IP addressCommand and controlSearch only2026-04-22HuntingZscaler ThreatLabz [1]
58[.]247[.]193[.]100IP addressCommand and controlSearch only2026-04-22HuntingZscaler ThreatLabz [1]
denemekulubum[.]com[.]trDomainMalware downloadSearch only2026-04-22HuntingThe DFIR Report [1]
wiprz[.]comDomainMalware downloadSearch only2026-04-22HuntingThe DFIR Report [1]
0x1x2x3[.]topDomainCommand and controlSearch only2026-04-22HuntingHuntress [1]
pool[.]supportxmr[.]comDomainCommand and controlSearch only2026-04-22HuntingHuntress, Unit 42 [1] [2]
147[.]45[.]41[.]25IP addressMalware downloadSearch only2026-04-22HuntingHuntress [1]
162[.]55[.]234[.]175IP addressMalware downloadSearch only2026-04-22HuntingHuntress [1]
172[.]245[.]159[.]216IP addressPhishingSearch only2026-04-22HuntingHuntress [1]
172[.]86[.]127[.]128IP addressData theftSearch only2026-04-22HuntingHuntress [1]
57[.]129[.]119[.]218IP addressData theftSearch only2026-04-22HuntingHuntress [1]
staybud[.]dpdns[.]orgDomainCommand and controlSearch only2026-04-20HuntingHuntress [1]
179[.]43[.]140[.]214IP addressAttacker addressSearch only2026-04-20HuntingHuntress [1]
212[.]232[.]23[.]69IP addressAttacker addressSearch only2026-04-20HuntingHuntress [1]
45[.]86[.]230[.]112IP addressCommand and controlSearch only2026-04-20HuntingCheck Point Research [1]
91[.]107[.]247[.]163IP addressCommand and controlSearch only2026-04-20HuntingCheck Point Research [1]
078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937bSHA-256 hashMalware fileSearch only2026-04-20HuntingCheck Point Research, Microsoft Threat Intelligence [1] [2]
cc14df781475ef0f3f2c441d03a622ea67cd86967526f8758ead6f45174db78eSHA-256 hashMalware fileSearch only2026-04-20HuntingCheck Point Research [1]
hxxps://x[.]com/TheGentlemen25URLMalware downloadSearch only2026-04-20HuntingCheck Point Research [1]
2b1[.]916[.]mytemp[.]websiteDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
2pd[.]f22[.]mytemp[.]websiteDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
92j[.]130[.]mytemp[.]websiteDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
ae-payapp[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
airansupasdports[.]cyouDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
alpha[.]filehost36[.]sbsDomainMalware downloadSearch only2026-04-17HuntingUnit 42 [1]
api[.]ra-backup[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
appleid[.]apple[.]com-update[.]required[.]kontol[.]emiratesbankgroup[.]infoDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
aramcoamericainvest[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
arch2[.]megadatahost3[.]homesDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
b0p[.]c0d[.]mytemp[.]websiteDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
b1z[.]0f6[.]mytemp[.]websiteDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
bankiran[.]betDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
bankofamerica[.]com[.]oidscreen[.]gorequestlocale[.]emiratesbankgroup[.]infoDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
biransupasdports[.]cyouDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
bit[.]lyDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
buydubaipropertywithcrypto[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
c1y[.]bf3[.]mytemp[.]websiteDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
c45[.]94b[.]mytemp[.]websiteDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
cache3[.]filehost36[.]sbsDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
cnmaestro[.]sapb-aramco[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
com-govauv[.]topDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
cover[.]www[.]microsoft[.]com[.]irancell[.]coursesDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
cryptocurrencies-offers[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
d1g[.]ccd[.]mytemp[.]websiteDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
dubai-custbims[.]topDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
dubai-custboms[.]topDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
dubai-customs[.]topDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
dubaicuctoms[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
dubaicustoms[.]topDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
dubaicustonms[.]topDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
dubaiicuctoms[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
dubaipolice[.]gov-tollbillba[.]lifeDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
eg3[.]db1[.]mytemp[.]websiteDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
emirates-ae[.]pack-541202699[.]azmtrust[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
emiratescryptobank[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
emiratesinvestunion[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
emiratespost-pay[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
emiratespost[.]traz[.]topDomainPhishingSearch only2026-04-17HuntingUnit 42 [1]
etisalataccount-quickpayae[.]clickDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
etisalataccountquickpayae[.]topDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
etisalatquickpay[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
f43[.]c76[.]mytemp[.]websiteDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
firansupport[.]cyouDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
fkiransusdpportsdf[.]cyouDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
gov-tollbillba[.]lifeDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
govauv[.]topDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
hyperfilevault1[.]xyzDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
hyperfilevault2[.]momDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
hyperfilevault3[.]momDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
hyperfilevault3[.]picsDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
iran[.]drproxy[.]proDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
iran11[.]drproxy[.]proDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
iran14[.]drproxy[.]proDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
iran15[.]drproxy[.]proDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
iran16[.]drproxy[.]proDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
iran18[.]drproxy[.]proDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
iran19[.]drproxy[.]proDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
iran2[.]drproxy[.]proDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
irancross[.]shopDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
irandargah[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
iranpaye[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
iransupasdports[.]cyouDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
iransupports[.]cyouDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
iransupporttyst[.]cyouDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
iransusdpportsdf[.]cyouDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
kiransupport[.]cyouDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
kiransupportsdf[.]cyouDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
kmd[.]8cd[.]mytemp[.]websiteDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
kzw[.]ce3[.]mytemp[.]websiteDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
m1w[.]4a0[.]mytemp[.]websiteDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
myemiratespost[.]clickDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
njb[.]551[.]mytemp[.]websiteDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
nxj[.]e57[.]mytemp[.]websiteDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
outlook[.]outlook[.]saudidigtalbank[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
pnd[.]86c[.]mytemp[.]websiteDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
portal[.]0111etisalat[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
portal[.]sapb-aramco[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
pro[.]iranpanel[.]lifeDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
recovery[.]cover[.]www[.]microsoft[.]com[.]irancell[.]coursesDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
s0u[.]210[.]mytemp[.]websiteDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
saudi-bill-pay[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
saudidigtalbank[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
secretemirates[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
sffifdsfsransupasdports[.]cyouDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
srv2[.]filehost37[.]sbsDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
store[.]appleid-apple[.]com-confirmation[.]verif[.]emiratesbankgroup[.]infoDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
superset[.]0111etisalat[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
tehran[.]t2[.]drproxy[.]proDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
the-dubai-lifestyleapp[.]cryptocurrencies-offers[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
traz[.]topDomainPhishingSearch only2026-04-17HuntingUnit 42 [1]
trdfiransupport[.]cyouDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
trumpvsirancoin[.]xyzDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
www[.]emirates-post[.]ae-payapp[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
www[.]forever-iran[.]netDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
www[.]hyperfilevault2[.]momDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
www[.]iran2026[.]orgDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
www[.]portal[.]0111etisalat[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
www[.]superset[.]0111etisalat[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
yoshi[.]0111etisalat[.]comDomainListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
hxxps://api[.]ra-backup[.]com/analytics/submit[.]phpURLListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
hxxps://bit[.]ly/4tWJhQhURLListed by researchersSearch only2026-04-17HuntingUnit 42 [1]
146[.]70[.]41[.]131IP addressListed by researchersSearch only2026-04-17HuntingHuntress [1]
62[.]60[.]246[.]210IP addressListed by researchersSearch only2026-04-17HuntingHuntress [1] [2]
bot[.]ddosvps[.]ccDomainCommand and controlSearch only2026-04-16HuntingUnit 42 [1]
cnc[.]vietdediserver[.]shopDomainCommand and controlSearch only2026-04-16HuntingUnit 42 [1]
51[.]38[.]137[.]113IP addressMalware downloadSearch only2026-04-16HuntingUnit 42 [1]
hxxp://51[.]38[.]137[.]113/armURLListed by researchersSearch only2026-04-16HuntingUnit 42 [1]
hxxp://51[.]38[.]137[.]113/arm5URLListed by researchersSearch only2026-04-16HuntingUnit 42 [1]
hxxp://51[.]38[.]137[.]113/arm6URLListed by researchersSearch only2026-04-16HuntingUnit 42 [1]
hxxp://51[.]38[.]137[.]113/arm7URLListed by researchersSearch only2026-04-16HuntingUnit 42 [1]
hxxp://51[.]38[.]137[.]113/mipsURLListed by researchersSearch only2026-04-16HuntingUnit 42 [1]
hxxp://51[.]38[.]137[.]113/sh4URLListed by researchersSearch only2026-04-16HuntingUnit 42 [1]
hxxp://51[.]38[.]137[.]113/x86_64URLListed by researchersSearch only2026-04-16HuntingUnit 42 [1]
hxxp://bot[.]ddosvps[.]cc/top1hbt[.]armURLListed by researchersSearch only2026-04-16HuntingUnit 42 [1]
hxxp://bot[.]ddosvps[.]cc/top1hbt[.]arm5URLListed by researchersSearch only2026-04-16HuntingUnit 42 [1]
hxxp://bot[.]ddosvps[.]cc/top1hbt[.]arm6URLListed by researchersSearch only2026-04-16HuntingUnit 42 [1]
hxxp://bot[.]ddosvps[.]cc/top1hbt[.]arm7URLListed by researchersSearch only2026-04-16HuntingUnit 42 [1]
hxxp://bot[.]ddosvps[.]cc/top1hbt[.]mipsURLListed by researchersSearch only2026-04-16HuntingUnit 42 [1]
hxxp://bot[.]ddosvps[.]cc/top1hbt[.]mpslURLListed by researchersSearch only2026-04-16HuntingUnit 42 [1]
hxxp://bot[.]ddosvps[.]cc/top1hbt[.]sh4URLListed by researchersSearch only2026-04-16HuntingUnit 42 [1]
hxxp://bot[.]ddosvps[.]cc/top1hbt[.]x86_64URLListed by researchersSearch only2026-04-16HuntingUnit 42 [1]
check02id[.]comDomainCommand and controlSearch only2026-04-16HuntingMicrosoft Threat Intelligence [1]
termsliva[.]comDomainMalware downloadSearch only2026-04-16HuntingMicrosoft Threat Intelligence [1]
uw04webzoom[.]usDomainMalware downloadSearch only2026-04-16HuntingMicrosoft Threat Intelligence [1]
104[.]145[.]210[.]107IP addressData theftSearch only2026-04-16HuntingMicrosoft Threat Intelligence [1]
188[.]227[.]196[.]252IP addressMalware downloadSearch only2026-04-16HuntingMicrosoft Threat Intelligence [1]
188[.]227[.]197[.]136IP addressMalware downloadSearch only2026-04-16HuntingMicrosoft Threat Intelligence [1]
83[.]136[.]208[.]246IP addressCommand and controlSearch only2026-04-16HuntingMicrosoft Threat Intelligence [1]
83[.]136[.]208[.]48IP addressListed by researchersSearch only2026-04-16HuntingMicrosoft Threat Intelligence [1]
83[.]136[.]209[.]22IP addressMalware downloadSearch only2026-04-16HuntingMicrosoft Threat Intelligence [1]
83[.]136[.]210[.]180IP addressListed by researchersSearch only2026-04-16HuntingMicrosoft Threat Intelligence [1]
95e893e7cdde19d7d16ff5a5074d0b369abd31c1a30962656133caa8153e8d63SHA-256 hashMalware fileSearch only2026-04-16HuntingMicrosoft Threat Intelligence [1]
97ccc28808d2c21b83f24835744af754920a992e57216d2cbc8315664905b0e2SHA-256 hashMalware fileSearch only2026-04-16HuntingMicrosoft Threat Intelligence [1]
980bf65c703edae7b28a752207a84b80332be0dae4ee87f00928f82a011ab0ceSHA-256 hashMalware fileSearch only2026-04-16HuntingMicrosoft Threat Intelligence [1]
a05400000843fbad6b28d2b76fc201c3d415a72d88d8dc548fafd8bae073c640SHA-256 hashMalware fileSearch only2026-04-16HuntingMicrosoft Threat Intelligence [1]
fcd0c4f9d4311de6f400cc61f476dd60ae06f8d19568dbbaa1a118e1a0ff68abSHA-256 hashMalware fileSearch only2026-04-16HuntingMicrosoft Threat Intelligence [1]
cardcpp[.]onlineDomainMalware downloadSearch only2026-04-15HuntingCyble [1]
cardhelp[.]liveDomainMalware downloadSearch only2026-04-15HuntingCyble [1]
dkfootwearstore[.]shopDomainMalware downloadSearch only2026-04-15HuntingCyble [1]
downloadhdfcapp[.]pythonanywhere[.]comDomainMalware downloadSearch only2026-04-15HuntingCyble [1]
free-secure[.]comDomainPhishingSearch only2026-04-15HuntingCyble [1]
getchaiian[.]short[.]gyDomainMalware downloadSearch only2026-04-15HuntingCyble [1]
googleeplaaystore[.]pages[.]devDomainPhishingSearch only2026-04-15HuntingCyble [1]
hamzaansari1612-ux[.]github[.]ioDomainMalware downloadSearch only2026-04-15HuntingCyble [1]
litter[.]catbox[.]moeDomainPhishingSearch only2026-04-15HuntingCyble [1]
protectcc[.]onlineDomainMalware downloadSearch only2026-04-15HuntingCyble [1]
tv-pluto[.]vercel[.]appDomainPhishingSearch only2026-04-15HuntingCyble [1]
www[.]icicimanagecards[.]onlineDomainMalware downloadSearch only2026-04-15HuntingCyble [1]
www[.]kavoutai[.]comDomainPhishingSearch only2026-04-15HuntingCyble [1]
hxxps://cardcpp[.]online/imobile[.]apkURLMalware downloadSearch only2026-04-15HuntingCyble [1]
hxxps://cardhelp[.]live/SBICreditCard[.]apkURLMalware downloadSearch only2026-04-15HuntingCyble [1]
hxxps://dkfootwearstore[.]shop/Jio%20Free%20Recharge[.]apkURLMalware downloadSearch only2026-04-15HuntingCyble [1]
hxxps://downloadhdfcapp[.]pythonanywhere[.]com/download/latest[.]apkURLMalware downloadSearch only2026-04-15HuntingCyble [1]
hxxps://free-secure[.]com/Free%20Secure%20-%20Annulation[.]apkURLPhishingSearch only2026-04-15HuntingCyble [1]
hxxps://getchaiian[.]short[.]gy/Getchallan0176URLMalware downloadSearch only2026-04-15HuntingCyble [1]
hxxps://googleeplaaystore[.]pages[.]dev/assets/AGENDA2026[.]apkURLPhishingSearch only2026-04-15HuntingCyble [1]
hxxps://hamzaansari1612-ux[.]github[.]io/ICICI00/imobile[.]apkURLMalware downloadSearch only2026-04-15HuntingCyble [1]
hxxps://litter[.]catbox[.]moe/o6pxvp[.]apkURLPhishingSearch only2026-04-15HuntingCyble [1]
hxxps://protectcc[.]online/imobile[.]apkURLMalware downloadSearch only2026-04-15HuntingCyble [1]
hxxps://raw[.]githubusercontent[.]com/singhsonali3021-pixel/my-apk/main/ICICI%20BANK%20CREDIT%20CARD[.]apkURLMalware downloadSearch only2026-04-15HuntingCyble [1]
hxxps://tv-pluto[.]vercel[.]app/PlutoTv[.]apkURLPhishingSearch only2026-04-15HuntingCyble [1]
hxxps://www[.]dl[.]dropboxusercontent[.]com/scl/fi/r9d5y9ch1k7dwvw6l36rj/TecnoCasaFotosPiso[.]apk?rlkey=z6n2qvft8v3nzm66fgy6acwcxURLPhishingSearch only2026-04-15HuntingCyble [1]
hxxps://www[.]icicimanagecards[.]online/iMobile%20Lite[.]apkURLMalware downloadSearch only2026-04-15HuntingCyble [1]
hxxps://www[.]kavoutai[.]com/signed[.]apkURLPhishingSearch only2026-04-15HuntingCyble [1]
artificialupdates[.]comDomainListed by researchersSearch only2026-04-14HuntingHuntress [1]
chromsterabrowser[.]comDomainMalware downloadSearch only2026-04-14HuntingHuntress [1]
chromsteraupdates[.]comDomainListed by researchersSearch only2026-04-14HuntingHuntress [1]
dl[.]isready26[.]onlineDomainMalware downloadSearch only2026-04-14HuntingHuntress [1]
dragonstraffic[.]comDomainListed by researchersSearch only2026-04-14HuntingHuntress [1]
isready26[.]onlineDomainListed by researchersSearch only2026-04-14HuntingHuntress [1]
updaterituals[.]comDomainListed by researchersSearch only2026-04-14HuntingHuntress [1]
worldwidewebframework2[.]comDomainListed by researchersSearch only2026-04-14HuntingHuntress [1]
worldwidewebuniverse3[.]comDomainMalware downloadSearch only2026-04-14HuntingHuntress [1]
26ddd0712a101b27b018658b4072ad56bb4083026c797b0345b2cce43862fc83SHA-256 hashMalware fileSearch only2026-04-14HuntingHuntress [1]
40ac30ce1e88c47f317700cc4b5aa0a510f98c89e11c32265971564930418372SHA-256 hashMalware fileSearch only2026-04-14HuntingHuntress [1]
909539d3ef8dedc3be56381256713fa5545cc7fd3d3d0e0428f7efb94a7e71cbSHA-256 hashMalware fileSearch only2026-04-14HuntingHuntress [1]
0x666[.]infoDomainCommand and controlSearch only2026-04-14HuntingElastic Security Labs [1] [2]
base[.]blockscout[.]comDomainCommand and controlSearch only2026-04-14HuntingElastic Security Labs [1] [2]
eth[.]blockscout[.]comDomainCommand and controlSearch only2026-04-14HuntingElastic Security Labs [1] [2]
fefea22134[.]netDomainCommand and controlSearch only2026-04-14HuntingElastic Security Labs [1]
optimism[.]blockscout[.]comDomainCommand and controlSearch only2026-04-14HuntingElastic Security Labs [1] [2]
panel[.]fefea22134[.]netDomainCommand and controlSearch only2026-04-14HuntingElastic Security Labs [1] [2]
thoroughly-publisher-troy-clara[.]trycloudflare[.]comDomainCommand and controlSearch only2026-04-14HuntingElastic Security Labs [1] [2]
195[.]3[.]222[.]251IP addressCommand and controlSearch only2026-04-14HuntingElastic Security Labs [1] [2]
9e3890d43366faec26523edaf91712640056ea2481cdefe2f5dfa6b2b642085dSHA-256 hashMalware fileSearch only2026-04-14HuntingElastic Security Labs [1]
hxxp://195[.]3[.]222[.]251/script1[.]ps1URLMalware downloadSearch only2026-04-14HuntingElastic Security Labs [1]
hxxp://195[.]3[.]222[.]251/stuk-phaseURLMalware downloadSearch only2026-04-14HuntingElastic Security Labs [1]
hxxp://195[.]3[.]222[.]251/syncobs[.]exe?q=%23OBSIDIANURLMalware downloadSearch only2026-04-14HuntingElastic Security Labs [1]
alafrica[.]xyzDomainListed by researchersSearch only2026-04-10HuntingInfoblox Threat Intel [1]
alperu[.]topDomainListed by researchersSearch only2026-04-10HuntingInfoblox Threat Intel [1]
avianca[.]sxjgo[.]ccDomainListed by researchersSearch only2026-04-10HuntingInfoblox Threat Intel [1]
dkhth[.]comDomainListed by researchersSearch only2026-04-10HuntingInfoblox Threat Intel [1]
lx-yindu[.]topDomainPhishingSearch only2026-04-10HuntingInfoblox Threat Intel [1]
ngovbr[.]ccDomainListed by researchersSearch only2026-04-10HuntingInfoblox Threat Intel [1]
orbiixtrade[.]comDomainPhishingSearch only2026-04-10HuntingInfoblox Threat Intel [1]
orgo[.]ccDomainListed by researchersSearch only2026-04-10HuntingInfoblox Threat Intel [1]
rycnair[.]comDomainListed by researchersSearch only2026-04-10HuntingInfoblox Threat Intel [1]
vnwd[.]topDomainListed by researchersSearch only2026-04-10HuntingInfoblox Threat Intel [1]
vsgo[.]ccDomainMalware downloadSearch only2026-04-10HuntingInfoblox Threat Intel [1]
103[.]214[.]169[.]197IP addressListed by researchersSearch only2026-04-10HuntingInfoblox Threat Intel [1]
18[.]167[.]169[.]60IP addressListed by researchersSearch only2026-04-10HuntingInfoblox Threat Intel [1]
38[.]47[.]52[.]4IP addressListed by researchersSearch only2026-04-10HuntingInfoblox Threat Intel [1]
39ea88f852b25d3c55d605464a3440bd250a577e3e21f52d1eaf94d15aad5b82SHA-256 hashMalware fileSearch only2026-04-10HuntingInfoblox Threat Intel [1]
4338ab77d05aeacd7eac5acbe9eed5568778c8e3e9499562816805b54b4d1a6aSHA-256 hashMalware fileSearch only2026-04-10HuntingInfoblox Threat Intel [1]
eshareflies[.]imDomainListed by researchersSearch only2026-04-09HuntingZscaler ThreatLabz [1]
07720d8220abc066b6fdb2c187ae58f5MD5 hashMalware fileSearch only2026-04-09HuntingZscaler ThreatLabz [1]
07f95ff34fb330875d80afadca3f0d5bMD5 hashMalware fileSearch only2026-04-09HuntingZscaler ThreatLabz [1]
3d389886e95f00fade1eea67a6c370d1MD5 hashMalware fileSearch only2026-04-09HuntingZscaler ThreatLabz [1]
3effadb977eddd4c48c7850c8dc03b13MD5 hashMalware fileSearch only2026-04-09HuntingZscaler ThreatLabz [1]
a7e5dbec37c8f431d175dfd9352db59fMD5 hashMalware fileSearch only2026-04-09HuntingZscaler ThreatLabz [1]
c02448e016b2568173de3eedadd80149MD5 hashMalware fileSearch only2026-04-09HuntingZscaler ThreatLabz [1]
c36910c4c8d23ec93f6ae7d7a2496ce5MD5 hashMalware fileSearch only2026-04-09HuntingZscaler ThreatLabz [1]
e4b594a18fc2a6ee164a76bdea980bc0MD5 hashMalware fileSearch only2026-04-09HuntingZscaler ThreatLabz [1]
hxxps://drive[.]google[.]com/uc?id=1TVJir-OlNZrLjm5FyBMk_hDjG9BV1zCy&export=downloadURLMalware downloadSearch only2026-04-09HuntingZscaler ThreatLabz [1]
hxxps://x0[.]at/qOfN[.]msiURLListed by researchersSearch only2026-04-09HuntingZscaler ThreatLabz [1]
dnshook[.]siteDomainMalware downloadSearch only2026-04-07HuntingUnit 42 [1]
ad67031e2ca68764fe1a7d6632c02b02a299d59efb920710011a9a2ccf4399b7SHA-256 hashMalware fileSearch only2026-04-07HuntingHuntress [1]
bde50a42efc079edde1a314243ad339db2d42e343fbbcd39117803b0f5960355SHA-256 hashMalware fileSearch only2026-04-07HuntingHuntress [1]
104[.]238[.]149[.]198IP addressListed by researchersSearch only2026-04-06HuntingUnit 42 [1]
23[.]235[.]188[.]3IP addressListed by researchersSearch only2026-04-06HuntingUnit 42 [1]
7d2c9b4a3942f6029d2de7f73723b505b64caa8e1763e4eb1f134360465185d0SHA-256 hashMalware fileSearch only2026-04-06HuntingUnit 42 [1]
bb470a803b6d7b12fb596d2e4a18ea9ca91f40fd34ded7f01a487eed9a1d814dSHA-256 hashMalware fileSearch only2026-04-06HuntingUnit 42 [1]
hxxp://104[.]238[.]149[.]198:12349/BVN0VEdddye5odDFVRURLListed by researchersSearch only2026-04-06HuntingUnit 42 [1]
134[.]195[.]91[.]224IP addressCommand and controlSearch only2026-04-06HuntingMicrosoft Threat Intelligence [1]
185[.]135[.]86[.]149IP addressCommand and controlSearch only2026-04-06HuntingMicrosoft Threat Intelligence [1]
85[.]155[.]186[.]121IP addressCommand and controlSearch only2026-04-06HuntingMicrosoft Threat Intelligence [1]
0cefeb6210b7103fd32b996beff518c9b6e1691a97bb1cda7f5fb57905c4be96SHA-256 hashMalware fileSearch only2026-04-06HuntingMicrosoft Threat Intelligence [1]
5ba7de7d5115789b952d9b1c6cff440c9128f438de933ff9044a68fff8496d19SHA-256 hashMalware fileSearch only2026-04-06HuntingMicrosoft Threat Intelligence [1]
9632d7e4a87ec12fdd05ed3532f7564526016b78972b2cd49a610354d672523cSHA-256 hashMalware fileSearch only2026-04-06HuntingMicrosoft Threat Intelligence [1]
e57ba1a4e323094ca9d747bfb3304bd12f3ea3be5e2ee785a3e656c3ab1e8086SHA-256 hashMalware fileSearch only2026-04-06HuntingMicrosoft Threat Intelligence [1]
xmr[.]kryptex[.]networkDomainListed by researchersSearch only2026-04-06HuntingCensys, Huntress [1] [2]
77[.]110[.]96[.]200IP addressMalware downloadSearch only2026-04-06HuntingCensys [1]
1864aaa74c027e799382467c08bb7304bf5b4e40cdb022b8016d4a8d77f556b9SHA-256 hashMalware fileSearch only2026-04-06HuntingCensys [1]
dc232b55329d95fe2a47a8d637b7bffea06f18e3d8332ba94b042b1862213a1dSHA-256 hashMalware fileSearch only2026-04-06HuntingCensys [1]
ecb05ace093a8bf936d0aac66a5b6d0896d21122961a21ebc178f4f3fdff09c6SHA-256 hashMalware fileSearch only2026-04-06HuntingCensys [1]
hxxp://77[.]110[.]96[.]200/ghost[.]shURLAttacker addressSearch only2026-04-06HuntingCensys [1]
23[.]254[.]167[.]216IP addressCommand and controlSearch only2026-04-03HuntingNVISO Labs [1]
4a-m[.]alDomainMalware downloadSearch only2026-04-02HuntingCensys [1]
mail[.]orcanmedikal[.]com[.]trDomainListed by researchersSearch only2026-04-02HuntingCensys [1]
orcanmedikal[.]com[.]trDomainMalware downloadSearch only2026-04-02HuntingCensys [1]
www[.]orcanmedikal[.]com[.]trDomainListed by researchersSearch only2026-04-02HuntingCensys [1]
86[.]106[.]85[.]194IP addressCommand and controlSearch only2026-04-02HuntingCensys [1]
34e90568af4dcd40f4f04174ec326e2aMD5 hashMalware fileSearch only2026-04-02HuntingCensys [1]
e013048d6ae5bb1289e36c9742b58934MD5 hashMalware fileSearch only2026-04-02HuntingCensys [1]
020668f00325631bec2b9c6dd8596d7744e118f68424fdbb28eb2a318f3a7adfSHA-256 hashMalware fileSearch only2026-04-02HuntingCensys [1]
656991f4dabe0e5d989be730dac86a2cf294b6b538b08d7db7a0a72f0c6c484bSHA-256 hashMalware fileSearch only2026-04-02HuntingCensys [1]
6f67c7441e31d448502050c9783a1032c307946323f29e41a82fb19915c59531SHA-256 hashMalware fileSearch only2026-04-02HuntingCensys [1]
7e13561d794f7065e9cb3afc319acc7ac9861b4cf653082c1a11d5cc25a5d1f1SHA-256 hashMalware fileSearch only2026-04-02HuntingCensys [1]
adc2f550e7ff2b707a070ffaa50fc367af6a01c037f1f5b347c444cca3c9a650SHA-256 hashMalware fileSearch only2026-04-02HuntingCensys [1]
b67d8db2f53547b4a5b070b736cd93cbdf3ece21109972d54f193e8ede0b584bSHA-256 hashMalware fileSearch only2026-04-02HuntingCensys [1]
c52314cea0d81acd337cec2f968e55d20c52aca4504d7c452842cd1dcfb9fdf1SHA-256 hashMalware fileSearch only2026-04-02HuntingCensys [1]
hxxps://4a-m[.]al/ConvertedFile[.]txtURLMalware downloadSearch only2026-04-02HuntingCensys [1]
hxxps://archive[.]org/download/optimized_msi_20250904/optimized_MSI[.]pngURLMalware downloadSearch only2026-04-02HuntingCensys [1]
hxxps://orcanmedikal[.]com[.]tr/tool[.]htaURLMalware downloadSearch only2026-04-02HuntingCensys [1]
rti[.]cargomanbd[.]comDomainListed by researchersSearch only2026-04-01HuntingZscaler ThreatLabz [1]
steamcommunity[.]comDomainCommand and controlSearch only2026-04-01HuntingElastic Security Labs, Red Canary, Securelist +1 [1] [2] [3] [4]
3388b415610f4ae018d124ea4dc99189MD5 hashMalware fileSearch only2026-04-01HuntingZscaler ThreatLabz [1]
77c73bd5e7625b7f691bc00a1b561a0fMD5 hashMalware fileSearch only2026-04-01HuntingZscaler ThreatLabz [1]
81fb210ba148fd39e999ee9cdc085dfcMD5 hashMalware fileSearch only2026-04-01HuntingZscaler ThreatLabz [1]
8660646bbc6bb7dc8f59a764e25fe1fdMD5 hashMalware fileSearch only2026-04-01HuntingZscaler ThreatLabz [1]
9a6ea91491ccb1068b0592402029527fMD5 hashMalware fileSearch only2026-04-01HuntingZscaler ThreatLabz [1]
d8256fbc62e85dae85eb8d4b49613774MD5 hashMalware fileSearch only2026-04-01HuntingZscaler ThreatLabz [1]
hxxps://github[.]com/idbzoomh1URLListed by researchersSearch only2026-04-01HuntingZscaler ThreatLabz [1]
hxxps://github[.]com/leaked-claude-code/leaked-claude-codeURLListed by researchersSearch only2026-04-01HuntingZscaler ThreatLabz [1]
hxxps://github[.]com/my3jie/leaked-claude-codeURLListed by researchersSearch only2026-04-01HuntingZscaler ThreatLabz [1]
hxxps://steamcommunity[.]com/profiles/76561198721263282URLListed by researchersSearch only2026-04-01HuntingZscaler ThreatLabz [1]
hxxps://telegram[.]me/g1n3sssURLListed by researchersSearch only2026-04-01HuntingZscaler ThreatLabz [1]
58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668SHA-256 hashMalware fileSearch only2026-04-01HuntingNVISO Labs, Unit 42 [1] [2]
59336a964f110c25c112bcc5adca7090296b54ab33fa95c0744b94f8a0d80c0fSHA-256 hashMalware fileSearch only2026-04-01HuntingNVISO Labs, Unit 42 [1] [2]
5bb67e88846096f1f8d42a0f0350c9c46260591567612ff9af46f98d1b7571cdSHA-256 hashMalware fileSearch only2026-04-01HuntingNVISO Labs, Unit 42 [1] [2]
142[.]11[.]206[.]73IP addressCommand and controlSearch only2026-04-01HuntingElastic Security Labs, Microsoft Threat Intelligence, NVISO Labs +2 [1] [2] [3] [4] [5] [6]
e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09SHA-256 hashMalware fileSearch only2026-04-01HuntingElastic Security Labs, NVISO Labs, Unit 42 [1] [2] [3]
e49c2732fb9861548208a78e72996b9c3c470b6b562576924bcc3a9fb75bf9ffSHA-256 hashMalware fileSearch only2026-04-01HuntingElastic Security Labs, NVISO Labs, Unit 42 [1] [2] [3]
callnrwise[.]comDomainCommand and controlSearch only2026-03-31HuntingHuntress, NVISO Labs, Unit 42 [1] [2] [3]
calltan[.]comDomainCommand and controlSearch only2026-03-31HuntingHuntress, NVISO Labs [1] [2]
packages[.]npm[.]orgDomainMalware downloadSearch only2026-03-31HuntingElastic Security Labs, Huntress, Unit 42 [1] [2] [3]
sfrclak[.]comDomainCommand and controlSearch only2026-03-31HuntingElastic Security Labs, Huntress, Microsoft Threat Intelligence +3 [1] [2] [3] [4] [5] [6] +1
hxxp://sfrclak[.]com:8000/6202033URLCommand and controlSearch only2026-03-31HuntingElastic Security Labs, Huntress, Microsoft Threat Intelligence +1 [1] [2] [3] [4] [5]
models[.]litellm[.]cloudDomainCommand and controlSearch only2026-03-31HuntingUnit 42, Zscaler ThreatLabz [1] [2] [3]
tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]ioDomainCommand and controlSearch only2026-03-31HuntingSeqrite, Unit 42 [1] [2]
316fee57d6004b1838576bb178215c99b56a0bd37a012e8650cd2898041f6785SHA-256 hashMalware fileSearch only2026-03-31HuntingZscaler ThreatLabz [1]
59db173fbff74cdab24995a0d3669dabf6b09f7332a0128d4faa68ae2526d39aSHA-256 hashMalware fileSearch only2026-03-31HuntingZscaler ThreatLabz [1]
6b15d702539c47fd54a63bda4d309e06d3c0b92d150f61c0b8b65eae787680beSHA-256 hashMalware fileSearch only2026-03-31HuntingZscaler ThreatLabz [1]
fetchapiutility[.]comDomainMalware downloadSearch only2026-03-31HuntingInfoblox Threat Intel [1]
43[.]134[.]52[.]221IP addressCommand and controlSearch only2026-03-31HuntingCheck Point Research [1]
43[.]134[.]90[.]60IP addressCommand and controlSearch only2026-03-31HuntingCheck Point Research [1]
47[.]237[.]15[.]197IP addressCommand and controlSearch only2026-03-31HuntingCheck Point Research [1]
22e32bcf113326e366ac480b077067cfMD5 hashMalware fileSearch only2026-03-31HuntingCheck Point Research [1]
248a4d7d4c48478dcbeade8f7dba80b3MD5 hashMalware fileSearch only2026-03-31HuntingCheck Point Research [1]
9b435ad985b733b64a6d5f39080f4ae0MD5 hashMalware fileSearch only2026-03-31HuntingCheck Point Research [1]
us-docker[.]pkg[.]devDomainMalware downloadSearch only2026-03-31HuntingUnit 42 [1]
anycourse[.]netDomainMalware downloadSearch only2026-03-31HuntingSeqrite [1]
hxxps://anycourse[.]net/wp-content/uploads/2025/04/Wallet[.]txtURLMalware downloadSearch only2026-03-31HuntingSeqrite [1]
autoupdatewinsystem[.]topDomainMalware downloadSearch only2026-03-31HuntingElastic Security Labs [1]
gulf[.]moneroocean[.]streamDomainListed by researchersSearch only2026-03-31HuntingElastic Security Labs, Unit 42 [1] [2]
icanhazip[.]comDomainCommand and controlSearch only2026-03-31HuntingElastic Security Labs [1] [2]
ident[.]meDomainCommand and controlSearch only2026-03-31HuntingElastic Security Labs [1]
ipify[.]orgDomainCommand and controlSearch only2026-03-31HuntingElastic Security Labs [1]
softwaredlfast[.]topDomainMalware downloadSearch only2026-03-31HuntingElastic Security Labs [1]
tabbysbakescodes[.]wsDomainCommand and controlSearch only2026-03-31HuntingElastic Security Labs [1]
tommysbakescodes[.]cvDomainCommand and controlSearch only2026-03-31HuntingElastic Security Labs [1]
tommysbakescodes[.]wsDomainCommand and controlSearch only2026-03-31HuntingElastic Security Labs [1]
win64autoupdates[.]topDomainCommand and controlSearch only2026-03-31HuntingElastic Security Labs [1]
winautordr[.]itemdb[.]comDomainCommand and controlSearch only2026-03-31HuntingElastic Security Labs [1]
winautordr[.]kozow[.]comDomainCommand and controlSearch only2026-03-31HuntingElastic Security Labs [1]
winautordr[.]ydns[.]euDomainCommand and controlSearch only2026-03-31HuntingElastic Security Labs [1]
windirautoupdates[.]topDomainCommand and controlSearch only2026-03-31HuntingElastic Security Labs [1]
wndlogon[.]hopto[.]orgDomainCommand and controlSearch only2026-03-31HuntingElastic Security Labs [1]
wndlogon[.]itemdb[.]comDomainCommand and controlSearch only2026-03-31HuntingElastic Security Labs [1]
wndlogon[.]kozow[.]comDomainCommand and controlSearch only2026-03-31HuntingElastic Security Labs [1]
wndlogon[.]ydns[.]euDomainCommand and controlSearch only2026-03-31HuntingElastic Security Labs [1]
872d515ea17b4e6c3abca9752c706242MD5 hashMalware fileSearch only2026-03-31HuntingElastic Security Labs [1]
0176ffaf278b9281aa207c59b858c8c0b6e38fdb13141f7ed391c9f8b2dc7630SHA-256 hashMalware fileSearch only2026-03-31HuntingElastic Security Labs [1]
542d2267b40c160b693646bc852df34cc508281c4f6ed2693b98147dae293678SHA-256 hashMalware fileSearch only2026-03-31HuntingElastic Security Labs [1]
7bb0e91558244bcc79b6d7a4fe9d9882f11d3a99b70e1527aac979e27165f1d7SHA-256 hashMalware fileSearch only2026-03-31HuntingElastic Security Labs [1]
82c03866670b70047209c39153615512f7253f125a252fe3dcd828c6598fdf86SHA-256 hashMalware fileSearch only2026-03-31HuntingElastic Security Labs [1]
9409f9c398645ddac096e3331d2782705b62e388a8ecb1c4e9d527616f0c6a9eSHA-256 hashMalware fileSearch only2026-03-31HuntingElastic Security Labs [1]
a3f84aa1d15fd33506157c61368fd602d0b81f69aff6c69249bf833d217308bbSHA-256 hashMalware fileSearch only2026-03-31HuntingElastic Security Labs [1]
bb48a52bae2ee8b98ee1888b3e7d05539c85b24548dd4c6acc08fbe5f0d7631aSHA-256 hashMalware fileSearch only2026-03-31HuntingElastic Security Labs [1]
c6c4a9725653b585a9d65fc90698d4610579b289bcfb2539f7a5f7e64e69f2e4SHA-256 hashMalware fileSearch only2026-03-31HuntingElastic Security Labs [1]
e1e87d11079d33ec1a1c25629cbb747e56fe17071bde5fd8c982461b5baa80a4SHA-256 hashMalware fileSearch only2026-03-31HuntingElastic Security Labs [1]
f84b00fc75f183c571c8f49fcc1d7e0241f538025db0f2daa4e2c5b9a6739049SHA-256 hashMalware fileSearch only2026-03-31HuntingElastic Security Labs [1]
hxxps://autoupdatewinsystem[.]top/MyMNRconfigs/0226[.]txtURLMalware downloadSearch only2026-03-31HuntingElastic Security Labs [1]
hxxps://github[.]com/lebnabar198/Hgh5gM99fe3dG/raw/refs/heads/main/MnrsInstllr_240126[.]exeURLMalware downloadSearch only2026-03-31HuntingElastic Security Labs [1]
hxxps://softwaredlfast[.]top/files/n71fGbs2b7XceW3op71aQsrx41Rkeydl/URLMalware downloadSearch only2026-03-31HuntingElastic Security Labs [1]
hxxps://tabbysbakescodes[.]ws/CNB/gate[.]phpURLCommand and controlSearch only2026-03-31HuntingElastic Security Labs [1]
hxxps://tommysbakescodes[.]cv/CNB/gate[.]phpURLCommand and controlSearch only2026-03-31HuntingElastic Security Labs [1]
hxxps://tommysbakescodes[.]ws/CNB/gate[.]phpURLCommand and controlSearch only2026-03-31HuntingElastic Security Labs [1]
hxxps://win64autoupdates[.]top/CNB/l0g1n234[.]phpURLCommand and controlSearch only2026-03-31HuntingElastic Security Labs [1]
forms[.]gleDomainMalware downloadSearch only2026-03-30HuntingCyble [1]
15[.]235[.]156[.]143IP addressData theftSearch only2026-03-30HuntingCyble [1]
hxxp://151[.]243[.]109[.]125/support/links/sunset[.]txtURLMalware downloadSearch only2026-03-30HuntingCyble [1]
hxxps://forms[.]gle/JjAtpy26Tcokow2Q7URLMalware downloadSearch only2026-03-30HuntingCyble [1]
hxxps://t[.]me/erik22sucbotURLCommand and controlSearch only2026-03-30HuntingCyble [1]
finalnovel[.]comDomainCommand and controlSearch only2026-03-30HuntingDarktrace [1]
heaveydutyl[.]comDomainCommand and controlSearch only2026-03-30HuntingDarktrace [1]
holonisz[.]comDomainCommand and controlSearch only2026-03-30HuntingDarktrace [1]
nsgatetest1[.]digitalDomainCommand and controlSearch only2026-03-30HuntingDarktrace [1]
thetavaluemetrics[.]comDomainCommand and controlSearch only2026-03-30HuntingDarktrace [1]
westford-systems[.]icuDomainCommand and controlSearch only2026-03-30HuntingDarktrace [1]
107[.]158[.]128[.]84IP addressCommand and controlSearch only2026-03-30HuntingDarktrace [1]
141[.]98[.]11[.]224IP addressCommand and controlSearch only2026-03-30HuntingDarktrace [1]
185[.]39[.]19[.]233IP addressCommand and controlSearch only2026-03-30HuntingDarktrace [1]
217[.]91[.]235[.]17IP addressCommand and controlSearch only2026-03-30HuntingDarktrace [1]
38[.]146[.]28[.]242IP addressCommand and controlSearch only2026-03-30HuntingDarktrace [1]
45[.]88[.]79[.]237IP addressCommand and controlSearch only2026-03-30HuntingDarktrace [1]
45[.]94[.]47[.]224IP addressCommand and controlSearch only2026-03-30HuntingDarktrace [1]
74[.]91[.]125[.]57IP addressCommand and controlSearch only2026-03-30HuntingDarktrace [1]
87[.]120[.]93[.]98IP addressCommand and controlSearch only2026-03-30HuntingDarktrace [1]
88[.]214[.]27[.]166IP addressCommand and controlSearch only2026-03-30HuntingDarktrace [1]
88[.]214[.]27[.]48IP addressCommand and controlSearch only2026-03-30HuntingDarktrace [1]
backblaze[.]comDomainData theftSearch only2026-03-29HuntingDarktrace [1]
backblazeb2[.]comDomainData theftSearch only2026-03-29HuntingDarktrace [1]
gfs302n520[.]userstorage[.]mega[.]co[.]nzDomainData theftSearch only2026-03-29HuntingDarktrace [1]
193[.]161[.]193[.]99IP addressCommand and controlSearch only2026-03-29HuntingDarktrace [1]
hui228[.]ruDomainCommand and controlSearch only2026-03-27HuntingCensys [1]
146[.]19[.]213[.]155IP addressAttacker addressSearch only2026-03-27HuntingCensys [1]
194[.]33[.]61[.]36IP addressMalware downloadSearch only2026-03-27HuntingCensys [1]
5d009f6f46979fbc170ede90fca15f945d6dae5286221cca77fa26223a5fe931SHA-256 hashMalware fileSearch only2026-03-27HuntingCensys [1]
gofile[.]ioDomainMalware downloadSearch only2026-03-27HuntingANY.RUN, ESET WeLiveSecurity, Huntress [1] [2] [3]
resources[.]dawnnewsisl[.]comDomainCommand and controlSearch only2026-03-27HuntingElastic Security Labs [1]
4f1ea5ed6035e7c951e688bd9c2ec47a1e184a81e9ae783d4a0979501a1985cfSHA-256 hashMalware fileSearch only2026-03-27HuntingElastic Security Labs [1]
89891aa3867c1a57512d77e8e248d4a35dd32e99dcda0344a633be402df4a9a7SHA-256 hashMalware fileSearch only2026-03-27HuntingElastic Security Labs [1]
webmail[.]homesmountain[.]comDomainCommand and controlSearch only2026-03-26HuntingUnit 42 [1]
webmail[.]rpcthai[.]comDomainCommand and controlSearch only2026-03-26HuntingUnit 42 [1]
511898b2f71f31932dfb3ee06e904289MD5 hashMalware fileSearch only2026-03-26HuntingUnit 42 [1]
05995284b59ad0066350f43517382228f7eee63cd297e787b2a271f69ecf2dfcSHA-256 hashMalware fileSearch only2026-03-26HuntingUnit 42 [1]
11c7728697d5ea11c592fee213063c6369340051157f71ddc7ca891f5f367720SHA-256 hashMalware fileSearch only2026-03-26HuntingUnit 42 [1]
1aa37a477c539edf25656a300002a28d4246ec83344422dd705b42d3443a2623SHA-256 hashMalware fileSearch only2026-03-26HuntingUnit 42 [1]
34bf325492614dd4d842ec24f22a402ab73908cb91a74846945eae4775290ff2SHA-256 hashMalware fileSearch only2026-03-26HuntingUnit 42 [1]
4b29b74798a4e6538f2ba245c57be82953383dc91fe0a91b984b903d12043e92SHA-256 hashMalware fileSearch only2026-03-26HuntingUnit 42 [1]
4e26aa1bb28874f0897ab9a08e61d4b99caaa395fe63cbe4398f7297371e388cSHA-256 hashMalware fileSearch only2026-03-26HuntingUnit 42 [1]
58ed0463d4cb393cd09198a6409591b39cae06bb0ba5f5d760186de88410f6b8SHA-256 hashMalware fileSearch only2026-03-26HuntingUnit 42 [1]
6caa78943939bd7518f5e7eaa44fa778d0db8b822e260d7fe281cf45513f82d9SHA-256 hashMalware fileSearch only2026-03-26HuntingUnit 42 [1]
84e37e42312b9a502c40cf1f3fc181e3ebd4f3e35c58bbf182740dfe38d3b6b9SHA-256 hashMalware fileSearch only2026-03-26HuntingUnit 42 [1]
f07b2af21e3fab6af5166a44ca77ed0ebc7c9a3e623202a63d4c4492abce8d65SHA-256 hashMalware fileSearch only2026-03-26HuntingUnit 42 [1]
adressinvalidepostescanada-enligne38846[.]infoDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
authentifybmo[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
bmosecure-portal[.]appDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
bmosecure-webportal[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
bnc-websecurity[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
bncloginsecuriter[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
canadapostshipment[.]infoDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
cibc-registration-access-online[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
cibcsecurity2fa[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
costcorebate-groceries2026[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
cra-signin-partner-id[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
dhlmanagemypack0099[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
etransfer-auth-cra[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
fedexca-orderstatus[.]linkDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
fedexdelivery[.]caDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
gigadat-claiminterac[.]infoDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
gigadat-interac-0910[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
gigadat-interac6302[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
health[.]tenerium[.]orgDomainMalware downloadSearch only2026-03-26HuntingInfoblox Threat Intel [1]
honknft[.]comDomainMalware downloadSearch only2026-03-26HuntingInfoblox Threat Intel [1]
interac-gigadat0012[.]infoDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
interac-gigadat15[.]infoDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
membros[.]mtcreatingimages[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
mydhl725378-order442-online[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
mygroceries2costco[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
myrbcsecureddevice[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
parceltrackdelfedex[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
rbcdevice-login[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
rbclogin-digital[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
rbcsecurityservices[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
tdcommercial-securedlogins[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
tdonlineverif[.]comDomainPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
top9mediatrk[.]comDomainListed by researchersSearch only2026-03-26HuntingInfoblox Threat Intel [1]
yellowusheart[.]netDomainMalware downloadSearch only2026-03-26HuntingInfoblox Threat Intel [1]
62[.]60[.]226[.]248IP addressMalware downloadSearch only2026-03-26HuntingInfoblox Threat Intel [1]
b98b53ca03e3e9009b31bcc37b90b206064b25effce449dde63c51cef6a47470SHA-256 hashMalware fileSearch only2026-03-26HuntingInfoblox Threat Intel [1]
hxxps://membros[.]mtcreatingimages[.]com/spotifyURLPhishingSearch only2026-03-26HuntingInfoblox Threat Intel [1]
116[.]62[.]172[.]147IP addressListed by researchersSearch only2026-03-26HuntingElastic Security Labs [1]
8[.]149[.]128[.]10IP addressListed by researchersSearch only2026-03-26HuntingElastic Security Labs [1]
recruiter[.]paloaltonetworksDomainListed by researchersSearch only2026-03-24HuntingUnit 42 [1]
amplifyapp[.]comDomainMalware downloadSearch only2026-03-23HuntingHuntress [1]
www[.]taskade[.]comDomainPhishingSearch only2026-03-23HuntingHuntress [1]
162[.]220[.]232[.]223IP addressListed by researchersSearch only2026-03-23HuntingHuntress [1]
162[.]220[.]232[.]230IP addressListed by researchersSearch only2026-03-23HuntingHuntress [1]
162[.]220[.]232[.]235IP addressListed by researchersSearch only2026-03-23HuntingHuntress [1]
162[.]220[.]232[.]55IP addressListed by researchersSearch only2026-03-23HuntingHuntress [1]
162[.]220[.]232[.]57IP addressListed by researchersSearch only2026-03-23HuntingHuntress [1]
162[.]220[.]232[.]99IP addressListed by researchersSearch only2026-03-23HuntingHuntress [1]
162[.]220[.]234[.]161IP addressListed by researchersSearch only2026-03-23HuntingHuntress [1]
162[.]220[.]234[.]32IP addressListed by researchersSearch only2026-03-23HuntingHuntress [1]
162[.]220[.]234[.]34IP addressListed by researchersSearch only2026-03-23HuntingHuntress [1]
162[.]220[.]234[.]41IP addressListed by researchersSearch only2026-03-23HuntingHuntress [1]
162[.]220[.]234[.]66IP addressListed by researchersSearch only2026-03-23HuntingHuntress [1]
44[.]252[.]85[.]168IP addressMalware downloadSearch only2026-03-20HuntingElastic Security Labs [1]
67[.]217[.]57[.]240IP addressMalware downloadSearch only2026-03-20HuntingElastic Security Labs [1]
hxxp://44[.]252[.]85[.]168:666/files/kube[.]pyURLMalware downloadSearch only2026-03-20HuntingElastic Security Labs [1]
hxxp://67[.]217[.]57[.]240:666/files/proxy[.]shURLMalware downloadSearch only2026-03-20HuntingElastic Security Labs [1]
pressureulcerlawyer[.]comDomainMalware downloadSearch only2026-03-19HuntingRed Canary [1]
telegram[.]meDomainCommand and controlSearch only2026-03-19HuntingGroup-IB, Red Canary, Sekoia +1 [1] [2] [3] [4]
hxxp://pressureulcerlawyer[.]com/curl/a66e5b9fda4fe269b1c75a5a07d57824099e940a1e59a6964abddae17e444ee3URLMalware downloadSearch only2026-03-19HuntingRed Canary [1]
carrd[.]coDomainMalware downloadSearch only2026-03-19HuntingMicrosoft Threat Intelligence [1]
edud[.]siteDomainPhishingSearch only2026-03-19HuntingMicrosoft Threat Intelligence [1]
smartvault[.]imDomainPhishingSearch only2026-03-19HuntingMicrosoft Threat Intelligence [1]
tax-statments2025[.]comDomainPhishingSearch only2026-03-19HuntingMicrosoft Threat Intelligence [1]
taxationstatments2025[.]comDomainPhishingSearch only2026-03-19HuntingMicrosoft Threat Intelligence [1]
45b6b4db1be6698c29ffde9daeb8ffaa344b687d3badded2f8c68c922cdce6e0SHA-256 hashMalware fileSearch only2026-03-19HuntingMicrosoft Threat Intelligence [1]
d422f6f5310af1e72f6113a2a592916f58e3871c58d0e46f058d4b669a3a0fd8SHA-256 hashMalware fileSearch only2026-03-19HuntingMicrosoft Threat Intelligence [1]
anukitax[.]comDomainMalware downloadSearch only2026-03-19HuntingHuntress [1]
bjtrck[.]comDomainListed by researchersSearch only2026-03-19HuntingHuntress [1]
bringetax[.]comDomainMalware downloadSearch only2026-03-19HuntingHuntress [1]
fioclouder[.]comDomainListed by researchersSearch only2026-03-19HuntingHuntress [1]