Newly reported: last 30 days

Release 20261012T180322Z · built 2026-10-12 18:03 UTC · valid until 2026-10-15 18:03 UTC

Indicators first published by a research team in the 30 days before this release: 0 confident, 1,573 blocking, 333 hunting only. Confident first, then Blocking, then Hunting.

Indicator (defanged)	Type	Reported as	Block scope	First reported	List	Sources
`sunnypaydayloan[.]com`	Domain	Malware download	That exact host	2026-09-14	Blocking	Sekoia [1]
`suveniricrnagora[.]com`	Domain	Malware download	That exact host	2026-09-14	Blocking	Sekoia [1]
`tamilarnews[.]com`	Domain	Malware download	That exact host	2026-09-14	Blocking	Sekoia [1]
`thistle-productions[.]com`	Domain	Malware download	That exact host	2026-09-14	Blocking	Sekoia [1]
`tycoonsrow[.]com`	Domain	Malware download	That exact host	2026-09-14	Blocking	Sekoia [1]
`us-addnewdevice[.]com`	Domain	Malware download	Domain and subdomains	2026-09-14	Blocking	Sekoia [1]
`ustgate[.]com`	Domain	Malware download	That exact host	2026-09-14	Blocking	Sekoia [1]
`verification-js-cdn[.]boats`	Domain	Command and control	Domain and subdomains	2026-09-14	Blocking	Sekoia [1]
`virgensantisima[.]com`	Domain	Malware download	That exact host	2026-09-14	Blocking	Sekoia [1]
`vydlje[.]com`	Domain	Malware download	Domain and subdomains	2026-09-14	Blocking	Sekoia [1]
`washingtondc-plumbing[.]com`	Domain	Malware download	That exact host	2026-09-14	Blocking	Sekoia [1]
`wergwee[.]com`	Domain	Malware download	Domain and subdomains	2026-09-14	Blocking	Sekoia [1]
`whirlpoploaderfast[.]com`	Domain	Command and control	Domain and subdomains	2026-09-14	Blocking	Sekoia [1]
`yuriajonesphotography[.]com`	Domain	Malware download	That exact host	2026-09-14	Blocking	Sekoia [1]
`193[.]41[.]68[.]196`	IP address	Malware download	That address only	2026-09-14	Blocking	Sekoia [1]
`2[.]27[.]5[.]165`	IP address	Malware download	That address only	2026-09-14	Blocking	Sekoia [1]
`31[.]76[.]31[.]28`	IP address	Malware download	That address only	2026-09-14	Blocking	Sekoia [1]
`31[.]77[.]228[.]46`	IP address	Malware download	That address only	2026-09-14	Blocking	Sekoia [1]
`65[.]21[.]18[.]60`	IP address	Malware download	That address only	2026-09-14	Blocking	Sekoia [1]
`65[.]21[.]208[.]199`	IP address	Malware download	That address only	2026-09-14	Blocking	Sekoia [1]
`85[.]239[.]144[.]195`	IP address	Malware download	That address only	2026-09-14	Blocking	Sekoia [1]
`85[.]239[.]149[.]13`	IP address	Malware download	That address only	2026-09-14	Blocking	Sekoia [1]
`85[.]239[.]149[.]14`	IP address	Malware download	That address only	2026-09-14	Blocking	Sekoia [1]
`89[.]34[.]90[.]217`	IP address	Malware download	That address only	2026-09-14	Blocking	Sekoia [1]
`91[.]92[.]33[.]156`	IP address	Malware download	That address only	2026-09-14	Blocking	Sekoia [1]
`91[.]92[.]43[.]245`	IP address	Malware download	That address only	2026-09-14	Blocking	Sekoia [1]
`93[.]152[.]223[.]161`	IP address	Malware download	That address only	2026-09-14	Blocking	Sekoia [1]
`94[.]26[.]90[.]126`	IP address	Command and control	That address only	2026-09-14	Blocking	Sekoia [1]
`affordableonline[.]online`	Domain	Listed by researchers	Domain and subdomains	2026-09-14	Blocking	Elastic Security Labs [1]
`californicationdetroit[.]com`	Domain	Listed by researchers	Domain and subdomains	2026-09-14	Blocking	Elastic Security Labs [1]
`connection[.]upgradeonline[.]site`	Domain	Malware download	That exact host	2026-09-14	Blocking	Elastic Security Labs [1]
`cremeb[.]com`	Domain	Listed by researchers	Domain and subdomains	2026-09-14	Blocking	Elastic Security Labs [1]
`donalurdesconfeitos[.]site`	Domain	Listed by researchers	Domain and subdomains	2026-09-14	Blocking	Elastic Security Labs [1]
`find-postman[.]ddesdokww[.]workers[.]dev`	Domain	Listed by researchers	That exact host	2026-09-14	Blocking	Elastic Security Labs [1]
`granderevolucao[.]store`	Domain	Listed by researchers	Domain and subdomains	2026-09-14	Blocking	Elastic Security Labs [1]
`graph[.]checkeligibitily[.]workers[.]dev`	Domain	Listed by researchers	That exact host	2026-09-14	Blocking	Elastic Security Labs [1]
`luizestrelhashapr[.]online`	Domain	Listed by researchers	Domain and subdomains	2026-09-14	Blocking	Elastic Security Labs [1]
`orange-sun-195a[.]checkeligibitily[.]workers[.]dev`	Domain	Listed by researchers	That exact host	2026-09-14	Blocking	Elastic Security Labs [1]
`seguranca[.]versionnova[.]site`	Domain	Listed by researchers	That exact host	2026-09-14	Blocking	Elastic Security Labs [1]
`version[.]checkeligibitily[.]workers[.]dev`	Domain	Listed by researchers	That exact host	2026-09-14	Blocking	Elastic Security Labs [1]
`volmira[.]site`	Domain	Malware download	Domain and subdomains	2026-09-14	Blocking	Elastic Security Labs [1]
`www[.]creamp1eonlyfans[.]net`	Domain	Malware download	That exact host	2026-09-14	Blocking	Elastic Security Labs [1]
`zaviro[.]online`	Domain	Malware download	Domain and subdomains	2026-09-14	Blocking	Elastic Security Labs [1]
`104[.]219[.]250[.]37`	IP address	Listed by researchers	That address only	2026-09-14	Blocking	Elastic Security Labs [1]
`144[.]172[.]112[.]239`	IP address	Listed by researchers	That address only	2026-09-14	Blocking	Elastic Security Labs [1]
`172[.]234[.]24[.]211`	IP address	Listed by researchers	That address only	2026-09-14	Blocking	Elastic Security Labs [1]
`172[.]239[.]57[.]117`	IP address	Listed by researchers	That address only	2026-09-14	Blocking	Elastic Security Labs [1]
`176[.]98[.]187[.]47`	IP address	Listed by researchers	That address only	2026-09-14	Blocking	Elastic Security Labs [1]
`178[.]92[.]162[.]38`	IP address	Listed by researchers	That address only	2026-09-14	Blocking	Elastic Security Labs [1]
`185[.]221[.]23[.]133`	IP address	Listed by researchers	That address only	2026-09-14	Blocking	Elastic Security Labs [1]
`2[.]59[.]170[.]20`	IP address	Listed by researchers	That address only	2026-09-14	Blocking	Elastic Security Labs [1]
`209[.]99[.]185[.]204`	IP address	Listed by researchers	That address only	2026-09-14	Blocking	Elastic Security Labs [1]
`216[.]203[.]21[.]40`	IP address	Listed by researchers	That address only	2026-09-14	Blocking	Elastic Security Labs [1]
`37[.]16[.]74[.]100`	IP address	Listed by researchers	That address only	2026-09-14	Blocking	Elastic Security Labs [1]
`37[.]16[.]74[.]34`	IP address	Listed by researchers	That address only	2026-09-14	Blocking	Elastic Security Labs [1]
`45[.]90[.]13[.]210`	IP address	Listed by researchers	That address only	2026-09-14	Blocking	Elastic Security Labs [1]
`45[.]90[.]13[.]77`	IP address	Listed by researchers	That address only	2026-09-14	Blocking	Elastic Security Labs [1]
`72[.]251[.]7[.]22`	IP address	Listed by researchers	That address only	2026-09-14	Blocking	Elastic Security Labs [1]
`72[.]251[.]7[.]23`	IP address	Listed by researchers	That address only	2026-09-14	Blocking	Elastic Security Labs [1]
`88[.]99[.]149[.]241`	IP address	Listed by researchers	That address only	2026-09-14	Blocking	Elastic Security Labs [1]
`106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42`	SHA-256 hash	Malware file	That file	2026-09-14	Blocking	Elastic Security Labs [1]
`170dffb37e05f525f735bc9ad84b3908a488f7ce43fcb07739a10e4331e15a2c`	SHA-256 hash	Malware file	That file	2026-09-14	Blocking	Elastic Security Labs [1]
`223be3f8648bf6998c4a58b972522e5fda8d9d0a57b4e163811930de66c3f7ca`	SHA-256 hash	Malware file	That file	2026-09-14	Blocking	Elastic Security Labs [1]
`5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552`	SHA-256 hash	Malware file	That file	2026-09-14	Blocking	Elastic Security Labs [1]
`ba80216c960977fa45e317f00dcf31e96acab29904a737cbc0bf86e929c3be5f`	SHA-256 hash	Malware file	That file	2026-09-14	Blocking	Elastic Security Labs [1]
`c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268`	SHA-256 hash	Malware file	That file	2026-09-14	Blocking	Elastic Security Labs [1]
`cb15cbf3f01a92e609e4c2bc26155e667e96c5d04770e83abba66ee07bcecea0`	SHA-256 hash	Malware file	That file	2026-09-14	Blocking	Elastic Security Labs [1]
`hxxps://cremeb[.]com/qrcode/api/v1/read?domain=$`	URL	Malware download	That exact URL	2026-09-14	Blocking	Elastic Security Labs [1]
`hxxps://graph[.]checkeligibitily[.]workers[.]dev/x01aab878f25420380b3?op=98d8049e-804f-11f1-b79f-ae3a8bb85d01`	URL	Command and control	That exact URL	2026-09-14	Blocking	Elastic Security Labs [1]
`hxxps://volmira[.]site//api/savecreds`	URL	Command and control	That exact URL	2026-09-14	Blocking	Elastic Security Labs [1]
`hxxps://volmira[.]site/api/ext/version`	URL	Malware download	That exact URL	2026-09-14	Blocking	Elastic Security Labs [1]
`hxxps://volmira[.]site/api/ext?p=98d8049e-804f-11f1-b79f-ae3a8bb85d01`	URL	Malware download	That exact URL	2026-09-14	Blocking	Elastic Security Labs [1]
`hxxps://zaviro[.]online//api/v1/fingerprint`	URL	Command and control	That exact URL	2026-09-14	Blocking	Elastic Security Labs [1]
`hxxps://www[.]dropbox[.]com/scl/fi/tbxu5vgr9l1vuw3s7rw7v/VisualStudioSetup[.]exe?rlkey=o6dpwfynneuxeyok7g5trtv96&st=nj5jxsoe&dl=1`	URL	Malware download	Search only	2026-10-12	Hunting	Elastic Security Labs [1]
`claude-desk-code[.]com`	Domain	Compromised site	Search only	2026-10-09	Hunting	BleepingComputer [1]
`ab[.]com`	Domain	Phishing	Search only	2026-10-09	Hunting	Censys [1]
`imagefiles-backup[.]oss-ap-southeast-7[.]aliyuncs[.]com`	Domain	Malware download	Search only	2026-10-08	Hunting	Huntress [1]
`177[.]4[.]12[.]11`	IP address	Listed by researchers	Search only	2026-10-08	Hunting	Huntress [1]
`hxxp://imagefiles-backup[.]oss-ap-southeast-7[.]aliyuncs[.]com/javas/Office/win/Taskgmr[.]ps1`	URL	Listed by researchers	Search only	2026-10-08	Hunting	Huntress [1]
`hxxp://imagefiles-backup[.]oss-ap-southeast-7[.]aliyuncs[.]com/javas/Office/win/WinRing0x64[.]sys`	URL	Listed by researchers	Search only	2026-10-08	Hunting	Huntress [1]
`hxxp://imagefiles-backup[.]oss-ap-southeast-7[.]aliyuncs[.]com/javas/Office/win/config[.]json`	URL	Listed by researchers	Search only	2026-10-08	Hunting	Huntress [1]
`hxxp://imagefiles-backup[.]oss-ap-southeast-7[.]aliyuncs[.]com/javas/Office/win/edge[.]exe`	URL	Listed by researchers	Search only	2026-10-08	Hunting	Huntress [1]
`hxxp://imagefiles-backup[.]oss-ap-southeast-7[.]aliyuncs[.]com/javas/Office/win/msedge[.]exe`	URL	Listed by researchers	Search only	2026-10-08	Hunting	Huntress [1]
`5[.]ahd187[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	Bitdefender Labs [1]
`api[.]weatherlive[.]world`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	Bitdefender Labs [1]
`hxxps://api[.]weatherlive[.]world/br_upgrade/upgradeV2/getConfigs`	URL	Command and control	Search only	2026-10-08	Hunting	Bitdefender Labs [1]
`067[.]cz`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`1421[.]client[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`1421[.]cloud[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`1421[.]support[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`154-119-131-252-103-58-216-162-36[.]m[.]secshow[.]net`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`2-12-44-140-78-81-211-109-241[.]h[.]secshow[.]net`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`20656[.]hus1[.]ptps[.]tk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`20656[.]hus3[.]ptps[.]tk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`22852[.]careers[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`22852[.]careers[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`22852[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`23175[.]careers[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`23175[.]careers[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`24280[.]hus1[.]ptps[.]tk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`2637596418[.]softether[.]net`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`28394[.]careers[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`28394[.]careers[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`28394[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`28733[.]careers[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`28733[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`30773[.]hus2[.]ptps[.]tk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`30773[.]hus3[.]ptps[.]tk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`35584[.]careers[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`35584[.]careers[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`35584[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`39583[.]b[.]alitagotest[.]cf`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`3w[.]feeee[.]io`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`44673[.]careers[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`44673[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`47298[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`47298[.]client[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`47298[.]cloud[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`47298[.]support[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`50669[.]careers[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`51640[.]careers[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`51943[.]hus1[.]ptps[.]tk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`51943[.]hus3[.]ptps[.]tk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`54-2-32-236-208-2-40-107-38[.]h[.]secshow[.]net`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`60928[.]hus1[.]ptps[.]tk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`66-37-178-96-110-2-40-107-38[.]h[.]secshow[.]net`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`74788[.]careers[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`74788[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`77692[.]careers[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`77692[.]careers[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`77692[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`82262[.]careers[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`82262[.]careers[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`85005[.]careers[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`85005[.]careers[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`85005[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`88783[.]hus1[.]ptps[.]tk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`90174[.]careers[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`90174[.]careers[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`96976[.]careers[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`96976[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`96cee[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`98aiblog[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`a[.]alitagotest[.]cf`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`a[.]studiocloud[.]xyz`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`admin[.]dellme[.]ml`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`alitagotest[.]cf`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`arforcex[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`asean[.]twimg[.]co[.]uk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`az[.]studiocloud[.]xyz`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`b[.]alitagotest[.]cf`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`bailbonding[.]info`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`bj-hk[.]hmbcloud[.]net`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`bj-jp[.]hmbcloud[.]net`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`blog[.]98aiblog[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`bsnl[.]twimg[.]co[.]uk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`careers[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`careers[.]trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`cch[.]ooguy[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`check[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`checkapi[.]tk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`checkinfo[.]tk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`chr0mail[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`cktime[.]ooguy[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`client[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`cloud[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`csrfproxy[.]studiocloud[.]xyz`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`dasxcyb[.]ga`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`dc-29465b27aa45[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`dc-4fe9871cb224[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`dc-582fc0f46da9[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`dc-843d98722400[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`dc-bb503834b7dc[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`dc-c11a983d7f83[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`dellme[.]ml`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`dns[.]studiocloud[.]xyz`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`dns361[.]tk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`eck[.]giize[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`eg[.]twimg[.]co[.]uk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`etechhosting[.]twimg[.]co[.]uk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`fcchk[.]twimg[.]co[.]uk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`feeee[.]io`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`fukua[.]org`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`gate[.]sinica[.]edu[.]tw[.]checkapi[.]cf`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`googles[.]ddns[.]net`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`gz-hk[.]hmbcloud[.]net`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`h[.]secshow[.]net`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`h5[.]feeee[.]io`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`halloween[.]checkapi[.]cf`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`helpuself[.]ptps[.]tk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`hgiga[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`honey1314520[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`hook[.]studiocloud[.]xyz`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`hus1[.]ptps[.]tk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`hus3[.]ptps[.]tk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`hw1[.]ptps[.]tk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`ica[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`im[.]arforcex[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`info[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`integritytoch[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`iplc-hk[.]hmbcloud[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`javacheck[.]ooguy[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`javaupdate[.]giize[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`just[.]checkapi[.]cf`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`kk[.]dasxcyb[.]ga`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`leicc009[.]ga`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`live[.]studiocloud[.]xyz`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`ls[.]twimg[.]co[.]uk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`m[.]secshow[.]net`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`ma[.]studiocloud[.]xyz`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`mail[.]bailbonding[.]info`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`masaplus[.]club`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`microscan[.]me`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`mitt[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`ms[.]studiocloud[.]xyz`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`natcloudservice[.]com`	Domain	Command and control	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`nikoes[.]gq`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`np[.]twimg[.]co[.]uk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`ns1[.]alitagotest[.]cf`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`ns1[.]honey1314520[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`ns1[.]nikoes[.]gq`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`ns2[.]nikoes[.]gq`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`one[.]hmbiplc-01[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`payment[.]feeee[.]io`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`ptps[.]tk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`puc[.]checkapi[.]tk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`purple76[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`pw[.]sexytube0[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`pw2[.]sexytube0[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`random[.]cktime[.]ooguy[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`s3crts[.]softether[.]net`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`scallpay[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`search[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`secretr[.]feeee[.]io`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`secshow[.]net`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`senate[.]twimg[.]co[.]uk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`server[.]feeee[.]io`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`sexytube0[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`sh-jp[.]hmbcloud[.]net`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`shifuj[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`shop[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`shopify[.]feeee[.]io`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`streescans[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`studiocloud[.]xyz`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`supper[.]feeee[.]io`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`support[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`szxcm-hkg01[.]iepl[.]node[.]cm`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`t[.]checkinfo[.]tk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`teyan[.]microscan[.]me`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`tj[.]twimg[.]co[.]uk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`traffic[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`trendmicro[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`trust[.]feeee`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`tsedws[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`txt[.]studiocloud[.]xyz`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`update[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`upgrate[.]checkapi[.]cf`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`upl[.]natcloudservice[.]com`	Domain	Malware download	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`v3[.]streescans[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`vnpt[.]sexytube0[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`vpn21[.]arforcex[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`vpn328433596[.]softether[.]net`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`vpn614174689[.]softether[.]net`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`vpn677190427[.]softether[.]net`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`vpn718535264[.]softether[.]net`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`vpn823494147[.]softether[.]net`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`wanfang[.]accesscam[.]org`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`webdisk[.]bailbonding[.]info`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`webmail[.]studiocloud[.]xyz`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`well[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`ws[.]studiocloud[.]xyz`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`wss[.]studiocloud[.]xyz`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`www[.]96html[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`www[.]alitagotest[.]cf`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`www[.]chr0mail[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`www[.]cktime[.]ooguy[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`www[.]dns361[.]tk`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`www[.]feeee[.]io`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`www[.]javacheck[.]ooguy[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`www[.]leicc009[.]ga`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`www[.]purple76[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`www[.]sofeter[.]ml`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`www[.]studiocloud[.]xyz`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`xassxxdns[.]alitagotest[.]cf`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`ximmd[.]sexytube0[.]com`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`zerogravity1986[.]softether[.]net`	Domain	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`106[.]53[.]181[.]231`	IP address	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`147[.]139[.]133[.]246`	IP address	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`162[.]14[.]178[.]86`	IP address	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`190[.]92[.]241[.]15`	IP address	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`191[.]232[.]188[.]144`	IP address	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`8[.]219[.]119[.]5`	IP address	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`84[.]17[.]57[.]40`	IP address	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`89[.]187[.]163[.]216`	IP address	Listed by researchers	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`1b8e29b6b7972fb124425aaa257f8f6d`	MD5 hash	Malware file	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`f82694de2f19e1bff333c27bb7eb7a56`	MD5 hash	Malware file	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`8e1b56ef51ba70aa4c4cfd4430820f20875b354588d5d723ba4d3940ea6c924b`	SHA-256 hash	Malware file	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`efb0437e6a6a0f07169952f1a8b734299ec9a8b1faadbed811fe017f2cf54976`	SHA-256 hash	Malware file	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`hxxps://natcloudservice[.]com/ews`	URL	Command and control	Search only	2026-10-08	Hunting	CISA Cybersecurity Advisories [1]
`ccwu[.]cc`	Domain	Command and control	Search only	2026-10-07	Hunting	Censys [1]
`g[.]northlab[.]cn`	Domain	Command and control	Search only	2026-10-07	Hunting	Censys [1]
`i[.]131422[.]com`	Domain	Listed by researchers	Search only	2026-10-07	Hunting	Censys [1]
`iplcz[.]cn`	Domain	Command and control	Search only	2026-10-07	Hunting	Censys [1]
`manager[.]g[.]northlab[.]cn`	Domain	Command and control	Search only	2026-10-07	Hunting	Censys [1]
`siekeltd[.]com`	Domain	Command and control	Search only	2026-10-07	Hunting	Censys [1]
`wumian[.]cc[.]cd`	Domain	Command and control	Search only	2026-10-07	Hunting	Censys [1]
`101[.]35[.]158[.]183`	IP address	Command and control	Search only	2026-10-07	Hunting	Censys [1]
`check[.]vykyn[.]click`	Domain	Attacker address	Search only	2026-10-07	Hunting	Huntress [1]
`instance-g01s1n-relay[.]screenconnect[.]com`	Domain	Malware download	Search only	2026-10-07	Hunting	Huntress [1]
`server[.]na-2[.]action1[.]com`	Domain	Listed by researchers	Search only	2026-10-06	Hunting	SANS Internet Storm Center [1]
`up-theta-rose[.]vercel[.]app`	Domain	Malware download	Search only	2026-10-06	Hunting	SANS Internet Storm Center [1]
`update-two-tau[.]vercel[.]app`	Domain	Malware download	Search only	2026-10-06	Hunting	SANS Internet Storm Center [1]
`musicdel[.]ir`	Domain	Malware download	Search only	2026-10-06	Hunting	Unit 42 [1]
`ns1[.]soroshpasargad[.]com`	Domain	Listed by researchers	Search only	2026-10-06	Hunting	Unit 42 [1]
`portal[.]sharjahairport[.]cloud`	Domain	Listed by researchers	Search only	2026-10-06	Hunting	Unit 42 [1]
`hxxps://api[.]github[.]com/repos/peakyblinders-tm/myLic/contents/`	URL	Malware download	Search only	2026-10-06	Hunting	Unit 42 [1]
`hxxps://github[.]com/GreenBeret0`	URL	Command and control	Search only	2026-10-06	Hunting	Unit 42 [1]
`hxxps://github[.]com/peakyblinders-tm`	URL	Command and control	Search only	2026-10-06	Hunting	Unit 42 [1]
`printpro[.]com`	Domain	Listed by researchers	Search only	2026-10-01	Hunting	Lab52 [1]
`188[.]190[.]4[.]111`	IP address	Listed by researchers	Search only	2026-10-01	Hunting	Lab52 [1]
`driftshare[.]co`	Domain	Phishing	Search only	2026-10-01	Hunting	Proofpoint Threat Insight [1]
`77[.]83[.]199[.]39`	IP address	Attacker address	Search only	2026-09-30	Hunting	Unit 42 [1]
`aware-cr1[.]com`	Domain	Command and control	Search only	2026-09-30	Hunting	Zscaler ThreatLabz [1]
`aka[.]ms`	Domain	Malware download	Search only	2026-09-30	Hunting	Microsoft Threat Intelligence [1]
`bypass[.]eu[.]org`	Domain	Command and control	Search only	2026-09-30	Hunting	Microsoft Threat Intelligence [1]
`dnslog[.]pp[.]ua`	Domain	Malware download	Search only	2026-09-30	Hunting	Microsoft Threat Intelligence [1]
`oast[.]fun`	Domain	Malware download	Search only	2026-09-30	Hunting	Microsoft Threat Intelligence [1]
`psk1zim[.]abrdns[.]com`	Domain	Command and control	Search only	2026-09-30	Hunting	Microsoft Threat Intelligence [1]
`tls[.]psk1zim[.]abrdns[.]com`	Domain	Command and control	Search only	2026-09-30	Hunting	Microsoft Threat Intelligence [1]
`transzimbra[.]linkpc[.]net`	Domain	Command and control	Search only	2026-09-30	Hunting	Microsoft Threat Intelligence [1]
`wslogzimbra[.]linkpc[.]net`	Domain	Malware download	Search only	2026-09-30	Hunting	Microsoft Threat Intelligence [1]
`3[.]209[.]137[.]175`	IP address	Command and control	Search only	2026-09-30	Hunting	Microsoft Threat Intelligence [1]
`hxxps://aka[.]ms/downloadazcopy-v10-linux`	URL	Malware download	Search only	2026-09-30	Hunting	Microsoft Threat Intelligence [1]
`www[.]wps-cn[.]com`	Domain	Malware download	Search only	2026-09-30	Hunting	Cisco Talos [1]
`chat[.]ririmochii[.]workers[.]dev`	Domain	Command and control	Search only	2026-09-30	Hunting	Huntress [1]
`bunstar[.]harej[.]si`	Domain	Listed by researchers	Search only	2026-09-29	Hunting	Microsoft Threat Intelligence [1]
`ojsuyw[.]niyari[.]org`	Domain	Listed by researchers	Search only	2026-09-29	Hunting	Microsoft Threat Intelligence [1]
`sdfghj[.]rd-team[.]ru`	Domain	Listed by researchers	Search only	2026-09-29	Hunting	Microsoft Threat Intelligence [1]
`swedcorry[.]stefneyv[.]com`	Domain	Listed by researchers	Search only	2026-09-29	Hunting	Microsoft Threat Intelligence [1]
`a03c84ae9e569c04fdd271277f508bba5a299d53c3c0efe0819338d178fe1c5b`	SHA-256 hash	Malware file	Search only	2026-09-29	Hunting	Microsoft Threat Intelligence [1]
`hxxps://chatgpt[.]com/g/g-6ab595ad6554819181b686d4876efb80-plus-5-6`	URL	Listed by researchers	Search only	2026-09-28	Hunting	Huntress [1]
`hxxps://chatgpt[.]com/g/g-6ab6ba039440819185ed491740b11cf8-plus-5-6`	URL	Listed by researchers	Search only	2026-09-28	Hunting	Huntress [1]
`hxxps://sites[.]google[.]com/view/antibot172881`	URL	Listed by researchers	Search only	2026-09-28	Hunting	Huntress [1]
`34[.]153[.]223[.]102`	IP address	Listed by researchers	Search only	2026-09-25	Hunting	Microsoft Threat Intelligence [1]
`rf[.]ws`	Domain	Malware download	Search only	2026-09-24	Hunting	Sekoia [1]
`docsend[.]appstore[.]com[.]mx`	Domain	Command and control	Search only	2026-09-24	Hunting	Securelist [1]
`slack[.]apple03cloudstore[.]com`	Domain	Malware download	Search only	2026-09-24	Hunting	Securelist [1]
`streamyard[.]appstore[.]com[.]mx`	Domain	Malware download	Search only	2026-09-24	Hunting	Securelist [1]
`waaako[.]appstore[.]com[.]mx`	Domain	Malware download	Search only	2026-09-24	Hunting	Securelist [1]
`warpcast[.]asia`	Domain	Listed by researchers	Search only	2026-09-24	Hunting	Securelist [1]
`hxxps://caldav[.]icloud[.]com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08`	URL	Listed by researchers	Search only	2026-09-24	Hunting	Securelist [1]
`hxxps://docsend[.]appstore[.]com[.]mx/dcc737d157ef4271/CoreUpdate[.]pkg[.]enc`	URL	Listed by researchers	Search only	2026-09-24	Hunting	Securelist [1]
`hxxps://docsend[.]appstore[.]com[.]mx/dcc737d157ef4271/Helper[.]pkg[.]enc`	URL	Listed by researchers	Search only	2026-09-24	Hunting	Securelist [1]
`hxxps://docsend[.]appstore[.]com[.]mx/dcc737d157ef4271/stage2[.]enc`	URL	Malware download	Search only	2026-09-24	Hunting	Securelist [1]
`hxxps://gateway[.]icloud[.]com/caldav/1_MTk1NDMwMDMzNTUxOTU0M0pybtJB186GzhogprwCQUjY3oZNiDFHH8WVo6bmgUtI/attach/4GE4TKNBTGAYDGMZVGUYTSNJUGOAALDAFMDOJBGWNUCYJLZRNDCLCO2YMQ3I64RLGMNXVG3KYBPWQOGYIEI7MPBDDYHECFDYVENTXIYFNDCPOVRMCTYI236RCYZAE63V5U3RTUYGUMO2CO7PKCLWMCXE73M7OPTHSGRWH5DXQ4PCUQU4ELZTLW54JSTK2H7VQ6PD26WOA2R7PPIQ6RTJWDEWP34U3HB4YWMXXC6EJ6PKWILSPYRSDEVY6QGMWSIUN6PR5W35KO3D4QZE7CFPUVBAEKI/Loader[.]app[.]tar[.]gz/YXR0YWNoYXR0YWNoYXR0YRhrE8mQ0E-b_dTUSGStQgTQ0ULFxCanei3Ke-EuEyQL`	URL	Malware download	Search only	2026-09-24	Hunting	Securelist [1]
`hxxps://streamyard[.]appstore[.]com[.]mx/installer[.]sh`	URL	Malware download	Search only	2026-09-24	Hunting	Securelist [1]
`hxxps://waaako[.]appstore[.]com[.]mx/installer[.]sh`	URL	Malware download	Search only	2026-09-24	Hunting	Securelist [1]
`ff-de[.]shutgpt[.]ir`	Domain	Listed by researchers	Search only	2026-09-23	Hunting	Group-IB [1]
`vpn[.]askarzadeh[.]com`	Domain	Attacker address	Search only	2026-09-23	Hunting	Group-IB [1]
`vpn[.]doneplay[.]site`	Domain	Attacker address	Search only	2026-09-23	Hunting	Group-IB [1]
`hxxps://telegram[.]me/+Psyt04xu-cRjMTg0`	URL	Command and control	Search only	2026-09-23	Hunting	Group-IB [1]
`hxxps://telegram[.]me/ftestera`	URL	Command and control	Search only	2026-09-23	Hunting	Group-IB [1]
`effectivecpmnetwork[.]com`	Domain	Command and control	Search only	2026-09-22	Hunting	Huntress [1]
`sharedfuturetech[.]com`	Domain	Malware download	Search only	2026-09-22	Hunting	Huntress [1]
`andsolarengyloanfunds[.]com`	Domain	Phishing	Search only	2026-09-22	Hunting	ANY.RUN [1]
`asambitiousaboutautismorguk[.]com`	Domain	Phishing	Search only	2026-09-22	Hunting	ANY.RUN [1]
`greenbullet[.]ba`	Domain	Malware download	Search only	2026-09-22	Hunting	ANY.RUN [1]
`theconversation[.]com`	Domain	Command and control	Search only	2026-09-21	Hunting	Volexity [1]
`technicais[.]sytes[.]net`	Domain	Listed by researchers	Search only	2026-09-18	Hunting	SentinelLabs [1]
`publicwavlib[.]pages[.]dev`	Domain	Malware download	Search only	2026-09-18	Hunting	K7 Labs [1]
`a650bc3533b424d03[.]zip`	Domain	Malware download	Search only	2026-09-17	Hunting	Group-IB [1]
`file26[.]zip`	Domain	Malware download	Search only	2026-09-17	Hunting	Group-IB [1]
`sgp1[.]vultrobjects[.]com`	Domain	Malware download	Search only	2026-09-17	Hunting	Group-IB [1]
`hxxps://api[.]telegram[.]org/bot783XXXX576`	URL	Malware download	Search only	2026-09-17	Hunting	Group-IB [1]
`hxxps://api[.]telegram[.]org/file/`	URL	Malware download	Search only	2026-09-17	Hunting	Group-IB [1]
`hxxps://sgp1[.]vultrobjects[.]com/downloads/pictory/Pictory_premium_ver9[.]0[.]4[.]exe`	URL	Malware download	Search only	2026-09-17	Hunting	Group-IB [1]
`hxxps://sgp1[.]vultrobjects[.]com/jttrepijgdb/`	URL	Malware download	Search only	2026-09-17	Hunting	Group-IB [1]
`hxxps://sgp1[.]vultrobjects[.]com/jttrepijgdb/efg_d4[.]zip`	URL	Malware download	Search only	2026-09-17	Hunting	Group-IB [1]
`hxxps://github[.]com/browserthemes/resourcepack`	URL	Listed by researchers	Search only	2026-09-16	Hunting	Securelist [1]
`hxxps://github[.]com/browserthemes/resourcepack/releases/download/main/resource-pack[.]zip`	URL	Malware download	Search only	2026-09-16	Hunting	Securelist [1]
`hxxps://github[.]com/mirror-js/mirror-js`	URL	Listed by researchers	Search only	2026-09-16	Hunting	Securelist [1]
`ferncore13[.]com`	Domain	Malware download	Search only	2026-09-16	Hunting	Unit 42 [1]
`grove-89[.]com`	Domain	Malware download	Search only	2026-09-16	Hunting	Unit 42 [1]
`cache-mcp[.]com`	Domain	Attacker address	Search only	2026-09-15	Hunting	Infoblox Threat Intel [1]
`hxxps://us-addnewdevice[.]com/panel`	URL	Attacker address	Search only	2026-09-14	Hunting	Sekoia [1]
`acrobat-updater[.]com`	Domain	Listed by researchers	Search only	2026-09-14	Hunting	Elastic Security Labs [1]
`cheapzone[.]space`	Domain	Listed by researchers	Search only	2026-09-14	Hunting	Elastic Security Labs [1]
`codecaudiog[.]site`	Domain	Listed by researchers	Search only	2026-09-14	Hunting	Elastic Security Labs [1]
`codecvideowin[.]online`	Domain	Listed by researchers	Search only	2026-09-14	Hunting	Elastic Security Labs [1]
`connection[.]timesmaluku[.]com`	Domain	Listed by researchers	Search only	2026-09-14	Hunting	Elastic Security Labs [1]
`harialurdes[.]site`	Domain	Listed by researchers	Search only	2026-09-14	Hunting	Elastic Security Labs [1]
`lojinhadaana[.]org`	Domain	Listed by researchers	Search only	2026-09-14	Hunting	Elastic Security Labs [1]
`lojinhadoluiz[.]online`	Domain	Listed by researchers	Search only	2026-09-14	Hunting	Elastic Security Labs [1]
`marialurdes[.]site`	Domain	Listed by researchers	Search only	2026-09-14	Hunting	Elastic Security Labs [1]
`mysterylink[.]xyz`	Domain	Listed by researchers	Search only	2026-09-14	Hunting	Elastic Security Labs [1]
`quirkyclub[.]club`	Domain	Listed by researchers	Search only	2026-09-14	Hunting	Elastic Security Labs [1]
`hxxps://acrobat-updater[.]com/api/v2/acrobat/latest`	URL	Malware download	Search only	2026-09-14	Hunting	Elastic Security Labs [1]
`hxxps://acrobat-updater[.]com/generate`	URL	Malware download	Search only	2026-09-14	Hunting	Elastic Security Labs [1]
`hxxps://archive[.]org/download/hotelmoskva/hotelmoskva[.]jpg`	URL	Malware download	Search only	2026-09-14	Hunting	Elastic Security Labs [1]
`hxxps://archive[.]org/download/operagarnier/operagarnier[.]jpg`	URL	Malware download	Search only	2026-09-14	Hunting	Elastic Security Labs [1]
`hxxps://archive[.]org/download/operaparis/operaparis[.]jpg`	URL	Malware download	Search only	2026-09-14	Hunting	Elastic Security Labs [1]
`hxxps://codecaudiog[.]site/87b76a60ba7c474dbf8f689df2808e1a?payload=f1d7b074-b81f-11ef-a763-1402ec3d56f0`	URL	Malware download	Search only	2026-09-14	Hunting	Elastic Security Labs [1]
`hxxps://codecaudiog[.]site/generate?domain=codecvideowin[.]online&payload=991589b0-4cc9-11f0-b9f4-1402ec3d56f0&prefix=NF&prefix_count=10&output=base64`	URL	Malware download	Search only	2026-09-14	Hunting	Elastic Security Labs [1]
`hxxps://codecvideowin[.]online/af15d5f?p=991589b0-4cc9-11f0-b9f4-1402ec3d56f0`	URL	Malware download	Search only	2026-09-14	Hunting	Elastic Security Labs [1]
`hxxps://codecvideowin[.]online/f9e95a1e1fa3f3aebfc802c6c8e6a2eb`	URL	Malware download	Search only	2026-09-14	Hunting	Elastic Security Labs [1]