WatchmanHQ

Newly reported: last 7 days

Release 20261012T180322Z · built 2026-10-12 18:03 UTC · valid until 2026-10-15 18:03 UTC

Indicators first published by a research team in the 7 days before this release: 0 confident, 828 blocking, 246 hunting only. Confident first, then Blocking, then Hunting.

Indicator (defanged)TypeReported asBlock scopeFirst reportedListSources
supper[.]feeee[.]ioDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
support[.]96html[.]comDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
szxcm-hkg01[.]iepl[.]node[.]cmDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
t[.]checkinfo[.]tkDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
teyan[.]microscan[.]meDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
tj[.]twimg[.]co[.]ukDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
traffic[.]96html[.]comDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
trendmicro[.]96html[.]comDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
trust[.]feeeeDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
tsedws[.]comDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
txt[.]studiocloud[.]xyzDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
update[.]96html[.]comDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
upgrate[.]checkapi[.]cfDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
upl[.]natcloudservice[.]comDomainMalware downloadSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
v3[.]streescans[.]comDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
vnpt[.]sexytube0[.]comDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
vpn21[.]arforcex[.]comDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
vpn328433596[.]softether[.]netDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
vpn614174689[.]softether[.]netDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
vpn677190427[.]softether[.]netDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
vpn718535264[.]softether[.]netDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
vpn823494147[.]softether[.]netDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
wanfang[.]accesscam[.]orgDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
webdisk[.]bailbonding[.]infoDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
webmail[.]studiocloud[.]xyzDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
well[.]96html[.]comDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
ws[.]studiocloud[.]xyzDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
wss[.]studiocloud[.]xyzDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
www[.]96html[.]comDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
www[.]alitagotest[.]cfDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
www[.]chr0mail[.]comDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
www[.]cktime[.]ooguy[.]comDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
www[.]dns361[.]tkDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
www[.]feeee[.]ioDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
www[.]javacheck[.]ooguy[.]comDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
www[.]leicc009[.]gaDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
www[.]purple76[.]comDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
www[.]sofeter[.]mlDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
www[.]studiocloud[.]xyzDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
xassxxdns[.]alitagotest[.]cfDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
ximmd[.]sexytube0[.]comDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
zerogravity1986[.]softether[.]netDomainListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
106[.]53[.]181[.]231IP addressListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
147[.]139[.]133[.]246IP addressListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
162[.]14[.]178[.]86IP addressListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
190[.]92[.]241[.]15IP addressListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
191[.]232[.]188[.]144IP addressListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
8[.]219[.]119[.]5IP addressListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
84[.]17[.]57[.]40IP addressListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
89[.]187[.]163[.]216IP addressListed by researchersSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
1b8e29b6b7972fb124425aaa257f8f6dMD5 hashMalware fileSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
f82694de2f19e1bff333c27bb7eb7a56MD5 hashMalware fileSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
8e1b56ef51ba70aa4c4cfd4430820f20875b354588d5d723ba4d3940ea6c924bSHA-256 hashMalware fileSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
efb0437e6a6a0f07169952f1a8b734299ec9a8b1faadbed811fe017f2cf54976SHA-256 hashMalware fileSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
hxxps://natcloudservice[.]com/ewsURLCommand and controlSearch only2026-10-08HuntingCISA Cybersecurity Advisories [1]
ccwu[.]ccDomainCommand and controlSearch only2026-10-07HuntingCensys [1]
g[.]northlab[.]cnDomainCommand and controlSearch only2026-10-07HuntingCensys [1]
i[.]131422[.]comDomainListed by researchersSearch only2026-10-07HuntingCensys [1]
iplcz[.]cnDomainCommand and controlSearch only2026-10-07HuntingCensys [1]
manager[.]g[.]northlab[.]cnDomainCommand and controlSearch only2026-10-07HuntingCensys [1]
siekeltd[.]comDomainCommand and controlSearch only2026-10-07HuntingCensys [1]
wumian[.]cc[.]cdDomainCommand and controlSearch only2026-10-07HuntingCensys [1]
101[.]35[.]158[.]183IP addressCommand and controlSearch only2026-10-07HuntingCensys [1]
check[.]vykyn[.]clickDomainAttacker addressSearch only2026-10-07HuntingHuntress [1]
instance-g01s1n-relay[.]screenconnect[.]comDomainMalware downloadSearch only2026-10-07HuntingHuntress [1]
server[.]na-2[.]action1[.]comDomainListed by researchersSearch only2026-10-06HuntingSANS Internet Storm Center [1]
up-theta-rose[.]vercel[.]appDomainMalware downloadSearch only2026-10-06HuntingSANS Internet Storm Center [1]
update-two-tau[.]vercel[.]appDomainMalware downloadSearch only2026-10-06HuntingSANS Internet Storm Center [1]
musicdel[.]irDomainMalware downloadSearch only2026-10-06HuntingUnit 42 [1]
ns1[.]soroshpasargad[.]comDomainListed by researchersSearch only2026-10-06HuntingUnit 42 [1]
portal[.]sharjahairport[.]cloudDomainListed by researchersSearch only2026-10-06HuntingUnit 42 [1]
hxxps://api[.]github[.]com/repos/peakyblinders-tm/myLic/contents/URLMalware downloadSearch only2026-10-06HuntingUnit 42 [1]
hxxps://github[.]com/GreenBeret0URLCommand and controlSearch only2026-10-06HuntingUnit 42 [1]
hxxps://github[.]com/peakyblinders-tmURLCommand and controlSearch only2026-10-06HuntingUnit 42 [1]