WatchmanHQ

Hunting: Look, don't block.

Release 20261012T180322Z · built 2026-10-12 18:03 UTC · valid until 2026-10-15 18:03 UTC

Linked to suspicious activity but not proven enough to block: a single mention, an older report, shared infrastructure, or something still waiting for validation. Search your logs for these and investigate any hit. Do not block them.

This page lists the indicators that are only on Hunting. Everything on Blocking is worth hunting for too.

5,203 indicators. Numbers in the Sources column link to the original reports.

Indicator (defanged)TypeReported asBlock scopeFirst reportedListSources
sukrajclasses[.]comDomainCompromised siteSearch only2026-06-11HuntingSekoia [1]
sysarchirnc[.]comDomainPhishingSearch only2026-06-11HuntingSekoia [1]
thewoodlandretreat[.]inDomainCompromised siteSearch only2026-06-11HuntingSekoia [1]
thumenectrics[.]esDomainPhishingSearch only2026-06-11HuntingSekoia [1]
tvsyndciate[.]comDomainPhishingSearch only2026-06-11HuntingSekoia [1]
unalkardesler[.]netDomainCompromised siteSearch only2026-06-11HuntingSekoia [1]
urbanumbrella[.]orgDomainPhishingSearch only2026-06-11HuntingSekoia [1]
usfightingsystems[.]comDomainPhishingSearch only2026-06-11HuntingSekoia [1]
vlsbali[.]comDomainCompromised siteSearch only2026-06-11HuntingSekoia [1]
webitww[.]comDomainPhishingSearch only2026-06-11HuntingSekoia [1]
welcomehomeproject[.]orgDomainPhishingSearch only2026-06-11HuntingSekoia [1]
windstreaim[.]comDomainPhishingSearch only2026-06-11HuntingSekoia [1]
wordtex[.]comDomainCompromised siteSearch only2026-06-11HuntingSekoia [1]
wwgle[.]comDomainPhishingSearch only2026-06-11HuntingSekoia [1]
www[.]fabribat[.]comDomainCompromised siteSearch only2026-06-11HuntingSekoia [1]
www[.]northernaid[.]orgDomainCompromised siteSearch only2026-06-11HuntingSekoia [1]
yaharaho[.]comDomainCompromised siteSearch only2026-06-11HuntingSekoia [1]
yogatrapezepoint[.]comDomainCompromised siteSearch only2026-06-11HuntingSekoia [1]
yugaljeeautomotive[.]comDomainCompromised siteSearch only2026-06-11HuntingSekoia [1]
yushengusa[.]comDomainPhishingSearch only2026-06-11HuntingSekoia [1]
185[.]125[.]100[.]81IP addressPhishingSearch only2026-06-11HuntingSekoia [1]
hxxps://highnationservices[.]com/n/uswDOVS70y9sjyPwtLieCJdZiEUGhokxRUvY7JApYlFo35Sb9o66AvhK8oNrHPTgj9aaJDHItTWDnPOo3t4mz8Tfhf7GBem0YE1cqx8O13VoKuWIbN4knGg6fRrvMIZXRQ2xgdEFzj2mVBzwSbpe5c/validateURLPhishingSearch only2026-06-11HuntingSekoia [1]
hxxps://kagumigroup[.]id/wp-content/plugins/well/auth/j9P8KGpfDZyoHplo5XdnHOw79OCkDYo2l7TQcrrnclSz2XGLzmtCghFJwIWR1AaW33Rk36Z0ymZc6DIgMy4EFqTsiiqAKEBIN5jiTbYAUk1BfG4uoVhetLa2XWebUSShQOFq7L8Mpx1vf4Pum0xBVx/verifyURLPhishingSearch only2026-06-11HuntingSekoia [1]
hxxps://mysilverfox[.]com[.]my/00/7N0tV3XAh1yp4NFo9X6YsH3cOam6DYJhmMEXRky24mzGUuTE2RpwIIlI4olBypVCEYqiKFPDTAsRvKrS8bgiKBOZiPOUnxoCSHveA0zk5hcdjQ1UltSxdw7rdgZoo7HDWorfj9CzN8gc0q5PQ19nZe/indexURLPhishingSearch only2026-06-11HuntingSekoia [1]
background-services[.]netDomainCommand and controlSearch only2026-06-11HuntingSekoia [1]
download-resourses[.]infoDomainMalware downloadSearch only2026-06-11HuntingSekoia [1]
lookup[.]inkDomainCommand and controlSearch only2026-06-11HuntingSekoia [1]
2[.]58[.]15[.]158IP addressCommand and controlSearch only2026-06-11HuntingSekoia [1]
213[.]159[.]79[.]56IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
38[.]180[.]206[.]61IP addressCommand and controlSearch only2026-06-11HuntingSekoia [1]
38[.]180[.]207[.]137IP addressCommand and controlSearch only2026-06-11HuntingSekoia [1]
carolinejuskus[.]comDomainMalware downloadSearch only2026-06-11HuntingSekoia [1]
googiedrivers[.]comDomainMalware downloadSearch only2026-06-11HuntingSekoia [1]
us18web-zoom[.]usDomainMalware downloadSearch only2026-06-11HuntingSekoia [1]
webapizmland[.]comDomainCommand and controlSearch only2026-06-11HuntingSekoia [1]
77[.]221[.]157[.]170IP addressCommand and controlSearch only2026-06-11HuntingSekoia [1]
85[.]209[.]11[.]155IP addressCommand and controlSearch only2026-06-11HuntingSekoia [1]
91[.]103[.]140[.]200IP addressCommand and controlSearch only2026-06-11HuntingSekoia [1]
95[.]182[.]97[.]58IP addressCommand and controlSearch only2026-06-11HuntingSekoia [1]
hxxp://77[.]221[.]157[.]170:3004/server[.]js5URLCommand and controlSearch only2026-06-11HuntingSekoia [1]
hxxp://85[.]209[.]11[.]155/joinsystemURLCommand and controlSearch only2026-06-11HuntingSekoia [1]
hxxp://91[.]103[.]140[.]200:9078/3936a074a2f65761a5eb8/6fmfpmi7[.]fwf4pURLCommand and controlSearch only2026-06-11HuntingSekoia [1]
hxxp://95[.]182[.]97[.]58/84b7b6f977dd1c65[.]phpURLCommand and controlSearch only2026-06-11HuntingSekoia [1]
hxxps://carolinejuskus[.]com/f9dfbcf6a999/7cc2f5dc3c76/load[.]51f8527e20dcb05ffd8586b853937a8a[.]php?call=launcherURLMalware downloadSearch only2026-06-11HuntingSekoia [1]
hxxps://carolinejuskus[.]com/kusaka[.]php?call=launcherURLMalware downloadSearch only2026-06-11HuntingSekoia [1]
hxxps://googIedrivers[.]com/fix-errorURLMalware downloadSearch only2026-06-11HuntingSekoia [1]
hxxps://us18web-zoom[.]us/ram[.]exeURLMalware downloadSearch only2026-06-11HuntingSekoia [1]
hxxps://us18web-zoom[.]us/stealc[.]exeURLMalware downloadSearch only2026-06-11HuntingSekoia [1]
hxxps://webapizmland[.]com/api/cmdrunedURLMalware downloadSearch only2026-06-11HuntingSekoia [1]
eyh[.]ocry[.]comDomainCommand and controlSearch only2026-06-11HuntingSekoia [1]
nbt201[.]dynamic-dns[.]netDomainCommand and controlSearch only2026-06-11HuntingSekoia [1]
38[.]60[.]221[.]145IP addressListed by researchersSearch only2026-06-11HuntingSekoia [1]
hxxps://38[.]60[.]221[.]145/static/URLListed by researchersSearch only2026-06-11HuntingSekoia [1]
run[.]on-demand[.]pwDomainMalware downloadSearch only2026-06-11HuntingSekoia [1]
sck-dns[.]ccDomainCommand and controlSearch only2026-06-11HuntingSekoia [1]
154[.]213[.]192[.]44IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
80[.]78[.]24[.]30IP addressCommand and controlSearch only2026-06-11HuntingSekoia [1]
hxxp://154[.]213[.]192[.]44/Ueordwfkay[.]pdfURLMalware downloadSearch only2026-06-11HuntingSekoia [1]
hxxp://154[.]213[.]192[.]44/plugin3[.]dllURLMalware downloadSearch only2026-06-11HuntingSekoia [1]
hxxp://sck-dns[.]cc/cURLMalware downloadSearch only2026-06-11HuntingSekoia [1]
ciwanensoresger[.]comDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
dicle[.]fmDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
dirbesiye[.]fmDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
halkin-dg[.]comDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
hawarnews[.]comDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
hbdh[.]infoDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
init4afrin[.]orgDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
kongra-star[.]orgDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
leftkup[.]comDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
lekolin[.]orgDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
orkesfm[.]comDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
pajk[.]orgDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
rojnews[.]newsDomainMalware downloadSearch only2026-06-11HuntingSekoia [1]
ronahi[.]netDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
ronahi[.]videoDomainCompromised siteSearch only2026-06-11HuntingSekoia [1]
sdf-press[.]comDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
sehidenrojava[.]comDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
star-fm[.]netDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
targetplatform[.]netDomainMalware downloadSearch only2026-06-11HuntingSekoia [1]
tev-dem[.]comDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
thkp-c[.]orgDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
webmail[.]onlinearuba[.]netDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
ypj-office[.]comDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
ypjrojava[.]netDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
yra-ufm[.]comDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
zindi24[.]comDomainListed by researchersSearch only2026-06-11HuntingSekoia [1]
170[.]75[.]161[.]102IP addressListed by researchersSearch only2026-06-11HuntingSekoia [1]
23[.]95[.]14[.]63IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
24[.]246[.]223[.]228IP addressListed by researchersSearch only2026-06-11HuntingSekoia [1]
hxxp://170[.]75[.]161[.]102/asd[.]jsURLMalware downloadSearch only2026-06-11HuntingSekoia [1]
hxxps://rojnews[.]news/ku/wp-content/mobile[.]htmlURLMalware downloadSearch only2026-06-11HuntingSekoia [1]
hxxps://targetplatform[.]net/mobile[.]htmlURLMalware downloadSearch only2026-06-11HuntingSekoia [1]
147[.]45[.]50[.]214IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
147[.]45[.]50[.]57IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
147[.]45[.]79[.]82IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
151[.]236[.]17[.]180IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
206[.]188[.]196[.]28IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
62[.]133[.]61[.]101IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
62[.]133[.]61[.]104IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
62[.]133[.]61[.]37IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
62[.]133[.]61[.]73IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
89[.]23[.]103[.]56IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
89[.]23[.]107[.]244IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
89[.]23[.]107[.]67IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
91[.]92[.]243[.]198IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
91[.]92[.]251[.]35IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
92[.]118[.]112[.]253IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
94[.]156[.]64[.]74IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
gouuv[.]frDomainPhishingSearch only2026-06-11HuntingSekoia [1]
paris2024[.]appDomainPhishingSearch only2026-06-11HuntingSekoia [1]
paris2024[.]ticket[.]netDomainPhishingSearch only2026-06-11HuntingSekoia [1]
tickets-paris2024[.]orgDomainPhishingSearch only2026-06-11HuntingSekoia [1]
tickets[.]pa4ris2024[.]orgDomainPhishingSearch only2026-06-11HuntingSekoia [1]
tickets[.]paaris2024[.]orgDomainPhishingSearch only2026-06-11HuntingSekoia [1]
tickets[.]pabis2024[.]orgDomainPhishingSearch only2026-06-11HuntingSekoia [1]
tickets[.]padis2024[.]orgDomainPhishingSearch only2026-06-11HuntingSekoia [1]
tickets[.]paris2024[.]appDomainPhishingSearch only2026-06-11HuntingSekoia [1]
tickets[.]paris2024[.]bizDomainPhishingSearch only2026-06-11HuntingSekoia [1]
103[.]140[.]239[.]63IP addressListed by researchersSearch only2026-06-11HuntingSekoia [1]
103[.]57[.]248[.]202IP addressListed by researchersSearch only2026-06-11HuntingSekoia [1]
151[.]236[.]20[.]30IP addressListed by researchersSearch only2026-06-11HuntingSekoia [1]
158[.]247[.]194[.]125IP addressListed by researchersSearch only2026-06-11HuntingSekoia [1]
45[.]77[.]44[.]119IP addressListed by researchersSearch only2026-06-11HuntingSekoia [1]
149[.]248[.]8[.]85IP addressPhishingSearch only2026-06-11HuntingSekoia [1]
142[.]11[.]205[.]164IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
151[.]236[.]20[.]185IP addressAttacker addressSearch only2026-06-11HuntingSekoia [1]
151[.]236[.]20[.]211IP addressAttacker addressSearch only2026-06-11HuntingSekoia [1]
23[.]254[.]201[.]175IP addressMalware downloadSearch only2026-06-11HuntingSekoia [1]
146[.]19[.]143[.]14IP addressListed by researchersSearch only2026-06-11HuntingSekoia [1]
91[.]235[.]234[.]202IP addressListed by researchersSearch only2026-06-11HuntingSekoia [1]
financemachinelearning[.]comDomainCommand and controlSearch only2026-06-11HuntingESET WeLiveSecurity [1]
gatewayrvcenter[.]comDomainListed by researchersSearch only2026-06-11HuntingESET WeLiveSecurity [1]
139[.]162[.]11[.]152IP addressCommand and controlSearch only2026-06-11HuntingESET WeLiveSecurity [1]
hxxps://financemachinelearning[.]com/apparatus/wind/twig/statement[.]htmlURLCommand and controlSearch only2026-06-11HuntingESET WeLiveSecurity [1]
fifa[.]helpDomainPhishingSearch only2026-06-10HuntingCyble [1]
carrolc[.]comDomainListed by researchersSearch only2026-06-09HuntingZscaler ThreatLabz [1]
cwrtwright[.]comDomainCommand and controlSearch only2026-06-09HuntingZscaler ThreatLabz [1]
powwowski[.]comDomainMalware downloadSearch only2026-06-09HuntingZscaler ThreatLabz [1]
rs2y15sungu[.]comDomainCommand and controlSearch only2026-06-09HuntingZscaler ThreatLabz [1]
thomphon[.]comDomainListed by researchersSearch only2026-06-09HuntingZscaler ThreatLabz [1]
brokeapt[.]comDomainCommand and controlSearch only2026-06-08HuntingMicrosoft Threat Intelligence [1]
legendarytrendsbay[.]shopDomainCompromised siteSearch only2026-06-08HuntingMicrosoft Threat Intelligence [1]
pan[.]rongtv[.]xyzDomainCommand and controlSearch only2026-06-08HuntingMicrosoft Threat Intelligence [1]
pan[.]ssffaa19[.]xyzDomainCommand and controlSearch only2026-06-08HuntingMicrosoft Threat Intelligence [1]
servicing[.]pureplantcravings[.]comDomainMalware downloadSearch only2026-06-08HuntingMicrosoft Threat Intelligence [1]
hxxp://dash[.]awaydouble[.]org/0v2authURLListed by researchersSearch only2026-06-08HuntingMicrosoft Threat Intelligence [1]
hxxps://github[.]com/DeepSeek-V4/deepseek-V4/releases/download/deepseek-V4/deepseek-v4-pro_x64[.]7zURLMalware downloadSearch only2026-06-08HuntingMicrosoft Threat Intelligence [1]
hxxps://github[.]com/shippingtechnologymovie/AI-techVideos/releases/download/13123/ProFluxeFlowAi-win-Setup[.]exeURLMalware downloadSearch only2026-06-08HuntingMicrosoft Threat Intelligence [1]
130[.]49[.]155[.]112IP addressListed by researchersSearch only2026-06-08HuntingSecurelist [1]
138[.]226[.]236[.]52IP addressListed by researchersSearch only2026-06-08HuntingSecurelist [1]
212[.]46[.]12[.]182IP addressListed by researchersSearch only2026-06-08HuntingSecurelist [1]
45[.]112[.]194[.]82IP addressListed by researchersSearch only2026-06-08HuntingSecurelist [1]
45[.]150[.]109[.]2IP addressCommand and controlSearch only2026-06-08HuntingSecurelist [1]
77[.]72[.]85[.]62IP addressCommand and controlSearch only2026-06-08HuntingSecurelist [1]
85[.]137[.]253[.]186IP addressListed by researchersSearch only2026-06-08HuntingSecurelist [1]
afxwd[.]ddns[.]netDomainListed by researchersSearch only2026-06-03HuntingHuntress [1]
andrefelipedonascime1778799406970[.]2241107[.]meusitehostgator[.]com[.]brDomainListed by researchersSearch only2026-06-03HuntingHuntress [1]
bth[.]startthewave[.]orgDomainMalware downloadSearch only2026-06-03HuntingHuntress [1]
catalogo[.]castrouria[.]comDomainListed by researchersSearch only2026-06-03HuntingHuntress [1]
fostercareintheus[.]optimizationprime[.]comDomainListed by researchersSearch only2026-06-03HuntingHuntress [1]
pengajian[.]muliastudy[.]comDomainListed by researchersSearch only2026-06-03HuntingHuntress [1]
xtadts[.]ddns[.]netDomainListed by researchersSearch only2026-06-03HuntingHuntress [1]
hxxp://catalogo[.]castrouria[.]com/c84da/bl[.]txtURLMalware downloadSearch only2026-06-03HuntingHuntress [1]
hxxps://andrefelipedonascime1778799406970[.]2241107[.]meusitehostgator[.]com[.]br/GpazlLUWIJ_14_05_Meus_ArquivosDeTexto/01[.]txtURLMalware downloadSearch only2026-06-03HuntingHuntress [1]
hxxps://andrefelipedonascime1778799406970[.]2241107[.]meusitehostgator[.]com[.]br/GpazlLUWIJ_14_05_Meus_ArquivosDeTexto/02[.]txtURLMalware downloadSearch only2026-06-03HuntingHuntress [1]
hxxps://andrefelipedonascime1778799406970[.]2241107[.]meusitehostgator[.]com[.]br/GpazlLUWIJ_14_05_Meus_ArquivosDeTexto/03[.]txtURLMalware downloadSearch only2026-06-03HuntingHuntress [1]
hxxps://andrefelipedonascime1778799406970[.]2241107[.]meusitehostgator[.]com[.]br/GpazlLUWIJ_14_05_Meus_ArquivosDeTexto/PeNoURLMalware downloadSearch only2026-06-03HuntingHuntress [1]
hxxps://bth[.]startthewave[.]org/a/#URLMalware downloadSearch only2026-06-03HuntingHuntress [1]
appfreshstart[.]comDomainCommand and controlSearch only2026-06-03HuntingCheck Point Research [1]
appgetonline[.]comDomainCommand and controlSearch only2026-06-03HuntingCheck Point Research [1]
appmakingcenter[.]comDomainCommand and controlSearch only2026-06-03HuntingCheck Point Research [1]
baxe[.]picsDomainListed by researchersSearch only2026-06-03HuntingCheck Point Research [1]
buccstanor[.]picsDomainListed by researchersSearch only2026-06-03HuntingCheck Point Research [1]
carlessclapped[.]comDomainListed by researchersSearch only2026-06-03HuntingCheck Point Research [1]
cdn-1415[.]brightcanvas[.]digitalDomainMalware downloadSearch only2026-06-03HuntingCheck Point Research [1]
crystaldiskmark[.]orgDomainPhishingSearch only2026-06-03HuntingCheck Point Research [1]
cw[.]hugo-lapp[.]latDomainListed by researchersSearch only2026-06-03HuntingCheck Point Research [1]
dnspy[.]orgDomainPhishingSearch only2026-06-03HuntingCheck Point Research [1]
ed[.]hugo-lapp[.]latDomainListed by researchersSearch only2026-06-03HuntingCheck Point Research [1]
fd[.]hugo-lapp[.]latDomainListed by researchersSearch only2026-06-03HuntingCheck Point Research [1]
file-enter-web[.]comDomainMalware downloadSearch only2026-06-03HuntingCheck Point Research [1]
flame-guard[.]ccDomainListed by researchersSearch only2026-06-03HuntingCheck Point Research [1]
forestoaker[.]comDomainListed by researchersSearch only2026-06-03HuntingCheck Point Research [1]
getfluxfile[.]comDomainMalware downloadSearch only2026-06-03HuntingCheck Point Research [1]
ghidralite[.]comDomainPhishingSearch only2026-06-03HuntingCheck Point Research [1]
gluckcreek[.]onlineDomainListed by researchersSearch only2026-06-03HuntingCheck Point Research [1]
grpcurl[.]comDomainPhishingSearch only2026-06-03HuntingCheck Point Research [1]
guiformat[.]comDomainPhishingSearch only2026-06-03HuntingCheck Point Research [1]
ilspy[.]orgDomainPhishingSearch only2026-06-03HuntingCheck Point Research [1]
integritycrc[.]comDomainCommand and controlSearch only2026-06-03HuntingCheck Point Research [1]
intem[.]latDomainListed by researchersSearch only2026-06-03HuntingCheck Point Research [1]
io[.]hugo-lapp[.]latDomainListed by researchersSearch only2026-06-03HuntingCheck Point Research [1]
javascriptapiusa[.]comDomainMalware downloadSearch only2026-06-03HuntingCheck Point Research [1]
kr[.]hugo-lapp[.]coDomainListed by researchersSearch only2026-06-03HuntingCheck Point Research [1]
media[.]stellarcloudhub1[.]cfdDomainMalware downloadSearch only2026-06-03HuntingCheck Point Research [1]
mfcmapi[.]comDomainPhishingSearch only2026-06-03HuntingCheck Point Research [1]
mobileversioncrc[.]comDomainCommand and controlSearch only2026-06-03HuntingCheck Point Research [1]
mqttexplorer[.]comDomainPhishingSearch only2026-06-03HuntingCheck Point Research [1]
originaldownloads[.]infoDomainMalware downloadSearch only2026-06-03HuntingCheck Point Research [1]
processing-in-progress-x4[.]t3[.]storage[.]devDomainPhishingSearch only2026-06-03HuntingCheck Point Research [1]
ropea[.]topDomainListed by researchersSearch only2026-06-03HuntingCheck Point Research [1]
st[.]hugo-lapp[.]latDomainListed by researchersSearch only2026-06-03HuntingCheck Point Research [1]
td[.]hugo-lapp[.]latDomainListed by researchersSearch only2026-06-03HuntingCheck Point Research [1]
trkscope[.]xyzDomainMalware downloadSearch only2026-06-03HuntingCheck Point Research [1]
webcrcprove[.]comDomainCommand and controlSearch only2026-06-03HuntingCheck Point Research [1]
webinnosetup[.]comDomainCommand and controlSearch only2026-06-03HuntingCheck Point Research [1]
winsetupfromusb[.]orgDomainPhishingSearch only2026-06-03HuntingCheck Point Research [1]
yourfastcrc[.]comDomainCommand and controlSearch only2026-06-03HuntingCheck Point Research [1]
194[.]150[.]220[.]218IP addressCommand and controlSearch only2026-06-03HuntingCheck Point Research [1]
217[.]156[.]122[.]75IP addressListed by researchersSearch only2026-06-03HuntingCheck Point Research [1]
94[.]231[.]205[.]229IP addressListed by researchersSearch only2026-06-03HuntingCheck Point Research [1]
hxxp://194[.]150[.]220[.]218/4SLEYpfAk57hGubo/fo0suc2ki2[.]rtfURLCommand and controlSearch only2026-06-03HuntingCheck Point Research [1]
hxxps://cdn-1415[.]brightcanvas[.]digital/fo0suc2ki2[.]rtfURLMalware downloadSearch only2026-06-03HuntingCheck Point Research [1]
hxxps://javascriptapiusa[.]com/lic?URLMalware downloadSearch only2026-06-03HuntingCheck Point Research [1]
hxxps://s3[.]us-east-2[.]amazonaws[.]com/activeslatnascdngetrcv/wstq162fmo/SetupFile_839132[.]html?utm_source=partner_consentURLMalware downloadSearch only2026-06-03HuntingCheck Point Research [1]
hxxps://s3[.]us-east-2[.]amazonaws[.]com/marketstagofortdas/ehjm145uvt/Download_Ready_461049[.]exeURLMalware downloadSearch only2026-06-03HuntingCheck Point Research [1]
hxxps://s3[.]us-east-2[.]amazonaws[.]com/marketstagofortdas/ehjm145uvt/Download_Ready_461049[.]html?utm_source=partner_consentURLMalware downloadSearch only2026-06-03HuntingCheck Point Research [1]
asper1[.]freeddns[.]orgDomainCommand and controlSearch only2026-06-03HuntingSecurelist [1]
country1[.]ignorelist[.]comDomainCommand and controlSearch only2026-06-03HuntingSecurelist [1]
winst0[.]kozow[.]comDomainMalware downloadSearch only2026-06-03HuntingSecurelist [1]
181[.]116[.]218[.]56IP addressListed by researchersSearch only2026-06-03HuntingSecurelist [1]
186[.]158[.]223[.]35IP addressCommand and controlSearch only2026-06-03HuntingSecurelist [1]
hxxps://github[.]com/DnyP/filesURLListed by researchersSearch only2026-06-03HuntingSecurelist [1]
hxxps://github[.]com/gmz159/uURLListed by researchersSearch only2026-06-03HuntingSecurelist [1]
hxxps://github[.]com/mgzv/pURLListed by researchersSearch only2026-06-03HuntingSecurelist [1]
aryamint[.]comDomainListed by researchersSearch only2026-06-02HuntingANY.RUN [1]
scan[.]aryamint[.]comDomainListed by researchersSearch only2026-06-02HuntingANY.RUN [1]
158[.]94[.]211[.]76IP addressListed by researchersSearch only2026-06-02HuntingANY.RUN [1]
91[.]92[.]243[.]79IP addressListed by researchersSearch only2026-06-02HuntingANY.RUN [1]
atsheisdomestic[.]orgDomainCommand and controlSearch only2026-06-02HuntingUnit 42 [1]
etoftheappyrince[.]orgDomainCommand and controlSearch only2026-06-02HuntingUnit 42 [1]
healightejustb[.]orgDomainCommand and controlSearch only2026-06-02HuntingUnit 42 [1]
sinterfumesco[.]comDomainMalware downloadSearch only2026-06-02HuntingUnit 42 [1]
hxxps://atsheisdomestic[.]org/update-thanks[.]htmlURLCommand and controlSearch only2026-06-02HuntingUnit 42 [1]
hxxps://etoftheappyrince[.]org/update-delayURLCommand and controlSearch only2026-06-02HuntingUnit 42 [1]
hxxps://healightejustb[.]org/checkupdateTO[.]jsURLCommand and controlSearch only2026-06-02HuntingUnit 42 [1]
hxxps://sinterfumesco[.]com/search?utn=URLMalware downloadSearch only2026-06-02HuntingUnit 42 [1]
note1ggbbhggdwa1[.]blob[.]core[.]windows[.]netDomainCommand and controlSearch only2026-05-29HuntingSeqrite [1]
abimj[.]edu[.]afDomainMalware downloadSearch only2026-05-29HuntingSeqrite [1]
hxxp://abimj[.]edu[.]af/institute/cloudiya/URLMalware downloadSearch only2026-05-29HuntingSeqrite [1]
hxxp://abimj[.]edu[.]af/institute/cloudiyaf/document[.]pdfURLMalware downloadSearch only2026-05-29HuntingSeqrite [1]
hxxps://abimj[.]edu[.]af/institute/10/URLMalware downloadSearch only2026-05-29HuntingSeqrite [1]
hxxps://abimj[.]edu[.]af/institute/7/URLMalware downloadSearch only2026-05-29HuntingSeqrite [1]
5d14vnfb[.]spaceDomainCommand and controlSearch only2026-05-28HuntingSecurelist [1]
file[.]ipfs[.]us[.]69[.]muDomainMalware downloadSearch only2026-05-28HuntingSecurelist [1]
jeaw520i[.]spaceDomainCommand and controlSearch only2026-05-28HuntingSecurelist [1]
kristina[.]questDomainListed by researchersSearch only2026-05-28HuntingSecurelist [1]
m4yuri[.]onlineDomainListed by researchersSearch only2026-05-28HuntingSecurelist [1]
qdmagva5[.]spaceDomainCommand and controlSearch only2026-05-28HuntingSecurelist [1]
r7mvjl67[.]spaceDomainCommand and controlSearch only2026-05-28HuntingSecurelist [1]
urush1bar4[.]onlineDomainMalware downloadSearch only2026-05-28HuntingSecurelist [1]
zgj1tam9[.]spaceDomainCommand and controlSearch only2026-05-28HuntingSecurelist [1]
107[.]172[.]212[.]235IP addressListed by researchersSearch only2026-05-28HuntingSecurelist [1]
bitlrewards-app[.]comDomainMalware downloadSearch only2026-05-27HuntingCyble [1]
hxxps://bitlrewards-app[.]com/api/download/IDAustriaURLMalware downloadSearch only2026-05-27HuntingCyble [1]
claude-desktop[.]gitlab[.]ioDomainMalware downloadSearch only2026-05-26HuntingRed Canary [1]
cw[.]compactedtightness[.]cfdDomainCommand and controlSearch only2026-05-26HuntingRed Canary [1]
icloud-cdn[.]netDomainMalware downloadSearch only2026-05-24HuntingDarktrace [1]
www[.]icloud-cdn[.]netDomainCommand and controlSearch only2026-05-24HuntingDarktrace, Fortinet Threat Research [1] [2]
www[.]yahoo-cdn[.]it[.]comDomainListed by researchersSearch only2026-05-24HuntingDarktrace, Fortinet Threat Research [1] [2]
154[.]223[.]58[.]142IP addressListed by researchersSearch only2026-05-24HuntingDarktrace, Fortinet Threat Research [1] [2]
global-check-business-it[.]azurewebsites[.]netDomainListed by researchersSearch only2026-05-22HuntingCheck Point Research [1]
global-check-itbusiness[.]azurewebsites[.]netDomainListed by researchersSearch only2026-05-22HuntingCheck Point Research [1]
global-it-checkbusiness[.]azurewebsites[.]netDomainListed by researchersSearch only2026-05-22HuntingCheck Point Research [1]
global-it-checkers[.]azurewebsites[.]netDomainListed by researchersSearch only2026-05-22HuntingCheck Point Research [1]
global-it-consultants[.]azurewebsites[.]netDomainListed by researchersSearch only2026-05-22HuntingCheck Point Research [1]
globalbusiness-checkers-it[.]azurewebsites[.]netDomainListed by researchersSearch only2026-05-22HuntingCheck Point Research [1]
globalit-consultants[.]azurewebsites[.]netDomainListed by researchersSearch only2026-05-22HuntingCheck Point Research [1]
globalitconsultants[.]azurewebsites[.]netDomainListed by researchersSearch only2026-05-22HuntingCheck Point Research [1]
buisness-centeral-transportation[.]azurewebsites[.]netDomainCommand and controlSearch only2026-05-22HuntingCheck Point Research, Unit 42 [1] [2]
buisness-centeral-transportation[.]comDomainCommand and controlSearch only2026-05-22HuntingCheck Point Research, Securelist, Unit 42 [1] [2] [3]
buisness-centeral[.]azurewebsites[.]netDomainCommand and controlSearch only2026-05-22HuntingCheck Point Research, Unit 42 [1] [2]
business-startup[.]azurewebsites[.]netDomainListed by researchersSearch only2026-05-22HuntingCheck Point Research, Securelist, Unit 42 [1] [2] [3]
business-startup[.]orgDomainListed by researchersSearch only2026-05-22HuntingCheck Point Research, Unit 42 [1] [2]
businessstartup[.]azurewebsites[.]netDomainListed by researchersSearch only2026-05-22HuntingCheck Point Research, Securelist, Unit 42 [1] [2] [3]
docspace-twpf0e[.]onlyoffice[.]comDomainListed by researchersSearch only2026-05-22HuntingUnit 42 [1]
docspace-y4cumb[.]onlyoffice[.]comDomainListed by researchersSearch only2026-05-22HuntingUnit 42 [1]
elementshift[.]azurewebsites[.]netDomainMalware downloadSearch only2026-05-22HuntingUnit 42 [1]
licencemanagers[.]azurewebsites[.]netDomainCommand and controlSearch only2026-05-22HuntingCheck Point Research, Unit 42 [1] [2]
licencesupporting[.]azurewebsites[.]netDomainCommand and controlSearch only2026-05-22HuntingCheck Point Research, Unit 42 [1] [2]
nanomatrix[.]azurewebsites[.]netDomainMalware downloadSearch only2026-05-22HuntingCheck Point Research, Unit 42 [1] [2]
peerdistsvcmanagers[.]azurewebsites[.]netDomainCommand and controlSearch only2026-05-22HuntingCheck Point Research, Unit 42 [1] [2]
premier-healthadvisory[.]azurewebsites[.]netDomainListed by researchersSearch only2026-05-22HuntingCheck Point Research, Unit 42 [1] [2]
premierhealthadvisory[.]azurewebsites[.]netDomainListed by researchersSearch only2026-05-22HuntingCheck Point Research, Unit 42 [1] [2]
premierhealthadvisory[.]comDomainListed by researchersSearch only2026-05-22HuntingCheck Point Research, Unit 42 [1] [2]
quantumweave[.]azurewebsites[.]netDomainMalware downloadSearch only2026-05-22HuntingUnit 42 [1]
ramiltons-finance[.]azurewebsites[.]netDomainListed by researchersSearch only2026-05-22HuntingCheck Point Research, Unit 42 [1] [2]
ramiltonsfinance[.]azurewebsites[.]netDomainListed by researchersSearch only2026-05-22HuntingCheck Point Research, Unit 42 [1] [2]
ramiltonsfinance[.]azurewebsites[.]netiDomainListed by researchersSearch only2026-05-22HuntingUnit 42 [1]
ramiltonsfinance[.]comDomainListed by researchersSearch only2026-05-22HuntingCheck Point Research, Unit 42 [1] [2]
themesmanagers[.]azurewebsites[.]netDomainCommand and controlSearch only2026-05-22HuntingUnit 42 [1]
themesprovidermanagers[.]azurewebsites[.]netDomainCommand and controlSearch only2026-05-22HuntingUnit 42 [1]
hxxps://docspace-twpf0e[.]onlyoffice[.]com/storage/files/root/folder_3765000/file_3764519/v1/content[.]zip?filename=remoteURLListed by researchersSearch only2026-05-22HuntingUnit 42 [1]
hxxps://docspace-y4cumb[.]onlyoffice[.]com/storage/files/root/folder_3602000/file_3601577/v1/content[.]zipURLMalware downloadSearch only2026-05-22HuntingUnit 42 [1]
agenciakharis[.]com[.]brDomainCompromised siteSearch only2026-05-22HuntingSecurelist [1]
allgoodsdirect[.]com[.]auDomainCompromised siteSearch only2026-05-22HuntingSecurelist [1]
alnakhlah[.]com[.]saDomainCompromised siteSearch only2026-05-22HuntingSecurelist [1]
amerikastaj[.]comDomainCompromised siteSearch only2026-05-22HuntingSecurelist [1]
bigbang[.]meDomainCompromised siteSearch only2026-05-22HuntingSecurelist [1]
firsai[.]tipshub[.]netDomainCompromised siteSearch only2026-05-22HuntingSecurelist [1]
fishingflytackle[.]comDomainCompromised siteSearch only2026-05-22HuntingSecurelist [1]
humanitas[.]siDomainCompromised siteSearch only2026-05-22HuntingSecurelist [1]
internationalcommoditiesllc[.]comDomainCompromised siteSearch only2026-05-22HuntingSecurelist [1]
investika-club[.]comDomainMalware downloadSearch only2026-05-22HuntingSecurelist [1]
istochnik[.]orgDomainMalware downloadSearch only2026-05-22HuntingSecurelist [1]
kommando[.]liveDomainCompromised siteSearch only2026-05-22HuntingSecurelist [1]
lafortunaitalian[.]co[.]ukDomainCompromised siteSearch only2026-05-22HuntingSecurelist [1]
landscapeuganda[.]comDomainCompromised siteSearch only2026-05-22HuntingSecurelist [1]
mamurjor[.]comDomainCompromised siteSearch only2026-05-22HuntingSecurelist [1]
paleturquoise-dragonfly-364512[.]hostingersite[.]comDomainCompromised siteSearch only2026-05-22HuntingSecurelist [1]
totallegacy[.]orgDomainCompromised siteSearch only2026-05-22HuntingSecurelist [1]
wizzifi[.]comDomainCompromised siteSearch only2026-05-22HuntingSecurelist [1]
znews[.]netiDomainMalware downloadSearch only2026-05-22HuntingSecurelist [1]
146[.]70[.]53[.]171IP addressMalware downloadSearch only2026-05-22HuntingSecurelist [1]
185[.]126[.]239[.]77IP addressMalware downloadSearch only2026-05-22HuntingSecurelist [1]
185[.]22[.]154[.]73IP addressMalware downloadSearch only2026-05-22HuntingSecurelist [1]
185[.]250[.]181[.]207IP addressMalware downloadSearch only2026-05-22HuntingSecurelist [1]
185[.]53[.]179[.]136IP addressMalware downloadSearch only2026-05-22HuntingSecurelist [1]
194[.]102[.]104[.]207IP addressMalware downloadSearch only2026-05-22HuntingSecurelist [1]
194[.]87[.]196[.]163IP addressMalware downloadSearch only2026-05-22HuntingSecurelist [1]
195[.]58[.]49[.]9IP addressMalware downloadSearch only2026-05-22HuntingSecurelist [1]
37[.]228[.]129[.]224IP addressMalware downloadSearch only2026-05-22HuntingSecurelist [1]
45[.]15[.]65[.]134IP addressMalware downloadSearch only2026-05-22HuntingSecurelist [1]
45[.]87[.]219[.]116IP addressMalware downloadSearch only2026-05-22HuntingSecurelist [1]
46[.]17[.]44[.]125IP addressMalware downloadSearch only2026-05-22HuntingSecurelist [1]
46[.]17[.]44[.]212IP addressMalware downloadSearch only2026-05-22HuntingSecurelist [1]
46[.]17[.]45[.]49IP addressMalware downloadSearch only2026-05-22HuntingSecurelist [1]
46[.]17[.]45[.]56IP addressMalware downloadSearch only2026-05-22HuntingSecurelist [1]
5[.]181[.]21[.]75IP addressMalware downloadSearch only2026-05-22HuntingSecurelist [1]
81[.]30[.]105[.]71IP addressMalware downloadSearch only2026-05-22HuntingSecurelist [1]
93[.]125[.]114[.]193IP addressMalware downloadSearch only2026-05-22HuntingSecurelist [1]
93[.]125[.]114[.]57IP addressMalware downloadSearch only2026-05-22HuntingSecurelist [1]
0c514e137860f489e3801213460ef938MD5 hashMalware fileSearch only2026-05-22HuntingSecurelist [1]
fea22134[.]netDomainCommand and controlSearch only2026-05-22HuntingElastic Security Labs [1]
146[.]70[.]129[.]114IP addressAttacker addressSearch only2026-05-21HuntingCyble [1]
160[.]119[.]76[.]250IP addressAttacker addressSearch only2026-05-21HuntingCyble [1]
169[.]150[.]218[.]33IP addressAttacker addressSearch only2026-05-21HuntingCyble [1]
45[.]234[.]176[.]202IP addressCommand and controlSearch only2026-05-21HuntingCyble [1]
45[.]95[.]147[.]178IP addressCommand and controlSearch only2026-05-21HuntingCyble [1]
hxxp://45[.]95[.]147[.]178/k[.]phpURLMalware downloadSearch only2026-05-21HuntingCyble [1]
hxxp://45[.]95[.]147[.]178/xURLMalware downloadSearch only2026-05-21HuntingCyble [1]
hxxp://45[.]95[.]147[.]178/z/post/noroot[.]phpURLMalware downloadSearch only2026-05-21HuntingCyble [1]
hxxp://45[.]95[.]147[.]178/z/post/noroot[.]php|URLMalware downloadSearch only2026-05-21HuntingCyble [1]
hxxp://45[.]95[.]147[.]178/z/post/root[.]phpURLMalware downloadSearch only2026-05-21HuntingCyble [1]
77[.]110[.]122[.]137IP addressListed by researchersSearch only2026-05-21HuntingHuntress [1]
lysander[.]asiaDomainCommand and controlSearch only2026-05-20HuntingSeqrite [1]
60[.]205[.]186[.]162IP addressCommand and controlSearch only2026-05-20HuntingSeqrite [1]
onezipapp[.]comDomainMalware downloadSearch only2026-05-20HuntingUnit 42 [1]
pixel[.]toolname[.]comDomainCommand and controlSearch only2026-05-20HuntingUnit 42 [1]
www[.]crystalpdf[.]comDomainMalware downloadSearch only2026-05-20HuntingUnit 42 [1]
hxxps://www[.]crystalpdf[.]com/conditionsURLMalware downloadSearch only2026-05-20HuntingUnit 42 [1]
ccleaner[.]glDomainListed by researchersSearch only2026-05-19HuntingBitdefender Labs [1]
explorer[.]vgDomainListed by researchersSearch only2026-05-19HuntingBitdefender Labs [1]
hosting-control[.]ccDomainMalware downloadSearch only2026-05-19HuntingBitdefender Labs [1]
microservice[.]glDomainListed by researchersSearch only2026-05-19HuntingBitdefender Labs [1]
py-installer[.]ccDomainMalware downloadSearch only2026-05-19HuntingBitdefender Labs [1]
system[.]net[.]webclientDomainMalware downloadSearch only2026-05-19HuntingBitdefender Labs [1]
api[.]ipify[.]orgDomainCommand and controlSearch only2026-05-15HuntingGroup-IB, Proofpoint Threat Insight, Sekoia +1 [1] [2] [3] [4] [5]
attach[.]docucloud[.]o-r[.]krDomainCommand and controlSearch only2026-05-14HuntingSecurelist [1]
cms[.]spaceyou[.]o-r[.]krDomainCommand and controlSearch only2026-05-14HuntingSecurelist [1]
erp[.]spaceme[.]p-e[.]krDomainCommand and controlSearch only2026-05-14HuntingSecurelist [1]
female-disorder-beta-metropolitan[.]trycloudflare[.]comDomainCommand and controlSearch only2026-05-14HuntingSecurelist [1]
file[.]bigcloud[.]n-e[.]krDomainCommand and controlSearch only2026-05-14HuntingSecurelist [1]
load[.]auraria[.]orgDomainCommand and controlSearch only2026-05-14HuntingSecurelist [1]
load[.]erasecloud[.]n-e[.]krDomainCommand and controlSearch only2026-05-14HuntingSecurelist [1]
load[.]ssangyongcne[.]o-r[.]krDomainCommand and controlSearch only2026-05-14HuntingSecurelist [1]
load[.]supershop[.]o-r[.]krDomainCommand and controlSearch only2026-05-14HuntingSecurelist [1]
load[.]yju[.]o-r[.]krDomainCommand and controlSearch only2026-05-14HuntingSecurelist [1]
morames[.]r-e[.]krDomainCommand and controlSearch only2026-05-14HuntingSecurelist [1]
newjo-imd[.]comDomainCommand and controlSearch only2026-05-14HuntingSecurelist [1]
opedromos1[.]r-e[.]krDomainCommand and controlSearch only2026-05-14HuntingSecurelist [1]
vscode[.]devDomainMalware downloadSearch only2026-05-14HuntingSecurelist [1]
www[.]pyrotech[.]co[.]krDomainCommand and controlSearch only2026-05-14HuntingSecurelist [1]
hxxp://female-disorder-beta-metropolitan[.]trycloudflare[.]com/index[.]phpURLCommand and controlSearch only2026-05-14HuntingSecurelist [1]
hxxp://newjo-imd[.]com/common/include/library/default[.]phpURLCommand and controlSearch only2026-05-14HuntingSecurelist [1]
hxxps://file[.]bigcloud[.]n-e[.]kr/index[.]phpURLCommand and controlSearch only2026-05-14HuntingSecurelist [1]
hxxps://github[.]com/login/deviceURLMalware downloadSearch only2026-05-14HuntingSecurelist [1]
hxxps://vscode[.]dev/tunnelURLMalware downloadSearch only2026-05-14HuntingSecurelist [1]
hxxps://vscode[.]download[.]prss[.]microsoft[.]com/dbazure/download/stable/1e3c50d64110be466c0b4a45222e81d2c9352888/vscode_cli_win32_x64_cli[.]zipURLMalware downloadSearch only2026-05-14HuntingSecurelist [1]
hxxps://vscode[.]download[.]prss[.]microsoft[.]com/dbazure/download/stable/bf9252a2fb45be6893dd8870c0bf37e2e1766d61/vscode_cli_win32_x64_cli[.]zipURLMalware downloadSearch only2026-05-14HuntingSecurelist [1]
hxxps://www[.]pyrotech[.]co[.]kr/common/include/tech/default[.]phpURLCommand and controlSearch only2026-05-14HuntingSecurelist [1]
applemaps-support[.]liveDomainMalware downloadSearch only2026-05-14HuntingInfoblox Threat Intel [1]
find-your-phone[.]helpDomainPhishingSearch only2026-05-14HuntingInfoblox Threat Intel [1]
viewlocation[.]appDomainPhishingSearch only2026-05-14HuntingInfoblox Threat Intel [1]
book-happy[.]needbinding[.]icuDomainMalware downloadSearch only2026-05-14HuntingESET WeLiveSecurity [1]
nama-belakang[.]nebao[.]icuDomainCommand and controlSearch only2026-05-14HuntingESET WeLiveSecurity [1]
hxxps://book-happy[.]needbinding[.]icu/wp-content/uploads/2023/10/1GreenAM[.]jpgURLMalware downloadSearch only2026-05-14HuntingESET WeLiveSecurity [1]
hxxps://nama-belakang[.]nebao[.]icu/statistics/discover[.]txtURLCommand and controlSearch only2026-05-14HuntingESET WeLiveSecurity [1]
1rpc[.]ioDomainCommand and controlSearch only2026-05-11HuntingMicrosoft Threat Intelligence, The DFIR Report [1] [2]
anythinghere[.]woremix[.]icuDomainListed by researchersSearch only2026-05-07HuntingHuntress [1]
lenwillfilenetwork[.]comDomainMalware downloadSearch only2026-05-07HuntingHuntress [1]
remote1a[.]peopleone[.]com[.]brDomainMalware downloadSearch only2026-05-07HuntingHuntress [1]
shankar[.]woremix[.]icuDomainListed by researchersSearch only2026-05-07HuntingHuntress [1]
84[.]54[.]33[.]192IP addressListed by researchersSearch only2026-05-07HuntingHuntress [1]
hxxp://84[.]54[.]33[.]192:8040/Bin/ScreenConnect[.]ClientSetup[.]msiURLListed by researchersSearch only2026-05-07HuntingHuntress [1]
hxxps://anythinghere[.]woremix[.]icu/Viewfiles/download[.]phpURLMalware downloadSearch only2026-05-07HuntingHuntress [1]
hxxps://lenwillfilenetwork[.]com/downloads/Network%20Solutions%20Agreement[.]msiURLMalware downloadSearch only2026-05-07HuntingHuntress [1]
whatsappcenter[.]comDomainCommand and controlSearch only2026-05-07HuntingSeqrite [1]
www[.]whatsappcenter[.]comDomainCommand and controlSearch only2026-05-07HuntingSeqrite [1]
159[.]198[.]41[.]140IP addressCommand and controlSearch only2026-05-07HuntingCyble, Securelist [1] [2]
hxxp://159[.]198[.]41[.]140/static/builder/lnk_uploads/invo[.]pdfURLMalware downloadSearch only2026-05-07HuntingCyble [1]
hxxps://github[.]com/leravalera2/dtfls/releases/download/dtfls/data[.]zipURLMalware downloadSearch only2026-05-07HuntingCyble [1]
hxxps://github[.]com/rustdesk/rustdesk/releases/download/1[.]4[.]4/rustdesk-1[.]4[.]4-x86_64[.]exeURLMalware downloadSearch only2026-05-07HuntingCyble [1]
136[.]0[.]8[.]48IP addressListed by researchersSearch only2026-05-07HuntingUnit 42 [1]
146[.]70[.]100[.]69IP addressCommand and controlSearch only2026-05-07HuntingUnit 42 [1]
149[.]104[.]66[.]84IP addressListed by researchersSearch only2026-05-07HuntingUnit 42 [1]
67[.]206[.]213[.]86IP addressListed by researchersSearch only2026-05-07HuntingUnit 42 [1]
hxxp://146[.]70[.]100[.]69:8000/php_sessURLMalware downloadSearch only2026-05-07HuntingUnit 42 [1]
hxxps://github[.]com/Acebond/ReverseSocks5/releases/download/v2[.]2[.]0/ReverseSocks5-v2[.]2[.]0-linux-amd64[.]tar[.]gzURLMalware downloadSearch only2026-05-07HuntingUnit 42 [1]
afonsoferragista[.]comDomainListed by researchersSearch only2026-05-07HuntingElastic Security Labs [1]
arquivos-omie[.]comDomainPhishingSearch only2026-05-07HuntingElastic Security Labs [1]
campanha1-api[.]ef971a42[.]workers[.]devDomainCommand and controlSearch only2026-05-07HuntingElastic Security Labs [1]
doccompartilhe[.]comDomainListed by researchersSearch only2026-05-07HuntingElastic Security Labs [1]
documentos-online[.]comDomainListed by researchersSearch only2026-05-07HuntingElastic Security Labs [1]
documents[.]ef971a42[.]workers[.]devDomainMalware downloadSearch only2026-05-07HuntingElastic Security Labs [1]
mxtestacionamentos[.]comDomainCommand and controlSearch only2026-05-07HuntingElastic Security Labs [1]
recebamais[.]comDomainListed by researchersSearch only2026-05-07HuntingElastic Security Labs [1]
saogeraldoshiping[.]comDomainCommand and controlSearch only2026-05-07HuntingElastic Security Labs [1]
191[.]96[.]224[.]96IP addressMalware downloadSearch only2026-05-07HuntingElastic Security Labs [1]
hxxps://campanha1-api[.]ef971a42[.]workers[.]dev/api/campaignURLCommand and controlSearch only2026-05-07HuntingElastic Security Labs [1]
hxxps://campanha1-api[.]ef971a42[.]workers[.]dev/api/installsURLCommand and controlSearch only2026-05-07HuntingElastic Security Labs [1]
hxxps://documents[.]ef971a42[.]workers[.]dev/fileURLMalware downloadSearch only2026-05-07HuntingElastic Security Labs [1]
cdn[.]kleymarket[.]ruDomainData theftSearch only2026-05-06HuntingSeqrite [1]
kleymarket[.]ruDomainCommand and controlSearch only2026-05-06HuntingSeqrite [1]
45[.]142[.]36[.]76IP addressListed by researchersSearch only2026-05-06HuntingSeqrite [1]
89[.]108[.]110[.]154IP addressListed by researchersSearch only2026-05-06HuntingSeqrite [1]
92[.]62[.]113[.]232IP addressListed by researchersSearch only2026-05-06HuntingSeqrite [1]
cloudcraftshub[.]comDomainListed by researchersSearch only2026-05-05HuntingZscaler ThreatLabz [1]
dropras[.]xyzDomainListed by researchersSearch only2026-05-05HuntingZscaler ThreatLabz [1]
trackpipe[.]devDomainListed by researchersSearch only2026-05-05HuntingZscaler ThreatLabz [1]
146[.]19[.]24[.]131IP addressListed by researchersSearch only2026-05-05HuntingZscaler ThreatLabz [1]
hxxps://cloudcraftshub[.]com/apiURLListed by researchersSearch only2026-05-05HuntingZscaler ThreatLabz [1]
hxxps://github[.]com/Crestdrasnip/Claude-ZeroclawURLListed by researchersSearch only2026-05-05HuntingZscaler ThreatLabz [1]
hxxps://github[.]com/FinPyromancerLog/xcode-clawURLListed by researchersSearch only2026-05-05HuntingZscaler ThreatLabz [1]
hxxps://github[.]com/Gentleatvice/seed-phrase-recover-BTC-ETHURLListed by researchersSearch only2026-05-05HuntingZscaler ThreatLabz [1]
hxxps://github[.]com/GoliathSocialBoiler/kalshi-claw-skillURLListed by researchersSearch only2026-05-05HuntingZscaler ThreatLabz [1]
hxxps://github[.]com/Heartflabrace/Doubao-ClawURLListed by researchersSearch only2026-05-05HuntingZscaler ThreatLabz [1]
hxxps://github[.]com/Rohit24567/HyperLiquid-ClawURLListed by researchersSearch only2026-05-05HuntingZscaler ThreatLabz [1]
hxxps://github[.]com/deborahikssv/Antigravity-clawURLListed by researchersSearch only2026-05-05HuntingZscaler ThreatLabz [1]
hxxps://github[.]com/helenigtxu/TradingView-ClawURLListed by researchersSearch only2026-05-05HuntingZscaler ThreatLabz [1]
hxxps://github[.]com/helenigtxu/blooketURLListed by researchersSearch only2026-05-05HuntingZscaler ThreatLabz [1]
hxxps://github[.]com/lunarraveneradicate/robinhood-auto-testnetURLListed by researchersSearch only2026-05-05HuntingZscaler ThreatLabz [1]
hxxps://github[.]com/michelleoincx/Bunkr-Downloader-PythonURLMalware downloadSearch only2026-05-05HuntingZscaler ThreatLabz [1]
hxxps://github[.]com/michelleoincx/genspark[.]ai-openclawURLListed by researchersSearch only2026-05-05HuntingZscaler ThreatLabz [1]
hxxps://github[.]com/sharonubsyq/trading-view-indicator-extensionURLListed by researchersSearch only2026-05-05HuntingZscaler ThreatLabz [1]
env-check[.]daemontools[.]ccDomainCommand and controlSearch only2026-05-05HuntingSecurelist [1]
38[.]180[.]107[.]76IP addressMalware downloadSearch only2026-05-05HuntingSecurelist [1]
hxxp://38[.]180[.]107[.]76/07fbb423143f99fe07URLMalware downloadSearch only2026-05-05HuntingSecurelist [1]
hxxp://38[.]180[.]107[.]76/407fbb423143f99fe0URLMalware downloadSearch only2026-05-05HuntingSecurelist [1]
ipinfo[.]ioDomainCommand and controlSearch only2026-05-05HuntingANY.RUN, ESET WeLiveSecurity, Proofpoint Threat Insight [1] [2] [3]
xiazai[.]sqgame[.]com[.]cnDomainMalware downloadSearch only2026-05-05HuntingESET WeLiveSecurity [1]
hxxp://xiazai[.]sqgame[.]com[.]cn/dating/20240429[.]zipURLMalware downloadSearch only2026-05-05HuntingESET WeLiveSecurity [1]
hxxps://ipinfo[.]io/jsonURLCommand and controlSearch only2026-05-05HuntingESET WeLiveSecurity, Proofpoint Threat Insight [1] [2]
hxxps://www[.]sqgame[.]net/games/gamedownload[.]aspxURLMalware downloadSearch only2026-05-05HuntingESET WeLiveSecurity [1]
acceptable-use-policy-calendly[.]deDomainMalware downloadSearch only2026-05-04HuntingMicrosoft Threat Intelligence [1] [2]
cocinternal[.]comDomainMalware downloadSearch only2026-05-04HuntingMicrosoft Threat Intelligence [1] [2]
compliance-protectionoutlook[.]deDomainMalware downloadSearch only2026-05-04HuntingMicrosoft Threat Intelligence [1] [2]
gadellinet[.]comDomainMalware downloadSearch only2026-05-04HuntingMicrosoft Threat Intelligence [1] [2]
harteprn[.]comDomainMalware downloadSearch only2026-05-04HuntingMicrosoft Threat Intelligence [1] [2]
95bcc0a2bb0fff25a2770010406cd0964fd4b3033ed8bae181518f7c8b69d324SHA-256 hashCompromised siteSearch only2026-05-01HuntingCensys [1]
banana[.]summarizer[.]oneDomainListed by researchersSearch only2026-04-30HuntingUnit 42 [1]
browser[.]cashDomainListed by researchersSearch only2026-04-30HuntingUnit 42 [1]
chatgptforchrome[.]comDomainListed by researchersSearch only2026-04-30HuntingUnit 42 [1]
gosupersonic[.]emailDomainListed by researchersSearch only2026-04-30HuntingUnit 42 [1]
mcp-browser[.]qubecare[.]aiDomainListed by researchersSearch only2026-04-30HuntingUnit 42 [1]
notionapp[.]cnDomainListed by researchersSearch only2026-04-30HuntingUnit 42 [1]
pic-editor-chromeextension[.]unoDomainListed by researchersSearch only2026-04-30HuntingUnit 42 [1]
vomet[.]ruDomainListed by researchersSearch only2026-04-30HuntingUnit 42 [1]
xuix[.]topDomainCommand and controlSearch only2026-04-30HuntingUnit 42 [1]
yiban[.]ioDomainMalware downloadSearch only2026-04-30HuntingUnit 42 [1]
199[.]80[.]55[.]27IP addressListed by researchersSearch only2026-04-30HuntingUnit 42 [1]
hxxps://yiban[.]io/extension/proxy[.]pac?t=huiyiURLMalware downloadSearch only2026-04-30HuntingUnit 42 [1]
bouleversement[.]niovapahrm[.]comDomainPhishingSearch only2026-04-30HuntingMicrosoft Threat Intelligence [1]
haematogenesis[.]hvishay[.]comDomainPhishingSearch only2026-04-30HuntingMicrosoft Threat Intelligence [1]
ubiquitarianism[.]drilto[.]comDomainPhishingSearch only2026-04-30HuntingMicrosoft Threat Intelligence [1]
ai-scan[.]digitalDomainListed by researchersSearch only2026-04-30HuntingHuntress, Red Canary [1] [2]
background-off[.]comDomainListed by researchersSearch only2026-04-30HuntingHuntress [1]
background-ready[.]onlineDomainListed by researchersSearch only2026-04-30HuntingHuntress [1]
backgroundformat[.]onlineDomainListed by researchersSearch only2026-04-30HuntingHuntress [1]
bg-go[.]onlineDomainListed by researchersSearch only2026-04-30HuntingHuntress [1]
bg-ready[.]onlineDomainListed by researchersSearch only2026-04-30HuntingHuntress [1]
bg-removerok[.]onlineDomainListed by researchersSearch only2026-04-30HuntingHuntress [1]
bg-transparency[.]onlineDomainListed by researchersSearch only2026-04-30HuntingHuntress, Red Canary [1] [2]
brionter[.]comDomainListed by researchersSearch only2026-04-30HuntingHuntress [1]
giovettiadv[.]comDomainListed by researchersSearch only2026-04-30HuntingHuntress [1]
obelnamevalf[.]orgDomainCommand and controlSearch only2026-04-30HuntingHuntress [1]
poronto[.]comDomainListed by researchersSearch only2026-04-30HuntingHuntress [1]
trindastal[.]comDomainMalware downloadSearch only2026-04-30HuntingHuntress [1]
38[.]146[.]28[.]30IP addressCommand and controlSearch only2026-04-30HuntingHuntress [1]
hxxps://brionter[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/net40[.]binURLListed by researchersSearch only2026-04-30HuntingHuntress [1]
hxxps://obelnamevalf[.]org/OaTS7yE9zd/defaultURLListed by researchersSearch only2026-04-30HuntingHuntress [1]
hxxps://trindastal[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/loc8URLMalware downloadSearch only2026-04-30HuntingHuntress [1]
hxxps://trindastal[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/v8URLMalware downloadSearch only2026-04-30HuntingHuntress [1]
hxxps://trindastal[.]com/8250d149-9bf8-566d-9d7d-ea925eae0a4URLCommand and controlSearch only2026-04-30HuntingHuntress [1]
hxxps://trindastal[.]com/8250d149-9bf8-566d-9d7d-ea925eae0a4c/URLListed by researchersSearch only2026-04-30HuntingHuntress [1]
vmheaven[.]ioDomainAttacker addressSearch only2026-04-30HuntingHuntress [1]
45[.]153[.]34[.]132IP addressListed by researchersSearch only2026-04-30HuntingHuntress [1]
hxxps://raw[.]githubusercontent[.]com/komari-monitor/komari-agent/refs/heads/main/install[.]ps1URLListed by researchersSearch only2026-04-30HuntingHuntress [1]
71bd06e73ad26ccf19cbc59c02630f14MD5 hashMalware fileSearch only2026-04-29HuntingBitdefender Labs [1]
nia[.]gov[.]in[.]in3ymonaq[.]casaDomainListed by researchersSearch only2026-04-24HuntingCyble [1]