{ "metadata": { "name": "NSS Daily Ledger", "site": "nsshq.com", "edition": "rolling 7-day edition", "disclaimer": "Not enriched or vetted by NSS. Filtered to indicators reported in a malicious role in public security reporting, with a known-good list removed. No further vetting. Check before blocking.", "basis": "Drawn from public security reporting as published. Not individually verified. May include false positives.", "terms": "free to use and redistribute with attribution to NSS Daily Ledger (nsshq.com)", "corrections": "corrections@nsshq.com", "window_start": "2026-11-08T00:00:00Z", "window_end": "2026-11-15T00:00:00Z", "window_days": 7, "generated_at": "2026-11-15T00:20:07Z", "count": 371, "count_by_type": { "btc": 1, "domain": 117, "email": 7, "ipv4": 106, "md5": 17, "sha1": 3, "sha256": 82, "url": 38 }, "selection": "Every indicator that a public security report processed by NSS in the window presents as hostile, one row per indicator. No verdict is given.", "fields": [ "type", "value", "first_seen", "source_count", "reference" ] }, "rows": [ { "type": "btc", "value": "1fd9ccecac8794f39d826fdd8a62e6bc", "first_seen": "2026-11-12T19:05:11Z", "source_count": 1, "reference": "Never be afraid to ask questions" }, { "type": "domain", "value": "1x0.is", "first_seen": "2026-10-28T01:24:35Z", "source_count": 1, "reference": "Notorious Brazilian Magecart group hijacks Convertr checkouts via Plausible analytics" }, { "type": "domain", "value": "4x.dmca-strike.com", "first_seen": "2026-05-17T01:26:47Z", "source_count": 1, "reference": "How We Disrupted a 110-Domain Fake Copyright-Strike Phishing Estate" }, { "type": "domain", "value": "a.ci-xxxxxx.sh", "first_seen": "2026-11-12T02:49:08Z", "source_count": 2, "reference": "headline not shown" }, { "type": "domain", "value": "abc123.ngrok-free.app", "first_seen": "2026-11-11T03:52:40Z", "source_count": 1, "reference": "headline not shown" }, { "type": "domain", "value": "ace.nche.edu", "first_seen": "2026-11-12T12:10:55Z", "source_count": 1, "reference": "Incransom has just published a new victim : American Council of Education" }, { "type": "domain", "value": "advanced-reserv882689.com", "first_seen": "2026-11-06T16:25:53Z", "source_count": 1, "reference": "The Industry Leader in Enterprise Brand Protection" }, { "type": "domain", "value": "amasonses.com", "first_seen": "2026-11-05T23:13:18Z", "source_count": 1, "reference": "IP snowshoeing under US .gov email via a whitelisted AmazonSES typo in SPF" }, { "type": "domain", "value": "amazones.com", "first_seen": "2026-11-09T18:01:32Z", "source_count": 1, "reference": "IP snowshoeing under US .gov email via a whitelisted AmazonSES typo in SPF" }, { "type": "domain", "value": "america250.org", "first_seen": "2026-11-04T07:48:29Z", "source_count": 1, "reference": "Hackers exploited iOS and Android flaws to infect phones" }, { "type": "domain", "value": "amexsafekeyupdate.com", "first_seen": "2026-11-12T00:37:51Z", "source_count": 1, "reference": "Active ScreenConnect attacks breach MSPs, impact dozens of organizations" }, { "type": "domain", "value": "anadnet.com", "first_seen": "2026-11-14T07:00:48Z", "source_count": 3, "reference": "CVE-2026-126697 Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel" }, { "type": "domain", "value": "analytics.convertr.app.br", "first_seen": "2026-11-09T02:05:14Z", "source_count": 1, "reference": "Notorious Brazilian Magecart group hijacks Convertr checkouts via Plausible analytics" }, { "type": "domain", "value": "analytics.insightjs.com", "first_seen": "2026-11-04T10:36:59Z", "source_count": 1, "reference": "Attackers turn NIKKE's game launcher into malware" }, { "type": "domain", "value": "apartments-review8509831.sbs", "first_seen": "2026-11-12T23:49:15Z", "source_count": 1, "reference": "Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters" }, { "type": "domain", "value": "api.cloudvflare.com", "first_seen": "2026-11-13T09:41:16Z", "source_count": 1, "reference": "Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes" }, { "type": "domain", "value": "asgomd.com", "first_seen": "2026-04-25T12:03:32Z", "source_count": 1, "reference": "Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters" }, { "type": "domain", "value": "asgrsv.com", "first_seen": "2026-04-25T12:03:32Z", "source_count": 1, "reference": "Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters" }, { "type": "domain", "value": "avcheck.net", "first_seen": "2023-10-05T10:21:55Z", "source_count": 1, "reference": "DOJ: Gootloader used in at least 44 ransomware attacks costing $29 million since 2018" }, { "type": "domain", "value": "backdoor.androidos.triada.ae", "first_seen": "2026-10-18T23:13:05Z", "source_count": 1, "reference": "IT threat evolution in Q3 2026. Mobile statistics" }, { "type": "domain", "value": "backdoor.androidos.triada.ag", "first_seen": "2026-10-18T23:13:05Z", "source_count": 1, "reference": "IT threat evolution in Q3 2026. Mobile statistics" }, { "type": "domain", "value": "backdoorphp8.1.0-dev.py", "first_seen": "2026-11-14T09:41:24Z", "source_count": 1, "reference": "php-8.1.0-dev-backdoor-rce" }, { "type": "domain", "value": "bandgdruback1.workers.dev", "first_seen": "2026-11-12T17:54:25Z", "source_count": 1, "reference": "The Hidden Relay: Inside a Device Code Phishing Kit That Never Shows the Code" }, { "type": "domain", "value": "bonto.io", "first_seen": "2026-10-28T15:01:48Z", "source_count": 1, "reference": "Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets" }, { "type": "domain", "value": "c30d9e770432bc4-id-gate.bandgdruback1.workers.dev", "first_seen": "2026-11-12T17:54:25Z", "source_count": 1, "reference": "The Hidden Relay: Inside a Device Code Phishing Kit That Never Shows the Code" }, { "type": "domain", "value": "cashewminaret.org", "first_seen": "2026-11-13T02:12:23Z", "source_count": 1, "reference": "2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT" }, { "type": "domain", "value": "cctv-update.top", "first_seen": "2026-11-13T14:41:28Z", "source_count": 1, "reference": "Hackers exploit exposed GeoVision CCTV software to disable Defender and deploy cryptominers" }, { "type": "domain", "value": "cdn.gsocket.io", "first_seen": "2026-11-11T22:16:49Z", "source_count": 1, "reference": "The global socket: how threat actors are weaponizing GSocket for stealthy C2" }, { "type": "domain", "value": "cdn007-digitaldownloads.com", "first_seen": "2026-11-12T00:37:51Z", "source_count": 3, "reference": "Active ScreenConnect attacks breach MSPs, impact dozens of organizations" }, { "type": "domain", "value": "chanret.com", "first_seen": "2026-10-29T13:57:36Z", "source_count": 1, "reference": "Investigating Abuse of Remote Desktop and Bulk Mailing Apps" }, { "type": "domain", "value": "chatlgpt.com", "first_seen": "2026-10-27T21:35:39Z", "source_count": 1, "reference": "headline not shown" }, { "type": "domain", "value": "cirroreplyurldemo.azurewebsites.net", "first_seen": "2026-11-13T02:21:05Z", "source_count": 1, "reference": "Inside Cirro: Enumeration as a Restricted Guest" }, { "type": "domain", "value": "cloude.ai", "first_seen": "2026-11-12T16:49:40Z", "source_count": 1, "reference": "headline not shown" }, { "type": "domain", "value": "clsude.ai", "first_seen": "2026-11-12T16:49:40Z", "source_count": 1, "reference": "headline not shown" }, { "type": "domain", "value": "cluade.ai", "first_seen": "2026-11-12T16:49:40Z", "source_count": 1, "reference": "headline not shown" }, { "type": "domain", "value": "confirmation-advanced-reserv203684.com", "first_seen": "2026-11-06T16:25:53Z", "source_count": 1, "reference": "The Industry Leader in Enterprise Brand Protection" }, { "type": "domain", "value": "copiot.com", "first_seen": "2026-11-12T16:49:40Z", "source_count": 1, "reference": "headline not shown" }, { "type": "domain", "value": "creepexplosiondarknight.com", "first_seen": "2026-11-10T10:41:20Z", "source_count": 1, "reference": "Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor" }, { "type": "domain", "value": "cryptor.biz", "first_seen": "2023-06-22T13:26:33Z", "source_count": 1, "reference": "DOJ: Gootloader used in at least 44 ransomware attacks costing $29 million since 2018" }, { "type": "domain", "value": "cryptor.live", "first_seen": "2026-11-13T17:06:53Z", "source_count": 1, "reference": "DOJ: Gootloader used in at least 44 ransomware attacks costing $29 million since 2018" }, { "type": "domain", "value": "cyberrexdesign.screenconnect.com", "first_seen": "2026-11-12T00:37:51Z", "source_count": 1, "reference": "Active ScreenConnect attacks breach MSPs, impact dozens of organizations" }, { "type": "domain", "value": "deepceek.com", "first_seen": "2026-11-12T16:49:40Z", "source_count": 1, "reference": "headline not shown" }, { "type": "domain", "value": "deepveindrilling.com", "first_seen": "2026-10-25T11:10:46Z", "source_count": 1, "reference": "deepveindrilling.com: Magento CMS block loader hits 953 stores" }, { "type": "domain", "value": "dvrlists.com", "first_seen": "2026-11-09T03:34:46Z", "source_count": 1, "reference": "Remcos RAT" }, { "type": "domain", "value": "ecoflowofficial.shop", "first_seen": "2026-11-12T17:48:48Z", "source_count": 1, "reference": "headline not shown" }, { "type": "domain", "value": "elevenlebs.io", "first_seen": "2026-11-12T16:49:40Z", "source_count": 1, "reference": "headline not shown" }, { "type": "domain", "value": "finaltests99.dssldrf.net", "first_seen": "2026-11-08T11:49:00Z", "source_count": 1, "reference": "MAL-2026-18758 Malicious code in blender-headless (PyPI)" }, { "type": "domain", "value": "find.flashysearches.com", "first_seen": "2026-11-12T16:49:40Z", "source_count": 1, "reference": "headline not shown" }, { "type": "domain", "value": "foreverpeace.ru", "first_seen": "2026-11-11T11:04:26Z", "source_count": 1, "reference": "Off the Rails: Inside an Exposed Silent Lynx Server" }, { "type": "domain", "value": "gardenstokyjp.com", "first_seen": "2026-09-28T04:13:50Z", "source_count": 1, "reference": "The Industry Leader in Enterprise Brand Protection" }, { "type": "domain", "value": "geimini.com", "first_seen": "2026-11-12T16:49:40Z", "source_count": 1, "reference": "headline not shown" }, { "type": "domain", "value": "goldeshoms.com", "first_seen": "2026-11-06T16:25:53Z", "source_count": 1, "reference": "The Industry Leader in Enterprise Brand Protection" }, { "type": "domain", "value": "griok.com", "first_seen": "2026-11-12T16:49:40Z", "source_count": 1, "reference": "headline not shown" }, { "type": "domain", "value": "gsgg.b-cdn.net", "first_seen": "2026-11-11T22:16:05Z", "source_count": 1, "reference": "The global socket: how threat actors are weaponizing GSocket for stealthy C2" }, { "type": "domain", "value": "gsocket.io", "first_seen": "2025-04-08T05:01:03Z", "source_count": 1, "reference": "The global socket: how threat actors are weaponizing GSocket for stealthy C2" }, { "type": "domain", "value": "guestnooks-homeset.com", "first_seen": "2026-11-06T16:25:53Z", "source_count": 1, "reference": "The Industry Leader in Enterprise Brand Protection" }, { "type": "domain", "value": "gurades-homs.com", "first_seen": "2026-11-06T16:25:53Z", "source_count": 1, "reference": "The Industry Leader in Enterprise Brand Protection" }, { "type": "domain", "value": "gustrwes-inforcheck.com", "first_seen": "2026-11-06T16:25:53Z", "source_count": 1, "reference": "The Industry Leader in Enterprise Brand Protection" }, { "type": "domain", "value": "halst21nfc.cc", "first_seen": "2026-11-10T21:00:35Z", "source_count": 1, "reference": "CVE-2026-95400" }, { "type": "domain", "value": "homeresbooks.com", "first_seen": "2026-11-06T16:25:53Z", "source_count": 1, "reference": "The Industry Leader in Enterprise Brand Protection" }, { "type": "domain", "value": "homesdowttups.com", "first_seen": "2026-09-26T04:26:05Z", "source_count": 1, "reference": "The Industry Leader in Enterprise Brand Protection" }, { "type": "domain", "value": "hosting2.ro.hostsailor.com", "first_seen": "2025-11-05T17:02:05Z", "source_count": 1, "reference": "Beware of phishing emails disguised as quote requests (SnakeKeylogger)" }, { "type": "domain", "value": "hotelchecckrsrv-krwo.world", "first_seen": "2026-10-30T19:42:24Z", "source_count": 1, "reference": "The Industry Leader in Enterprise Brand Protection" }, { "type": "domain", "value": "hyperpwn.xyz", "first_seen": "2026-11-10T08:32:57Z", "source_count": 1, "reference": "Re: Rooting ISPs and Hosting Providers with Hyperglass" }, { "type": "domain", "value": "insightjs.com", "first_seen": "2026-11-04T10:36:59Z", "source_count": 2, "reference": "Summary of Malicious Program Distribution via Goddess of Victory: NIKKE PC Launcher" }, { "type": "domain", "value": "justsendtext.xyz", "first_seen": "2026-11-12T14:38:55Z", "source_count": 1, "reference": "Luna Moth Returns, Re-Targeting Law Firms Through Access Tokens" }, { "type": "domain", "value": "keylogger.nullsect0r.tech", "first_seen": "2026-11-12T23:51:45Z", "source_count": 1, "reference": "MAL-2026-19200 Malicious code in basek (crates.io)" }, { "type": "domain", "value": "lbl.support", "first_seen": "2022-01-12T13:25:04Z", "source_count": 1, "reference": "Remcos RAT" }, { "type": "domain", "value": "midj0urney.org", "first_seen": "2026-11-12T16:49:40Z", "source_count": 1, "reference": "headline not shown" }, { "type": "domain", "value": "milivcounty.gov", "first_seen": "2026-11-09T18:01:32Z", "source_count": 1, "reference": "IP snowshoeing under US .gov email via a whitelisted AmazonSES typo in SPF" }, { "type": "domain", "value": "millimed-office.synology.me", "first_seen": "2026-11-12T12:13:43Z", "source_count": 1, "reference": "Incransom has just published a new victim : Millimed Thailand (i-HERB)" }, { "type": "domain", "value": "mykolapalinchak.medianewsonline.com", "first_seen": "2026-10-13T13:53:57Z", "source_count": 1, "reference": "422. Kimsuky Uses AwardSpace Domains for C2 Infrastructure" }, { "type": "domain", "value": "n0n.to", "first_seen": "2026-09-21T10:38:04Z", "source_count": 1, "reference": "Dark Web Profile: n0n Ransomware" }, { "type": "domain", "value": "neoca-office.synology.me", "first_seen": "2026-11-12T12:13:43Z", "source_count": 1, "reference": "Incransom has just published a new victim : Millimed Thailand (i-HERB)" }, { "type": "domain", "value": "newnewnew.gotdns.org", "first_seen": "2026-11-12T00:37:51Z", "source_count": 3, "reference": "Active ScreenConnect attacks breach MSPs, impact dozens of organizations" }, { "type": "domain", "value": "notebookklm.com", "first_seen": "2026-11-12T16:49:40Z", "source_count": 1, "reference": "headline not shown" }, { "type": "domain", "value": "ns.mo7sen.dev", "first_seen": "2026-11-12T00:15:26Z", "source_count": 4, "reference": "Active ScreenConnect attacks breach MSPs, impact dozens of organizations" }, { "type": "domain", "value": "orchardandbarite.com", "first_seen": "2026-11-13T02:12:23Z", "source_count": 1, "reference": "2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT" }, { "type": "domain", "value": "orustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion", "first_seen": "2026-11-10T18:36:59Z", "source_count": 1, "reference": "Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers" }, { "type": "domain", "value": "pokijhgcfsdfghnj.mywebcommunity.org", "first_seen": "2025-05-13T16:27:43Z", "source_count": 1, "reference": "422. Kimsuky Uses AwardSpace Domains for C2 Infrastructure" }, { "type": "domain", "value": "polwanlo.vip", "first_seen": "2026-11-12T17:54:25Z", "source_count": 1, "reference": "The Hidden Relay: Inside a Device Code Phishing Kit That Never Shows the Code" }, { "type": "domain", "value": "polyfill.io", "first_seen": "2025-11-05T16:58:42Z", "source_count": 1, "reference": "nDiligence Releases Four-Year Study Identifying a Critical Supply-Chain Vulnerability Across 50 Platform Types" }, { "type": "domain", "value": "preplexity.ai", "first_seen": "2026-11-12T16:49:40Z", "source_count": 1, "reference": "headline not shown" }, { "type": "domain", "value": "proof.ovh.net", "first_seen": "2026-11-10T14:56:05Z", "source_count": 1, "reference": "Results of incident investigation and compromise assessment projects" }, { "type": "domain", "value": "quill-kraee-um2gf.pro", "first_seen": "2026-11-12T21:44:29Z", "source_count": 1, "reference": "Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)" }, { "type": "domain", "value": "qweasdzxc.mygamesonline.org", "first_seen": "2026-10-13T13:53:57Z", "source_count": 1, "reference": "422. Kimsuky Uses AwardSpace Domains for C2 Infrastructure" }, { "type": "domain", "value": "reserv-advanced67746202.com", "first_seen": "2026-11-06T16:25:53Z", "source_count": 1, "reference": "The Industry Leader in Enterprise Brand Protection" }, { "type": "domain", "value": "sc.payproofkit.com", "first_seen": "2026-11-12T00:37:51Z", "source_count": 3, "reference": "Active ScreenConnect attacks breach MSPs, impact dozens of organizations" }, { "type": "domain", "value": "site.vietnam852.com", "first_seen": "2026-11-12T23:12:05Z", "source_count": 1, "reference": "Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners" }, { "type": "domain", "value": "socket.io", "first_seen": "2025-11-30T19:49:53Z", "source_count": 1, "reference": "PolinRider: Malicious Coding Assignments Steal Developer Secrets" }, { "type": "domain", "value": "solaric.com.ph", "first_seen": "2026-10-18T22:30:55Z", "source_count": 1, "reference": "Corium: A New ClickFix Panel Shows How Malware Delivery Is Becoming a Turnkey Business" }, { "type": "domain", "value": "soxnewwork.homedns.org", "first_seen": "2026-11-12T00:37:51Z", "source_count": 3, "reference": "Active ScreenConnect attacks breach MSPs, impact dozens of organizations" }, { "type": "domain", "value": "staysuites-homebay.com", "first_seen": "2026-11-06T16:25:53Z", "source_count": 1, "reference": "The Industry Leader in Enterprise Brand Protection" }, { "type": "domain", "value": "tac.vpnla.org", "first_seen": "2026-11-09T18:05:10Z", "source_count": 1, "reference": "Hackers exploit SSHole OpenSSH flaw to breach Linux systems" }, { "type": "domain", "value": "takayara-homs.com", "first_seen": "2026-11-06T16:25:53Z", "source_count": 1, "reference": "The Industry Leader in Enterprise Brand Protection" }, { "type": "domain", "value": "teams-cloud.live", "first_seen": "2026-10-20T11:12:43Z", "source_count": 1, "reference": "headline not shown" }, { "type": "domain", "value": "teams-livemeeting.com", "first_seen": "2026-11-12T07:47:53Z", "source_count": 1, "reference": "headline not shown" }, { "type": "domain", "value": "testa213022.dssldrf.net", "first_seen": "2026-11-08T11:49:00Z", "source_count": 2, "reference": "MAL-2026-18761 Malicious code in infra-libs (PyPI)" }, { "type": "domain", "value": "themicrosoft.com", "first_seen": "2026-11-12T17:54:25Z", "source_count": 1, "reference": "The Hidden Relay: Inside a Device Code Phishing Kit That Never Shows the Code" }, { "type": "domain", "value": "tiamen-rooms.com", "first_seen": "2026-11-06T16:25:53Z", "source_count": 1, "reference": "The Industry Leader in Enterprise Brand Protection" }, { "type": "domain", "value": "towntearse.com", "first_seen": "2026-11-06T16:25:53Z", "source_count": 1, "reference": "The Industry Leader in Enterprise Brand Protection" }, { "type": "domain", "value": "trojan-banker.androidos.agent.io", "first_seen": "2026-10-20T08:09:44Z", "source_count": 1, "reference": "IT threat evolution in Q3 2026. Mobile statistics" }, { "type": "domain", "value": "trojan-banker.androidos.agent.ws", "first_seen": "2026-10-18T23:13:05Z", "source_count": 1, "reference": "IT threat evolution in Q3 2026. Mobile statistics" }, { "type": "domain", "value": "trojan-dropper.androidos.mamont.am", "first_seen": "2026-11-10T08:09:55Z", "source_count": 1, "reference": "IT threat evolution in Q3 2026. Mobile statistics" }, { "type": "domain", "value": "trojan.androidos.fakeapp.in", "first_seen": "2026-11-10T08:08:44Z", "source_count": 1, "reference": "IT threat evolution in Q3 2026. Mobile statistics" }, { "type": "domain", "value": "trojan.androidos.subscriber.bh", "first_seen": "2026-11-10T08:09:55Z", "source_count": 1, "reference": "IT threat evolution in Q3 2026. Mobile statistics" }, { "type": "domain", "value": "update.pentagi.com", "first_seen": "2026-11-13T17:04:59Z", "source_count": 1, "reference": "headline not shown" }, { "type": "domain", "value": "ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion", "first_seen": "2026-11-10T20:55:22Z", "source_count": 2, "reference": "Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access" }, { "type": "domain", "value": "w.anadnet.com", "first_seen": "2026-11-14T07:00:48Z", "source_count": 3, "reference": "CVE-2026-126697 Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel" }, { "type": "domain", "value": "wersdfxcv.mygamesonline.org", "first_seen": "2026-10-13T13:53:57Z", "source_count": 1, "reference": "422. Kimsuky Uses AwardSpace Domains for C2 Infrastructure" }, { "type": "domain", "value": "www.cryptic-heaven.net", "first_seen": "2026-11-14T09:29:27Z", "source_count": 1, "reference": "How I received a job offer, and they hid a way to launch malicious code through Git inside the ZIP" }, { "type": "domain", "value": "www.dumbsplash.com", "first_seen": "2026-11-13T05:04:34Z", "source_count": 1, "reference": "Beware of phishing emails disguised as purchase order confirmation requests (Xloader)" }, { "type": "domain", "value": "www.hlushkova.top", "first_seen": "2026-11-10T13:54:39Z", "source_count": 1, "reference": "Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures" }, { "type": "domain", "value": "www.stanbicfinanceug.com", "first_seen": "2026-11-10T13:54:39Z", "source_count": 1, "reference": "Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures" }, { "type": "domain", "value": "xcai.pro", "first_seen": "2026-10-09T08:13:36Z", "source_count": 1, "reference": "ARTEX Exposed: Infrastructure Behind the South Korea Bank Hack" }, { "type": "domain", "value": "ye.dmca-desk.com", "first_seen": "2026-05-17T01:26:48Z", "source_count": 1, "reference": "How We Disrupted a 110-Domain Fake Copyright-Strike Phishing Estate" }, { "type": "domain", "value": "ysoserial.net", "first_seen": "2022-03-09T12:14:32Z", "source_count": 1, "reference": "CVE-2026-63079" }, { "type": "domain", "value": "zonastoski.com", "first_seen": "2026-11-12T23:53:49Z", "source_count": 1, "reference": "How Attackers Hide ScreenConnect in Windows Installers" }, { "type": "email", "value": "admin@root.com", "first_seen": "2026-11-10T00:57:42Z", "source_count": 1, "reference": "CVE-2026-125384" }, { "type": "email", "value": "log@aewn.buzz", "first_seen": "2026-11-12T07:50:11Z", "source_count": 1, "reference": "Beware of phishing emails disguised as quote requests (SnakeKeylogger)" }, { "type": "email", "value": "logs@aewn.buzz", "first_seen": "2026-11-12T07:50:11Z", "source_count": 1, "reference": "Beware of phishing emails disguised as quote requests (SnakeKeylogger)" }, { "type": "email", "value": "mhsu@mincomining.ca", "first_seen": "2026-11-12T12:16:13Z", "source_count": 1, "reference": "Incransom has just published a new victim : Ken Cai EMPIRE (Minco Silver, HempNova and other)" }, { "type": "email", "value": "mmnew@millimed.world", "first_seen": "2026-11-12T12:13:43Z", "source_count": 1, "reference": "Incransom has just published a new victim : Millimed Thailand (i-HERB)" }, { "type": "email", "value": "notice@n0n-cases.net", "first_seen": "2026-11-12T12:22:43Z", "source_count": 1, "reference": "Dark Web Profile: n0n Ransomware" }, { "type": "email", "value": "whitearmorxd@onionmail.org", "first_seen": "2026-11-08T04:24:58Z", "source_count": 1, "reference": "Whitearmor has just published a new victim : Clinica La Sagrada Familia (Colombia)" }, { "type": "ipv4", "value": "1.14.104.208", "first_seen": "2026-08-20T05:41:15Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "103.101.85.19", "first_seen": "2026-11-10T21:05:27Z", "source_count": 1, "reference": "How We Disrupted a 110-Domain Fake Copyright-Strike Phishing Estate" }, { "type": "ipv4", "value": "103.142.140.158", "first_seen": "2026-11-13T21:45:17Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "103.179.142.155", "first_seen": "2026-10-17T17:07:40Z", "source_count": 1, "reference": "PolinRider: Malicious Coding Assignments Steal Developer Secrets" }, { "type": "ipv4", "value": "104.28.219.97", "first_seen": "2026-09-05T03:49:13Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "104.28.225.223", "first_seen": "2026-10-11T03:38:14Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "104.28.251.98", "first_seen": "2026-08-26T08:53:52Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "104.28.251.99", "first_seen": "2026-09-27T04:08:28Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "104.37.184.195", "first_seen": "2026-11-12T14:38:55Z", "source_count": 1, "reference": "Luna Moth Returns, Re-Targeting Law Firms Through Access Tokens" }, { "type": "ipv4", "value": "109.94.173.13", "first_seen": "2026-11-05T10:46:35Z", "source_count": 1, "reference": "Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)" }, { "type": "ipv4", "value": "112.162.23.132", "first_seen": "2026-11-08T16:35:15Z", "source_count": 1, "reference": "Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)" }, { "type": "ipv4", "value": "121.163.224.97", "first_seen": "2026-11-03T19:10:00Z", "source_count": 1, "reference": "Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)" }, { "type": "ipv4", "value": "121.190.39.238", "first_seen": "2026-10-23T08:05:36Z", "source_count": 1, "reference": "Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)" }, { "type": "ipv4", "value": "125.103.213.41", "first_seen": "2026-11-13T21:45:17Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "128.242.115.131", "first_seen": "2026-11-13T21:45:17Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "130.94.19.168", "first_seen": "2026-11-12T14:13:06Z", "source_count": 1, "reference": "PHP2Shell Exploitation on Check Point Gateway" }, { "type": "ipv4", "value": "130.94.19.204", "first_seen": "2026-11-12T14:13:06Z", "source_count": 2, "reference": "PHP2Shell Exploitation on Check Point Gateway" }, { "type": "ipv4", "value": "134.209.82.225", "first_seen": "2026-10-30T07:59:26Z", "source_count": 2, "reference": "headline not shown" }, { "type": "ipv4", "value": "136.0.141.71", "first_seen": "2026-11-05T12:42:56Z", "source_count": 1, "reference": "CWPdoor: The Invisible Backdoor Living Inside Control Web Panel" }, { "type": "ipv4", "value": "139.99.69.109", "first_seen": "2026-11-13T12:24:28Z", "source_count": 1, "reference": "4EverAble2Shell At a Glance" }, { "type": "ipv4", "value": "144.91.73.103", "first_seen": "2026-11-11T04:17:47Z", "source_count": 1, "reference": "Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th)" }, { "type": "ipv4", "value": "150.136.38.110", "first_seen": "2026-11-13T21:45:17Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "152.233.50.185", "first_seen": "2026-11-06T12:11:28Z", "source_count": 1, "reference": "Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)" }, { "type": "ipv4", "value": "153.75.82.159", "first_seen": "2026-11-12T07:39:16Z", "source_count": 2, "reference": "headline not shown" }, { "type": "ipv4", "value": "154.44.31.4", "first_seen": "2026-11-12T15:20:28Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "154.80.128.173", "first_seen": "2026-10-31T03:18:39Z", "source_count": 1, "reference": "Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)" }, { "type": "ipv4", "value": "155.94.150.39", "first_seen": "2026-11-12T00:37:51Z", "source_count": 2, "reference": "Active ScreenConnect attacks breach MSPs, impact dozens of organizations" }, { "type": "ipv4", "value": "156.238.252.37", "first_seen": "2026-10-31T19:32:25Z", "source_count": 1, "reference": "Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)" }, { "type": "ipv4", "value": "157.20.241.16", "first_seen": "2026-11-12T14:30:32Z", "source_count": 4, "reference": "New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access" }, { "type": "ipv4", "value": "157.22.126.128", "first_seen": "2026-11-06T00:51:45Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "160.119.69.4", "first_seen": "2026-04-07T10:55:06Z", "source_count": 1, "reference": "From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign" }, { "type": "ipv4", "value": "171.22.131.24", "first_seen": "2026-11-13T04:50:03Z", "source_count": 1, "reference": "Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)" }, { "type": "ipv4", "value": "172.86.127.14", "first_seen": "2026-11-11T06:11:07Z", "source_count": 1, "reference": "Analysis of Wpcdoor Attack Case Distributed Through Domestic DVR Management Software" }, { "type": "ipv4", "value": "172.86.127.89", "first_seen": "2026-11-11T10:02:14Z", "source_count": 1, "reference": "Analysis of Wpcdoor Attack Case Distributed Through Domestic DVR Management Software" }, { "type": "ipv4", "value": "173.212.202.60", "first_seen": "2026-11-13T04:54:52Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "178.83.226.215", "first_seen": "2026-11-09T18:10:40Z", "source_count": 1, "reference": "The Cold Chain on Fire : Unpatched Danfoss controllers exploited" }, { "type": "ipv4", "value": "18.143.168.96", "first_seen": "2026-11-12T02:49:08Z", "source_count": 5, "reference": "headline not shown" }, { "type": "ipv4", "value": "183.99.38.238", "first_seen": "2026-10-23T07:57:27Z", "source_count": 1, "reference": "Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)" }, { "type": "ipv4", "value": "185.157.161.148", "first_seen": "2026-10-29T20:38:59Z", "source_count": 1, "reference": "Dark Web Profile: n0n Ransomware" }, { "type": "ipv4", "value": "185.2.148.137", "first_seen": "2026-11-04T22:52:22Z", "source_count": 1, "reference": "Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)" }, { "type": "ipv4", "value": "185.209.199.73", "first_seen": "2026-10-17T07:56:43Z", "source_count": 1, "reference": "Trusted by Default: Qubole Cross-Account Access Abused in the Wild" }, { "type": "ipv4", "value": "185.99.255.28", "first_seen": "2026-11-12T00:37:51Z", "source_count": 3, "reference": "Active ScreenConnect attacks breach MSPs, impact dozens of organizations" }, { "type": "ipv4", "value": "188.214.135.130", "first_seen": "2026-11-12T12:22:43Z", "source_count": 1, "reference": "Dark Web Profile: n0n Ransomware" }, { "type": "ipv4", "value": "188.240.57.94", "first_seen": "2026-05-11T04:37:07Z", "source_count": 1, "reference": "Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes" }, { "type": "ipv4", "value": "193.32.204.199", "first_seen": "2026-09-01T23:45:10Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "194.150.166.244", "first_seen": "2026-11-11T18:47:22Z", "source_count": 5, "reference": "headline not shown" }, { "type": "ipv4", "value": "195.178.110.78", "first_seen": "2026-10-17T07:57:45Z", "source_count": 1, "reference": "Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)" }, { "type": "ipv4", "value": "199.19.77.84", "first_seen": "2026-11-03T19:47:36Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "2.58.67.83", "first_seen": "2026-11-10T13:53:51Z", "source_count": 1, "reference": "Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures" }, { "type": "ipv4", "value": "20.207.192.84", "first_seen": "2026-11-13T04:54:52Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "210.86.171.29", "first_seen": "2026-11-12T12:10:55Z", "source_count": 1, "reference": "Incransom has just published a new victim : Millimed Thailand (i-HERB)" }, { "type": "ipv4", "value": "210.86.174.42", "first_seen": "2026-11-12T12:10:55Z", "source_count": 1, "reference": "Incransom has just published a new victim : Millimed Thailand (i-HERB)" }, { "type": "ipv4", "value": "212.107.28.51", "first_seen": "2026-11-13T21:45:17Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "212.193.31.189", "first_seen": "2026-10-18T21:42:33Z", "source_count": 1, "reference": "Dark Web Profile: CyberXero" }, { "type": "ipv4", "value": "213.86.169.133", "first_seen": "2026-11-05T21:27:27Z", "source_count": 1, "reference": "Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)" }, { "type": "ipv4", "value": "216.176.239.231", "first_seen": "2026-11-13T21:45:17Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "220.70.219.98", "first_seen": "2026-11-03T12:51:20Z", "source_count": 1, "reference": "Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)" }, { "type": "ipv4", "value": "220.77.237.35", "first_seen": "2026-11-04T06:24:18Z", "source_count": 1, "reference": "Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)" }, { "type": "ipv4", "value": "23.248.226.250", "first_seen": "2026-10-21T21:28:58Z", "source_count": 1, "reference": "ARTEX Exposed: Infrastructure Behind the South Korea Bank Hack" }, { "type": "ipv4", "value": "31.22.91.156", "first_seen": "2026-10-16T07:49:19Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "31.41.33.212", "first_seen": "2026-11-13T09:41:16Z", "source_count": 2, "reference": "Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes" }, { "type": "ipv4", "value": "37.16.75.128", "first_seen": "2026-11-09T18:10:40Z", "source_count": 1, "reference": "The Cold Chain on Fire : Unpatched Danfoss controllers exploited" }, { "type": "ipv4", "value": "38.244.50.120", "first_seen": "2026-10-09T08:13:36Z", "source_count": 2, "reference": "ARTEX Exposed: Infrastructure Behind the South Korea Bank Hack" }, { "type": "ipv4", "value": "42.193.100.94", "first_seen": "2026-10-18T21:42:33Z", "source_count": 1, "reference": "Dark Web Profile: CyberXero" }, { "type": "ipv4", "value": "42.193.227.214", "first_seen": "2026-09-16T06:24:42Z", "source_count": 1, "reference": "Dark Web Profile: CyberXero" }, { "type": "ipv4", "value": "43.240.29.11", "first_seen": "2026-11-13T14:46:52Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "43.240.29.28", "first_seen": "2026-11-13T14:48:06Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "43.240.29.33", "first_seen": "2026-11-13T14:48:06Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "43.255.159.10", "first_seen": "2026-11-12T19:07:17Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "45.115.26.23", "first_seen": "2026-10-15T19:41:15Z", "source_count": 1, "reference": "Triaging the Week 143" }, { "type": "ipv4", "value": "45.149.154.135", "first_seen": "2026-11-13T09:41:16Z", "source_count": 2, "reference": "Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes" }, { "type": "ipv4", "value": "45.150.32.130", "first_seen": "2026-11-13T04:50:03Z", "source_count": 1, "reference": "Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)" }, { "type": "ipv4", "value": "45.61.182.54", "first_seen": "2026-11-03T12:06:31Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "45.83.220.211", "first_seen": "2026-10-20T11:31:09Z", "source_count": 1, "reference": "Trusted by Default: Qubole Cross-Account Access Abused in the Wild" }, { "type": "ipv4", "value": "45.88.106.2", "first_seen": "2026-10-18T21:42:33Z", "source_count": 1, "reference": "Dark Web Profile: CyberXero" }, { "type": "ipv4", "value": "45.88.106.78", "first_seen": "2026-08-08T08:46:47Z", "source_count": 1, "reference": "Dark Web Profile: CyberXero" }, { "type": "ipv4", "value": "45.95.147.178", "first_seen": "2026-04-07T11:13:05Z", "source_count": 1, "reference": "From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign" }, { "type": "ipv4", "value": "46.21.250.135", "first_seen": "2026-10-12T08:24:06Z", "source_count": 1, "reference": "Dark Web Profile: CyberXero" }, { "type": "ipv4", "value": "49.234.12.182", "first_seen": "2026-10-18T21:42:33Z", "source_count": 1, "reference": "Dark Web Profile: CyberXero" }, { "type": "ipv4", "value": "5.101.84.233", "first_seen": "2026-11-10T21:05:27Z", "source_count": 1, "reference": "How We Disrupted a 110-Domain Fake Copyright-Strike Phishing Estate" }, { "type": "ipv4", "value": "5.9.115.199", "first_seen": "2026-11-10T13:53:51Z", "source_count": 1, "reference": "Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures" }, { "type": "ipv4", "value": "52.119.124.122", "first_seen": "2026-11-08T09:47:47Z", "source_count": 1, "reference": "Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)" }, { "type": "ipv4", "value": "57.129.54.120", "first_seen": "2026-11-09T18:02:54Z", "source_count": 2, "reference": "Trusted by Default: Qubole Cross-Account Access Abused in the Wild" }, { "type": "ipv4", "value": "58.151.184.226", "first_seen": "2026-11-08T16:35:15Z", "source_count": 1, "reference": "Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)" }, { "type": "ipv4", "value": "62.210.173.100", "first_seen": "2026-10-21T07:55:49Z", "source_count": 1, "reference": "Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)" }, { "type": "ipv4", "value": "65.87.223.26", "first_seen": "2026-08-08T06:30:10Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "79.76.51.56", "first_seen": "2026-11-13T12:24:28Z", "source_count": 1, "reference": "4EverAble2Shell At a Glance" }, { "type": "ipv4", "value": "81.161.239.10", "first_seen": "2026-09-20T18:39:57Z", "source_count": 1, "reference": "Dark Web Profile: n0n Ransomware" }, { "type": "ipv4", "value": "82.26.72.21", "first_seen": "2026-11-09T20:25:03Z", "source_count": 1, "reference": "Attackers Searching for SAP Netweaver Webshells, (Mon, Nov 9th)" }, { "type": "ipv4", "value": "82.29.129.54", "first_seen": "2026-11-12T15:20:28Z", "source_count": 1, "reference": "headline not shown" }, { "type": "ipv4", "value": "82.74.132.129", "first_seen": "2026-11-08T09:48:28Z", "source_count": 1, "reference": "Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)" }, { "type": "ipv4", "value": "87.199.205.61", "first_seen": "2026-11-13T02:12:23Z", "source_count": 1, "reference": "2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT" }, { "type": "ipv4", "value": "87.241.132.12", "first_seen": "2026-10-23T07:39:37Z", "source_count": 1, "reference": "Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)" }, { "type": "ipv4", "value": "89.125.213.123", "first_seen": "2026-11-11T11:04:26Z", "source_count": 1, "reference": "Off the Rails: Inside an Exposed Silent Lynx Server" }, { "type": "ipv4", "value": "89.127.233.127", "first_seen": "2026-11-04T10:36:33Z", "source_count": 1, "reference": "Attackers turn NIKKE's game launcher into malware" }, { "type": "ipv4", "value": "89.34.90.203", "first_seen": "2026-08-03T05:46:05Z", "source_count": 1, "reference": "Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters" }, { "type": "ipv4", "value": "89.37.63.175", "first_seen": "2026-11-09T18:02:54Z", "source_count": 1, "reference": "Trusted by Default: Qubole Cross-Account Access Abused in the Wild" }, { "type": "ipv4", "value": "91.208.184.148", "first_seen": "2026-10-18T21:42:33Z", "source_count": 1, "reference": "Dark Web Profile: CyberXero" }, { "type": "ipv4", "value": "91.210.108.180", "first_seen": "2026-11-11T15:23:08Z", "source_count": 1, "reference": "Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand" }, { "type": "ipv4", "value": "91.210.109.118", "first_seen": "2026-11-11T15:23:08Z", "source_count": 1, "reference": "Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand" }, { "type": "ipv4", "value": "91.211.251.112", "first_seen": "2023-08-01T17:45:33Z", "source_count": 3, "reference": "Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers" }, { "type": "ipv4", "value": "91.234.194.113", "first_seen": "2026-11-10T13:53:51Z", "source_count": 1, "reference": "Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures" }, { "type": "ipv4", "value": "91.92.242.121", "first_seen": "2024-07-09T08:48:47Z", "source_count": 1, "reference": "Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes" }, { "type": "ipv4", "value": "92.255.57.7", "first_seen": "2026-10-05T03:14:03Z", "source_count": 1, "reference": "Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)" }, { "type": "ipv4", "value": "93.152.209.36", "first_seen": "2026-11-11T03:41:57Z", "source_count": 1, "reference": "2026-11-10: Traffic Analysis Exercise: The Lucky Turkey" }, { "type": "ipv4", "value": "95.135.181.151", "first_seen": "2026-10-27T17:55:14Z", "source_count": 1, "reference": "PolinRider: Malicious Coding Assignments Steal Developer Secrets" }, { "type": "md5", "value": "098f6bcd4621d373cade4e832627b4f6", "first_seen": "2026-10-20T22:07:11Z", "source_count": 1, "reference": "HTB: Nimbus" }, { "type": "md5", "value": "17b29b6c9de80402a45e321bbe1168fa", "first_seen": "2026-11-11T15:22:36Z", "source_count": 1, "reference": "Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand" }, { "type": "md5", "value": "1fd9ccecac8794f39d826fdd8a62e6bc", "first_seen": "2026-11-12T19:02:11Z", "source_count": 1, "reference": "Never be afraid to ask questions" }, { "type": "md5", "value": "36b3ecad8e2d570b8c53ed65e53842b3", "first_seen": "2026-11-14T17:09:04Z", "source_count": 1, "reference": "HTB: Nimbus" }, { "type": "md5", "value": "372b56d018b8cbc359b0819e402f11d5", "first_seen": "2026-11-12T17:54:25Z", "source_count": 1, "reference": "The Hidden Relay: Inside a Device Code Phishing Kit That Never Shows the Code" }, { "type": "md5", "value": "3870a559b5b6ea6076f5f90029c180b7", "first_seen": "2026-11-10T13:58:08Z", "source_count": 1, "reference": "Dark Web Profile: CyberXero" }, { "type": "md5", "value": "3f49a821c5c08c9e5ef49f4084ecd513", "first_seen": "2026-11-14T17:09:04Z", "source_count": 1, "reference": "HTB: Nimbus" }, { "type": "md5", "value": "648894d150483a6a8d1b9d555ff3a6f9", "first_seen": "2026-11-14T17:09:04Z", "source_count": 1, "reference": "HTB: Nimbus" }, { "type": "md5", "value": "6e33ec0fe4463a313585d4c7f1e9097c", "first_seen": "2026-11-14T17:09:04Z", "source_count": 1, "reference": "HTB: Nimbus" }, { "type": "md5", "value": "7107fb029e7c63523e3aca5fc8e56b38", "first_seen": "2026-11-11T15:22:36Z", "source_count": 1, "reference": "Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand" }, { "type": "md5", "value": "95a6a4b638cfdfbe3afc883d593a1f87", "first_seen": "2026-11-05T19:01:09Z", "source_count": 1, "reference": "Never be afraid to ask questions" }, { "type": "md5", "value": "9eee984b187423c46c10a63d080da15d", "first_seen": "2026-11-11T15:22:36Z", "source_count": 1, "reference": "Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand" }, { "type": "md5", "value": "c236f2af130f959a5723562fa5eff7b2", "first_seen": "2026-11-14T17:09:04Z", "source_count": 1, "reference": "HTB: Nimbus" }, { "type": "md5", "value": "cf903e4a1629aa0582fd0363b5786676", "first_seen": "2024-05-29T15:31:57Z", "source_count": 1, "reference": "Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand" }, { "type": "md5", "value": "d631627131b90d576d77f4bf530e1abe", "first_seen": "2026-11-11T15:22:36Z", "source_count": 1, "reference": "Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand" }, { "type": "md5", "value": "d6c049a09ba8ac3085c51ee9df24a4e5", "first_seen": "2026-11-12T12:13:07Z", "source_count": 1, "reference": "Attackers turn NIKKE's game launcher into malware" }, { "type": "md5", "value": "e251df2d0b7c3682965efb4d2009a2f4", "first_seen": "2026-11-11T15:22:36Z", "source_count": 1, "reference": "Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand" }, { "type": "sha1", "value": "133883ab9f6ede5b9ba6b82e27bedaf0ce152f25", "first_seen": "2026-11-06T06:01:49Z", "source_count": 1, "reference": "Dropbear: the restriction names an address - permitopen/permitlisten not enforced for unix-socket forwarding, docker.sock reachable (HEAD 99baf182, live-proven)" }, { "type": "sha1", "value": "28f8da19ddcdf26e426875c7a834b34a79bc1c33", "first_seen": "2026-11-13T09:38:53Z", "source_count": 1, "reference": "Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes" }, { "type": "sha1", "value": "dc7d7455c95b3092eb14bff2bd93315b84b066fa", "first_seen": "2026-11-09T18:03:46Z", "source_count": 1, "reference": "Malicious bee-js npm Release and Swarm Desktop Releases Deliver SleepyDuck Ethereum C2 Backdoor" }, { "type": "sha256", "value": "00c9ac44291f83c72d54302e99d155a3e26d02225a3e516764d5833a99657c9e", "first_seen": "2026-11-12T14:34:36Z", "source_count": 1, "reference": "0% GPU utilization: How SANSAR hides Linux cryptomining" }, { "type": "sha256", "value": "0522937c0c0337be54fe25493539e5f5f8ceb9742c980aaff1cfc9515f3a96f7", "first_seen": "2026-11-12T14:13:06Z", "source_count": 1, "reference": "PHP2Shell Exploitation on Check Point Gateway" }, { "type": "sha256", "value": "0f1051c395438db8dc0dbe6de1cb09e6e10c83fc6062d359ca85093ce946f0e0", "first_seen": "2026-11-13T04:54:52Z", "source_count": 1, "reference": "headline not shown" }, { "type": "sha256", "value": "0f8978dc13690cab2fe33ad377e4c09bb1fa181ecd2fbba9fc1b2e7c17f8d70f", "first_seen": "2026-11-14T19:31:39Z", "source_count": 1, "reference": "MAL-2026-19937 Malicious code in gateio-ws (PyPI)" }, { "type": "sha256", "value": "101e9ac653ccd341e36fae84a5c6920dff47a41822e87db4c72e36da4830d707", "first_seen": "2026-11-13T02:12:23Z", "source_count": 1, "reference": "2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT" }, { "type": "sha256", "value": "119ef283a7038fe02a4d309ce942bcce3a37a70ef5468749ae4f4e378d971e9d", "first_seen": "2026-11-14T17:05:48Z", "source_count": 1, "reference": "MAL-2026-19934 Malicious code in ps-bool (PyPI)" }, { "type": "sha256", "value": "12450bafc7a4398040e1ad3a16dbf4dbc79b6a8f83ef306c4f0f73f59886f06c", "first_seen": "2026-11-11T22:16:05Z", "source_count": 1, "reference": "The global socket: how threat actors are weaponizing GSocket for stealthy C2" }, { "type": "sha256", "value": "15dc419b7fbeb50c50820a7cd27997541deafa4fa710f074bb657f0149574baf", "first_seen": "2026-11-13T09:38:53Z", "source_count": 1, "reference": "Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes" }, { "type": "sha256", "value": "1bece13e2be06ddffd2ed4bf25cc171363f7e3030003e5eda4e49ede0988b115", "first_seen": "2026-11-14T17:05:48Z", "source_count": 1, "reference": "MAL-2026-19933 Malicious code in gateio-client (PyPI)" }, { "type": "sha256", "value": "1c14a761620691a43b1a554a9eccd38d21c15d59463945250d4f57b10d20fce9", "first_seen": "2026-10-28T07:41:21Z", "source_count": 1, "reference": "From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign" }, { "type": "sha256", "value": "2063ecf38d2b7342633616dbfe9b2933f1e9d9ea73116105e55d6313279ac6e4", "first_seen": "2026-11-08T09:32:58Z", "source_count": 2, "reference": "headline not shown" }, { "type": "sha256", "value": "21f0c643e1ed1b11c56bfdd5f7567b2c0172924c227206b8ab9e4210918c6ee3", "first_seen": "2026-11-09T01:44:47Z", "source_count": 2, "reference": "MAL-2026-18772 Malicious code in parseyaml (PyPI)" }, { "type": "sha256", "value": "2974a808e24e76c1a9fecdaaecebefe27e841204bc1aa20536c32c1f0b309f47", "first_seen": "2026-11-10T13:53:51Z", "source_count": 1, "reference": "Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures" }, { "type": "sha256", "value": "2eb387df728fc6f5dd2dcffaf1883cbf8c5e0c489f6cb38021d67f856ee669d0", "first_seen": "2026-11-13T02:12:23Z", "source_count": 1, "reference": "2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT" }, { "type": "sha256", "value": "331465c8581a5dcaff2ec4ed0ace90f59daece320f7826bdfc40980aaf146331", "first_seen": "2026-11-10T08:42:24Z", "source_count": 1, "reference": "MAL-2026-19074 Malicious code in futrou (npm)" }, { "type": "sha256", "value": "38edbfc4ac89619d2bdb3f4bb2626deaaf422868d6d7af640f59d7959903f838", "first_seen": "2026-10-28T07:41:21Z", "source_count": 1, "reference": "From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign" }, { "type": "sha256", "value": "3b51080a909023f7d484e2443740b572307ce0054eb9e32d98f0a06bfcd2db90", "first_seen": "2026-11-12T14:13:06Z", "source_count": 1, "reference": "PHP2Shell Exploitation on Check Point Gateway" }, { "type": "sha256", "value": "3b70be66ff6d01cbf23ac275f3311a3ce40aa24fad549f7b742266d881998946", "first_seen": "2026-11-13T21:45:03Z", "source_count": 1, "reference": "MAL-2026-19259 Malicious code in qap793gl4l (PyPI)" }, { "type": "sha256", "value": "4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec8", "first_seen": "2026-11-12T14:13:06Z", "source_count": 1, "reference": "PHP2Shell Exploitation on Check Point Gateway" }, { "type": "sha256", "value": "45e598a8dddd7e9cc7b7e7a2f319c0e9f3f090ad4a089e50c3c9e4d75ee9d718", "first_seen": "2026-11-10T13:53:51Z", "source_count": 1, "reference": "Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures" }, { "type": "sha256", "value": "4fd6430a61e5d42a452c3a7de94d03173b9eb02d06aa33357fe5ee9776524aec", "first_seen": "2026-11-10T13:53:51Z", "source_count": 1, "reference": "Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures" }, { "type": "sha256", "value": "55d141bb2f62c527c3fea3413b8429fed7d52633d0b123b5e611bfa42165229f", "first_seen": "2025-07-21T20:02:40Z", "source_count": 1, "reference": "The global socket: how threat actors are weaponizing GSocket for stealthy C2" }, { "type": "sha256", "value": "569a21b519aaac8c92f653d708ab6ef34e3f38ea967f47e041d1e2425f6a4b33", "first_seen": "2026-11-02T14:26:32Z", "source_count": 1, "reference": "PapRAT Campaign Exposes BITTER's Expanding Espionage Toolkit" }, { "type": "sha256", "value": "58e503cc2e6aacc6bdba54f40a7edebf7a5362bef0a9039769baaba8c472c4db", "first_seen": "2026-11-13T04:50:03Z", "source_count": 1, "reference": "Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)" }, { "type": "sha256", "value": "58eb890b612938867237c3fa1715b8742d9b25a8fe136cd75ea659882b7b7a10", "first_seen": "2026-10-23T12:01:07Z", "source_count": 1, "reference": "Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures" }, { "type": "sha256", "value": "59c535f47ab4d35f6d9fc8b8aec4a72438ea0b89e5a4dcea74b05d2d32cfa483", "first_seen": "2026-10-18T21:42:33Z", "source_count": 1, "reference": "Dark Web Profile: CyberXero" }, { "type": "sha256", "value": "5a9b7a0d3f25757aea957713d7e84cabec87597b3474368328a8fd5ed7a12f78", "first_seen": "2026-11-13T09:38:53Z", "source_count": 1, "reference": "Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes" }, { "type": "sha256", "value": "65f061281c9a712e9502793dc4c5035cae490b84da05f7d4223cefa65ad396e4", "first_seen": "2026-11-09T18:02:54Z", "source_count": 1, "reference": "Trusted by Default: Qubole Cross-Account Access Abused in the Wild" }, { "type": "sha256", "value": "6604e2b2afca5be9f394786598898c0d718100ef3cb3595590fb74949b3eb9b5", "first_seen": "2026-11-08T11:49:00Z", "source_count": 2, "reference": "MAL-2026-18763 Malicious code in agentic-call-control (RubyGems)" }, { "type": "sha256", "value": "675c24728f87f7aa0fa07527027c95c24c246049c65eaef89270ab04ea50a180", "first_seen": "2026-11-12T14:34:36Z", "source_count": 1, "reference": "0% GPU utilization: How SANSAR hides Linux cryptomining" }, { "type": "sha256", "value": "6ba1aa275e0e2826e8b48b36473539ca56cbdc41f429e539a45f8532b084d7a4", "first_seen": "2026-11-12T14:34:36Z", "source_count": 1, "reference": "0% GPU utilization: How SANSAR hides Linux cryptomining" }, { "type": "sha256", "value": "71e21094c1ac1cf0275c91ed377965e248bca1c12711f6dd20e2682681fc1192", "first_seen": "2026-10-18T21:42:33Z", "source_count": 1, "reference": "Dark Web Profile: CyberXero" }, { "type": "sha256", "value": "721b376b505d760e78f3ac8417b54789f538a5a8127f59fe7c2660067366ce32", "first_seen": "2026-11-08T11:49:00Z", "source_count": 1, "reference": "MAL-2026-18761 Malicious code in infra-libs (PyPI)" }, { "type": "sha256", "value": "7d6f675842c53ecd7e78bcbc396a02f73665d842dafe8c213fd714f30fdb8ec5", "first_seen": "2026-11-11T09:55:03Z", "source_count": 1, "reference": "Analysis of Wpcdoor Attack Case Distributed Through Domestic DVR Management Software" }, { "type": "sha256", "value": "7db6d4bfe675bbaa2043f2958993761070ab6e5a09572d884082465b51bdf437", "first_seen": "2026-11-13T04:54:52Z", "source_count": 1, "reference": "headline not shown" }, { "type": "sha256", "value": "7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f", "first_seen": "2026-10-22T20:00:36Z", "source_count": 1, "reference": "Never be afraid to ask questions" }, { "type": "sha256", "value": "81b2cc96166cfebf7a2fb72d280ca06f5b9c4c9c735f6aee4beceafbce5430de", "first_seen": "2026-11-08T23:28:12Z", "source_count": 2, "reference": "MAL-2026-18770 Malicious code in bundyfed (PyPI)" }, { "type": "sha256", "value": "83327b9e45cb49b02f4a3681837f5acdc84f15373a85648f4409946e6fa72f75", "first_seen": "2026-11-08T11:49:00Z", "source_count": 1, "reference": "Malicious code in control-character-command-injection (RubyGems)" }, { "type": "sha256", "value": "83716a1c499cecbd64fe45f5ff56ab70ea6d1543e922c55e0514f2e2a69fe391", "first_seen": "2026-11-12T23:49:17Z", "source_count": 1, "reference": "MAL-2026-19201 Malicious code in hesk (crates.io)" }, { "type": "sha256", "value": "89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf", "first_seen": "2026-11-12T02:49:08Z", "source_count": 4, "reference": "headline not shown" }, { "type": "sha256", "value": "8b5026d841aa93758ec3cb55c276f84d3ec1cf459810e0d9aa5624e2776f2fcd", "first_seen": "2026-11-13T04:50:03Z", "source_count": 1, "reference": "Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)" }, { "type": "sha256", "value": "92a789444708fa1cb4cc5a89e0aa6cc7a279b62a7b8a4d2857255a18197d0090", "first_seen": "2026-10-18T21:42:33Z", "source_count": 1, "reference": "Dark Web Profile: CyberXero" }, { "type": "sha256", "value": "96fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46", "first_seen": "2025-12-26T01:18:42Z", "source_count": 1, "reference": "0% GPU utilization: How SANSAR hides Linux cryptomining" }, { "type": "sha256", "value": "97d10fee9034b632ade0ace8612645594a710e3686e8408e89e24a300102ce56", "first_seen": "2026-11-12T23:53:25Z", "source_count": 1, "reference": "How Attackers Hide ScreenConnect in Windows Installers" }, { "type": "sha256", "value": "985c3972712218c62d2418b41056dba5fe883ca5104d8ec12041f8611db344f9", "first_seen": "2026-10-22T20:00:36Z", "source_count": 1, "reference": "Never be afraid to ask questions" }, { "type": "sha256", "value": "a1146a6fabdfef289472f99a56851249e7a46e8d19d4d8bf85fe833e2f0158b6", "first_seen": "2026-11-14T02:14:52Z", "source_count": 1, "reference": "GHSA-QFX6-Q44V-9QQW ag-psd can exhaust memory when parsing crafted PSD dimensions" }, { "type": "sha256", "value": "a49edd934436b6bb41d7805becfebe94285739c8bb758cd4d1ab807250509295", "first_seen": "2026-11-11T09:55:03Z", "source_count": 1, "reference": "Analysis of Wpcdoor Attack Case Distributed Through Domestic DVR Management Software" }, { "type": "sha256", "value": "a5ae0aab352871bc0b038b3aa43b03eb223425628c884af7b9fc592cd34eb86c", "first_seen": "2026-10-18T21:42:33Z", "source_count": 1, "reference": "Dark Web Profile: CyberXero" }, { "type": "sha256", "value": "a970e997093fcd10d108354423c8fa420a6887ed97cbf7c7dbe3551faa4d9b95", "first_seen": "2026-10-23T12:01:07Z", "source_count": 1, "reference": "Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures" }, { "type": "sha256", "value": "aa6dfd7ee90d9aea5af29ae39c14ff70cf8687118abadd7aa4fc98923f01ffd1", "first_seen": "2026-10-28T07:41:21Z", "source_count": 1, "reference": "From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign" }, { "type": "sha256", "value": "acc706afc9322a3eae1ef49049749e0a7c9f1a123895ac56dc8a289beb2fb5b7", "first_seen": "2026-11-12T14:34:36Z", "source_count": 1, "reference": "0% GPU utilization: How SANSAR hides Linux cryptomining" }, { "type": "sha256", "value": "adeb015fdb37814edc3ed45230f48d2b0e87bb195a5a7e4487c01549b47c744c", "first_seen": "2026-10-28T07:41:21Z", "source_count": 1, "reference": "From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign" }, { "type": "sha256", "value": "ae59aedc4d89d7b22db5dc65cd0b2ff68b20b74863d44f53fd346de739081694", "first_seen": "2026-11-12T19:02:11Z", "source_count": 1, "reference": "Never be afraid to ask questions" }, { "type": "sha256", "value": "b0ee22dee7a8a9710992294f73069f047d31506b50dc1150ef6013fcd6225ed1", "first_seen": "2026-11-10T13:53:51Z", "source_count": 1, "reference": "Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures" }, { "type": "sha256", "value": "b54a8d9e98ff36dfe63b2aea97a2003b670f7311595bb4dd072850fed5900a0b", "first_seen": "2026-10-28T07:41:21Z", "source_count": 1, "reference": "From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign" }, { "type": "sha256", "value": "bb6afd419500201966e8ccb55d2f3c8ea28caae5ec8bfc59a87dcf19ca9d022b", "first_seen": "2026-11-08T11:49:00Z", "source_count": 1, "reference": "MAL-2026-18766 Malicious code in dynamic-object-handler (RubyGems)" }, { "type": "sha256", "value": "c34cc30cb1cff5c47d77e62a3ba63e9a183989ec1ccdf7929beb1bcae0d41f23", "first_seen": "2026-11-13T04:50:03Z", "source_count": 1, "reference": "Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)" }, { "type": "sha256", "value": "c6e64453ea8bc0856333b6f57567c9efd8c440410787cae135d1c4a248c07c0d", "first_seen": "2026-10-28T07:41:21Z", "source_count": 1, "reference": "From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign" }, { "type": "sha256", "value": "c7d9477309fac6c638a1128442056a242de086996add8cb49cd6496c36003237", "first_seen": "2026-11-12T14:13:06Z", "source_count": 1, "reference": "PHP2Shell Exploitation on Check Point Gateway" }, { "type": "sha256", "value": "cc0ad05bfe85940a6067b3a72c182d3953339129206634141926d5d0b35973ec", "first_seen": "2026-11-12T12:13:07Z", "source_count": 1, "reference": "Attackers turn NIKKE's game launcher into malware" }, { "type": "sha256", "value": "cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b", "first_seen": "2026-11-12T23:53:25Z", "source_count": 1, "reference": "How Attackers Hide ScreenConnect in Windows Installers" }, { "type": "sha256", "value": "cc1ad7f14777a098ccc91fd4e8f6143da14418c2b6fdf23b7f8f6b3d1b0b7f1d", "first_seen": "2026-11-12T14:34:36Z", "source_count": 1, "reference": "0% GPU utilization: How SANSAR hides Linux cryptomining" }, { "type": "sha256", "value": "d2ce56d3cbce6034dcebd88520ffec19a094c0888b7e797f66c46bc69e8d2eac", "first_seen": "2026-11-14T19:31:39Z", "source_count": 1, "reference": "MAL-2026-19935 Malicious code in demo-pingtest-xyz (PyPI)" }, { "type": "sha256", "value": "d345671e688ee807e1bb9b6fc45e6bb0611bbb1331c33888c8030ec2db47e672", "first_seen": "2026-10-28T07:41:21Z", "source_count": 1, "reference": "From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign" }, { "type": "sha256", "value": "d6453c71dad6e54f6da82865427269aa20b223cca8a29a0079cd05e57ca72ede", "first_seen": "2026-11-12T23:53:25Z", "source_count": 1, "reference": "How Attackers Hide ScreenConnect in Windows Installers" }, { "type": "sha256", "value": "d7549671c7189979f0624ec52dad9ea6a707d23146e3585ab8f8c4720eca0c63", "first_seen": "2026-11-12T14:13:06Z", "source_count": 1, "reference": "PHP2Shell Exploitation on Check Point Gateway" }, { "type": "sha256", "value": "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa", "first_seen": "2025-07-23T18:17:31Z", "source_count": 1, "reference": "The global socket: how threat actors are weaponizing GSocket for stealthy C2" }, { "type": "sha256", "value": "da5f11fa30f28362c8394977403d7736c91c828ba295b3d175baa1c8539edf8b", "first_seen": "2026-11-14T09:37:38Z", "source_count": 1, "reference": "MAL-2026-19930 Malicious code in trezortranslate (PyPI)" }, { "type": "sha256", "value": "daf0fb9836af133a053a98dbd88106efeaccd310d038b52f596a53be0efc6f76", "first_seen": "2026-11-14T19:31:39Z", "source_count": 1, "reference": "MAL-2026-19936 Malicious code in gateio-sdk (PyPI)" }, { "type": "sha256", "value": "df8ab6fd699e6ae90e63e9696bae8f01342708bafc2ed88af414337e4f237194", "first_seen": "2026-11-12T14:34:36Z", "source_count": 1, "reference": "0% GPU utilization: How SANSAR hides Linux cryptomining" }, { "type": "sha256", "value": "e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b", "first_seen": "2026-11-02T14:26:32Z", "source_count": 1, "reference": "PapRAT Campaign Exposes BITTER's Expanding Espionage Toolkit" }, { "type": "sha256", "value": "edb3e92eb7bda7413a09edcc4b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3", "first_seen": "2026-11-12T14:13:06Z", "source_count": 1, "reference": "PHP2Shell Exploitation on Check Point Gateway" }, { "type": "sha256", "value": "ee16e1695711b9d60c62925fcfb2fe1a29c18ae26565bc05410a14e16d2a39d7", "first_seen": "2026-11-12T14:13:06Z", "source_count": 1, "reference": "PHP2Shell Exploitation on Check Point Gateway" }, { "type": "sha256", "value": "f004357dd044b3c2c644a1f759dcd47a154a37533635280af0f3b5adb76469a4", "first_seen": "2026-11-09T01:44:47Z", "source_count": 2, "reference": "MAL-2026-18771 Malicious code in extrahtml (PyPI)" }, { "type": "sha256", "value": "f0f8ceed9d5db100de257e6c8a4c85b08a30fd9591de754169adcfe0cf627bcb", "first_seen": "2026-11-12T19:02:11Z", "source_count": 1, "reference": "Never be afraid to ask questions" }, { "type": "sha256", "value": "f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85", "first_seen": "2026-11-05T19:01:09Z", "source_count": 1, "reference": "Never be afraid to ask questions" }, { "type": "sha256", "value": "f5c9a28325ed2eab5c7d029bfed410f05ae858b6b436e3b14891f29a6ec96d73", "first_seen": "2026-11-10T13:53:51Z", "source_count": 1, "reference": "Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures" }, { "type": "sha256", "value": "f693b92cac909344a9cbab93f5f80ab6d820759af5042d323d90f10351d39d76", "first_seen": "2026-11-08T11:49:00Z", "source_count": 1, "reference": "MAL-2026-18760 Malicious code in expect-tests (PyPI)" }, { "type": "sha256", "value": "f82b1f071f557e9f25cfce6d7643f19053c6a2bd7d61470fcf114ac53e950c63", "first_seen": "2026-11-12T23:49:17Z", "source_count": 1, "reference": "MAL-2026-19200 Malicious code in basek (crates.io)" }, { "type": "sha256", "value": "f95c4d029e6784e3849b4d1e2e2ae1a661187236ef7c5d487c71158a290a03b5", "first_seen": "2026-11-11T22:16:05Z", "source_count": 1, "reference": "The global socket: how threat actors are weaponizing GSocket for stealthy C2" }, { "type": "sha256", "value": "fb1a6235eb6bce8c9ec8cd8bb85f17c9c2bde8ecb45b7a243a30ceadf26654da", "first_seen": "2026-11-12T14:13:06Z", "source_count": 1, "reference": "PHP2Shell Exploitation on Check Point Gateway" }, { "type": "sha256", "value": "fc4c01fd11bc301cf312830460cfdccc3af9dcfe50c910b86d6a1117bc76c747", "first_seen": "2026-11-13T11:16:15Z", "source_count": 1, "reference": "4EverAble2Shell At a Glance" }, { "type": "url", "value": "http://156.238.252.37:8000/bot.x86_64", "first_seen": "2026-11-01T15:02:09Z", "source_count": 1, "reference": "Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)" }, { "type": "url", "value": "http://157.20.241.16:8080/jup.sh", "first_seen": "2026-11-13T07:16:36Z", "source_count": 1, "reference": "Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2" }, { "type": "url", "value": "http://160.119.69.4/hima_data/index.php", "first_seen": "2026-07-30T19:41:04Z", "source_count": 1, "reference": "From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign" }, { "type": "url", "value": "http://171.22.131.24:8133/api/t", "first_seen": "2026-11-13T04:50:03Z", "source_count": 1, "reference": "Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)" }, { "type": "url", "value": "http://194.150.166.244:8080/exfil", "first_seen": "2026-11-12T02:49:08Z", "source_count": 2, "reference": "headline not shown" }, { "type": "url", "value": "http://45.150.32.130/37339606cba4522a?force=1", "first_seen": "2026-11-13T04:50:03Z", "source_count": 1, "reference": "Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)" }, { "type": "url", "value": "http://45.150.32.130/4be1066a49e75?force=1", "first_seen": "2026-11-13T04:50:03Z", "source_count": 1, "reference": "Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)" }, { "type": "url", "value": "http://45.95.147.178/hima_data/index.php", "first_seen": "2026-07-30T19:33:51Z", "source_count": 1, "reference": "From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign" }, { "type": "url", "value": "http://aws.nimbus.htb/847219365028/nimbus-jobs", "first_seen": "2026-11-14T17:09:04Z", "source_count": 1, "reference": "HTB: Nimbus" }, { "type": "url", "value": "http://site.vietnam852.com:88/ip.php", "first_seen": "2026-11-12T15:58:14Z", "source_count": 1, "reference": "Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners" }, { "type": "url", "value": "http://www.dumbsplash.com/ilto/", "first_seen": "2026-11-13T05:04:34Z", "source_count": 1, "reference": "Beware of phishing emails disguised as purchase order confirmation requests (Xloader)" }, { "type": "url", "value": "http://www.hlushkova.top/ef5f/", "first_seen": "2026-11-10T13:54:39Z", "source_count": 1, "reference": "Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures" }, { "type": "url", "value": "http://www.stanbicfinanceug.com/9wgi/", "first_seen": "2026-11-10T13:54:39Z", "source_count": 1, "reference": "Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures" }, { "type": "url", "value": "https://abc123.ngrok-free.app/voice/webhook", "first_seen": "2026-11-11T03:52:40Z", "source_count": 1, "reference": "headline not shown" }, { "type": "url", "value": "https://anadnet.com/updates/?action=getmetadata&slug=quick-pagepost-redirect-quick", "first_seen": "2026-11-14T07:01:26Z", "source_count": 3, "reference": "CVE-2026-126697 Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel" }, { "type": "url", "value": "https://analytics.insightjs.com/comm/assets/insight.bundle", "first_seen": "2026-11-12T12:13:07Z", "source_count": 1, "reference": "Attackers turn NIKKE's game launcher into malware" }, { "type": "url", "value": "https://cashewminaret.org/identity/gateway-dom.js?18e76625db12fb1d", "first_seen": "2026-11-13T02:12:23Z", "source_count": 1, "reference": "2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT" }, { "type": "url", "value": "https://cashewminaret.org/identity/middleware-build?osgdpy5p", "first_seen": "2026-11-13T02:12:23Z", "source_count": 1, "reference": "2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT" }, { "type": "url", "value": "https://cashewminaret.org/identity/reset-layout.js", "first_seen": "2026-11-13T02:12:23Z", "source_count": 1, "reference": "2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT" }, { "type": "url", "value": "https://cdn.gsocket.io/bin/gs-netcat_mini-linux-aarch64", "first_seen": "2026-11-11T22:16:49Z", "source_count": 1, "reference": "The global socket: how threat actors are weaponizing GSocket for stealthy C2" }, { "type": "url", "value": "https://cirroreplyurldemo.azurewebsites.net", "first_seen": "2026-11-13T02:21:05Z", "source_count": 1, "reference": "Inside Cirro: Enumeration as a Restricted Guest" }, { "type": "url", "value": "https://domaina.com/uploads/.ab12cd34.php?cmd=id", "first_seen": "2026-11-12T16:51:43Z", "source_count": 1, "reference": "CWP2SHELL" }, { "type": "url", "value": "https://domaina.com/uploads/.ef56gh78.php", "first_seen": "2026-11-12T16:51:43Z", "source_count": 1, "reference": "CWP2SHELL" }, { "type": "url", "value": "https://gsgg.b-cdn.net/bin/gs-netcat_mini-linux-x86_64", "first_seen": "2026-11-11T22:16:49Z", "source_count": 1, "reference": "The global socket: how threat actors are weaponizing GSocket for stealthy C2" }, { "type": "url", "value": "https://gsocket.io/install.sh", "first_seen": "2026-11-11T22:16:49Z", "source_count": 1, "reference": "The global socket: how threat actors are weaponizing GSocket for stealthy C2" }, { "type": "url", "value": "https://gsocket.io/y", "first_seen": "2025-04-08T05:01:03Z", "source_count": 1, "reference": "The global socket: how threat actors are weaponizing GSocket for stealthy C2" }, { "type": "url", "value": "https://hyperpwn.xyz/", "first_seen": "2026-11-10T08:32:57Z", "source_count": 1, "reference": "Re: Rooting ISPs and Hosting Providers with Hyperglass" }, { "type": "url", "value": "https://keylogger.nullsect0r.tech/log", "first_seen": "2026-11-12T23:49:17Z", "source_count": 1, "reference": "MAL-2026-19200 Malicious code in basek (crates.io)" }, { "type": "url", "value": "https://ns.mo7sen.dev/EadF.php", "first_seen": "2026-11-12T16:40:40Z", "source_count": 1, "reference": "ScreenConnect Attack: SCKit Turns Remote Support Into an Attack Platform" }, { "type": "url", "value": "https://ns.mo7sen.dev/eadf.php", "first_seen": "2026-11-12T17:08:24Z", "source_count": 1, "reference": "ScreenConnect Attack: SCKit Turns Remote Support Into an Attack Platform" }, { "type": "url", "value": "https://ns.mo7sen.dev/eadf.php?p=4", "first_seen": "2026-11-12T00:37:51Z", "source_count": 1, "reference": "Active ScreenConnect attacks breach MSPs, impact dozens of organizations" }, { "type": "url", "value": "https://orchardandbarite.com/gross", "first_seen": "2026-11-13T02:12:23Z", "source_count": 1, "reference": "2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT" }, { "type": "url", "value": "https://orchardandbarite.com/spa", "first_seen": "2026-11-13T02:12:23Z", "source_count": 1, "reference": "2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT" }, { "type": "url", "value": "https://store-eu-par-12.gofile.io/download/web/a2a60e90-dea4-4c6c-9a02-be5ede78dc08/solace.exe", "first_seen": "2026-11-08T11:49:00Z", "source_count": 2, "reference": "MAL-2026-18762 Malicious code in rainbowcolors (PyPI)" }, { "type": "url", "value": "https://w.anadnet.com/bro/3/", "first_seen": "2026-11-14T07:00:48Z", "source_count": 3, "reference": "CVE-2026-126697 Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel" }, { "type": "url", "value": "https://webhook.site/dcf126c3-9328-4fb7-943d-0fda6e997c16?src=gh-readme-cmdi", "first_seen": "2026-11-14T09:37:38Z", "source_count": 1, "reference": "mechanize-takehome-rce-poc" }, { "type": "url", "value": "https://webhook.site/dcf126c3-9328-4fb7-943d-0fda6e997c16?src=gh-readme-ssti", "first_seen": "2026-11-14T09:37:38Z", "source_count": 1, "reference": "mechanize-takehome-rce-poc" }, { "type": "url", "value": "https://www.cryptic-heaven.net/contract", "first_seen": "2026-11-14T09:29:27Z", "source_count": 1, "reference": "How I received a job offer, and they hid a way to launch malicious code through Git inside the ZIP" } ] }