# NSS Daily Ledger **Disclaimer: Not enriched or vetted by NSS. Filtered to indicators reported in a malicious role in public security reporting, with a known-good list removed. No further vetting. Check before blocking.** NSS Daily Ledger (nsshq.com): indicators from public security reporting, rolling 7-day edition. - Drawn from public security reporting as published. Not individually verified. May include false positives. - Terms: free to use and redistribute with attribution to NSS Daily Ledger (nsshq.com). Corrections: corrections@nsshq.com - Window: 2026-11-08T00:00:00Z to 2026-11-15T00:00:00Z (UTC, the end is not included) - Generated: 2026-11-15T00:20:07Z - Indicators: 371 - Selection: Every indicator that a public security report processed by NSS in the window presents as hostile, one row per indicator. No verdict is given. - Fields: type, value, first_seen (UTC, the earliest time NSS recorded the indicator), source_count (distinct public reports in the window that carry it), reference (the headline of one of those reports, or 'headline not shown'). Indicators are written defanged here (dots in brackets, the scheme broken). The plain text, CSV and JSON editions carry the same rows in machine form. ## btc (1) ### 1fd9ccecac8794f39d826fdd8a62e6bc First recorded by NSS on 2026-11-12 at 19:05 UTC. Public reports in the window: 1. Reference: Never be afraid to ask questions. ## Domains (117) ### 1x0[.]is First recorded by NSS on 2026-10-28 at 01:24 UTC. Public reports in the window: 1. Reference: Notorious Brazilian Magecart group hijacks Convertr checkouts via Plausible analytics. ### 4x[.]dmca-strike[.]com First recorded by NSS on 2026-05-17 at 01:26 UTC. Public reports in the window: 1. Reference: How We Disrupted a 110-Domain Fake Copyright-Strike Phishing Estate. ### a[.]ci-xxxxxx[.]sh First recorded by NSS on 2026-11-12 at 02:49 UTC. Public reports in the window: 2. Reference: headline not shown. ### abc123[.]ngrok-free[.]app First recorded by NSS on 2026-11-11 at 03:52 UTC. Public reports in the window: 1. Reference: headline not shown. ### ace[.]nche[.]edu First recorded by NSS on 2026-11-12 at 12:10 UTC. Public reports in the window: 1. Reference: Incransom has just published a new victim : American Council of Education. ### advanced-reserv882689[.]com First recorded by NSS on 2026-11-06 at 16:25 UTC. Public reports in the window: 1. Reference: The Industry Leader in Enterprise Brand Protection. ### amasonses[.]com First recorded by NSS on 2026-11-05 at 23:13 UTC. Public reports in the window: 1. Reference: IP snowshoeing under US .gov email via a whitelisted AmazonSES typo in SPF. ### amazones[.]com First recorded by NSS on 2026-11-09 at 18:01 UTC. Public reports in the window: 1. Reference: IP snowshoeing under US .gov email via a whitelisted AmazonSES typo in SPF. ### america250[.]org First recorded by NSS on 2026-11-04 at 07:48 UTC. Public reports in the window: 1. Reference: Hackers exploited iOS and Android flaws to infect phones. ### amexsafekeyupdate[.]com First recorded by NSS on 2026-11-12 at 00:37 UTC. Public reports in the window: 1. Reference: Active ScreenConnect attacks breach MSPs, impact dozens of organizations. ### anadnet[.]com First recorded by NSS on 2026-11-14 at 07:00 UTC. Public reports in the window: 3. Reference: CVE-2026-126697 Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel. ### analytics[.]convertr[.]app[.]br First recorded by NSS on 2026-11-09 at 02:05 UTC. Public reports in the window: 1. Reference: Notorious Brazilian Magecart group hijacks Convertr checkouts via Plausible analytics. ### analytics[.]insightjs[.]com First recorded by NSS on 2026-11-04 at 10:36 UTC. Public reports in the window: 1. Reference: Attackers turn NIKKE's game launcher into malware. ### apartments-review8509831[.]sbs First recorded by NSS on 2026-11-12 at 23:49 UTC. Public reports in the window: 1. Reference: Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters. ### api[.]cloudvflare[.]com First recorded by NSS on 2026-11-13 at 09:41 UTC. Public reports in the window: 1. Reference: Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes. ### asgomd[.]com First recorded by NSS on 2026-04-25 at 12:03 UTC. Public reports in the window: 1. Reference: Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters. ### asgrsv[.]com First recorded by NSS on 2026-04-25 at 12:03 UTC. Public reports in the window: 1. Reference: Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters. ### avcheck[.]net First recorded by NSS on 2023-10-05 at 10:21 UTC. Public reports in the window: 1. Reference: DOJ: Gootloader used in at least 44 ransomware attacks costing $29 million since 2018. ### backdoor[.]androidos[.]triada[.]ae First recorded by NSS on 2026-10-18 at 23:13 UTC. Public reports in the window: 1. Reference: IT threat evolution in Q3 2026. Mobile statistics. ### backdoor[.]androidos[.]triada[.]ag First recorded by NSS on 2026-10-18 at 23:13 UTC. Public reports in the window: 1. Reference: IT threat evolution in Q3 2026. Mobile statistics. ### backdoorphp8[.]1[.]0-dev[.]py First recorded by NSS on 2026-11-14 at 09:41 UTC. Public reports in the window: 1. Reference: php-8.1.0-dev-backdoor-rce. ### bandgdruback1[.]workers[.]dev First recorded by NSS on 2026-11-12 at 17:54 UTC. Public reports in the window: 1. Reference: The Hidden Relay: Inside a Device Code Phishing Kit That Never Shows the Code. ### bonto[.]io First recorded by NSS on 2026-10-28 at 15:01 UTC. Public reports in the window: 1. Reference: Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets. ### c30d9e770432bc4-id-gate[.]bandgdruback1[.]workers[.]dev First recorded by NSS on 2026-11-12 at 17:54 UTC. Public reports in the window: 1. Reference: The Hidden Relay: Inside a Device Code Phishing Kit That Never Shows the Code. ### cashewminaret[.]org First recorded by NSS on 2026-11-13 at 02:12 UTC. Public reports in the window: 1. Reference: 2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT. ### cctv-update[.]top First recorded by NSS on 2026-11-13 at 14:41 UTC. Public reports in the window: 1. Reference: Hackers exploit exposed GeoVision CCTV software to disable Defender and deploy cryptominers. ### cdn[.]gsocket[.]io First recorded by NSS on 2026-11-11 at 22:16 UTC. Public reports in the window: 1. Reference: The global socket: how threat actors are weaponizing GSocket for stealthy C2. ### cdn007-digitaldownloads[.]com First recorded by NSS on 2026-11-12 at 00:37 UTC. Public reports in the window: 3. Reference: Active ScreenConnect attacks breach MSPs, impact dozens of organizations. ### chanret[.]com First recorded by NSS on 2026-10-29 at 13:57 UTC. Public reports in the window: 1. Reference: Investigating Abuse of Remote Desktop and Bulk Mailing Apps. ### chatlgpt[.]com First recorded by NSS on 2026-10-27 at 21:35 UTC. Public reports in the window: 1. Reference: headline not shown. ### cirroreplyurldemo[.]azurewebsites[.]net First recorded by NSS on 2026-11-13 at 02:21 UTC. Public reports in the window: 1. Reference: Inside Cirro: Enumeration as a Restricted Guest. ### cloude[.]ai First recorded by NSS on 2026-11-12 at 16:49 UTC. Public reports in the window: 1. Reference: headline not shown. ### clsude[.]ai First recorded by NSS on 2026-11-12 at 16:49 UTC. Public reports in the window: 1. Reference: headline not shown. ### cluade[.]ai First recorded by NSS on 2026-11-12 at 16:49 UTC. Public reports in the window: 1. Reference: headline not shown. ### confirmation-advanced-reserv203684[.]com First recorded by NSS on 2026-11-06 at 16:25 UTC. Public reports in the window: 1. Reference: The Industry Leader in Enterprise Brand Protection. ### copiot[.]com First recorded by NSS on 2026-11-12 at 16:49 UTC. Public reports in the window: 1. Reference: headline not shown. ### creepexplosiondarknight[.]com First recorded by NSS on 2026-11-10 at 10:41 UTC. Public reports in the window: 1. Reference: Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor. ### cryptor[.]biz First recorded by NSS on 2023-06-22 at 13:26 UTC. Public reports in the window: 1. Reference: DOJ: Gootloader used in at least 44 ransomware attacks costing $29 million since 2018. ### cryptor[.]live First recorded by NSS on 2026-11-13 at 17:06 UTC. Public reports in the window: 1. Reference: DOJ: Gootloader used in at least 44 ransomware attacks costing $29 million since 2018. ### cyberrexdesign[.]screenconnect[.]com First recorded by NSS on 2026-11-12 at 00:37 UTC. Public reports in the window: 1. Reference: Active ScreenConnect attacks breach MSPs, impact dozens of organizations. ### deepceek[.]com First recorded by NSS on 2026-11-12 at 16:49 UTC. Public reports in the window: 1. Reference: headline not shown. ### deepveindrilling[.]com First recorded by NSS on 2026-10-25 at 11:10 UTC. Public reports in the window: 1. Reference: deepveindrilling[.]com: Magento CMS block loader hits 953 stores. ### dvrlists[.]com First recorded by NSS on 2026-11-09 at 03:34 UTC. Public reports in the window: 1. Reference: Remcos RAT. ### ecoflowofficial[.]shop First recorded by NSS on 2026-11-12 at 17:48 UTC. Public reports in the window: 1. Reference: headline not shown. ### elevenlebs[.]io First recorded by NSS on 2026-11-12 at 16:49 UTC. Public reports in the window: 1. Reference: headline not shown. ### finaltests99[.]dssldrf[.]net First recorded by NSS on 2026-11-08 at 11:49 UTC. Public reports in the window: 1. Reference: MAL-2026-18758 Malicious code in blender-headless (PyPI). ### find[.]flashysearches[.]com First recorded by NSS on 2026-11-12 at 16:49 UTC. Public reports in the window: 1. Reference: headline not shown. ### foreverpeace[.]ru First recorded by NSS on 2026-11-11 at 11:04 UTC. Public reports in the window: 1. Reference: Off the Rails: Inside an Exposed Silent Lynx Server. ### gardenstokyjp[.]com First recorded by NSS on 2026-09-28 at 04:13 UTC. Public reports in the window: 1. Reference: The Industry Leader in Enterprise Brand Protection. ### geimini[.]com First recorded by NSS on 2026-11-12 at 16:49 UTC. Public reports in the window: 1. Reference: headline not shown. ### goldeshoms[.]com First recorded by NSS on 2026-11-06 at 16:25 UTC. Public reports in the window: 1. Reference: The Industry Leader in Enterprise Brand Protection. ### griok[.]com First recorded by NSS on 2026-11-12 at 16:49 UTC. Public reports in the window: 1. Reference: headline not shown. ### gsgg[.]b-cdn[.]net First recorded by NSS on 2026-11-11 at 22:16 UTC. Public reports in the window: 1. Reference: The global socket: how threat actors are weaponizing GSocket for stealthy C2. ### gsocket[.]io First recorded by NSS on 2025-04-08 at 05:01 UTC. Public reports in the window: 1. Reference: The global socket: how threat actors are weaponizing GSocket for stealthy C2. ### guestnooks-homeset[.]com First recorded by NSS on 2026-11-06 at 16:25 UTC. Public reports in the window: 1. Reference: The Industry Leader in Enterprise Brand Protection. ### gurades-homs[.]com First recorded by NSS on 2026-11-06 at 16:25 UTC. Public reports in the window: 1. Reference: The Industry Leader in Enterprise Brand Protection. ### gustrwes-inforcheck[.]com First recorded by NSS on 2026-11-06 at 16:25 UTC. Public reports in the window: 1. Reference: The Industry Leader in Enterprise Brand Protection. ### halst21nfc[.]cc First recorded by NSS on 2026-11-10 at 21:00 UTC. Public reports in the window: 1. Reference: CVE-2026-95400. ### homeresbooks[.]com First recorded by NSS on 2026-11-06 at 16:25 UTC. Public reports in the window: 1. Reference: The Industry Leader in Enterprise Brand Protection. ### homesdowttups[.]com First recorded by NSS on 2026-09-26 at 04:26 UTC. Public reports in the window: 1. Reference: The Industry Leader in Enterprise Brand Protection. ### hosting2[.]ro[.]hostsailor[.]com First recorded by NSS on 2025-11-05 at 17:02 UTC. Public reports in the window: 1. Reference: Beware of phishing emails disguised as quote requests (SnakeKeylogger). ### hotelchecckrsrv-krwo[.]world First recorded by NSS on 2026-10-30 at 19:42 UTC. Public reports in the window: 1. Reference: The Industry Leader in Enterprise Brand Protection. ### hyperpwn[.]xyz First recorded by NSS on 2026-11-10 at 08:32 UTC. Public reports in the window: 1. Reference: Re: Rooting ISPs and Hosting Providers with Hyperglass. ### insightjs[.]com First recorded by NSS on 2026-11-04 at 10:36 UTC. Public reports in the window: 2. Reference: Summary of Malicious Program Distribution via Goddess of Victory: NIKKE PC Launcher. ### justsendtext[.]xyz First recorded by NSS on 2026-11-12 at 14:38 UTC. Public reports in the window: 1. Reference: Luna Moth Returns, Re-Targeting Law Firms Through Access Tokens. ### keylogger[.]nullsect0r[.]tech First recorded by NSS on 2026-11-12 at 23:51 UTC. Public reports in the window: 1. Reference: MAL-2026-19200 Malicious code in basek (crates[.]io). ### lbl[.]support First recorded by NSS on 2022-01-12 at 13:25 UTC. Public reports in the window: 1. Reference: Remcos RAT. ### midj0urney[.]org First recorded by NSS on 2026-11-12 at 16:49 UTC. Public reports in the window: 1. Reference: headline not shown. ### milivcounty[.]gov First recorded by NSS on 2026-11-09 at 18:01 UTC. Public reports in the window: 1. Reference: IP snowshoeing under US .gov email via a whitelisted AmazonSES typo in SPF. ### millimed-office[.]synology[.]me First recorded by NSS on 2026-11-12 at 12:13 UTC. Public reports in the window: 1. Reference: Incransom has just published a new victim : Millimed Thailand (i-HERB). ### mykolapalinchak[.]medianewsonline[.]com First recorded by NSS on 2026-10-13 at 13:53 UTC. Public reports in the window: 1. Reference: 422. Kimsuky Uses AwardSpace Domains for C2 Infrastructure. ### n0n[.]to First recorded by NSS on 2026-09-21 at 10:38 UTC. Public reports in the window: 1. Reference: Dark Web Profile: n0n Ransomware. ### neoca-office[.]synology[.]me First recorded by NSS on 2026-11-12 at 12:13 UTC. Public reports in the window: 1. Reference: Incransom has just published a new victim : Millimed Thailand (i-HERB). ### newnewnew[.]gotdns[.]org First recorded by NSS on 2026-11-12 at 00:37 UTC. Public reports in the window: 3. Reference: Active ScreenConnect attacks breach MSPs, impact dozens of organizations. ### notebookklm[.]com First recorded by NSS on 2026-11-12 at 16:49 UTC. Public reports in the window: 1. Reference: headline not shown. ### ns[.]mo7sen[.]dev First recorded by NSS on 2026-11-12 at 00:15 UTC. Public reports in the window: 4. Reference: Active ScreenConnect attacks breach MSPs, impact dozens of organizations. ### orchardandbarite[.]com First recorded by NSS on 2026-11-13 at 02:12 UTC. Public reports in the window: 1. Reference: 2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT. ### orustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid[.]onion First recorded by NSS on 2026-11-10 at 18:36 UTC. Public reports in the window: 1. Reference: Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers. ### pokijhgcfsdfghnj[.]mywebcommunity[.]org First recorded by NSS on 2025-05-13 at 16:27 UTC. Public reports in the window: 1. Reference: 422. Kimsuky Uses AwardSpace Domains for C2 Infrastructure. ### polwanlo[.]vip First recorded by NSS on 2026-11-12 at 17:54 UTC. Public reports in the window: 1. Reference: The Hidden Relay: Inside a Device Code Phishing Kit That Never Shows the Code. ### polyfill[.]io First recorded by NSS on 2025-11-05 at 16:58 UTC. Public reports in the window: 1. Reference: nDiligence Releases Four-Year Study Identifying a Critical Supply-Chain Vulnerability Across 50 Platform Types. ### preplexity[.]ai First recorded by NSS on 2026-11-12 at 16:49 UTC. Public reports in the window: 1. Reference: headline not shown. ### proof[.]ovh[.]net First recorded by NSS on 2026-11-10 at 14:56 UTC. Public reports in the window: 1. Reference: Results of incident investigation and compromise assessment projects. ### quill-kraee-um2gf[.]pro First recorded by NSS on 2026-11-12 at 21:44 UTC. Public reports in the window: 1. Reference: Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th). ### qweasdzxc[.]mygamesonline[.]org First recorded by NSS on 2026-10-13 at 13:53 UTC. Public reports in the window: 1. Reference: 422. Kimsuky Uses AwardSpace Domains for C2 Infrastructure. ### reserv-advanced67746202[.]com First recorded by NSS on 2026-11-06 at 16:25 UTC. Public reports in the window: 1. Reference: The Industry Leader in Enterprise Brand Protection. ### sc[.]payproofkit[.]com First recorded by NSS on 2026-11-12 at 00:37 UTC. Public reports in the window: 3. Reference: Active ScreenConnect attacks breach MSPs, impact dozens of organizations. ### site[.]vietnam852[.]com First recorded by NSS on 2026-11-12 at 23:12 UTC. Public reports in the window: 1. Reference: Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners. ### socket[.]io First recorded by NSS on 2025-11-30 at 19:49 UTC. Public reports in the window: 1. Reference: PolinRider: Malicious Coding Assignments Steal Developer Secrets. ### solaric[.]com[.]ph First recorded by NSS on 2026-10-18 at 22:30 UTC. Public reports in the window: 1. Reference: Corium: A New ClickFix Panel Shows How Malware Delivery Is Becoming a Turnkey Business. ### soxnewwork[.]homedns[.]org First recorded by NSS on 2026-11-12 at 00:37 UTC. Public reports in the window: 3. Reference: Active ScreenConnect attacks breach MSPs, impact dozens of organizations. ### staysuites-homebay[.]com First recorded by NSS on 2026-11-06 at 16:25 UTC. Public reports in the window: 1. Reference: The Industry Leader in Enterprise Brand Protection. ### tac[.]vpnla[.]org First recorded by NSS on 2026-11-09 at 18:05 UTC. Public reports in the window: 1. Reference: Hackers exploit SSHole OpenSSH flaw to breach Linux systems. ### takayara-homs[.]com First recorded by NSS on 2026-11-06 at 16:25 UTC. Public reports in the window: 1. Reference: The Industry Leader in Enterprise Brand Protection. ### teams-cloud[.]live First recorded by NSS on 2026-10-20 at 11:12 UTC. Public reports in the window: 1. Reference: headline not shown. ### teams-livemeeting[.]com First recorded by NSS on 2026-11-12 at 07:47 UTC. Public reports in the window: 1. Reference: headline not shown. ### testa213022[.]dssldrf[.]net First recorded by NSS on 2026-11-08 at 11:49 UTC. Public reports in the window: 2. Reference: MAL-2026-18761 Malicious code in infra-libs (PyPI). ### themicrosoft[.]com First recorded by NSS on 2026-11-12 at 17:54 UTC. Public reports in the window: 1. Reference: The Hidden Relay: Inside a Device Code Phishing Kit That Never Shows the Code. ### tiamen-rooms[.]com First recorded by NSS on 2026-11-06 at 16:25 UTC. Public reports in the window: 1. Reference: The Industry Leader in Enterprise Brand Protection. ### towntearse[.]com First recorded by NSS on 2026-11-06 at 16:25 UTC. Public reports in the window: 1. Reference: The Industry Leader in Enterprise Brand Protection. ### trojan-banker[.]androidos[.]agent[.]io First recorded by NSS on 2026-10-20 at 08:09 UTC. Public reports in the window: 1. Reference: IT threat evolution in Q3 2026. Mobile statistics. ### trojan-banker[.]androidos[.]agent[.]ws First recorded by NSS on 2026-10-18 at 23:13 UTC. Public reports in the window: 1. Reference: IT threat evolution in Q3 2026. Mobile statistics. ### trojan-dropper[.]androidos[.]mamont[.]am First recorded by NSS on 2026-11-10 at 08:09 UTC. Public reports in the window: 1. Reference: IT threat evolution in Q3 2026. Mobile statistics. ### trojan[.]androidos[.]fakeapp[.]in First recorded by NSS on 2026-11-10 at 08:08 UTC. Public reports in the window: 1. Reference: IT threat evolution in Q3 2026. Mobile statistics. ### trojan[.]androidos[.]subscriber[.]bh First recorded by NSS on 2026-11-10 at 08:09 UTC. Public reports in the window: 1. Reference: IT threat evolution in Q3 2026. Mobile statistics. ### update[.]pentagi[.]com First recorded by NSS on 2026-11-13 at 17:04 UTC. Public reports in the window: 1. Reference: headline not shown. ### ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid[.]onion First recorded by NSS on 2026-11-10 at 20:55 UTC. Public reports in the window: 2. Reference: Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access. ### w[.]anadnet[.]com First recorded by NSS on 2026-11-14 at 07:00 UTC. Public reports in the window: 3. Reference: CVE-2026-126697 Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel. ### wersdfxcv[.]mygamesonline[.]org First recorded by NSS on 2026-10-13 at 13:53 UTC. Public reports in the window: 1. Reference: 422. Kimsuky Uses AwardSpace Domains for C2 Infrastructure. ### www[.]cryptic-heaven[.]net First recorded by NSS on 2026-11-14 at 09:29 UTC. Public reports in the window: 1. Reference: How I received a job offer, and they hid a way to launch malicious code through Git inside the ZIP. ### www[.]dumbsplash[.]com First recorded by NSS on 2026-11-13 at 05:04 UTC. Public reports in the window: 1. Reference: Beware of phishing emails disguised as purchase order confirmation requests (Xloader). ### www[.]hlushkova[.]top First recorded by NSS on 2026-11-10 at 13:54 UTC. Public reports in the window: 1. Reference: Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures. ### www[.]stanbicfinanceug[.]com First recorded by NSS on 2026-11-10 at 13:54 UTC. Public reports in the window: 1. Reference: Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures. ### xcai[.]pro First recorded by NSS on 2026-10-09 at 08:13 UTC. Public reports in the window: 1. Reference: ARTEX Exposed: Infrastructure Behind the South Korea Bank Hack. ### ye[.]dmca-desk[.]com First recorded by NSS on 2026-05-17 at 01:26 UTC. Public reports in the window: 1. Reference: How We Disrupted a 110-Domain Fake Copyright-Strike Phishing Estate. ### ysoserial[.]net First recorded by NSS on 2022-03-09 at 12:14 UTC. Public reports in the window: 1. Reference: CVE-2026-63079. ### zonastoski[.]com First recorded by NSS on 2026-11-12 at 23:53 UTC. Public reports in the window: 1. Reference: How Attackers Hide ScreenConnect in Windows Installers. ## Mail addresses (7) ### admin@root[.]com First recorded by NSS on 2026-11-10 at 00:57 UTC. Public reports in the window: 1. Reference: CVE-2026-125384. ### log@aewn[.]buzz First recorded by NSS on 2026-11-12 at 07:50 UTC. Public reports in the window: 1. Reference: Beware of phishing emails disguised as quote requests (SnakeKeylogger). ### logs@aewn[.]buzz First recorded by NSS on 2026-11-12 at 07:50 UTC. Public reports in the window: 1. Reference: Beware of phishing emails disguised as quote requests (SnakeKeylogger). ### mhsu@mincomining[.]ca First recorded by NSS on 2026-11-12 at 12:16 UTC. Public reports in the window: 1. Reference: Incransom has just published a new victim : Ken Cai EMPIRE (Minco Silver, HempNova and other). ### mmnew@millimed[.]world First recorded by NSS on 2026-11-12 at 12:13 UTC. Public reports in the window: 1. Reference: Incransom has just published a new victim : Millimed Thailand (i-HERB). ### notice@n0n-cases[.]net First recorded by NSS on 2026-11-12 at 12:22 UTC. Public reports in the window: 1. Reference: Dark Web Profile: n0n Ransomware. ### whitearmorxd@onionmail[.]org First recorded by NSS on 2026-11-08 at 04:24 UTC. Public reports in the window: 1. Reference: Whitearmor has just published a new victim : Clinica La Sagrada Familia (Colombia). ## IPv4 addresses (106) ### 1[.]14[.]104[.]208 First recorded by NSS on 2026-08-20 at 05:41 UTC. Public reports in the window: 1. Reference: headline not shown. ### 103[.]101[.]85[.]19 First recorded by NSS on 2026-11-10 at 21:05 UTC. Public reports in the window: 1. Reference: How We Disrupted a 110-Domain Fake Copyright-Strike Phishing Estate. ### 103[.]142[.]140[.]158 First recorded by NSS on 2026-11-13 at 21:45 UTC. Public reports in the window: 1. Reference: headline not shown. ### 103[.]179[.]142[.]155 First recorded by NSS on 2026-10-17 at 17:07 UTC. Public reports in the window: 1. Reference: PolinRider: Malicious Coding Assignments Steal Developer Secrets. ### 104[.]28[.]219[.]97 First recorded by NSS on 2026-09-05 at 03:49 UTC. Public reports in the window: 1. Reference: headline not shown. ### 104[.]28[.]225[.]223 First recorded by NSS on 2026-10-11 at 03:38 UTC. Public reports in the window: 1. Reference: headline not shown. ### 104[.]28[.]251[.]98 First recorded by NSS on 2026-08-26 at 08:53 UTC. Public reports in the window: 1. Reference: headline not shown. ### 104[.]28[.]251[.]99 First recorded by NSS on 2026-09-27 at 04:08 UTC. Public reports in the window: 1. Reference: headline not shown. ### 104[.]37[.]184[.]195 First recorded by NSS on 2026-11-12 at 14:38 UTC. Public reports in the window: 1. Reference: Luna Moth Returns, Re-Targeting Law Firms Through Access Tokens. ### 109[.]94[.]173[.]13 First recorded by NSS on 2026-11-05 at 10:46 UTC. Public reports in the window: 1. Reference: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th). ### 112[.]162[.]23[.]132 First recorded by NSS on 2026-11-08 at 16:35 UTC. Public reports in the window: 1. Reference: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th). ### 121[.]163[.]224[.]97 First recorded by NSS on 2026-11-03 at 19:10 UTC. Public reports in the window: 1. Reference: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th). ### 121[.]190[.]39[.]238 First recorded by NSS on 2026-10-23 at 08:05 UTC. Public reports in the window: 1. Reference: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th). ### 125[.]103[.]213[.]41 First recorded by NSS on 2026-11-13 at 21:45 UTC. Public reports in the window: 1. Reference: headline not shown. ### 128[.]242[.]115[.]131 First recorded by NSS on 2026-11-13 at 21:45 UTC. Public reports in the window: 1. Reference: headline not shown. ### 130[.]94[.]19[.]168 First recorded by NSS on 2026-11-12 at 14:13 UTC. Public reports in the window: 1. Reference: PHP2Shell Exploitation on Check Point Gateway. ### 130[.]94[.]19[.]204 First recorded by NSS on 2026-11-12 at 14:13 UTC. Public reports in the window: 2. Reference: PHP2Shell Exploitation on Check Point Gateway. ### 134[.]209[.]82[.]225 First recorded by NSS on 2026-10-30 at 07:59 UTC. Public reports in the window: 2. Reference: headline not shown. ### 136[.]0[.]141[.]71 First recorded by NSS on 2026-11-05 at 12:42 UTC. Public reports in the window: 1. Reference: CWPdoor: The Invisible Backdoor Living Inside Control Web Panel. ### 139[.]99[.]69[.]109 First recorded by NSS on 2026-11-13 at 12:24 UTC. Public reports in the window: 1. Reference: 4EverAble2Shell At a Glance. ### 144[.]91[.]73[.]103 First recorded by NSS on 2026-11-11 at 04:17 UTC. Public reports in the window: 1. Reference: Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th). ### 150[.]136[.]38[.]110 First recorded by NSS on 2026-11-13 at 21:45 UTC. Public reports in the window: 1. Reference: headline not shown. ### 152[.]233[.]50[.]185 First recorded by NSS on 2026-11-06 at 12:11 UTC. Public reports in the window: 1. Reference: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th). ### 153[.]75[.]82[.]159 First recorded by NSS on 2026-11-12 at 07:39 UTC. Public reports in the window: 2. Reference: headline not shown. ### 154[.]44[.]31[.]4 First recorded by NSS on 2026-11-12 at 15:20 UTC. Public reports in the window: 1. Reference: headline not shown. ### 154[.]80[.]128[.]173 First recorded by NSS on 2026-10-31 at 03:18 UTC. Public reports in the window: 1. Reference: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th). ### 155[.]94[.]150[.]39 First recorded by NSS on 2026-11-12 at 00:37 UTC. Public reports in the window: 2. Reference: Active ScreenConnect attacks breach MSPs, impact dozens of organizations. ### 156[.]238[.]252[.]37 First recorded by NSS on 2026-10-31 at 19:32 UTC. Public reports in the window: 1. Reference: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th). ### 157[.]20[.]241[.]16 First recorded by NSS on 2026-11-12 at 14:30 UTC. Public reports in the window: 4. Reference: New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access. ### 157[.]22[.]126[.]128 First recorded by NSS on 2026-11-06 at 00:51 UTC. Public reports in the window: 1. Reference: headline not shown. ### 160[.]119[.]69[.]4 First recorded by NSS on 2026-04-07 at 10:55 UTC. Public reports in the window: 1. Reference: From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign. ### 171[.]22[.]131[.]24 First recorded by NSS on 2026-11-13 at 04:50 UTC. Public reports in the window: 1. Reference: Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th). ### 172[.]86[.]127[.]14 First recorded by NSS on 2026-11-11 at 06:11 UTC. Public reports in the window: 1. Reference: Analysis of Wpcdoor Attack Case Distributed Through Domestic DVR Management Software. ### 172[.]86[.]127[.]89 First recorded by NSS on 2026-11-11 at 10:02 UTC. Public reports in the window: 1. Reference: Analysis of Wpcdoor Attack Case Distributed Through Domestic DVR Management Software. ### 173[.]212[.]202[.]60 First recorded by NSS on 2026-11-13 at 04:54 UTC. Public reports in the window: 1. Reference: headline not shown. ### 178[.]83[.]226[.]215 First recorded by NSS on 2026-11-09 at 18:10 UTC. Public reports in the window: 1. Reference: The Cold Chain on Fire : Unpatched Danfoss controllers exploited. ### 18[.]143[.]168[.]96 First recorded by NSS on 2026-11-12 at 02:49 UTC. Public reports in the window: 5. Reference: headline not shown. ### 183[.]99[.]38[.]238 First recorded by NSS on 2026-10-23 at 07:57 UTC. Public reports in the window: 1. Reference: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th). ### 185[.]157[.]161[.]148 First recorded by NSS on 2026-10-29 at 20:38 UTC. Public reports in the window: 1. Reference: Dark Web Profile: n0n Ransomware. ### 185[.]2[.]148[.]137 First recorded by NSS on 2026-11-04 at 22:52 UTC. Public reports in the window: 1. Reference: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th). ### 185[.]209[.]199[.]73 First recorded by NSS on 2026-10-17 at 07:56 UTC. Public reports in the window: 1. Reference: Trusted by Default: Qubole Cross-Account Access Abused in the Wild. ### 185[.]99[.]255[.]28 First recorded by NSS on 2026-11-12 at 00:37 UTC. Public reports in the window: 3. Reference: Active ScreenConnect attacks breach MSPs, impact dozens of organizations. ### 188[.]214[.]135[.]130 First recorded by NSS on 2026-11-12 at 12:22 UTC. Public reports in the window: 1. Reference: Dark Web Profile: n0n Ransomware. ### 188[.]240[.]57[.]94 First recorded by NSS on 2026-05-11 at 04:37 UTC. Public reports in the window: 1. Reference: Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes. ### 193[.]32[.]204[.]199 First recorded by NSS on 2026-09-01 at 23:45 UTC. Public reports in the window: 1. Reference: headline not shown. ### 194[.]150[.]166[.]244 First recorded by NSS on 2026-11-11 at 18:47 UTC. Public reports in the window: 5. Reference: headline not shown. ### 195[.]178[.]110[.]78 First recorded by NSS on 2026-10-17 at 07:57 UTC. Public reports in the window: 1. Reference: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th). ### 199[.]19[.]77[.]84 First recorded by NSS on 2026-11-03 at 19:47 UTC. Public reports in the window: 1. Reference: headline not shown. ### 2[.]58[.]67[.]83 First recorded by NSS on 2026-11-10 at 13:53 UTC. Public reports in the window: 1. Reference: Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures. ### 20[.]207[.]192[.]84 First recorded by NSS on 2026-11-13 at 04:54 UTC. Public reports in the window: 1. Reference: headline not shown. ### 210[.]86[.]171[.]29 First recorded by NSS on 2026-11-12 at 12:10 UTC. Public reports in the window: 1. Reference: Incransom has just published a new victim : Millimed Thailand (i-HERB). ### 210[.]86[.]174[.]42 First recorded by NSS on 2026-11-12 at 12:10 UTC. Public reports in the window: 1. Reference: Incransom has just published a new victim : Millimed Thailand (i-HERB). ### 212[.]107[.]28[.]51 First recorded by NSS on 2026-11-13 at 21:45 UTC. Public reports in the window: 1. Reference: headline not shown. ### 212[.]193[.]31[.]189 First recorded by NSS on 2026-10-18 at 21:42 UTC. Public reports in the window: 1. Reference: Dark Web Profile: CyberXero. ### 213[.]86[.]169[.]133 First recorded by NSS on 2026-11-05 at 21:27 UTC. Public reports in the window: 1. Reference: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th). ### 216[.]176[.]239[.]231 First recorded by NSS on 2026-11-13 at 21:45 UTC. Public reports in the window: 1. Reference: headline not shown. ### 220[.]70[.]219[.]98 First recorded by NSS on 2026-11-03 at 12:51 UTC. Public reports in the window: 1. Reference: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th). ### 220[.]77[.]237[.]35 First recorded by NSS on 2026-11-04 at 06:24 UTC. Public reports in the window: 1. Reference: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th). ### 23[.]248[.]226[.]250 First recorded by NSS on 2026-10-21 at 21:28 UTC. Public reports in the window: 1. Reference: ARTEX Exposed: Infrastructure Behind the South Korea Bank Hack. ### 31[.]22[.]91[.]156 First recorded by NSS on 2026-10-16 at 07:49 UTC. Public reports in the window: 1. Reference: headline not shown. ### 31[.]41[.]33[.]212 First recorded by NSS on 2026-11-13 at 09:41 UTC. Public reports in the window: 2. Reference: Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes. ### 37[.]16[.]75[.]128 First recorded by NSS on 2026-11-09 at 18:10 UTC. Public reports in the window: 1. Reference: The Cold Chain on Fire : Unpatched Danfoss controllers exploited. ### 38[.]244[.]50[.]120 First recorded by NSS on 2026-10-09 at 08:13 UTC. Public reports in the window: 2. Reference: ARTEX Exposed: Infrastructure Behind the South Korea Bank Hack. ### 42[.]193[.]100[.]94 First recorded by NSS on 2026-10-18 at 21:42 UTC. Public reports in the window: 1. Reference: Dark Web Profile: CyberXero. ### 42[.]193[.]227[.]214 First recorded by NSS on 2026-09-16 at 06:24 UTC. Public reports in the window: 1. Reference: Dark Web Profile: CyberXero. ### 43[.]240[.]29[.]11 First recorded by NSS on 2026-11-13 at 14:46 UTC. Public reports in the window: 1. Reference: headline not shown. ### 43[.]240[.]29[.]28 First recorded by NSS on 2026-11-13 at 14:48 UTC. Public reports in the window: 1. Reference: headline not shown. ### 43[.]240[.]29[.]33 First recorded by NSS on 2026-11-13 at 14:48 UTC. Public reports in the window: 1. Reference: headline not shown. ### 43[.]255[.]159[.]10 First recorded by NSS on 2026-11-12 at 19:07 UTC. Public reports in the window: 1. Reference: headline not shown. ### 45[.]115[.]26[.]23 First recorded by NSS on 2026-10-15 at 19:41 UTC. Public reports in the window: 1. Reference: Triaging the Week 143. ### 45[.]149[.]154[.]135 First recorded by NSS on 2026-11-13 at 09:41 UTC. Public reports in the window: 2. Reference: Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes. ### 45[.]150[.]32[.]130 First recorded by NSS on 2026-11-13 at 04:50 UTC. Public reports in the window: 1. Reference: Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th). ### 45[.]61[.]182[.]54 First recorded by NSS on 2026-11-03 at 12:06 UTC. Public reports in the window: 1. Reference: headline not shown. ### 45[.]83[.]220[.]211 First recorded by NSS on 2026-10-20 at 11:31 UTC. Public reports in the window: 1. Reference: Trusted by Default: Qubole Cross-Account Access Abused in the Wild. ### 45[.]88[.]106[.]2 First recorded by NSS on 2026-10-18 at 21:42 UTC. Public reports in the window: 1. Reference: Dark Web Profile: CyberXero. ### 45[.]88[.]106[.]78 First recorded by NSS on 2026-08-08 at 08:46 UTC. Public reports in the window: 1. Reference: Dark Web Profile: CyberXero. ### 45[.]95[.]147[.]178 First recorded by NSS on 2026-04-07 at 11:13 UTC. Public reports in the window: 1. Reference: From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign. ### 46[.]21[.]250[.]135 First recorded by NSS on 2026-10-12 at 08:24 UTC. Public reports in the window: 1. Reference: Dark Web Profile: CyberXero. ### 49[.]234[.]12[.]182 First recorded by NSS on 2026-10-18 at 21:42 UTC. Public reports in the window: 1. Reference: Dark Web Profile: CyberXero. ### 5[.]101[.]84[.]233 First recorded by NSS on 2026-11-10 at 21:05 UTC. Public reports in the window: 1. Reference: How We Disrupted a 110-Domain Fake Copyright-Strike Phishing Estate. ### 5[.]9[.]115[.]199 First recorded by NSS on 2026-11-10 at 13:53 UTC. Public reports in the window: 1. Reference: Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures. ### 52[.]119[.]124[.]122 First recorded by NSS on 2026-11-08 at 09:47 UTC. Public reports in the window: 1. Reference: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th). ### 57[.]129[.]54[.]120 First recorded by NSS on 2026-11-09 at 18:02 UTC. Public reports in the window: 2. Reference: Trusted by Default: Qubole Cross-Account Access Abused in the Wild. ### 58[.]151[.]184[.]226 First recorded by NSS on 2026-11-08 at 16:35 UTC. Public reports in the window: 1. Reference: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th). ### 62[.]210[.]173[.]100 First recorded by NSS on 2026-10-21 at 07:55 UTC. Public reports in the window: 1. Reference: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th). ### 65[.]87[.]223[.]26 First recorded by NSS on 2026-08-08 at 06:30 UTC. Public reports in the window: 1. Reference: headline not shown. ### 79[.]76[.]51[.]56 First recorded by NSS on 2026-11-13 at 12:24 UTC. Public reports in the window: 1. Reference: 4EverAble2Shell At a Glance. ### 81[.]161[.]239[.]10 First recorded by NSS on 2026-09-20 at 18:39 UTC. Public reports in the window: 1. Reference: Dark Web Profile: n0n Ransomware. ### 82[.]26[.]72[.]21 First recorded by NSS on 2026-11-09 at 20:25 UTC. Public reports in the window: 1. Reference: Attackers Searching for SAP Netweaver Webshells, (Mon, Nov 9th). ### 82[.]29[.]129[.]54 First recorded by NSS on 2026-11-12 at 15:20 UTC. Public reports in the window: 1. Reference: headline not shown. ### 82[.]74[.]132[.]129 First recorded by NSS on 2026-11-08 at 09:48 UTC. Public reports in the window: 1. Reference: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th). ### 87[.]199[.]205[.]61 First recorded by NSS on 2026-11-13 at 02:12 UTC. Public reports in the window: 1. Reference: 2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT. ### 87[.]241[.]132[.]12 First recorded by NSS on 2026-10-23 at 07:39 UTC. Public reports in the window: 1. Reference: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th). ### 89[.]125[.]213[.]123 First recorded by NSS on 2026-11-11 at 11:04 UTC. Public reports in the window: 1. Reference: Off the Rails: Inside an Exposed Silent Lynx Server. ### 89[.]127[.]233[.]127 First recorded by NSS on 2026-11-04 at 10:36 UTC. Public reports in the window: 1. Reference: Attackers turn NIKKE's game launcher into malware. ### 89[.]34[.]90[.]203 First recorded by NSS on 2026-08-03 at 05:46 UTC. Public reports in the window: 1. Reference: Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters. ### 89[.]37[.]63[.]175 First recorded by NSS on 2026-11-09 at 18:02 UTC. Public reports in the window: 1. Reference: Trusted by Default: Qubole Cross-Account Access Abused in the Wild. ### 91[.]208[.]184[.]148 First recorded by NSS on 2026-10-18 at 21:42 UTC. Public reports in the window: 1. Reference: Dark Web Profile: CyberXero. ### 91[.]210[.]108[.]180 First recorded by NSS on 2026-11-11 at 15:23 UTC. Public reports in the window: 1. Reference: Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand. ### 91[.]210[.]109[.]118 First recorded by NSS on 2026-11-11 at 15:23 UTC. Public reports in the window: 1. Reference: Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand. ### 91[.]211[.]251[.]112 First recorded by NSS on 2023-08-01 at 17:45 UTC. Public reports in the window: 3. Reference: Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers. ### 91[.]234[.]194[.]113 First recorded by NSS on 2026-11-10 at 13:53 UTC. Public reports in the window: 1. Reference: Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures. ### 91[.]92[.]242[.]121 First recorded by NSS on 2024-07-09 at 08:48 UTC. Public reports in the window: 1. Reference: Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes. ### 92[.]255[.]57[.]7 First recorded by NSS on 2026-10-05 at 03:14 UTC. Public reports in the window: 1. Reference: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th). ### 93[.]152[.]209[.]36 First recorded by NSS on 2026-11-11 at 03:41 UTC. Public reports in the window: 1. Reference: 2026-11-10: Traffic Analysis Exercise: The Lucky Turkey. ### 95[.]135[.]181[.]151 First recorded by NSS on 2026-10-27 at 17:55 UTC. Public reports in the window: 1. Reference: PolinRider: Malicious Coding Assignments Steal Developer Secrets. ## MD5 hashes (17) ### 098f6bcd4621d373cade4e832627b4f6 First recorded by NSS on 2026-10-20 at 22:07 UTC. Public reports in the window: 1. Reference: HTB: Nimbus. ### 17b29b6c9de80402a45e321bbe1168fa First recorded by NSS on 2026-11-11 at 15:22 UTC. Public reports in the window: 1. Reference: Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand. ### 1fd9ccecac8794f39d826fdd8a62e6bc First recorded by NSS on 2026-11-12 at 19:02 UTC. Public reports in the window: 1. Reference: Never be afraid to ask questions. ### 36b3ecad8e2d570b8c53ed65e53842b3 First recorded by NSS on 2026-11-14 at 17:09 UTC. Public reports in the window: 1. Reference: HTB: Nimbus. ### 372b56d018b8cbc359b0819e402f11d5 First recorded by NSS on 2026-11-12 at 17:54 UTC. Public reports in the window: 1. Reference: The Hidden Relay: Inside a Device Code Phishing Kit That Never Shows the Code. ### 3870a559b5b6ea6076f5f90029c180b7 First recorded by NSS on 2026-11-10 at 13:58 UTC. Public reports in the window: 1. Reference: Dark Web Profile: CyberXero. ### 3f49a821c5c08c9e5ef49f4084ecd513 First recorded by NSS on 2026-11-14 at 17:09 UTC. Public reports in the window: 1. Reference: HTB: Nimbus. ### 648894d150483a6a8d1b9d555ff3a6f9 First recorded by NSS on 2026-11-14 at 17:09 UTC. Public reports in the window: 1. Reference: HTB: Nimbus. ### 6e33ec0fe4463a313585d4c7f1e9097c First recorded by NSS on 2026-11-14 at 17:09 UTC. Public reports in the window: 1. Reference: HTB: Nimbus. ### 7107fb029e7c63523e3aca5fc8e56b38 First recorded by NSS on 2026-11-11 at 15:22 UTC. Public reports in the window: 1. Reference: Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand. ### 95a6a4b638cfdfbe3afc883d593a1f87 First recorded by NSS on 2026-11-05 at 19:01 UTC. Public reports in the window: 1. Reference: Never be afraid to ask questions. ### 9eee984b187423c46c10a63d080da15d First recorded by NSS on 2026-11-11 at 15:22 UTC. Public reports in the window: 1. Reference: Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand. ### c236f2af130f959a5723562fa5eff7b2 First recorded by NSS on 2026-11-14 at 17:09 UTC. Public reports in the window: 1. Reference: HTB: Nimbus. ### cf903e4a1629aa0582fd0363b5786676 First recorded by NSS on 2024-05-29 at 15:31 UTC. Public reports in the window: 1. Reference: Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand. ### d631627131b90d576d77f4bf530e1abe First recorded by NSS on 2026-11-11 at 15:22 UTC. Public reports in the window: 1. Reference: Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand. ### d6c049a09ba8ac3085c51ee9df24a4e5 First recorded by NSS on 2026-11-12 at 12:13 UTC. Public reports in the window: 1. Reference: Attackers turn NIKKE's game launcher into malware. ### e251df2d0b7c3682965efb4d2009a2f4 First recorded by NSS on 2026-11-11 at 15:22 UTC. Public reports in the window: 1. Reference: Citrus Ransomware: VLESS for traffic, Sn00py for encryption, and LLMs lending a hand. ## SHA-1 hashes (3) ### 133883ab9f6ede5b9ba6b82e27bedaf0ce152f25 First recorded by NSS on 2026-11-06 at 06:01 UTC. Public reports in the window: 1. Reference: Dropbear: the restriction names an address - permitopen/permitlisten not enforced for unix-socket forwarding, docker[.]sock reachable (HEAD 99baf182, live-proven). ### 28f8da19ddcdf26e426875c7a834b34a79bc1c33 First recorded by NSS on 2026-11-13 at 09:38 UTC. Public reports in the window: 1. Reference: Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes. ### dc7d7455c95b3092eb14bff2bd93315b84b066fa First recorded by NSS on 2026-11-09 at 18:03 UTC. Public reports in the window: 1. Reference: Malicious bee-js npm Release and Swarm Desktop Releases Deliver SleepyDuck Ethereum C2 Backdoor. ## SHA-256 hashes (82) ### 00c9ac44291f83c72d54302e99d155a3e26d02225a3e516764d5833a99657c9e First recorded by NSS on 2026-11-12 at 14:34 UTC. Public reports in the window: 1. Reference: 0% GPU utilization: How SANSAR hides Linux cryptomining. ### 0522937c0c0337be54fe25493539e5f5f8ceb9742c980aaff1cfc9515f3a96f7 First recorded by NSS on 2026-11-12 at 14:13 UTC. Public reports in the window: 1. Reference: PHP2Shell Exploitation on Check Point Gateway. ### 0f1051c395438db8dc0dbe6de1cb09e6e10c83fc6062d359ca85093ce946f0e0 First recorded by NSS on 2026-11-13 at 04:54 UTC. Public reports in the window: 1. Reference: headline not shown. ### 0f8978dc13690cab2fe33ad377e4c09bb1fa181ecd2fbba9fc1b2e7c17f8d70f First recorded by NSS on 2026-11-14 at 19:31 UTC. Public reports in the window: 1. Reference: MAL-2026-19937 Malicious code in gateio-ws (PyPI). ### 101e9ac653ccd341e36fae84a5c6920dff47a41822e87db4c72e36da4830d707 First recorded by NSS on 2026-11-13 at 02:12 UTC. Public reports in the window: 1. Reference: 2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT. ### 119ef283a7038fe02a4d309ce942bcce3a37a70ef5468749ae4f4e378d971e9d First recorded by NSS on 2026-11-14 at 17:05 UTC. Public reports in the window: 1. Reference: MAL-2026-19934 Malicious code in ps-bool (PyPI). ### 12450bafc7a4398040e1ad3a16dbf4dbc79b6a8f83ef306c4f0f73f59886f06c First recorded by NSS on 2026-11-11 at 22:16 UTC. Public reports in the window: 1. Reference: The global socket: how threat actors are weaponizing GSocket for stealthy C2. ### 15dc419b7fbeb50c50820a7cd27997541deafa4fa710f074bb657f0149574baf First recorded by NSS on 2026-11-13 at 09:38 UTC. Public reports in the window: 1. Reference: Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes. ### 1bece13e2be06ddffd2ed4bf25cc171363f7e3030003e5eda4e49ede0988b115 First recorded by NSS on 2026-11-14 at 17:05 UTC. Public reports in the window: 1. Reference: MAL-2026-19933 Malicious code in gateio-client (PyPI). ### 1c14a761620691a43b1a554a9eccd38d21c15d59463945250d4f57b10d20fce9 First recorded by NSS on 2026-10-28 at 07:41 UTC. Public reports in the window: 1. Reference: From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign. ### 2063ecf38d2b7342633616dbfe9b2933f1e9d9ea73116105e55d6313279ac6e4 First recorded by NSS on 2026-11-08 at 09:32 UTC. Public reports in the window: 2. Reference: headline not shown. ### 21f0c643e1ed1b11c56bfdd5f7567b2c0172924c227206b8ab9e4210918c6ee3 First recorded by NSS on 2026-11-09 at 01:44 UTC. Public reports in the window: 2. Reference: MAL-2026-18772 Malicious code in parseyaml (PyPI). ### 2974a808e24e76c1a9fecdaaecebefe27e841204bc1aa20536c32c1f0b309f47 First recorded by NSS on 2026-11-10 at 13:53 UTC. Public reports in the window: 1. Reference: Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures. ### 2eb387df728fc6f5dd2dcffaf1883cbf8c5e0c489f6cb38021d67f856ee669d0 First recorded by NSS on 2026-11-13 at 02:12 UTC. Public reports in the window: 1. Reference: 2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT. ### 331465c8581a5dcaff2ec4ed0ace90f59daece320f7826bdfc40980aaf146331 First recorded by NSS on 2026-11-10 at 08:42 UTC. Public reports in the window: 1. Reference: MAL-2026-19074 Malicious code in futrou (npm). ### 38edbfc4ac89619d2bdb3f4bb2626deaaf422868d6d7af640f59d7959903f838 First recorded by NSS on 2026-10-28 at 07:41 UTC. Public reports in the window: 1. Reference: From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign. ### 3b51080a909023f7d484e2443740b572307ce0054eb9e32d98f0a06bfcd2db90 First recorded by NSS on 2026-11-12 at 14:13 UTC. Public reports in the window: 1. Reference: PHP2Shell Exploitation on Check Point Gateway. ### 3b70be66ff6d01cbf23ac275f3311a3ce40aa24fad549f7b742266d881998946 First recorded by NSS on 2026-11-13 at 21:45 UTC. Public reports in the window: 1. Reference: MAL-2026-19259 Malicious code in qap793gl4l (PyPI). ### 4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec8 First recorded by NSS on 2026-11-12 at 14:13 UTC. Public reports in the window: 1. Reference: PHP2Shell Exploitation on Check Point Gateway. ### 45e598a8dddd7e9cc7b7e7a2f319c0e9f3f090ad4a089e50c3c9e4d75ee9d718 First recorded by NSS on 2026-11-10 at 13:53 UTC. Public reports in the window: 1. Reference: Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures. ### 4fd6430a61e5d42a452c3a7de94d03173b9eb02d06aa33357fe5ee9776524aec First recorded by NSS on 2026-11-10 at 13:53 UTC. Public reports in the window: 1. Reference: Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures. ### 55d141bb2f62c527c3fea3413b8429fed7d52633d0b123b5e611bfa42165229f First recorded by NSS on 2025-07-21 at 20:02 UTC. Public reports in the window: 1. Reference: The global socket: how threat actors are weaponizing GSocket for stealthy C2. ### 569a21b519aaac8c92f653d708ab6ef34e3f38ea967f47e041d1e2425f6a4b33 First recorded by NSS on 2026-11-02 at 14:26 UTC. Public reports in the window: 1. Reference: PapRAT Campaign Exposes BITTER's Expanding Espionage Toolkit. ### 58e503cc2e6aacc6bdba54f40a7edebf7a5362bef0a9039769baaba8c472c4db First recorded by NSS on 2026-11-13 at 04:50 UTC. Public reports in the window: 1. Reference: Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th). ### 58eb890b612938867237c3fa1715b8742d9b25a8fe136cd75ea659882b7b7a10 First recorded by NSS on 2026-10-23 at 12:01 UTC. Public reports in the window: 1. Reference: Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures. ### 59c535f47ab4d35f6d9fc8b8aec4a72438ea0b89e5a4dcea74b05d2d32cfa483 First recorded by NSS on 2026-10-18 at 21:42 UTC. Public reports in the window: 1. Reference: Dark Web Profile: CyberXero. ### 5a9b7a0d3f25757aea957713d7e84cabec87597b3474368328a8fd5ed7a12f78 First recorded by NSS on 2026-11-13 at 09:38 UTC. Public reports in the window: 1. Reference: Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes. ### 65f061281c9a712e9502793dc4c5035cae490b84da05f7d4223cefa65ad396e4 First recorded by NSS on 2026-11-09 at 18:02 UTC. Public reports in the window: 1. Reference: Trusted by Default: Qubole Cross-Account Access Abused in the Wild. ### 6604e2b2afca5be9f394786598898c0d718100ef3cb3595590fb74949b3eb9b5 First recorded by NSS on 2026-11-08 at 11:49 UTC. Public reports in the window: 2. Reference: MAL-2026-18763 Malicious code in agentic-call-control (RubyGems). ### 675c24728f87f7aa0fa07527027c95c24c246049c65eaef89270ab04ea50a180 First recorded by NSS on 2026-11-12 at 14:34 UTC. Public reports in the window: 1. Reference: 0% GPU utilization: How SANSAR hides Linux cryptomining. ### 6ba1aa275e0e2826e8b48b36473539ca56cbdc41f429e539a45f8532b084d7a4 First recorded by NSS on 2026-11-12 at 14:34 UTC. Public reports in the window: 1. Reference: 0% GPU utilization: How SANSAR hides Linux cryptomining. ### 71e21094c1ac1cf0275c91ed377965e248bca1c12711f6dd20e2682681fc1192 First recorded by NSS on 2026-10-18 at 21:42 UTC. Public reports in the window: 1. Reference: Dark Web Profile: CyberXero. ### 721b376b505d760e78f3ac8417b54789f538a5a8127f59fe7c2660067366ce32 First recorded by NSS on 2026-11-08 at 11:49 UTC. Public reports in the window: 1. Reference: MAL-2026-18761 Malicious code in infra-libs (PyPI). ### 7d6f675842c53ecd7e78bcbc396a02f73665d842dafe8c213fd714f30fdb8ec5 First recorded by NSS on 2026-11-11 at 09:55 UTC. Public reports in the window: 1. Reference: Analysis of Wpcdoor Attack Case Distributed Through Domestic DVR Management Software. ### 7db6d4bfe675bbaa2043f2958993761070ab6e5a09572d884082465b51bdf437 First recorded by NSS on 2026-11-13 at 04:54 UTC. Public reports in the window: 1. Reference: headline not shown. ### 7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f First recorded by NSS on 2026-10-22 at 20:00 UTC. Public reports in the window: 1. Reference: Never be afraid to ask questions. ### 81b2cc96166cfebf7a2fb72d280ca06f5b9c4c9c735f6aee4beceafbce5430de First recorded by NSS on 2026-11-08 at 23:28 UTC. Public reports in the window: 2. Reference: MAL-2026-18770 Malicious code in bundyfed (PyPI). ### 83327b9e45cb49b02f4a3681837f5acdc84f15373a85648f4409946e6fa72f75 First recorded by NSS on 2026-11-08 at 11:49 UTC. Public reports in the window: 1. Reference: Malicious code in control-character-command-injection (RubyGems). ### 83716a1c499cecbd64fe45f5ff56ab70ea6d1543e922c55e0514f2e2a69fe391 First recorded by NSS on 2026-11-12 at 23:49 UTC. Public reports in the window: 1. Reference: MAL-2026-19201 Malicious code in hesk (crates[.]io). ### 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf First recorded by NSS on 2026-11-12 at 02:49 UTC. Public reports in the window: 4. Reference: headline not shown. ### 8b5026d841aa93758ec3cb55c276f84d3ec1cf459810e0d9aa5624e2776f2fcd First recorded by NSS on 2026-11-13 at 04:50 UTC. Public reports in the window: 1. Reference: Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th). ### 92a789444708fa1cb4cc5a89e0aa6cc7a279b62a7b8a4d2857255a18197d0090 First recorded by NSS on 2026-10-18 at 21:42 UTC. Public reports in the window: 1. Reference: Dark Web Profile: CyberXero. ### 96fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46 First recorded by NSS on 2025-12-26 at 01:18 UTC. Public reports in the window: 1. Reference: 0% GPU utilization: How SANSAR hides Linux cryptomining. ### 97d10fee9034b632ade0ace8612645594a710e3686e8408e89e24a300102ce56 First recorded by NSS on 2026-11-12 at 23:53 UTC. Public reports in the window: 1. Reference: How Attackers Hide ScreenConnect in Windows Installers. ### 985c3972712218c62d2418b41056dba5fe883ca5104d8ec12041f8611db344f9 First recorded by NSS on 2026-10-22 at 20:00 UTC. Public reports in the window: 1. Reference: Never be afraid to ask questions. ### a1146a6fabdfef289472f99a56851249e7a46e8d19d4d8bf85fe833e2f0158b6 First recorded by NSS on 2026-11-14 at 02:14 UTC. Public reports in the window: 1. Reference: GHSA-QFX6-Q44V-9QQW ag-psd can exhaust memory when parsing crafted PSD dimensions. ### a49edd934436b6bb41d7805becfebe94285739c8bb758cd4d1ab807250509295 First recorded by NSS on 2026-11-11 at 09:55 UTC. Public reports in the window: 1. Reference: Analysis of Wpcdoor Attack Case Distributed Through Domestic DVR Management Software. ### a5ae0aab352871bc0b038b3aa43b03eb223425628c884af7b9fc592cd34eb86c First recorded by NSS on 2026-10-18 at 21:42 UTC. Public reports in the window: 1. Reference: Dark Web Profile: CyberXero. ### a970e997093fcd10d108354423c8fa420a6887ed97cbf7c7dbe3551faa4d9b95 First recorded by NSS on 2026-10-23 at 12:01 UTC. Public reports in the window: 1. Reference: Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures. ### aa6dfd7ee90d9aea5af29ae39c14ff70cf8687118abadd7aa4fc98923f01ffd1 First recorded by NSS on 2026-10-28 at 07:41 UTC. Public reports in the window: 1. Reference: From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign. ### acc706afc9322a3eae1ef49049749e0a7c9f1a123895ac56dc8a289beb2fb5b7 First recorded by NSS on 2026-11-12 at 14:34 UTC. Public reports in the window: 1. Reference: 0% GPU utilization: How SANSAR hides Linux cryptomining. ### adeb015fdb37814edc3ed45230f48d2b0e87bb195a5a7e4487c01549b47c744c First recorded by NSS on 2026-10-28 at 07:41 UTC. Public reports in the window: 1. Reference: From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign. ### ae59aedc4d89d7b22db5dc65cd0b2ff68b20b74863d44f53fd346de739081694 First recorded by NSS on 2026-11-12 at 19:02 UTC. Public reports in the window: 1. Reference: Never be afraid to ask questions. ### b0ee22dee7a8a9710992294f73069f047d31506b50dc1150ef6013fcd6225ed1 First recorded by NSS on 2026-11-10 at 13:53 UTC. Public reports in the window: 1. Reference: Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures. ### b54a8d9e98ff36dfe63b2aea97a2003b670f7311595bb4dd072850fed5900a0b First recorded by NSS on 2026-10-28 at 07:41 UTC. Public reports in the window: 1. Reference: From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign. ### bb6afd419500201966e8ccb55d2f3c8ea28caae5ec8bfc59a87dcf19ca9d022b First recorded by NSS on 2026-11-08 at 11:49 UTC. Public reports in the window: 1. Reference: MAL-2026-18766 Malicious code in dynamic-object-handler (RubyGems). ### c34cc30cb1cff5c47d77e62a3ba63e9a183989ec1ccdf7929beb1bcae0d41f23 First recorded by NSS on 2026-11-13 at 04:50 UTC. Public reports in the window: 1. Reference: Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th). ### c6e64453ea8bc0856333b6f57567c9efd8c440410787cae135d1c4a248c07c0d First recorded by NSS on 2026-10-28 at 07:41 UTC. Public reports in the window: 1. Reference: From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign. ### c7d9477309fac6c638a1128442056a242de086996add8cb49cd6496c36003237 First recorded by NSS on 2026-11-12 at 14:13 UTC. Public reports in the window: 1. Reference: PHP2Shell Exploitation on Check Point Gateway. ### cc0ad05bfe85940a6067b3a72c182d3953339129206634141926d5d0b35973ec First recorded by NSS on 2026-11-12 at 12:13 UTC. Public reports in the window: 1. Reference: Attackers turn NIKKE's game launcher into malware. ### cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b First recorded by NSS on 2026-11-12 at 23:53 UTC. Public reports in the window: 1. Reference: How Attackers Hide ScreenConnect in Windows Installers. ### cc1ad7f14777a098ccc91fd4e8f6143da14418c2b6fdf23b7f8f6b3d1b0b7f1d First recorded by NSS on 2026-11-12 at 14:34 UTC. Public reports in the window: 1. Reference: 0% GPU utilization: How SANSAR hides Linux cryptomining. ### d2ce56d3cbce6034dcebd88520ffec19a094c0888b7e797f66c46bc69e8d2eac First recorded by NSS on 2026-11-14 at 19:31 UTC. Public reports in the window: 1. Reference: MAL-2026-19935 Malicious code in demo-pingtest-xyz (PyPI). ### d345671e688ee807e1bb9b6fc45e6bb0611bbb1331c33888c8030ec2db47e672 First recorded by NSS on 2026-10-28 at 07:41 UTC. Public reports in the window: 1. Reference: From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign. ### d6453c71dad6e54f6da82865427269aa20b223cca8a29a0079cd05e57ca72ede First recorded by NSS on 2026-11-12 at 23:53 UTC. Public reports in the window: 1. Reference: How Attackers Hide ScreenConnect in Windows Installers. ### d7549671c7189979f0624ec52dad9ea6a707d23146e3585ab8f8c4720eca0c63 First recorded by NSS on 2026-11-12 at 14:13 UTC. Public reports in the window: 1. Reference: PHP2Shell Exploitation on Check Point Gateway. ### d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa First recorded by NSS on 2025-07-23 at 18:17 UTC. Public reports in the window: 1. Reference: The global socket: how threat actors are weaponizing GSocket for stealthy C2. ### da5f11fa30f28362c8394977403d7736c91c828ba295b3d175baa1c8539edf8b First recorded by NSS on 2026-11-14 at 09:37 UTC. Public reports in the window: 1. Reference: MAL-2026-19930 Malicious code in trezortranslate (PyPI). ### daf0fb9836af133a053a98dbd88106efeaccd310d038b52f596a53be0efc6f76 First recorded by NSS on 2026-11-14 at 19:31 UTC. Public reports in the window: 1. Reference: MAL-2026-19936 Malicious code in gateio-sdk (PyPI). ### df8ab6fd699e6ae90e63e9696bae8f01342708bafc2ed88af414337e4f237194 First recorded by NSS on 2026-11-12 at 14:34 UTC. Public reports in the window: 1. Reference: 0% GPU utilization: How SANSAR hides Linux cryptomining. ### e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b First recorded by NSS on 2026-11-02 at 14:26 UTC. Public reports in the window: 1. Reference: PapRAT Campaign Exposes BITTER's Expanding Espionage Toolkit. ### edb3e92eb7bda7413a09edcc4b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3 First recorded by NSS on 2026-11-12 at 14:13 UTC. Public reports in the window: 1. Reference: PHP2Shell Exploitation on Check Point Gateway. ### ee16e1695711b9d60c62925fcfb2fe1a29c18ae26565bc05410a14e16d2a39d7 First recorded by NSS on 2026-11-12 at 14:13 UTC. Public reports in the window: 1. Reference: PHP2Shell Exploitation on Check Point Gateway. ### f004357dd044b3c2c644a1f759dcd47a154a37533635280af0f3b5adb76469a4 First recorded by NSS on 2026-11-09 at 01:44 UTC. Public reports in the window: 2. Reference: MAL-2026-18771 Malicious code in extrahtml (PyPI). ### f0f8ceed9d5db100de257e6c8a4c85b08a30fd9591de754169adcfe0cf627bcb First recorded by NSS on 2026-11-12 at 19:02 UTC. Public reports in the window: 1. Reference: Never be afraid to ask questions. ### f4b1f888f29faa7fbec180f42bdc78596e8a8b908c0a6e6c419933703c81df85 First recorded by NSS on 2026-11-05 at 19:01 UTC. Public reports in the window: 1. Reference: Never be afraid to ask questions. ### f5c9a28325ed2eab5c7d029bfed410f05ae858b6b436e3b14891f29a6ec96d73 First recorded by NSS on 2026-11-10 at 13:53 UTC. Public reports in the window: 1. Reference: Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures. ### f693b92cac909344a9cbab93f5f80ab6d820759af5042d323d90f10351d39d76 First recorded by NSS on 2026-11-08 at 11:49 UTC. Public reports in the window: 1. Reference: MAL-2026-18760 Malicious code in expect-tests (PyPI). ### f82b1f071f557e9f25cfce6d7643f19053c6a2bd7d61470fcf114ac53e950c63 First recorded by NSS on 2026-11-12 at 23:49 UTC. Public reports in the window: 1. Reference: MAL-2026-19200 Malicious code in basek (crates[.]io). ### f95c4d029e6784e3849b4d1e2e2ae1a661187236ef7c5d487c71158a290a03b5 First recorded by NSS on 2026-11-11 at 22:16 UTC. Public reports in the window: 1. Reference: The global socket: how threat actors are weaponizing GSocket for stealthy C2. ### fb1a6235eb6bce8c9ec8cd8bb85f17c9c2bde8ecb45b7a243a30ceadf26654da First recorded by NSS on 2026-11-12 at 14:13 UTC. Public reports in the window: 1. Reference: PHP2Shell Exploitation on Check Point Gateway. ### fc4c01fd11bc301cf312830460cfdccc3af9dcfe50c910b86d6a1117bc76c747 First recorded by NSS on 2026-11-13 at 11:16 UTC. Public reports in the window: 1. Reference: 4EverAble2Shell At a Glance. ## URLs (38) ### hxxp://156[.]238[.]252[.]37:8000/bot.x86_64 First recorded by NSS on 2026-11-01 at 15:02 UTC. Public reports in the window: 1. Reference: Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th). ### hxxp://157[.]20[.]241[.]16:8080/jup.sh First recorded by NSS on 2026-11-13 at 07:16 UTC. Public reports in the window: 1. Reference: Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2. ### hxxp://160[.]119[.]69[.]4/hima_data/index.php First recorded by NSS on 2026-07-30 at 19:41 UTC. Public reports in the window: 1. Reference: From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign. ### hxxp://171[.]22[.]131[.]24:8133/api/t First recorded by NSS on 2026-11-13 at 04:50 UTC. Public reports in the window: 1. Reference: Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th). ### hxxp://194[.]150[.]166[.]244:8080/exfil First recorded by NSS on 2026-11-12 at 02:49 UTC. Public reports in the window: 2. Reference: headline not shown. ### hxxp://45[.]150[.]32[.]130/37339606cba4522a?force=1 First recorded by NSS on 2026-11-13 at 04:50 UTC. Public reports in the window: 1. Reference: Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th). ### hxxp://45[.]150[.]32[.]130/4be1066a49e75?force=1 First recorded by NSS on 2026-11-13 at 04:50 UTC. Public reports in the window: 1. Reference: Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th). ### hxxp://45[.]95[.]147[.]178/hima_data/index.php First recorded by NSS on 2026-07-30 at 19:33 UTC. Public reports in the window: 1. Reference: From Hijacked Pbx To Stolen Trunk Inj3ctor3s Campaign. ### hxxp://aws[.]nimbus[.]htb/847219365028/nimbus-jobs First recorded by NSS on 2026-11-14 at 17:09 UTC. Public reports in the window: 1. Reference: HTB: Nimbus. ### hxxp://site[.]vietnam852[.]com:88/ip.php First recorded by NSS on 2026-11-12 at 15:58 UTC. Public reports in the window: 1. Reference: Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners. ### hxxp://www[.]dumbsplash[.]com/ilto/ First recorded by NSS on 2026-11-13 at 05:04 UTC. Public reports in the window: 1. Reference: Beware of phishing emails disguised as purchase order confirmation requests (Xloader). ### hxxp://www[.]hlushkova[.]top/ef5f/ First recorded by NSS on 2026-11-10 at 13:54 UTC. Public reports in the window: 1. Reference: Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures. ### hxxp://www[.]stanbicfinanceug[.]com/9wgi/ First recorded by NSS on 2026-11-10 at 13:54 UTC. Public reports in the window: 1. Reference: Formbook Targets European Manufacturing and Technology Businesses with Localized Order Lures. ### hxxps://abc123[.]ngrok-free[.]app/voice/webhook First recorded by NSS on 2026-11-11 at 03:52 UTC. Public reports in the window: 1. Reference: headline not shown. ### hxxps://anadnet[.]com/updates/?action=getmetadata&slug=quick-pagepost-redirect-quick First recorded by NSS on 2026-11-14 at 07:01 UTC. Public reports in the window: 3. Reference: CVE-2026-126697 Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel. ### hxxps://analytics[.]insightjs[.]com/comm/assets/insight.bundle First recorded by NSS on 2026-11-12 at 12:13 UTC. Public reports in the window: 1. Reference: Attackers turn NIKKE's game launcher into malware. ### hxxps://cashewminaret[.]org/identity/gateway-dom.js?18e76625db12fb1d First recorded by NSS on 2026-11-13 at 02:12 UTC. Public reports in the window: 1. Reference: 2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT. ### hxxps://cashewminaret[.]org/identity/middleware-build?osgdpy5p First recorded by NSS on 2026-11-13 at 02:12 UTC. Public reports in the window: 1. Reference: 2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT. ### hxxps://cashewminaret[.]org/identity/reset-layout.js First recorded by NSS on 2026-11-13 at 02:12 UTC. Public reports in the window: 1. Reference: 2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT. ### hxxps://cdn[.]gsocket[.]io/bin/gs-netcat_mini-linux-aarch64 First recorded by NSS on 2026-11-11 at 22:16 UTC. Public reports in the window: 1. Reference: The global socket: how threat actors are weaponizing GSocket for stealthy C2. ### hxxps://cirroreplyurldemo[.]azurewebsites[.]net First recorded by NSS on 2026-11-13 at 02:21 UTC. Public reports in the window: 1. Reference: Inside Cirro: Enumeration as a Restricted Guest. ### hxxps://domaina[.]com/uploads/.ab12cd34.php?cmd=id First recorded by NSS on 2026-11-12 at 16:51 UTC. Public reports in the window: 1. Reference: CWP2SHELL. ### hxxps://domaina[.]com/uploads/.ef56gh78.php First recorded by NSS on 2026-11-12 at 16:51 UTC. Public reports in the window: 1. Reference: CWP2SHELL. ### hxxps://gsgg[.]b-cdn[.]net/bin/gs-netcat_mini-linux-x86_64 First recorded by NSS on 2026-11-11 at 22:16 UTC. Public reports in the window: 1. Reference: The global socket: how threat actors are weaponizing GSocket for stealthy C2. ### hxxps://gsocket[.]io/install.sh First recorded by NSS on 2026-11-11 at 22:16 UTC. Public reports in the window: 1. Reference: The global socket: how threat actors are weaponizing GSocket for stealthy C2. ### hxxps://gsocket[.]io/y First recorded by NSS on 2025-04-08 at 05:01 UTC. Public reports in the window: 1. Reference: The global socket: how threat actors are weaponizing GSocket for stealthy C2. ### hxxps://hyperpwn[.]xyz/ First recorded by NSS on 2026-11-10 at 08:32 UTC. Public reports in the window: 1. Reference: Re: Rooting ISPs and Hosting Providers with Hyperglass. ### hxxps://keylogger[.]nullsect0r[.]tech/log First recorded by NSS on 2026-11-12 at 23:49 UTC. Public reports in the window: 1. Reference: MAL-2026-19200 Malicious code in basek (crates[.]io). ### hxxps://ns[.]mo7sen[.]dev/EadF.php First recorded by NSS on 2026-11-12 at 16:40 UTC. Public reports in the window: 1. Reference: ScreenConnect Attack: SCKit Turns Remote Support Into an Attack Platform. ### hxxps://ns[.]mo7sen[.]dev/eadf.php First recorded by NSS on 2026-11-12 at 17:08 UTC. Public reports in the window: 1. Reference: ScreenConnect Attack: SCKit Turns Remote Support Into an Attack Platform. ### hxxps://ns[.]mo7sen[.]dev/eadf.php?p=4 First recorded by NSS on 2026-11-12 at 00:37 UTC. Public reports in the window: 1. Reference: Active ScreenConnect attacks breach MSPs, impact dozens of organizations. ### hxxps://orchardandbarite[.]com/gross First recorded by NSS on 2026-11-13 at 02:12 UTC. Public reports in the window: 1. Reference: 2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT. ### hxxps://orchardandbarite[.]com/spa First recorded by NSS on 2026-11-13 at 02:12 UTC. Public reports in the window: 1. Reference: 2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT. ### hxxps://store-eu-par-12[.]gofile[.]io/download/web/a2a60e90-dea4-4c6c-9a02-be5ede78dc08/solace.exe First recorded by NSS on 2026-11-08 at 11:49 UTC. Public reports in the window: 2. Reference: MAL-2026-18762 Malicious code in rainbowcolors (PyPI). ### hxxps://w[.]anadnet[.]com/bro/3/ First recorded by NSS on 2026-11-14 at 07:00 UTC. Public reports in the window: 3. Reference: CVE-2026-126697 Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel. ### hxxps://webhook[.]site/dcf126c3-9328-4fb7-943d-0fda6e997c16?src=gh-readme-cmdi First recorded by NSS on 2026-11-14 at 09:37 UTC. Public reports in the window: 1. Reference: mechanize-takehome-rce-poc. ### hxxps://webhook[.]site/dcf126c3-9328-4fb7-943d-0fda6e997c16?src=gh-readme-ssti First recorded by NSS on 2026-11-14 at 09:37 UTC. Public reports in the window: 1. Reference: mechanize-takehome-rce-poc. ### hxxps://www[.]cryptic-heaven[.]net/contract First recorded by NSS on 2026-11-14 at 09:29 UTC. Public reports in the window: 1. Reference: How I received a job offer, and they hid a way to launch malicious code through Git inside the ZIP.