{"generated":1792412924168,"iocs":{"1l0bt3w":{"src":"https://www.wiz.io/blog/anatomy-of-ai-driven-cloud-attacks","h":[],"ip":[],"d":["webhook.site"],"u":[]},"maxdzc":{"src":"https://objective-see.org/blog/blog_0x57.html","h":["899e66ede95686a06394f707dd09b7c29af68f95d22136f0a023bfd01390ad53","846d8647d27a0d729df40b13a644f3bffdc95f6d0e600f2195c85628d59f1dc6","8bd4b789e325649bafcc23f70bae0d1b915b67dc","4f3367208a1a6eebc890d020eeffb9ebf43138f2","4f3367208a1a6eebc890d020eeffb9ebf43138f298580293df2851eb0c6be1aa","08dd7e9fb1551c8d893fac2193d8c4969a9bc08d4b7b79c4870263abaae8917d","d2e8bbc6db07e2c468674f829a3991d72aa196fd"],"ip":["67.43.239.146","185.62.58.207"],"d":[],"u":[]},"mi1eid":{"src":"https://objective-see.org/blog/blog_0x56.html","h":["d3308664aa7e12df271dc78a7ae61f27ada63bd6"],"ip":[],"d":[],"u":[]},"16vr7j3":{"src":"https://objective-see.org/blog/blog_0x54.html","h":["6588d262529dc372c400bef8478c2eec","ca57054ea39f84a6f5ba0c65539a0762"],"ip":[],"d":["unioncrypto.vip"],"u":["https://unioncrypto.vip/"]},"v9s598":{"src":"https://objective-see.org/blog/blog_0x53.html","h":["3d0d7e5fb2ce288813306e4d4636395e047a3d28","b639bca429778d24bda4f4a40c1bbc64de46fa79","23017a55b3d25a2597b7148214fd8fb2372591a5","6850189bbf5191a76761ab20f7c630ef","a8096ddf8758a79fdf68753190c6216a","6588d262529dc372c400bef8478c2eec","55554944ee2cb96a1f5132ce8788c3fe0dfe7392","8d204e5b7ae08e80b728de675aeb8cc735ccf6e7"],"ip":["46.226.108.171","69.195.124.206","89.34.111.113","185.49.69.210","193.37.212.176"],"d":["message-whatsapp.com","appstockfolio.com","unioncrypto.vip"],"u":["https://appstockfolio.com/panel/upload.php","https://unioncrypto.vip/"]},"7d9ynd":{"src":"https://objective-see.org/blog/blog_0x52.html","h":["a3b89da4ccb998ef9fa66fb11bafcfa1"],"ip":[],"d":[],"u":[]},"1f1lzkm":{"src":"https://objective-see.org/blog/blog_0x51.html","h":["6588d262529dc372c400bef8478c2eec","55554944ee2cb96a1f5132ce8788c3fe0dfe7392","8d204e5b7ae08e80b728de675aeb8cc735ccf6e7"],"ip":["104.168.167.16"],"d":["unioncrypto.vip"],"u":["https://unioncrypto.vip/"]},"1ayob0x":{"src":"https://objective-see.org/blog/blog_0x49.html","h":["74390fba9445188f2489959cb289e73c6fbe58e4"],"ip":["185.228.83.32"],"d":[],"u":[]},"sl86h1":{"src":"https://objective-see.org/blog/blog_0x45.html","h":["b639bca429778d24bda4f4a40c1bbc64de46fa79","af10aad603fe227ca27077b83b26543b","97200b2b005e60a1c6077eea56fc4bb3e08196f14ed692b9422c96686fbfc3ad"],"ip":["185.49.69.210"],"d":[],"u":[]},"1fi2060":{"src":"https://objective-see.org/blog/blog_0x44.html","h":["de3a8b1e149312dac5b8584a33c3f3c6","23017a55b3d25a2597b7148214fd8fb2372591a5","07a4e04ee8b4c8dc0f7507f56dc24db00537d4637afee43dbb9357d4d54f6ff4"],"ip":["89.34.111.113"],"d":[],"u":[]},"1c5963h":{"src":"https://objective-see.org/blog/blog_0x3D.html","h":["758f10bd7c69bd2c0b38fd7d523a816db4addd90"],"ip":[],"d":[],"u":[]},"scugxq":{"src":"https://objective-see.org/blog/blog_0x3C.html","h":[],"ip":["82.163.143.135","82.163.142.137","45.77.49.118","185.243.115.230","40.87.56.192","94.156.189.77","185.206.144.226","46.226.108.171","37.1.221.204"],"d":["www.celasllc.com"],"u":["https://www.celasllc.com/checkupdate.php"]},"1rykkln":{"src":"https://objective-see.org/blog/blog_0x3B.html","h":["4613f5b1e172cb08d6a2e7f2186e2fdd875b24e5","df2a83dc0ae09c970e7318b93d95041395976da7","6d1614617732f106d5ab01125cb8e57119f29d91","da342c4ca1b2ab31483c6f2d43cdcc195dfe481b"],"ip":[],"d":[],"u":[]},"1ew2k5i":{"src":"https://starlabs.sg/blog/2026/10-two-hawks-in-a-pod-one-android-rat-behind-a-flock-of-fake-japanese-brands/","h":["24e58e12c24180abf800f142b83348b318f60894f94571a68eea98481abd84f0","a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc","c65dec85e6271c91f39de06a6df2d439ee348cc7365d3079e07cf28025b4d7d7"],"ip":[],"d":[],"u":[]},"15ahe09":{"src":"https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access","h":[],"ip":["144.172.64.128"],"d":[],"u":[]},"1mb6406":{"src":"https://www.volexity.com/blog/2026/10/16/mind-the-patch-gap-part-3-analysis-with-volexity-volcano-threat-intel-and-mcp/","h":[],"ip":[],"d":["cloud.shinewrist.net"],"u":["https://cloud.shinewrist.net/foo/Files1.html"]},"1h2r20n":{"src":"https://opensourcemalware.com/blog/ghostaction-copycats-polinrider-by-hiding-a-stealer-in-a-fake-font-file","h":["cb3842832267421b9563c7bd32d3582a8fff624860e57c2c9058966735d4da60","61eca87b4b4c3e6248dc0fde25ff9cf28637798a8c4be172eaef9843252d12f6","92dec8f50d934c338ff3c1bcbf1c9b028aa9561128d0077a101a1ef4dac0f0db","a043f03e89ef55779f4f630138cf5efe1dd37632e176c7a0d9bbfa989ba84eeb","6d258db70677c99c08c9db37e002751eb0f0fb7c0cab2a4effd7c8fa8d115d19","d301438d713006a7a63889969fb5a30389c88bba5fbd89ef22becac611823a4f","40a007874722c46e0d194c4453f6cee26ee9c64513597784cc9c0e8b85471e7c"],"ip":["193.32.204.199"],"d":[],"u":["http://193.32.204.199:8080/?c=reinject","http://193.32.204.199:8080/?c=auto_20261013","http://193.32.204.199:8080/?c=security","http://193.32.204.199/?c=new","http://193.32.204.199:8080/c2/"]},"1vf7y91":{"src":"https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/","h":["2bf7992e6260c1a98c709fa98ec766fb9f27692f338b30b43ac821b824fd849e","27d799ceadb570bfca890d4c2572314afe57eecf14083d30409da15afdfc4704","d73186cea6cf2cf3d48c09139a9d15521365aab675787b4e7a6f81767331c9fd","9e45830171eb607cf2c0fc80f5cc9cc3db39bb937032136990383a595f6f151e","c527b94e3d21824a674face4cd9d862e536b60ccbf54573839e3360f99188343","d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa","44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879","1505a3a727f8899b2ad343519f7bf9c438b8b802f8d6b854f5db3b52f857c76a","76c58fad4f70cf277a15a499b9a2151ac60e7a6b5c7a9ab684843dcc19f0d0a5","b1e82c6b0caea177e8bb71ad826867f509c65f0a43a651b50253e7c726566eac"],"ip":["104.194.158.65","45.88.188.140","198.23.185.234","138.68.244.146","185.21.136.6","72.61.89.179","109.224.53.140","162.243.175.162","154.93.37.228","141.164.58.87","88.80.150.232","88.119.167.57","173.212.247.23","104.248.131.53","147.182.224.216","93.93.112.57","192.210.183.17"],"d":["magento.ink","solidmonpe.com","wibu-bau-bawang.online","beraskencur.site","gsocket.io","transfer.sh","bashupload.com","filebin.net","catbox.moe"],"u":[]},"v366g2":{"src":"https://blog.talosintelligence.com/the-q3-vulnerability-pulse-discovery-exploitation/","h":["9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507","2915b3f8b703eb744fc54c81f4a9c67f","73ac1bbfaee6c76c34f655ac0477a4cd930f2aa55e658c8e312ff81aac9a741f","63f3351cfdf618bec6045f60203e7978","58d6fec4ba24c32d38c9a0c7c39df3cb0e91f500b323e841121d703c7b718681","f1fe671bcefd4630e5ed8b87c9283534","fed979f93bcaf4e73ebd25748093a92095d5109cbd01d55f97bdc50ce509ad2f","207d9d891ac756b2bfad88aba5682c65"],"ip":[],"d":[],"u":[]},"hn0p1g":{"src":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/","h":["dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb","1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462"],"ip":[],"d":[],"u":[]},"171517m":{"src":"https://www.infoblox.com/blog/threat-intelligence/inside-help-tds-hotejka-cloudflare-pages-and-predictive-detection/","h":[],"ip":["162.244.35.33","91.196.33.144","62.113.117.248"],"d":["pages.dev","linen-thorn-wild.pages.dev","roi777.com","pastebin.com","varbani.com","roi-traffic.icu","hotejka.com","roi777.online","zenno.club","ultraviewer.net","sun-sky-calm.pages.dev","ligia.ns.cloudflare.com","coleman.ns.cloudflare.com","fosetya.shop","hotcname.help","lib1.biz","serv.host","usa.on1xvpn.com","usa.on1xvpn.ru","pinkfels.shop","hotejka.ink","hotns.rest","zylvantrexor.lol","goalods.lol","trixsolvesxa.shop","arrow-berry-gem.pages.dev","ashen-drift-stone.pages.dev","solar-cloud-branch.pages.dev"],"u":[]},"s7oh8a":{"src":"https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering/","h":["ee89c99f3753231771170f5d9cbbae1e","31323e7e738230fa6a8deef2b7894666","d2f9ef2429312667f0512504b6a19ba4a9cc5514f1b2933923dd42f75a1c5934","bf73c4391b58ca95220ce3ae03f66dcf","9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450","6670ab3f0434a42f33416f8354150b1701e7615f3cfa2f1635e54f8df0f6eec7","11e576df44e9c9eef72b9f5b699291bcdb200a19130778ec231e5b0987b913ad","b360b6db0c2b668317edc1504a7c39ef047f0d925c8f113b521f6724c157ae21","9ed503c6a9a3a493fb859401e9ed469eed77ab9927341964d6dbfbfa6255aeba","d167bc898e856da8a4003cb4dfc7de55fea109eee3cd64fc8999710314109464","8fbaa74b27dc1e89abfc694e834378746f0ad37a688098c5f8f511410157c8b8","5837bc26a73cfb46ffd466cf889f03ce2f6a48f1f3fd42ec8be22189d51cab1e","4c0a75e0f62ddc0bb350c224fe996f3b2ab08dcb0d288231c61ffe9406c7045b","4b4d25b3501519476f9a62a88a781e4f446f669280eb5e98c6b96eb6d3743431","d7cfa659d224928e7b72c806dcf2169594d993ecf6422e6efcdcf251190f2e7c","14b31918075e6130b9123158743db0a81e2d7bfcf6d39731ee7d9200a98cd591","8c8090aca8ddb1cf968d2b810457e0cfce97c03cd721f70d2eca7f37f2681fc4","7b252be444dee2fb2a57043a823dc5b5e1fae970aea91ee2c8339aa70329969d","2d99e9d732ff9304d97c7856b052ca520ae689fec1ce86df724de741913afa4b","dad559ae9bc977783c7251591eeb7aa432b860ce821ccf10b1260fd0e650c951","d71a119b4950ee88dd36205176d989a64df5248ac268591d4bbb78621a73acbd","924ad92d89dde577d5858b2ebc5703a485467842d78e98b75019b2e2e0ac3fe6","286e0d8c7bdfaa7c251a3e8f0f2fefbe25c67586c0149d39b1095c89dc6023c8","f2a7d0a4c8613a9cdd31ede6131b27040c0571ca97970b245a710191806d7ac4"],"ip":["8.210.84.56","8.218.65.184","47.239.60.117","96.126.191.98"],"d":["promotion.storage-data.com"],"u":["https://promotion.storage-data.com/config/component.zip"]},"1muqyae":{"src":"https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming","h":["91a9788a4e7576a17806bf3af0a8b07043b779f8"],"ip":[],"d":["mtrtb.com","d23625plpxg1yn.cloudfront.net","infinoas.mtrtb.com","ppv2.mtrtb.com","dtech.adtimizer.co","tracookiepixel.xyz","cookie-sync.xyz","akedo.gg","adtimizer.co","discovertech-alb-100966113.us-east-1.elb.amazonaws.com","tekma.adtimizer.co","tekma-dmp.ai","discover-tech.io","myipinfo.io","volasim.com","www.discover-tech.io","ads-monitor.xyz","d8lmy5wyiokrq.cloudfront.net","d39619tdxn6mhj.cloudfront.net","d2f4zpg1mgzwov.cloudfront.net","d1fzw0miu1r9rc.cloudfront.net","d19oo8r6k9oumb.cloudfront.net","d147nolwbekx2b.cloudfront.net","dcv2rnj2ograe.cloudfront.net","d1x4e580sn23dn.cloudfront.net","d2epnp0vokbtl7.cloudfront.net","pagead.trustlayersdk.com"],"u":["https://d23625plpxg1yn.cloudfront.net/iframe?impid=9IV7g%2BfykP3oJT3FXlJkl%2BLl4BSzjtUawfMu9fP5wkc5DN7ntRrf8REGVnO5hobj95Nvl4FMj2df29qcqlT7eBOnd0hDiwskAfMv2P4pichYSlisMk8n7xk2h4pa%2FmgvJiBPD5Z%2BQjVxH%2FfBtS8xrHAtZA35NY8Kj%2BcdOyMMgdzI44SbipeB%2FBMNE5Ql3mLrXjF2p5nbqpXIhEZ96IlfcH5yEsv9RKJ%2BEfSXubJDo"]},"5ah1jw":{"src":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-105133-and-cve-2026-105134/","h":[],"ip":[],"d":["imagefiles-backup.oss-ap-southeast-7.aliyuncs.com","xmr.kryptex.network"],"u":[]},"1rcscb4":{"src":"https://starlabs.sg/blog/2026/10-yuankong-rat-the-android-remote-control-service-that-stamps-its-operators-names-into-every-build/","h":["73cbe8e3730cacfdd208f22eab468bb5495a78c0eb2cb37eff5af0cafe321387","675d083b63e2169e8fd0ac0cfd27904005b5e2be00f6e3489f6e47fc4c57a4d1","4280a408a7f0490d9d2eaa3f536f339b","12480408006dece2fa756b3572766eecb6fb2144a1226f4e21c4cb7d54383105","af92f7d616564dabffb0679a1a38fb24d6a6c4e4a90114c6eb0834c57dd456c9","b94b2608c3b296f521000550c1267bf9","d96056e9f00bb82c621be36f6a7c5c1f47cce61d11be141ee976c0092c8693b1","5e4d1980f76e571dd0300b9fa356818f874528fc0517d0d0e0afb7e561904764"],"ip":["206.82.1.14"],"d":[],"u":[]},"aegta5":{"src":"https://www.greynoise.io/blog/proxyjacking-edge-devices-residential-proxies","h":["e3dedf983c572d3e646a9b70fe9b41be497a3a2e5342c36dd3bd37cef7ebeffd","fdc18f4287c1c6a285c664d3ce0f17d3479bc246bc6c163eb90b1a84adb453a7","4fd7fa22776dbfde7ddaf02a4f904564593e2ed69f87cbb7bbd6c206a874ecf7","26abd52f207739556282023e82873424795abc5e527771205a40749f90c01f6e","df27938d26c1c9421ff307aafcb87131521e05f5d87ecaaab4a32ece3335fee4","2c12a3193b1528cd0a88d4fcfa0c060404de4c2bbe1fecb3fc3fa347f04e0165","71f2924a549a8f79a48ff332b071a12cd0b01e9ba643e9f8ed7b72b6d382325d"],"ip":["209.99.190.80"],"d":[],"u":[]},"cddqz0":{"src":"https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/","h":["b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70","829b1cd270b30565739a478441833f49f10a49bd06f0d18cc96c8ae4a0431f11","bd064244dad748cf2a44074bee56f5bfab4a2b18ee944b75d1b3febd4c1fe02a","9c4c4436ff5cdf0d6d68f5108031cbf3708a095cde4ef8c09316af7a7110437e","fc1b10c58057ef9f1f9a1e2a3d4a1c89f43b0ead451398c70ed7a6e0312b36ee","f84eea718526706afdf2d1a2774fab76ecb11c18fb61995a37be8249c5e379ab","b7ae166fd49a7ecfe6322a80b8aa56d6aa0825d8f5d106dab2e4fb7d14ce15a8","8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92"],"ip":["45.32.41.202","198.199.122.22","23.240.77.233","47.18.167.159"],"d":[],"u":["http://23.240.77.233:8085/","http://23.240.77.233:8085/pM.js","http://47.18.167.159:8085/pM.js","http://23.240.77.233:8084/directory","http://23.240.77.233:8084/acme/new-acct","http://23.240.77.233:8084/acme/order/11111","http://23.240.77.233:8084/acme/authz/1","http://23.240.77.233:8084/acme/finalize/61924744/774083503"]},"1xm0duq":{"src":"https://www.proofpoint.com/us/blog/threat-insight/disruption-targets-major-chinese-language-phishing-kits-japanese-focus","h":[],"ip":[],"d":["kenandy.shop","paidy.farradae.com","lygyaou.com","ylhgkj.com","new-app-haixing.com"],"u":["https://kenandy.shop/paidy/ubmisionsjp/","https://paidy.farradae.com/paidy/ubmissionsjp","https://lygyaou.com/9AioLNhtdi.kumamoto-city.jp","https://ylhgkj.com/BCuXkTPfKZ.kumamoto-city.jp","https://new-app-haixing.com/1DWSd1DeDf.kumamoto-city.jp"]},"1jyz4ut":{"src":"https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/","h":[],"ip":[],"d":["jewishchoice.org"],"u":[]},"svvsbs":{"src":"https://www.malwarebytes.com/blog/threat-intel/2026/10/fake-calendly-meta-careers-pages-steal-facebook-and-google-logins","h":[],"ip":[],"d":["joinconnect.cfd","joinconnect.works","joinhire.cfd","joinhire.info","joinquest.cfd","joinquest.info","joinquest.works","jointhetalent.cfd","jointhetalent.info","jointhetalent.works","jointheteam.cfd","rkrt01c0mc.execute-api.ap-southeast-1.amazonaws.com"],"u":[]},"19gbp55":{"src":"https://blog.trailofbits.com/2026/10/14/package-managers-have-an-integrity-problem/","h":["9b129329f58692f6e6578329498a8fe9fbe98f090beb764ffbb8ee2eadd01dcd","cac0f6daea041b0ccf42934163defb20","d88e31b84d65e754935053b1c584ea8e2320698a","b094ded77ee97a6027ad6cf0e8c7b9f88381814c"],"ip":[],"d":[],"u":[]},"13jujmi":{"src":"https://www.huntress.com/blog/fake-watchguard-vpn-credential-phishing","h":[],"ip":["74.208.236.39","80.249.132.140","158.94.209.19"],"d":["watchguard-vpn.com","watchguard-vpn.net","www.watchguard-vpn.net","watchguard-ssl.online"],"u":["https://www.watchguard-vpn.net/"]},"12hvz0u":{"src":"https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935","h":[],"ip":["25.1.1.1","25.1.1.2","25.1.2.2","25.1.3.1"],"d":[],"u":[]},"adh76s":{"src":"https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/","h":[],"ip":["108.165.147.64"],"d":[],"u":[]},"1yok3nf":{"src":"https://blog.virustotal.com/2026/10/introducing-macos-mirage.html.html","h":["be77bca22f078d57058535ddcf26a39a752a8df030392cb45ba6a60e06651878","f7dcdc4167ec267aef007f9d5f98e9e0314185e5355effd3e304b6fa686ea84c","d7dd630f67e03d2945185838dca887211ea3693c91fc0bd0d2e257948bb3b678","b8017658b8eef8b1293176d76212e600b660d0a36a4f5dc80141324fae360bbf","01f9a24bd868a856909db5eb61be6f30939e402fd7dd2e40180ffe2406de5c35","336c1ba08fb64d466e042e16f20bf0d1f3947e4430000be08c2b6698884de028","c363180da38cac9e894b158a65eb3ad72eb31c24a6b16c00bbc3bfc276db32d5"],"ip":["109.238.87.111","193.178.159.129"],"d":[],"u":[]},"1cnnf2b":{"src":"https://blog.doyensec.com/2026/10/13/Sfape.html","h":["aefedeb6a7f84679c192d3c19f6c08c3e508222574ae5c9e3d0e10fd2dece4af","1b5b909dcb4d9dc73a036ddfb9b97a80da54925dba72f2c0cce36c58edf5d33a"],"ip":[],"d":[],"u":[]},"nmkal1":{"src":"https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages","h":["d719bf57e65ba09de1bacdb182c99118edafd518fd3a4a9797bcad221adb8151","b31c6e241ac846728da9c1fac4936651cffb944d143ab816276bcc6da0284787","e98f37d7f4e1fa433d19304dc2258042090e2d1d7eea7670d41f738d08729660","ccf8a1cec56605b8517552ba1a2d061c03a29e90274fb2fcf59ba4b75c392390","985829083f3937df6c82419216f7697afae0caac8efca6257a756066fe2c0abb","5ee7145061f05779f7f6f9b72e216713d17d53e183a92f408bfbbc44f2bfb95d","42a760b15fea7c9af718ee45386c1c3ea1bec9e30c95d16c287bcc8b2efdc72e","127ae4cad80b6605157ca2a1feada8a235e16aacc5d2119337a98115a4e13274","20f0a401676292d4ae34932e61f34afa97bcfc47ee517cda2afeb7222264a193","a50cdb508d13884630945a98eea0615b866d938eb0a16c5d958e6c8c181a6df8","68f5a00eafa8ecebf5d93328e0fec23b24d6f91808c8384db002946a13656c71","ee8cd9aba420f1b26b5d43e5bcdd6025a277b4946bb5daf76ab45c0e5f7ecd0b","ed5cb4af1d2cb067b8d23783ebf05d70278728462ba4f1bf29da0a3a41efc35e"],"ip":[],"d":["vrf.apexaccs.org","verify.apexfdn.xyz","arena.apexaccs.org","arenapex.cloud","cloudmain365duo.top","fdn4apex.com","main.router-apex.com","update.apex-arena-router.com","ccmihr.com","0auth-chromium.com","ehegisnightmare.icu","www.dropbox.com","apexaccs.org","token.apexaccs.org","arena.apexfdn.xyz"],"u":["https://vrf.apexaccs.org/api/v1/vrf","https://verify.apexfdn.xyz/macos/installer/terminal/interactive/bash","https://arena.apexaccs.org/dashboard/pilot","https://arena.apexaccs.org/api/llm/v1/chat/completions","https://arena.apexaccs.org/api/copilot/mcp","https://main.router-apex.com/updater.sh","https://update.apex-arena-router.com/loader.sh","https://ccmihr.com/macos/jquery.js","https://ehegisnightmare.icu/build/nTOugj-fWWMurYHg/bludness.exe","https://ehegisnightmare.icu/build/J2BkQFArlBUXf4MF/install.exe","https://www.dropbox.com/scl/fi/tbxu5vgr9l1vuw3s7rw7v/VisualStudioSetup.exe?rlkey=o6dpwfynneuxeyok7g5trtv96&st=nj5jxsoe&dl=1"]},"6iruzv":{"src":"https://opensourcemalware.com/blog/ghostaction-phishing-campaign","h":["3eebe7d8c33c1ffd3876be6a44bedcfbccb09c43ecd3562d7242fe43e244fc51","2c2066652172b6358a573e993ed413c6137a042268b5188394169650fefb2313","6b159fd26f574345a095aed40e27b73c3a22d35c7de5464436810d9cd89223f2","10ef603a50587a8fb6b44829b9eff8c188637d9bc7eeda5c5986b34d43cf7cdb","68c20885a3e234c9eb1e4f87a7013298923646f9c50dfdad97a9e35d989119f8","e6bdd7e782ef2fbf42209509993811a63ae19f1580d2453b8324b87db5ad1449"],"ip":["193.32.204.199","95.214.27.108"],"d":["my-github.com","github.my-github.com","api.my-github.com","docs.my-github.com","collector.my-github.com","my-gitlab.com"],"u":["https://my-github.com/SDRVuhYw","http://my-github.com/","http://my-github.com/SDRVuhYw","https://my-github.com/login","https://my-github.com/sessions/two-factor/app"]},"1w8mtjq":{"src":"https://opensourcemalware.com/blog/ghostaction-attack-escalates","h":["7fbd40446a82c77b23432c6ab73bd8595c98e90e4f4a473198b4d1256f3e8c4b"],"ip":["193.32.204.199","170.39.218.2","45.139.104.115","18.167.164.26"],"d":["my-gitlab.com","my-github.com","gitlab.my-gitlab.com","bold-dhawan.45-139-104-115.plesk.page","carte-avantage.com","objective-hopper.45-139-104-115.plesk.page","ghassets.my-github.com","github.my-github.com","api.my-github.com","gh.my-github.com","sncf.carte-avantage.com"],"u":["http://193.32.204.199","http://193.32.204.199/c/","https://my-github.com/SDRVuhYw","http://193.32.204.199/?c=monami&quot"]},"bvv5mk":{"src":"https://censys.com/blog/the-ultimate-guide-to-brand-protection-with-censys/","h":[],"ip":["45.194.44.46","43.157.174.200"],"d":["binance-idexchange.com","ab.com","google.2oauth.com","usps.xupqnqz.one","i-ua.cc.cd","bigmir-net.cc.cd","meta-ua.cc.cd","gta-six-leaks.com","account.check-profile.digital","check-account.digital","mail-secure-login.digital","account-protection-team.icu","verification-service.cc.cd","r.oblox.com.et","js.rbxcdn.com","www.roblox.com","headshotz.ai","redirect.rbxinfra.net","beta.eggywall.cc","acme.com"],"u":["http://binance-idexchange.com/333.mp4"]},"1gd62d5":{"src":"https://dti.domaintools.com/securitysnacks/it-always-comes-back-to-dns-iranian-vpn-over-dns-activity-in-the-2026-conflict","h":[],"ip":[],"d":["supaghost.cc"],"u":[]},"18eeyi":{"src":"https://www.stepsecurity.io/blog/ghostaction-returns","h":[],"ip":["193.32.204.199","45.139.104.115","170.39.218.2"],"d":[],"u":[]},"1hvb02m":{"src":"https://www.infoblox.com/blog/threat-intelligence/when-a-wallet-drainer-asks-dns-where-to-go/","h":[],"ip":[],"d":["listchoiseopenleaderboardseptember.netlify.app","render-984.pages.dev","noir.black"],"u":[]},"1y89k3b":{"src":"https://socket.dev/blog/ghostaction-cloud-credentials","h":[],"ip":["193.32.204.199"],"d":[],"u":["http://193.32.204.199","http://193.32.204.199/?c=monami"]},"xo7fik":{"src":"https://www.threathunter.ai/blog/azure30-nodejs-backdoor-trojanized-msi-clickfix/","h":["e08a33f5a9a722f05c1fb881ccb48337013a8824444a0fae7adf0e107b5700a0","f84ee2ce545c4a96a1ffa89fae89c0c0","249945a84797252d3f15742a695bdf4a05e2350e","cf0e8e12b06533929150a2df806a597d","c435c1eb474a335b48fbb40745a1c1c9b77d0772","e58352492f1605380d1ddef0287ed380b31061fb","0bd0ba59f5e31cd37637b72b042bd0da09f935b2","d6a2ba02d52c61bdd355d36d5e16397808a0f2e4","e921fe5307e29bf6fd00000dd594356affd3a7b044e52720c7f10decbdc305b9","e89ed5c2f859a81eeda81880edfcb931e8e69988cea86aa425dcbc55cdf661f9","de54fd3af55c1b95229bdb25791053e172fb0e75c4e214047b0ae3b330926f98","142642785c2bd4ca3baf1691dd1c86938f338daadf9f66ba2030d3076a52c686","3ee1f0744b66ebdb5d0debeffee9bf8ebbf1301eb196cb1c35a34f6cc2b5b473","36c34b602987687457a538d6788113253aaa4e5880a68e0e3df69bed15070252","93416eb93cebf61de3856d9650cf0f0f1a62c54848399b3d1d989fa6e718324e","df97bb9b57b254f592650df7d89d5a8e2a7a294d8af54baf3398000f79a6397c","c4bf33bb6c5ddc8357537f7d1b1107ad293a5352f2016a2717ecec84aeb4db44","f42d3f717ea64ccb113b5b2bd25cce69f19dcaf89f4bdd14d2f9d4cdd32e4fd0","9dbddba534a154fb29f0edc20d99b7c1d96766ea75cf9a930ab90d0fde3da763","4b3a357fe7bdec0d8555a8a80c7922f3e85bb18822bdec08ebbbe690b83823b1","ab36258431c902359d8a6c87145d644f6eb08f9f7fcf4adf3052a27d68c0b6c6","c10b7deee5ec55bcb3936d88c62a661c99c3d5bd257a5ad50fe58d79f4358050","8133bd9c038df80cfe855d1ae83c3b2aee6c45fb7ed50afdb164f19f6b275e68","a814f510b8cdfca1ded3f46808af5e91ad2ee0e94f9173c16809bad2c3d33292","2e2d350edd52862c48ee6072e9f7b5cde4bfd7d6c03263e242e221128deca365","b8350cad312c3fb8480faec550cd10e390c24119d6f9478d6105c4bf127f6f74","c6770cfd5d0b18dbaea871001c7d18f47f2f132d12b4bf784ebd8a44c3a1b4b9","eeadf86449af05649e5e4734f0fb02843da800a55a5fa35063e4e7c120840020","b77b7cd86284c5c1f025176af24c1c432a98eedef5b443dcd263816788bbc54d","81c10d3a550a0efba3087e6da45ea7e04d11422460b1afb115df92b8ddb2b211","fbe7e6984be4a22fbe000e4b0f018d170e26b16ee96dbbcda7106f1b42d0c569","4c96caab1f05300825c2b1d818c3aab66dca786071ebf3517cc325bd1cd18840","b47d2dd6e946df9d1a0aba4951ac13744a1814e3b4a1236a095d7927a787cde5","48b7bef5d3a7c98411efcb0af108e1b927f2dc266f06df97a4bbce70e5f5c17a","368f80e8d385c2569b366250bbb28f6c77932b728e445e71a640b8bd72c08f4b","8072cefe934454e727bff04406537925a006e296ccb4f0e31dcfd7455ceecfaf","2af45b4fee8f4e89047464a591951d34d203a5533cc14c4be0f71ad484e77f3f","3acb1d0ddd346b9b5c1fa64dbc2b9ee1b9866cc02b1e0e60ef8785abfe652bb3","29c03878e42ac20901beba376967c9de97588bbc073a3969c6bfe2846bf40746","ec44fa52511c43f99a904d86bf917c272d0b7907814408b72c962b28d4a5b726","f6b9ce1b3c2111c5f71543a714b13581bb42c8c212137b24c2381f2ccf00c644","f50d86d68e1b74c0187d73dbcffdf25406f636c34b2f5ca1c0481f3a375fbb45","70cc4cf3986d46c6f9f37e38dd91434123978e8e36ac075d90a2dcd39db2dfac","ac10585593e3f161c316d036ac54c31b268c21f357449ec80c30e607dd086975","5c0c278c6a3cf5237676afae1926bde3c1437896b65e51a5b62afe292c80dc5d","8f1938520d63c220d65f1232ff58b20640e4c1cbdf8317b853b5be0a8a3e4f05","96f022d77e96fca21c1a798057d29f8fd01f6825561c9e0693d6ba1db34ba60b"],"ip":["23.94.145.92"],"d":["usatraksell.net","usaclodconfig.net","shift-api-control.com","dibardo.net","api.ipify.org"],"u":["http://usaclodconfig.net\\lnegraverif.php?ver=","http://usatraksell.net:443/api/agent/script","https://api.ipify.org?format=text"]},"1miu8gw":{"src":"https://www.huntress.com/blog/ahsaycbs-flaws-exploit","h":["05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034","4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d","481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21"],"ip":["51.195.127.124","177.4.12.11","38.60.252.110","107.191.47.199","185.220.236.49","104.234.26.10","123.202.208.37"],"d":["imagefiles-backup.oss-ap-southeast-7.aliyuncs.com","xmr.kryptex.network"],"u":["http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com","http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/Taskgmr.ps1&quot","http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/Taskgmr.ps1","http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/edge.exe","http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/msedge.exe","http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/config.json","http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/WinRing0x64.sys"]},"kl16kf":{"src":"https://www.zscaler.com/blogs/security-research/suspected-tradertraitor-group-uses-trojanized-terraform-provider-deliver","h":["9d78ece09457907b730d139e4e0c64dd","73adaea97f003735335505858c1c6def","116f7189ed7b41f1b339a749d56e63be","9d88b4494c7bc27b10358b68a899ad54"],"ip":[],"d":["hashicorp-terraform.io","arusupport-region1-webhook.online","urldelay.servehttp.comroofdeck"],"u":["https://arusupport-region1-webhook.online/statics/cache/v11/abicfjej"]},"1xbszls":{"src":"https://blog.talosintelligence.com/making-sure-the-checks-get-printed/","h":["9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507","2915b3f8b703eb744fc54c81f4a9c67f","fed979f93bcaf4e73ebd25748093a92095d5109cbd01d55f97bdc50ce509ad2f","207d9d891ac756b2bfad88aba5682c65","9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f","38de5b216c33833af710e88f7f64fc98","73ac1bbfaee6c76c34f655ac0477a4cd930f2aa55e658c8e312ff81aac9a741f","63f3351cfdf618bec6045f60203e7978","58d6fec4ba24c32d38c9a0c7c39df3cb0e91f500b323e841121d703c7b718681","f1fe671bcefd4630e5ed8b87c9283534"],"ip":[],"d":[],"u":[]},"1f7r9nn":{"src":"https://www.bitdefender.com/en-us/blog/labs/midnight-mimosa-malware","h":["0903d7fd3e1d4a599a7eb3c5d356779b","61aac6a98abd6dcff0dc41bb88159786","250205ee4b8de59e60c745856f439608","08d231c6a5303e543eb60d4181f6a4ea","4a171f62d1bab01827b06ae73d4caafa","e250e5966c119a9098f7818fc6c080e5","3b20edff1125e146aa3d5153708b58f4","6739fe083cfa8dec9b4f989ccba0e99e","542ab80429ec42e8643dc645f58b716c","145b806282d247441751bb4957b71606","ee70ec99121f4d7c8b5a883e5ab3a858","92390cacdd20d2ee5405093669e7302c","b862681953e945439167a736ba4cd41b","d4ceb05682ecd60f4ebb4e76e02fcf7d","2b784622422f4280e0b3e38b30dd87bc","a8847b68428fde206b6dff8001051f92","05ae89e761a890fa24f80f4be7263651","1da42505f1c83959c7f901f5139a158e","a147cd8f72aadfcf78f7723db6813e86","f456f0c6b89bd3d5124699d43971d094","2c77653b889dfccd649b82446f8c0d1b","5d29e9b24708c3ec36d1d59036124838","998e9010e5dfc4e4645f5572cbbe5b53","b3a4405d1b8d43545d07b10581008d32","0377ca97ac0ca35f9134052fede67a81","0b0d8e995e6ff24d4e9d00417446c25e","1414d4ef2d1191080abc59a407dcb6c5","345057421c7d9ac2b671c47449f35030","36deebfcda4012d18706cd170c1edf1f","37f18a20b9cf32e6f07450e903eaad7c","4507363415e7dc6d2cab14eeed137f6c","512a6db4a22244272826f39da020fb44","5b3a49938f455d1197736971c4c07228","6aca76699ec0bb8e51372d5c68c8359b","815b910f1efc95f38ba0c5b12c4f2129","c75ec7f3bcbc879aae9a21ad544d3232","d9fc6b2cd5eaa3929207f1029663d947","e51c11442a529dcd06dc7c8e45974ec2","e9b91e1d94bb3ff9a1c00b1c13eb7960","be22c91b4578ac2357a16133615df335","d5d88214170875386ab855172f881e51","dce5b0dc0e7d7059b5ab8384a7c24ec4","2b7f1a7d5f5515c05d0c8e3857155ae2","3d3358b1057b1bfbd7e60577d8a31e0c","7400c34f7c6f866499029f5e759f58bd","60bc23d3d453f258e2c4ca421cd086a9","ed1a6bed83899952b464c27aef9752cc","a57a1ba15364dfb35d334f644d7049e8","cde0490e11db8ad54737c1df59ec658b","7f7747575980098bdc98e7b7aa362697","d3faec4f013c4a1e84a1d681448312c0","e75e183027bf897eda6447366c7acd01","20108557cacd24263e7e611afc327801","aac942aaf6ec0773cbac87fde4a6b284","cf20de9d9ddc952bb2265002d26a916f","f602230f54507cbddf5ef3014737d768","079298a7a506b376def4f4ff9a250672","20cefb2c667f945d482daded7e698eea","254bc5f6f81de1f3c47534e6febaf023","31b3280f1c0836c39c470932cf6c3e6f","3b35d3c5667136134b20a8411803c97d","3bc159537c909fa86bcc55eda127b5aa","42a9f64e75911c167ec7a163e8b24920","66c6512b9a73425aba40c8bfa95d23a0","6df909898f5f1394e78508d1152fab38","6ee2be3e5558085b532dacc8db61f3e9","6eea0568d5cc776ae03e09149cec3cd8","765d3ce85a6393d05973c4cfa7738116","90e0d27d808105167fdaa3a22b918217","9e7b34e63d8d38e37667f88a945ae69a","a02f28387527abe90d73d2879f671972","abe12db77a62ecb99d6ab5dc4fff18c7","de66cac88f156c3227749e03bdf7cf54","e6650dc6721aaa27f8a289ff92e613ff","e7c56b4f580da53cd0e4f11d1a11e402","2de346602433cdd1668f36b2e9db0be1","af16072864ae0f9d755f8cf00fded359","e974cf4cc5d55cddc04f026dd3ea72b8","af7f1eef22bf5ee3d0a394f53ba7e1b8","7322d8a65a56a7ab09f4d526cb343e3d","0b8d3cd264c191f4884a25d0cc5318b5","33b2d3ec9a35cfb0b5a5d7b24ce4140e","3bb270d4927e2a8385793d9084a92fd3","4e46549122c0236307c5eef8891466f5","642d84ed5660407b972f1df642acb192","9a3d04aa36654b5c4b21edd22e46f92d","b7d0d5ae09b0d2d2f999c1087c450456","cdfcc848e16660d607aba6ecf24567f4","f0b7b1c940ebcee97eb68f528682fc50","1150da1af88729e54a34b8da5a2741c7","36f9e8cf47a28f9803fba427cf02a25c","ca7e2d265fc35aede432c4636a2cf4cb","fcb9f38cc687fc8a4637e0acdf91ab66","c55c9d7e12cc273b812ceffca8f62d4b","9a46098de785ae732e5fced55a2f3063","d145b14b9cc15799485f2592b2c16d9a","0a26a9d5f7ab91cb5eed852cf83ef078","294ab3f586d76772ae89add417cf6324","a13af0174bc211709e8b73bf60492a17","b974ef4106af6b932df352563a9b8b3c","e9ec6d7b50c1e54cd523283b9de55e10","5400ffac371c5e5c9b7f3705ce9faca5","92f2fd8bcccc8ec4ffa64c7f6b3b9b8d","ab8d6be686ca9413e27a11e85f9cef1a","879168159c155758dbfd7a76e8f21548","b6c5f7dfaf9d47cd67380a48df5e1731","cb19dbf279a3488aec76c17e8e122c14","fc812444baa071f5141ddad812d673de","4f7d3c5859100d65ff02449884841b9c","50e9cdc3ed145bbc688356eda07f8eb3","9f1e2249003ab22cf8a38048e0ff6f6c","e39bddf592016ad6d0784770df3e2ffe","7469c9c06e5f324ca608e0140156bbad","4521a5bbe0f33a15da86bd80ff5d6d9c","8ec360829f4f7ae8dcae47c02b996762","d56158a2cc8d13778df850907733b2c4","fac6548a4a7a88156468b809c4f877f5","ac8957a474f8aa812c7b233aafde4723","cf4f24fdd283f80313565b08fea9d06d","3c098465af131141996ff840bd34e791","387f7af167530486adcf3d8546063462","ee4e778e53ce4d4339d7c7888d06384d","c8ea2a7c1f52c4c2474475c28373ee27","836739fe7196437d8e998245b6f2b3b4","d6ba4044f9d57f7e86d83187982ed593","838dc8fcde1b28171e404ece1cfcde44","da67e37be01c20566990152ecfb14ed1"],"ip":["85.17.70.38","39.96.8.180","120.78.215.151"],"d":["oss.showtimetool.com","0aa0cf0637d66c0d.com","aa86a52a98162b7d.com","442fe7151fb1e9b5.com","v46wd6uramzkmeeo.in","api.weatherlive.world","cgb.jingongbuxiao.com","5.ahd187.com","zhuifengzhe.top","fyapi.freeflightbird.com","newsadapi.zhuifengzhe.top"],"u":["https://api.weatherlive.world/br_upgrade/upgradeV2/getConfigs","https://oss.showtimetool.com/...png","https://oss.showtimetool.com/ssc/2026/08-13/[REDACTED].png","https://oss.showtimetool.com/ssc/2026/07-04/[REDACTED].png","https://oss.showtimetool.com/ssc/2026/03-09/[REDACTED].png","https://oss.showtimetool.com/ssc/2025/12-07/[REDACTED].png"]},"1e8vv8b":{"src":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a","h":["48ca18a25424a0f52276290b619a7a83","72c6af6a4be99e31c4a7a0aa4f01750792788e7f6f9749243a9f2c47c14a708f","38f5ff8169423e2c756848c02e8cac3b","456586ababa08f70216c4459f4d6375676166ebfddd98a33b447ceb5099e8dc5","d61326c4e6d24aa9b67e2b7a3ef7cedf","2f5c406eb64ad8902c8e30610d43fd3efc05a14cdb8fb158818953eaf3dc6a81","f8de2e99dc7523d2c83d1a48e844c5ff","5782ff2c835c88cc1ee521d2e8c523cfad73db3f9a29c93b40c4223f0338ade9","5b5a2c7fa705d8b1eb04da5db900b0d7","0e6fecb2d369b0eae63731616a3daada52036634885ab1b85b115af6bc5bcb86","655cd134976d3e80c521708aa8be418b","36f3b7645609ef40444dbc68f01d26c543d67689eda4937272ea5cfa4df1b522","dae8f50ea44225fae3ba1f160b42bfdc","670fa10a2ddde21fd594c4fef86b554d864089ed2de7153b472e921c623403ae","fdece34bc084f1e252aeae274650eb8d","645f6f2667af01a94d04a9d7a71916a13d9426835d636b4ceee2e25ccb34e525","596b990b0b389d906a8f4384837c1878","4d488f21269b18e37aaca93ac2a61707c9b611e506cdb3b287277746e94636b5","a73eca669fe80628dbbd2c7d9bb14c8f","a14844e982f172d0f23910558c3f390a9d4c45dc32db825c2af7cf0ed8631db2","be121e707f817aa9392c55af1e7ec2aa","add7dd142e4f7e2873bc8f7b7fb6308063608e0b49a773dea93abad4047f1489","7ce68f0dd85355ba2897a68521167e56","e7e727458f573dded05537baddac2867d2801db1c3c74410398d063dfd6f6575","f82694de2f19e1bff333c27bb7eb7a56","8e1b56ef51ba70aa4c4cfd4430820f20875b354588d5d723ba4d3940ea6c924b","1933c314041415939331fce183939547","46e59172c40c95d83c3a6f24f801fc2265653c8b575b66a726463e2a4eebd7f2","8829f6f1cc5fc0aab2f6e71bfd7dc53d","752b14c6e6936991d51fcd5ebf40d303e657c2372893604f96044848ad9a5f24","cf903e4a1629aa0582fd0363b5786676","7b9efc7ef8957411cdd22582ce4bfb3a5f76d9c91cdb7e36bf85c9785a2480e9","f01a9a2d1e31332ed36c1a4d2839f412","c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e","ef713447f18f5b7ee16af4ac37ec4133","2fbcb1995c458e5affd5fb8f1f979a08ddce21714a2e413aa3d5dc44f9f245fe","8dcc4f9ccc6b6adf7eeeb3f51c95afad","33790218d5871af646feef5be29e0596d4703a45ce675c1eb2ca00140b3a1bde","b04375cca637f0702bf27feaff22a92d","c7f86a4623db5c90273cea041d43207849c5c6b0060c370b2095f13871b1366d","bcacc7ca999980d26c186ef791242fb5","2ecb51d7fa3bc3fa7ad7df64c6d0cd1f4ff2b37ed6839d3cff529fb08af49fb0","1b8e29b6b7972fb124425aaa257f8f6d","efb0437e6a6a0f07169952f1a8b734299ec9a8b1faadbed811fe017f2cf54976","4f61b9ab907f351bb40b37b10f4974d0","8b869a5edaff74ff18bca3658a519a19771e66d00ff7849af7a142dd6fc8da85","6d57c42dee8bd7789969e2dd28671162","804a53be802378a8ec4c94602fd3d6584e0d472d83148e8a42c731950fec415d","776807750280daad05348f931a33e4ef","c4503db6ece93eddf4511e787607cb14606a1df9f526f1e39992497119437cec","a973c0ab904c1b74655a906b99b76850","b1552703ff0035f197c22cdb3a514bb6aa45ec98de3ef5409faab0978f18c35e","f62cbbbdf35c7790909c26c7c5fbce05","8a592e22c51311d482272ec5aba0103c9cd0cfd78e5b5ba75dfa8f1c56926672","a05cdf6afcbb107961307f59cbab5e4f","86f1cfa6a2e0a8cb6fc1fbee28472308e6467932f8658a6a4885e29ed8c34a67","7d5a182f70bed0e4fa2f8615aba070de","e93244080a749b521f63476343ce3c81cc8c1b672fa0d9e67359aee37544c784","1bcaef76b2063f1b80b0fa0d277ec9c5","9dc85f9569a15eaf51c7d34254767ea30dd67b2178cec4cc7125288b9544fe00","4d33bfb75e27fefaa72526899604d557","644decbc6ce8c52382f4755fa6fc2cb4d89a0e7ec0e574c11b398a6f2eed04b1","fc6e8ca41cf4f6100177352660e520b4","67db57a1f957031b78f29aa91e2e87780eae3835290259eff846d8f14afb794b"],"ip":["149.28.132.137","1.34.140.5","2.58.242.74","5.188.34.134","5.188.230.69","8.219.119.5","14.1.98.160","14.128.33.8","14.1.98.223","27.154.215.126","27.154.105.36","27.149.115.78","27.149.79.35","31.232.221.35","36.112.10.102","36.112.188.119","36.112.186.135","36.112.206.121","36.249.156.117","36.249.156.122","36.249.156.159","36.249.156.178","36.249.156.205","36.249.156.206","36.249.156.220","36.249.156.226","36.112.200.35","36.249.156.51","36.112.198.68","36.249.156.69","36.112.10.99","39.72.220.221","42.73.98.232","45.123.189.19","45.32.140.182","45.32.232.146","45.63.123.142","45.63.116.190","45.131.69.197","45.76.169.12","45.77.195.169","45.32.61.246","45.77.231.209","45.76.37.168","45.63.59.121","45.77.11.47","45.32.84.223","45.63.62.217","45.63.48.36","45.76.43.37","45.76.66.19","45.76.243.67","45.63.17.9","45.77.28.77","45.76.194.89","45.76.37.85","45.63.95.62","45.63.94.71","45.77.86.70","49.93.136.14","49.93.184.194","59.120.144.153","59.124.120.178","59.120.167.25","59.125.128.54","59.120.58.176","60.250.199.112","60.250.146.19","60.251.155.19","60.248.152.204","59.120.82.67","60.184.242.224","60.251.205.37","60.220.43.193","60.251.58.145","60.248.1.64","60.251.201.8","60.248.88.151","60.248.110.97","60.249.239.86","61.220.112.137","60.220.84.41","61.247.165.27","60.220.84.63","61.220.35.15","61.221.55.4","61.222.245.73","61.219.118.99","61.216.74.97","64.176.38.35","65.20.97.251","66.42.103.188","66.42.42.109","66.42.40.189","66.42.36.236","66.42.60.242","66.42.77.138","77.111.226.5","78.141.221.241","78.141.238.97","84.17.57.40","89.187.163.216","95.179.189.106","95.179.235.135","95.179.186.251","98.159.37.4","103.107.198.117","103.16.231.220","103.16.231.254","103.233.253.197","103.25.254.210","103.149.200.44","103.179.45.203","103.73.160.232","103.77.211.193","103.106.230.88","103.172.80.35","104.238.149.146","104.238.182.153","104.238.152.209","103.51.145.98","103.73.162.99","104.156.231.98","106.53.181.231","106.122.171.92","108.61.181.104","108.61.177.81","110.42.10.148","110.85.170.125","111.203.153.245","110.74.172.80","111.55.138.141","111.55.137.40","111.203.153.95","112.5.168.102","112.5.168.104","112.5.145.154","112.5.143.161","112.5.168.138","112.5.168.151","112.5.168.160","112.54.132.162","112.5.168.187","112.5.168.218","112.5.168.231","112.5.168.234","112.5.168.238","112.51.26.151","112.66.108.16","112.5.168.29","112.51.44.102","112.51.44.142","112.51.44.143","112.51.44.188","112.51.44.189","112.51.44.20","112.51.44.206","112.51.44.217","112.51.44.234","112.5.168.65","112.51.44.37","112.80.50.138","112.51.44.57","112.5.168.93","113.76.136.171","114.246.237.111","114.255.70.18","114.255.70.20","114.255.70.30","114.246.93.103","114.246.94.102","114.35.122.83","114.246.94.154","114.246.92.58","114.246.92.71","117.133.51.176","117.61.244.135","117.56.214.246","117.132.198.70","117.92.127.132","117.130.201.90","118.163.217.199","118.163.197.241","118.163.31.226","118.163.104.67","118.163.142.80","118.163.3.76","119.116.159.217","119.13.79.145","120.233.10.212","120.36.251.100","120.36.248.104","120.42.128.165","120.36.250.103","120.36.254.100","120.36.248.109","120.36.253.106","120.36.255.105","120.36.251.110","120.36.251.11"],"d":["98aiblog.com","hmbcloud.com","hmbcloud.net","hmbiplc-01.com","iepl.node.cm","javacheck.ooguy.com","javaupdate.giize.com","sexytube0.com","twimg.co.uk","upl.natcloudservice.com","natcloudservice.com","upl.natcloudservice.com.ews","067.cz","1421.client.96html.com","1421.cloud.96html.com","1421.support.96html.com","154-119-131-252-103-58-216-162-36.m.secshow.net","20656.hus1.ptps.tk","20656.hus3.ptps.tk","2-12-44-140-78-81-211-109-241.h.secshow.net","22852.careers.96html.com","22852.careers.trendmicro.96html.com","22852.trendmicro.96html.com","23175.careers.96html.com","23175.careers.trendmicro.96html.com","24280.hus1.ptps.tk","2637596418.softether.net","28394.careers.96html.com","28394.careers.trendmicro.96html.com","28394.trendmicro.96html.com","28733.careers.trendmicro.96html.com","28733.trendmicro.96html.com","30773.hus2.ptps.tk","30773.hus3.ptps.tk","35584.careers.96html.com","35584.careers.trendmicro.96html.com","35584.trendmicro.96html.com","39583.b.alitagotest.cf","3w.feeee.io","44673.careers.96html.com","44673.trendmicro.96html.com","47298.96html.com","47298.client.96html.com","47298.cloud.96html.com","47298.support.96html.com","50669.careers.trendmicro.96html.com","51640.careers.trendmicro.96html.com","51943.hus1.ptps.tk","51943.hus3.ptps.tk","54-2-32-236-208-2-40-107-38.h.secshow.net","60928.hus1.ptps.tk","66-37-178-96-110-2-40-107-38.h.secshow.net","74788.careers.96html.com","74788.trendmicro.96html.com","77692.careers.96html.com","77692.careers.trendmicro.96html.com","77692.trendmicro.96html.com","82262.careers.96html.com","82262.careers.trendmicro.96html.com","85005.careers.96html.com","85005.careers.trendmicro.96html.com","85005.trendmicro.96html.com","88783.hus1.ptps.tk","90174.careers.96html.com","90174.careers.trendmicro.96html.com","96976.careers.96html.com","96976.trendmicro.96html.com","96cee.com","96html.com","a.alitagotest.cf","a.studiocloud.xyz","admin.dellme.ml","alitagotest.cf","arforcex.com","asean.twimg.co.uk","az.studiocloud.xyz","b.alitagotest.cf","bailbonding.info","bbs.sunmoon.website","bj-hk.hmbcloud.net","bj-jp.hmbcloud.net","blog.98aiblog.com","bsnl.twimg.co.uk","careers.96html.com","careers.trendmicro.96html.com","cch.ooguy.com","check.96html.com","checkapi.tk","checkinfo.tk","chr0mail.com","cktime.ooguy.com","client.96html.com","cloud.96html.com","csrfproxy.studiocloud.xyz","dasxcyb.ga","dc-29465b27aa45.96html.com","dc-4fe9871cb224.96html.com","dc-582fc0f46da9.96html.com","dc-843d98722400.96html.com","dc-bb503834b7dc.96html.com","dc-c11a983d7f83.96html.com","dellme.ml","dns.studiocloud.xyz","dns361.tk","dsdsei.com","eck.giize.com","eg.twimg.co.uk","etechhosting.twimg.co.uk","fcchk.twimg.co.uk","feeee.io","findfindx.com","fukua.org","gate.sinica.edu.tw.checkapi.cf","googles.ddns.net","gz-hk.hmbcloud.net","h.secshow.net","h5.feeee.io","halloween.checkapi.cf","helpuself.ptps.tk","hgiga.96html.com","honey1314520.com","hook.studiocloud.xyz","hus1.ptps.tk","hus3.ptps.tk","hw1.ptps.tk","ica.96html.com","im.arforcex.com","imap.sunmoon.website","info.96html.com","integritytoch.com","iplc-hk.hmbcloud.com","just.checkapi.cf","kk.dasxcyb.ga","leicc009.ga","live.studiocloud.xyz","ls.twimg.co.uk","m.secshow.net","ma.studiocloud.xyz","mail.bailbonding.info","mail.sunmoon.website","masaplus.club","microscan.me","mitt.96html.com","ms.studiocloud.xyz","msedge.store","mx.sunmoon.website","nikoes.gq","np.twimg.co.uk","ns1.alitagotest.cf","ns1.honey1314520.com","ns1.nikoes.gq","ns2.nikoes.gq","one.hmbiplc-01.com","payment.feeee.io","ptps.tk","puc.checkapi.tk","purple76.com","pw.sexytube0.com","pw2.sexytube0.com","random.cktime.ooguy.com","s3crts.softether.net","scallpay.com","search.96html.com","secretr.feeee.io","secshow.net","senate.twimg.co.uk","server.feeee.io","shifuj.com","sh-jp.hmbcloud.net","shop.96html.com","shopify.feeee.io","smtp.sunmoon.website","streescans.com","studiocloud.xyz","sunmoon.website","supper.feeee.io","support.96html.com","szxcm-hkg01.iepl.node.cm","t.checkinfo.tk","teyan.microscan.me","tj.twimg.co.uk","traffic.96html.com","trendmicro.96html.com","trust.feeee","tsedws.com","txt.studiocloud.xyz","update.96html.com","upgrate.checkapi.cf","v3.streescans.com","vnpt.sexytube0.com","vpn21.arforcex.com","vpn328433596.softether.net","vpn614174689.softether.net","vpn677190427.softether.net","vpn718535264.softether.net","vpn823494147.softether.net","wanfang.accesscam.org","webdisk.bailbonding.info","webmail.studiocloud.xyz","well.96html.com"],"u":["https://upl.natcloudservice.com","https://natcloudservice.com/ews","https://upl.natcloudservice.com.ews"]},"xppfom":{"src":"https://blog.virustotal.com/2026/10/internet-scanning-in-vt.html","h":["29f69693228c27033209532b5a6a97d1","3a85f1d2131fa2723ac6ade171eafacd"],"ip":["91.219.237.110","185.146.232.3","96.9.125.59","5.175.221.206","157.254.194.31","167.148.41.164","54.37.237.164","54.37.237.166","51.89.199.125","51.89.199.118","185.14.92.162","185.14.92.223","45.87.41.133","64.111.92.89"],"d":["grabber.cy","lumma.cy"],"u":["https://5.175.221.206:8443/"]},"yfzky4":{"src":"https://blog.talosintelligence.com/ignore-all-instructions-and-read-this-blog-the-state-of-ai-analysis-evasion-in-malware/","h":["f8f5e0440c57c7deffd75ca33e2511867039796aa803e7ef847396a379188a7d","34098fe0bc4c69c4c4eb3f74688fb375326804536d25e5574e8c4c28c113b5c3","389066bd5543aeea363d23a4dce7f7a21c7f2c73c61f506a93a69f594cf48ecf","5f60d16fa67ff8ef07817c33b7e6b7fa91c6c21060020df46b1f5c56e076e259","a0294f7152f9c4c908e9def58279e9fa29952715947c950c8489949f26a15cc8","c17bf76d02163863c251c3bb3a12725eeb525fab5522521923925e0469ca269f","2aa7f13bf474e2ce5049fd4db2bf4da04b4ce51ac0d36dceb24865255241c937","bacb5794a300f7a88c7f6d458382eb11d2f39c0f496b509ca512afe8588fc33f","2e3e1bcd44cc3cbec4f5ca9991d14a326d3cc6bf76fe6e0d434c9b5f7e1ae6ab","a42632c68d2dcea06300e790c9440fe0943ce0dee2075f29170fd2774eacf433","7dd3747d777f9576a11004532b463351e7718b6af193d8ee7221ac41479d199a"],"ip":[],"d":[],"u":[]},"1kti4n0":{"src":"https://www.welivesecurity.com/en/eset-research/matchboil-new-tricks-same-old-evil-intentions/","h":["f886b615cb9e23ead2718ff2a61155acfb04ce9e","1e2c4aac30edff86cd9a30bd08b199bcd3d0ccce","c85d28f7d272ce2bbbfb9dae71d21bf25b8d00fc","050926727cdd74f0b3a8a098e60b76d10fb06b14"],"ip":["64.95.10.223","64.95.13.210"],"d":["lanner.pro","f.com","rvice.com","nerate.com"],"u":[]},"y5t5ui":{"src":"https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm","h":["25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef","b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec"],"ip":[],"d":[],"u":[]},"1m0ajyd":{"src":"https://socket.dev/blog/tensorlake-compromise","h":["25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef","b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec","b614155fd88114d40549b259457bcf921df091b9"],"ip":[],"d":["iseekaigogo.com"],"u":[]},"18b1zoi":{"src":"https://starlabs.sg/blog/2026/10-novinarya-an-android-stealer-that-hides-its-live-c2-in-a-shop-bio/","h":["be165239e4fe899b1f2eedf6459d363bca4fe6856fda87a63ba5d4e5e612e1c9","a572a20b5aa7103d743769cd09bf08ede95903c315d1a4b61aa6cf5faee44b72"],"ip":[],"d":[],"u":[]},"17gmvvz":{"src":"https://censys.com/blog/darksword-coruna-open-directory-finding-report/","h":["1334417664270db20af705f422878c53c8378203","864d68e64618d6bfc26d75d6f780ae0b7bfed3698cc8333818ed32519e560d1f","c391bce7b09a0ea263e4b2c1d1bde0327c180723fa3299b006485429564c61ee","8973e80ab494c02463d4123f76fc5e2dca2ea2c097317d246323d75c1f2eb791","a50c4da5c92636b2b1f170cdce3bd967a213886a8df5656cf3519214fcecfac5","54a4166ab33ffe02b41de9c943e783d20129b6cc22f56b7fe7d564fd02bde006","7ff5bb16cd5f8c92bc4fec72bba162662f202af075418db5000a1b4f81489fc2","c73dfcfd60a0c7ebcc03352d433349bc","09d0b8d58a71653cd1c89c64c866f2e6","2d2aebba0bf3d7d694194a7ab93b0a96"],"ip":["185.189.45.40","43.134.165.205","156.239.230.120","166.88.95.90","23.148.212.237","47.102.192.23","183.154.173.30","182.239.114.223","154.217.250.206","202.146.222.253","112.213.108.85","14.128.47.81","154.219.127.147","199.30.90.154","101.35.158.183","218.25.85.177","218.25.85.178","59.46.4.117","59.46.4.119","154.18.187.160","203.91.77.253","154.219.127.94"],"d":["66ds.lol","your_c2_host","hdios.cn","t.me","ccwu.cc","wumian.cc.cd","fc.rsqqq.top","iplcz.cn","g.northlab.cn","manager.g.northlab.cn","northlab.cn","i.131422.com","st.onlinefc.top","siekeltd.com","escofiringbijou.com"],"u":["https://66ds.lol","http://YOUR_C2_HOST:8082","https://t.me/YATA0000","https://backup%u.fit","http://199.30.90.154:18090"]},"1ofoovj":{"src":"https://www.levelblue.com/blogs/spiderlabs-blog/inside-phantompolia-remus-stealer-delivery-via-donut-shellcode-in-clickfix-campaign","h":["5a3589462b41fa8cf91ac2c7773a285d9c790548","36e9baafedf5bacf043ff3d862ac3aa4","8212d2bda1c4647998b1a92edae33b80","a136171cf7f550fc39ca425091cde99ab6605e8f","663566d170555c92a9af909089ec1e28","034415dafdf168c75e4600b7c9458e8fcd9db957de0f413947c2333b2e5e240e","cd919a6a7c6e942e9d97773b3069f8b2306a1dd4981203506bb5302cfd4062f2","b7a49bfe734499684435a2d5bce25994deccf7fab1752ae98b892bbdee44a056","4dbdca7277427edee4d5b4e3d012bca73aefadf1","9ba9103cf28abf54e63655cc57956403d1f48a42b51d9277a5b94eb2e6116979","28b7605be52b7107cd7710f6f855a1a026e72f4a","baadf410b634ffed2decbc4f66f2613fa2d1559a749aac8a4311631b46cb77ec","5ea589954314fe8d5ecb509b35d77a389912b42f","6177effa359be26ba663cb6f511c376a6c6145394bcfb9cc6ad13e26c0efc3e0","3b14187b76dc39005e8d568b26455d53bd198749","834cd32eb3b4c87a2bec086625319c50a2625ca839065dabe9fd3c5647105edb","61b3e0681f6485e4e85e5ee981757d8b12ec414f","a8e443851e9a99444395c156022c599bccaef93cf56788ea76695ec5f79bacfb","5a155a3f01fa60c3fa0177022ba05fcc6a313a4d","fea685e85ae8f904b3e979afc0e062bb","11a879d4599de275ab48f899bb6c507cb80559204178c1854de131c5cc7af65f","05629f35dfe1409ea963c135581c228e3b71869b0707974244f6938af635a70e","8f4903b8b110ec1b9580a5a27bf49c3e4793538a863100559d085b7545fcda25","f02e2fefd74c7268e3aced61017173fff92e2a1d0e7eaf7807189f371fbfcc1f","61def8b242913b520ec110458a416b02a6a38dc8765bc76bd571ee7ae8350aae","22b0fc350b5e5c557344267b3c44323ac117d3fbeb5cf1bcb8b027352155fa11","a38e6f54efe342b4a2ca9ac4428a5268faed96cd602baa1886efb09f72435abb","5363bc92bac44aa2ba87b46c59fd3f78d5cdd32839efa854e97380a55fdacabb","dc0a864f441f0237853b40217eda577defb7c1dd15af407c7241688b1b3a3b46","a0923188fbd52277e1711ae312f3c6fb841f3cdebe1a95d5c89fe2455f8ace32"],"ip":[],"d":["cdn.jsdelivr.net","1rpc.io","unpkg.com","0xrpc.io","eth-sepolia-testnet.api.pocket.network","voderlence.com","nightflamevortex.top","voidravenstorm.top","velnoderic.com","ironphantomcore.top","stormvenomforge.top","shadowemberstrike.top","cloudcheckic.com","github.com","workeslexamp.com","spaceclou.com","littworkers.com","cokakina.com","citywebntw.com","littnetworks.com","oceanvw.click","cruahop.shop","drepace.click","spogear.click"],"u":["https://","https://0xrpc[]].io/sep","https://cdn.jsdelivr.net/npm/ethers@5.7.2/dist/ethers.esm.js","https://1rpc.io/sepolia","https://unpkg.com/ethers@5.7.2/dist/ethers.esm.js","https://0xrpc.io/sep","https://eth-sepolia-testnet.api.pocket.network","https://cloudcheckic.com/a698891e68d71ead7b51649ec27a1384?id=cf1d026f09e207c1ea44e5e0cb272ee272ab8f96507959dd0b20e0542c666f0f&nonce=c5999babb6d361afb4a799f3fb9f4f00&ts=1789650568000","https://cloudcheckic.com/3956c8bdebb48342cb2e265b6be19ae4?id=$sid&nonce=$nonce&ts=$ts","https://cloudcheckic.com/3956c8bdebb48342cb2e265b6be19ae4?id=11a879d4599de275ab48f899bb6c507cb80559204178c1854de131c5cc7af65f&nonce=eb82ad83d725e7f703d0bdc7b2927f8d&ts=1789650643328","https://cloudcheckic.com/f654a79f56219371b242f551552191a7"]},"i7obou":{"src":"https://socket.dev/blog/firefox-crypto-wallet-stealers","h":["7d9d7e80ed52350616be0215a7ded10aaeb9aaa64e34ff8af7f9177c8c855799","da447fe02e4577da97144a4d92b395078954fde1ff196746413837e1e4a20bcd","be246ca5cb1372394e0443df45454f88ca39eb4a8dcfc4a99cb8865100fb4897","c550f0860012e0dfab14ed65a9425961e22025e0ab23fd9d69d294a8aa34db2f","eb134bbf73046800c8177383754cf754b8776ec30cf5cc8a13655d259e49a4bf","2f9270269e631bc4fd634d741afcfc3df8f54e43e40b16f38660fe8ce6c26f51","225f5d6c5d70a7e7f3abf62ea0dda1cf8bf8e70565f7db748b0d8fa602da939b","6b53369fb868efb92b60af40fbd5906fa3d3d8785a7878b4af6e4efd333a4de8","8906dd85b0991fac14e5973b3f3f61d93ef1101504cb5867a004c762ee184ef7","9fea0ee3c81047f5e50eeb3a2ab2a7cd70357f3e49944b7079ab3e90c9ea0e8b","0aed5f24ce625ee6b9422083302766f74b0b9a57e1b18213328b950cc7057e35","635b31b4a19b5673fcbe0fedeb3f7ed2c27fddb739685f19ca5f3d1f1d7f0083","d9432e41e0401715bce4ce11f4a7104d94fab1ec89be553ba57a2097e418c1a1","458e7255438f15aaede02fd7f8fcfdf762aa6e08608b9546fe8aa8aa399c76b7","bb8f60b3f77d96adc93bf0515b34df7c5f1f560a9f6d0c353b7d849609e3557d","71ec70479ab78efb1e1f9507f8ff7348d5711c837cc50a0120f3a188c340f3f4","e96c75cd0c9b35000b4a3ec12d5dd23ca157e94aee7271a0fe8d8d7c9f2e9096","faf174414ddc7099360c4ae4d16497b9846cfae71ffad5bbab820bba657f94d3","b02ae1d5a0d2a5b28f8baa2afcdc7d7090fab051536303cba3ba1f17860da980","4512389444a767f12211beeb5f2ad165aca4a558e88e8f111affb30b77ed6a5a","e5c9a29d5ba0f53a49d8b333bfab17bf9878f94e8c3f325f5afacad44bb26fb5"],"ip":[],"d":["icy-star-f45c.workers.dev","fondationanimalaidrelief.workers.dev","silent-wind-get.icy-star-f45c.workers.dev","green-firefly-ab28.icy-star-f45c.workers.dev","small-boat-969c.icy-star-f45c.workers.dev","flat-wildflower-f954.fondationanimalaidrelief.workers.dev"],"u":["https://silent-wind-get.icy-star-f45c.workers.dev/","https://small-boat-969c.icy-star-f45c.workers.dev/","https://green-firefly-ab28.icy-star-f45c.workers.dev/","https://flat-wildflower-f954.fondationanimalaidrelief.workers.dev/"]},"dszmya":{"src":"https://www.huntress.com/blog/screenconnect-power-bi","h":["5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3","f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35"],"ip":[],"d":["check.vykyn.click","burnsworth.site","instance-g01s1n-relay.screenconnect.com","onthegotree.site"],"u":[]},"ffvpgj":{"src":"https://www.welivesecurity.com/en/social-media/brand-deal-scam-targeting-youtube-creators/","h":[],"ip":[],"d":["joinmatchy.com","matchyjoin.com"],"u":[]},"1965nlj":{"src":"https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/","h":[],"ip":["38.244.50.120","101.53.80.20","205.214.59.31","124.155.252.63","154.201.79.246","23.248.249.90","23.158.220.98","103.248.148.84","203.160.133.172","209.209.85.38"],"d":["xcai.pro","www.khan.co.kr"],"u":["http://38.244.50.120:18899/.claude/CLAUDE.md","https://www.khan.co.kr/en/article/202610042320007"]},"1ht2m50":{"src":"https://opensourcemalware.com/blog/how-to-investigate-a-github-repos-real-history","h":["5bdb04df0b5c92568f7b862529d5dfe946e18868","187c20dc2b421fc95b0be0bab561fa5c6fb2627f","2fac30d5be730de6e4a339e8ae4a7ba9cb896f0d","1622ff5a8f96f81e3fd192bf727f6fa078199a92","f7791d612bc4af16dd5891d6cabe17e0a3e69ac5"],"ip":[],"d":[],"u":[]},"6xokcu":{"src":"https://socket.dev/blog/vscode-extensions","h":[],"ip":[],"d":["fingercakes4sale.store"],"u":["https://fingercakes4sale.store/dsyuC"]},"21btzz":{"src":"https://isc.sans.edu/diary/rss/33400","h":[],"ip":[],"d":["up-theta-rose.vercel.app","server.na-2.action1.com","update-two-tau.vercel.app"],"u":["https://up-theta-rose.vercel.app/action1.msi","https://update-two-tau.vercel.app/adobe-ne"]},"js0kck":{"src":"https://www.huntress.com/blog/mapping-akira-ransomware-attack","h":["1f1bb322591b6d27fd2946e373d7d2efc2f4e1e66818846060d391600b600fba","d00833318a04caa019c6f95dcb3598ad947d405010bfb2f3cbd04530a00bc3a4"],"ip":["64.227.4.134"],"d":[],"u":[]},"cv0fo8":{"src":"https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/","h":["6e7d9b33f1e72ea1ede71373a604ecdb060dab7d42055179c1eede9ecd1fd239","f5b12772db6817f7a765a6fe7565fd3d4f87edc28e42fe3ec0244a372a410fc9","53f35e49eb9b271fd8cbcd3daacb525328dbf159a03dbd1c7adebe0363daa402","3fd810a3aa0039993393741b32287c367a9a5037a41e826906440887cdd3ed13","76273382e4252c1f60a2251141e108942494409c759358320735891762c0682e","d3561bd4aad003dc3e08157b0891860bb496b80cd6e44901692e08ab1d4e8260","f5ba1645694c62f527ed6ceda8c68a5c3dd92b4032439167e8e937e72803b4bd","7cc571aca6d8715d9aaad3d83e1bcd30467565d583db1dfe73697c5d00a1f875"],"ip":["91.107.156.29","65.109.214.145","87.248.129.239","38.180.136.127"],"d":["api.github.com","musicdel.ir","cloud.g-drive.cam","googeldrive.cam","drivegoogel.cam","googelmeet.online","meetonline.cam","asdfafadafg.online","github.com","ns1.soroshpasargad.com","portal.sharjahairport.cloud"],"u":["https://api.github.com/repos/peakyblinders-tm/myLic/contents/{machineId}/Lic.txt","https://github.com/peakyblinders-tm","https://github.com/GreenBeret0","https://cloud.g-drive.cam/drive/file/d/[generated","https://cloud.g-drive.cam/signin/v2/identifier?from=landing"]},"wzr3vk":{"src":"https://securitylabs.datadoghq.com/articles/beyond-valid-credentials-how-exposed-aws-keys-are-tested-for-amazon-bedrock-access/","h":["c9335bb8a21bd2c568d03b040fb86a0e72145691e54a33495ee0cfaac55835dc","923641364ef0ce3a6f1d944890244082b8c7f29c9600c0433b2a0ca9822c0608"],"ip":["115.138.247.83","116.106.179.94","128.116.206.252","138.94.168.132","154.119.213.63","157.100.141.65","172.56.122.32","173.92.116.211","181.115.172.90","181.51.32.38","186.154.182.44","190.56.117.218","191.93.177.69","196.177.214.142","200.151.53.165","206.206.119.201","213.186.157.53","45.11.61.22","46.100.30.188","47.230.250.253","50.82.6.249","51.15.192.215","59.92.240.165","71.76.4.45","79.117.129.254","82.86.130.180","83.194.172.248","84.50.134.231","85.253.221.206","88.167.240.60","92.144.3.108","92.216.157.153","93.118.107.1","98.44.224.55","85.137.53.173","87.58.197.199","194.36.27.53","216.126.227.187","146.70.173.170","173.249.254.173","85.137.52.59","103.148.197.54","103.160.185.100","108.168.65.226","109.146.93.39","112.78.151.90","95.216.34.254","89.249.72.22","78.109.78.211","192.74.128.184","72.235.197.91","137.103.56.107","69.250.15.174","138.199.15.176","94.154.46.248","94.154.46.249","94.154.46.242","94.154.46.243","94.154.46.245","94.154.46.246","94.154.46.247","94.154.46.250","87.58.197.196","151.243.18.111"],"d":[],"u":[]},"16mhdlc":{"src":"https://www.stepsecurity.io/blog/subql-ecosystem-compromised","h":["51e2a2c985c3c869510a36e8c37a3b3557af4a3c","031267ee37c5a84c25cb0542cbfeb49f30d5604305b0bdccdeafbedcbbe6849b","f0c8b0cde86b98a2869a22fd43ffcf61f1dcca252729e2be291e590e3dc5f49a","7b2807bfb5bfec2383b46ba8226f47edb330ae6b32178eab61e377f3c3486c47"],"ip":[],"d":[],"u":[]},"arfncx":{"src":"https://www.fortinet.com/blog/threat-research/clingstun-linux-backdoor-abuses-public-stun-infrastructure","h":["dc892f5013edb0aa1e61e808511387373d8d120348b5be0929621d21e6e9946a","a297eddfa7abea8d411afc0f150f8f6f30e470a77204de87e3b0815fa9bb8a84","4fbd61cb9181ebbc4fe9a6e59d3c346dc00001da48d66bd890556fc6fad22b07","121f2050e3c891b29565fd73451fff7ae60199c86eb8d79ec1eb1d9844578487","48f9b72ce72ab7087794650d6eef10135345088384fbde1482f1c74a02b80302","e6e113783356446aef66e5296db45b244f318292af7cebc2a9bd76f095a95c4c","c1d8e2829ea63b9dc1cf2c3421a5093406adad4d6622e238376e78e908e0e6e8","48962b3893f2c8261e32e6b95ea7d463d145a529a8b2a6c987dd979454405c73","76692a23abe718b93e63edefd743971ec627c0cdf3778f856bd5ec88003deaa2","ec199c78c11040fd3127887222fd75a85e5797bf96aa691a117fdd83dd663d81","c0d8ffebfba969b1c1ca76bd9623bb623e9f95155c8ceca77d8fcc521435a497","f49f45303cbfccee14ff193ac9608f860e6d616f08c0ecbef1ec44f7c863d7ec","9391c6ad17aced1142607c0c623b18d86a7697cc483d204ffac94093e26b8068","e4d12208789f36efc5a1ff765088fed95d6bb5972d1a804a4536fd42366797d4","284e5ec8748f99fd1b8c331b699a5fe5fd4448bbaae0347a940f427f931c4d14","6581bf37184bb2db899b9893064d39dd314ea691adf3281cc0aa7e0a31e5138a","10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da","2ed54e0f988a62039abed88f6394eb1e3d5ed931f0183556055417fb08844ecf","b90640b392827b4f2d280f6cf67860862953331917d42df23e1653a92f2f98ad","dfba6008a2c828a9cb62342aec53006ae05a60cb8d4c41c3fa216fd727e8c6a3","5c4e263546fb21f8fe8732789a5b6583eaa8ae11ebeef099462a7c9bf50e022d"],"ip":["124.163.212.119","222.223.152.97","118.145.196.225","5.39.72.109","77.72.169.213","154.73.34.8","20.14.234.56","81.187.30.115","185.125.180.70","64.131.63.217","82.113.193.63","207.38.82.134","66.51.128.1","83.211.9.232","212.53.40.43","74.125.250.129","85.17.88.164","212.227.67.33","77.72.169.210","85.93.219.114","212.227.67.34","77.72.169.211","139.162.62.29","216.93.246.18","77.72.169.212","145.249.115.184","217.0.0.249"],"d":[],"u":[]},"p097g9":{"src":"https://opensourcemalware.com/blog/malicious-crypto-shell","h":["97af898dfb119215afcbeb48beed7936a0e778dd","387a778a6376b6c060516ce5c1191a61e075acfe3fb073e6e5cd78eeb96a95b3","549d35217f1e884634993ba6f13dd8e82091dd9f995a9ed0cb575958e63f073d","57a56ab47fa7f33147d4924b07e77d773515b4a06ca9ac090874209a9950f30b","b857fdf59db6948ea01643d935742904e9275572e63cd23331a9405483c6379c","33276fedf0632be39b4e8a646c520bfa081bb7e67dce52042da46bbbda16d440","075b6ac656aa414e2d21b9d1bc8b0fd030902202222e9d06a326fd80d7827ae6"],"ip":["45.138.12.177"],"d":[],"u":["http://45.138.12.177:8092/wgkit.tar.gz"]},"8bi57o":{"src":"https://www.rapid7.com/blog/post/tr-smtp-is-the-key-bpfdoor-averat-hitting-the-network-edge","h":["a37ea9897221d4495b538de72b74f2aa1d2ff09b7b6dcedd395aee58931adbf3","7e667ba5f9df912e02275d3cfe3809d16f822fe776f4035c84b118ebd925b1b5","a6f3b7f932761fb1fd5e74123f2482e36c65dd13e769af2ce08c65da195bfa7a","4435fcd6862921092614dbeaa880e4192352984686ebcd98f0ba13ee8e226ef9","652508a9cf40bee883dc0e5e219dfeba71fe7dac591d01c89f74c21f73b4963f","2bedc26d4b29b435c21962beed7db21188a0219a0d28334bba8b4fb1656d7b15","bf8135f46ecedfe5bd06fcecbb2e721c2367ff765b18f4aa3f868e6597f49e47","4925bcca085ec504f51191645da278d8e96698d91f3c6df44146336c697b4de8","a4379e115d3c4420f5d4b92561022d6e0897990e7297be65c033d47de68e6a6a","925c041807d4fb9dfe2ad84f963c2a4c60ea1289f6a0bdccbfb944478ffc2cf2","2fe2dd402ee6f9c578fce6dd4b36daaa407e99133e5dd502f2afca80feb60150","a65048eb30661e27f8edc2dd8d8c77ec87faec1f1750f6e04e7ecaf069a32858"],"ip":["59.125.211.65","122.116.138.33","1.34.200.85"],"d":[],"u":[]},"1vnllqt":{"src":"https://blog.trailofbits.com/2026/10/02/sequencehash-multihashing-for-the-rest-of-us/","h":["4fce0a9940a42b5c9d1bcbfc9a6ddd6de20d731d584a0acf5bda6de86483641c","ff000000000000000000000000000000","6eea7264b266d35bd5e483ef042189d2cebe51f9e8b764b90b0f9c82185de7ca","1469d91e90c1d9c6189f576822e900f5cc8c3cdbd2ec51256df649d37c1688f7","1800a2188e126c79dac8f7cf7e38a66e3f797654c15a5e49248a94d4e99bcaae","3e54b5cd60ef78773dcf14c5f65ed593726a981f2c80045db7fac03015cc07ad","3c5b12ea6952714fed499796a743b103de97575fc938aab7d154cc6c605984a9","706af798b32b12c9f508c16c3411b594227f79936a3cc521e6e1f362b1ef3a38","9a24e4209dad98d2e1f1eecd62aa2908234f1eed2963395292fd9718129fe258","4e4b71b8bb7b2c80e9f9ca89cb8bff43cd77cc5b530fc5f163069e5dda2876cb","6faf7818842f5a208dc306afe83ed7bea5b3fadc2a617c2208e836709f925889"],"ip":[],"d":[],"u":[]},"107i0fg":{"src":"https://socket.dev/blog/glassworm-vscode-themes","h":["4c4b9a3773e9dced6015a670855fd32b","a276b76d3b00f302bb4dfb3690125c85ff472b16049c3c37476ac5e51096df07","5e68ca8c2097caccdb74d2752b85b85595a4bf646b442b8431a2416e87dbf268","684c877a52d226d50584cb886ca8ec5bec6355d4de853f406734c79d5b387804","da2d950e50326171adbff9c2bfd6f28998e32623ea7c2c475b9159a45cfb86bb"],"ip":[],"d":["fingercakes4sale.store","holiday-themes.dev"],"u":["https://fingercakes4sale.store/dsyuC"]},"1l22pwa":{"src":"https://blog.talosintelligence.com/give-yourself-room-to-be-human/","h":["9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507","2915b3f8b703eb744fc54c81f4a9c67f","96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974","aac3165ece2959f39ff98334618d10d9","d4aa3e7010220ad1b458fac17039c274","90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59","c2efb2dcacba6d3ccc175b6ce1b7ed0a","540080fea97d88ed902c5e4f9a026b4fcd32ab263706c520e00728f1a29578b8","d65c7b544a97b0c3f2773b5fcc57d30e","9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f","38de5b216c33833af710e88f7f64fc98"],"ip":[],"d":[],"u":[]},"cl5625":{"src":"https://www.malwarebytes.com/blog/threat-intel/2026/10/fake-xstocks-pendle-and-other-sites-bait-crypto-users-with-rewards-votes","h":[],"ip":[],"d":["sitemufl06qs0r4o.xyz","sitemui6m6bbj1bd.xyz","sitemui8go6g99bb.xyz","sitemuicitd4jrtr.xyz","sitemuidkr38kji0.xyz","sitemuidlij5urd0.xyz","sitemuif3pa5k4eh.xyz","sitemuife3h91vjj.xyz","sitemuioeefbyh3i.xyz","sitemuioi7005ekb.xyz","sitemuizkhpdbjnv.xyz","sitemuj1xencnin8.xyz","sitemuj7lzbasipw.xyz","sitemujbcz1nas1x.xyz","sitemujdi54aitrf.xyz","sitemujejvp4tp0x.xyz","sitemujffobdhxgj.xyz","sitemuji07m137aw.xyz","sitemujoqrmsm0et.xyz","sitemujrfn7witew.xyz","sitemujsm7brhwh0.xyz","sitemujtcvh5q9fj.xyz","sitemujtd8ingh2b.xyz","sitemujtdkvy6c7n.xyz","sitemujufht1ntj4.xyz","sitemujufs1975v4.xyz","sitemujug76lkyke.xyz","sitemujumvtmjaf1.xyz","sitemujuncdlpnng.xyz","sitemujuno47vpud.xyz","sitemujunzgjapds.xyz","sitemujw19idqe01.xyz","sitemujw1uspghl1.xyz","sitemujwcvm5ufu8.xyz","sitemujxjlv2lmhh.xyz","sitemuk3jcm1olr8.xyz","sitemuk3jpe1eph7.xyz","sitemuk3z1hh2tvn.xyz","sitemuk3zjrr2ufy.xyz","sitemuk3zu5776gi.xyz","sitemuk6zd201nsw.xyz","sitemuk7f31386dx.xyz","sitemuk7fi1dcrp4.xyz","sitemuk7fvnvihra.xyz","sitemuk7xbyszpzj.xyz","sitemuk7y434m4om.xyz","sitemuk7yi5eqn74.xyz","sitemuk7ys6db9qj.xyz","sitemuk9ayiwadjz.xyz","sitemuk9c4oppeco.xyz","sitemukh5awm67rj.xyz","sitemukpy2hpmpwv.xyz","sitemukrod1am6ez.xyz","sitemukvxv7j5hmv.xyz","sitemukvy7wudsqb.xyz","sitemukww7ivnaji.xyz","sitemukwxih8302f.xyz","sitemul94tcv4l80.xyz","sitemul95f18sowo.xyz","sitemul95pxqgmm8.xyz","sitemulaay8dbm66.xyz","sitemulaucnbmnrd.xyz","sitemulffos1qryn.xyz","sitemuli8pd7qi9z.xyz","sitemulpmt6if530.xyz","sitemulpnff7964j.xyz","sitemulpo7jkntfz.xyz","sitemulr9d1dg77r.xyz","sitemuls00qrsh0k.xyz","sitemulszq4rm2yn.xyz"],"u":[]},"1po80sc":{"src":"https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit","h":["c6b8d0cdb53da98a5d15e79b7bb9e9f4c272c4f9592acdc291089f126f892f45","0d8ea89a63070f68286249aa437aece0e040c1609b8c5c0950ebbc90e6f70f02","1e22fde68d3277ed0fe7a8a7b554f0ae118260a2fa143f8e1bdc84c994ebbe90","9903f4576980ff7cfd560ca57c665a4b59b3c30d"],"ip":["31.56.58.59","193.32.162.134","195.178.110.209"],"d":[],"u":[]},"i679ef":{"src":"https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy","h":["b314a1499cd728ca3e54b7150661fd0c7d2279065fe3f570f0f66c395d744460"],"ip":["108.61.163.187"],"d":["driftshare.co","globalfileshareplatform.com","tw-koryu.org","heritiages.org","heritiage.org","shinjirou.info","quickfly.online","smartsyncbox.com","cirrushare.co","mypublicshare.com","goshshare.online","synchvault.co","cloudsyncpulse.com","onecloudfilesync.com","msfile.online","winsync.cloud","publicsharefile.cloud","fileswiftonline.cloud","sharehub.space"],"u":[]},"iguzji":{"src":"https://isc.sans.edu/diary/rss/33388","h":[],"ip":[],"d":["thelittlecupandsaucer.com.au"],"u":["https://thelittlecupandsaucer.com.au/ScreenConnect.ClientSetup.exe"]},"69etnm":{"src":"https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators","h":["e9fe43968c6c0955300e3bc4d7fb0b05a18570b4733aaf4f5c6f7f09be5a242c","974b69782fdf5d67b97cfd508465939e44ee10798dbcc1e82b92d78776bad938"],"ip":["64.94.85.67","31.56.197.72","23.27.143.20","45.141.21.130","70.172.58.168","162.243.36.88","173.40.135.209","47.230.224.154","62.133.62.80","92.118.204.229","87.224.84.82"],"d":[],"u":["http://64.94.85.67:443/update_c08937.pl","http://31.56.197.72:9090/lula","http://23.27.143.20:9000/main.py","http://62.133.62.80:80/xd7h/x","http://64.94.85.67:443/update_result_3567cs.tgz"]},"1w1dnpe":{"src":"https://www.stepsecurity.io/blog/sckit-supply-chain-worm-hits-memtensor-npm-pypi-scopes","h":["d9169ce8f4faaa663bf5f44918b5612ed9f933ba18987207dc4ab412733d5164","5dbc82475ce61369e53f795f0a44451715763450051fa2a84d38d6b2e8700114","c1b0998347b489582bae7b7f4930f9831d9ef4b6bc150cfd488ee1a43272dd36","381ac6dc1715d9298fe81b2a53a11f7b7d78e361ee3a6619ad54f8c4b062cc18","e077c387b223811064b7bbc5a55a0182fca9bf50894f949ff284d4be87d44b26","65faf8ccbcf5b34eb4f72c71bf82815fa9c1e2f947b9c898491540e866132c31","f8ccdd1da7dff1aef16377a2842bc7acf7c516e32122dd6e42dc4a4e57653fce","56cd3416d2ec2aa7e7cec2a06010cf0b58eb09c0a5486809df52afeaca8f14be","d6b3e77c36ee8017c9bf30d1da7218ec0ea843768d313eb8e35845c8a9b38a26","9de0d5b0ca184f71f630be5781d134998883a02d5d7bc65aeb9559d8f9efb364","5405e330507602e803f7dd6f2a9d4555aec8558ab222b51413594a962da6888a","8f647f17a1934679c4095e21bee2b9bd83e28476603758bc91408a0c8443e3b4","16de381deb978744535b10f68fe15165251374b86eef18ffc2c47f61ea673047","f7c4014e284f3d56c452b8b222a287c54f73dc4a40a7e022e765ac8376362947"],"ip":["139.84.223.178"],"d":["10729e014d0e.skyleen.fr","8a8acaf167b3.skyleen.fr","0b48fafd6fbe.skyleen.fr","266297c6df27.skyleen.fr","c747d139e7e9.skyleen.fr","73376a079d87.skyleen.fr","d4f77a3a8cb0.skyleen.fr"],"u":[]},"1er45yk":{"src":"https://blog.confiant.com/p/opsec-fail-leaks-a-rare-look-inside","h":[],"ip":["62.60.226.45"],"d":["boroxior.pro","lonvexo.xyz","johnuribelaw.com","lefigaro-news.com","rtveglobalnewstv.media","rtvetvnewsglobal.media","lomexar.pro","tanemoqy.pro","savendor.pro","lembrio.pro","jurelio.pro","kordavi.pro","brenvato.pro","gralven.pro","dalmieroq.com","cavorelij.com","ervalisy.com"],"u":["http://62.60.226.45/3a9c102/postback?subid=","http://62.60.226.45/lander/apifb/is-dupl.php"]},"1enmcx3":{"src":"https://www.rapid7.com/blog/post/etr-critical-cisco-catalyst-sd-wan-manager-api-authentication-bypass-exploited-in-the-wild-cve-2026-76504","h":[],"ip":["20.9.10.1","20.12.8.2","20.15.6.1","20.18.4.1","26.1.2.1"],"d":[],"u":[]},"1muz7s1":{"src":"https://www.zscaler.com/blogs/security-research/2cloader-new-malware-loader-delivering-vidar-and-remus","h":["18c070b8d032336a244440df1115123d"],"ip":[],"d":[],"u":[]},"126s1m0":{"src":"https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/","h":["25bda7feb3553995ad68a9a8ed8c731b73a71586","dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a","aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d","6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244","bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf","b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159","65a7576c389326b6cdf9c993d0be6e5d50fed9655d1cdf2a3a50f2c21c8ec435","22ef852f6ebc39ee71235b90648b4b200b385c47d25c79545986493f8c70db69","518fe65dd349180191d9b258ab24876aaed6613cd657d0b626d1fc24e03a22b6"],"ip":["117.107.25.243","192.255.193.111","45.32.30.235","193.42.40.135","3.209.137.175"],"d":["oast.fun","oast.online","dnslog.pp.ua","requestrepo.com","bypass.eu.org","aka.ms","wsweb03.blob.core.windows.net","psk1zim.abrdns.com","transzimbra.linkpc.net","tls.psk1zim.abrdns.com","wslogzimbra.linkpc.net","mexico-cashpay-test.s3.dualstack.mx-central-1.amazonaws.com","github.com"],"u":["https://aka.ms/downloadazcopy-v10-linux"]},"x7vznj":{"src":"https://blog.talosintelligence.com/china-nexus-uat-11587-targets-government-and-policy-organizations-across-asia-with-antino-backdoor/","h":["abfa7742e315485a98a5fafd6dbfb68e","e809da86bd81463347fa7f922d3e088755a94a331889d32acb55aa8f57778a34","e6ff096a0562c0042b09d250bd60272ffcd8d72bd95c563842acf765a8dc8bcf","4d0fdce4c098635fe9b296c3a82c74645f9885eb5e383aa44a0fe7e50da3ca3f","f1ef5fe4c0cdcff13cc750c867728b89719f81437bdc49041edd1ae1f3edb4e8","01b5c6acb20e41799a0e96d9d1d6e1c44791883706b6285e874fcb15cc93b31a","5a35fcd4458e808ab0fa52bb2a92923b60566ee4d7aaadaac7c95cad3d839562","17b53ffa8e005f0e82491d3f9c0a4984c44da52e1668a855c11a137f627c5b4b","484ab497072ea09f12187b349f5b1c80754e4942408a009cccb20a2a3c8c6506","3a94910eb8022592ce030e6861359f7e980fc1b5a6ccd290cbb071d3e95ed02a","6a1dbbfcfe6867ac83d35012b2717084388b4a34707efd0b725466dfd0e8fa56","75c12795016ae48b1bddd34a9f5adea63a12f58701eae01e1b4ab3d9dfa1513c","bd8ddc8f33e0fe43147ee6f1713654996420a27c5d2cd91751ad67124ebc6fe4","b75492466462141c56d97b705f0c606faf272577631dc2822aa8d6bda53633b6","23d5f1af8581ae200615d9a66d539f2043c3248b649e862557b379d7e8b7a3ac","0b4e5e017c0f0ccac79e13ca5d580a75af67a24ca0763f9ebfdaaeb1ba4fc739","ae1b45fb56b9f1b9cb3ee30d2bb1279c9b90b70bb62f8de305d198c6a4e0585e","cd3509fa82e506cc6f2eeafa0a45d4b8b76a07edadd29779daf00568febcaba7","b8e6e83a73e6e07f8873c364dd2a4b830bceb60758163e2efcd7e387cb604655","7969ae5f11fc163049c8eadba06f814f5edece13a707e6087c1c49011a45b838","aea5e9029f9212d05bde10f7806d1f2819be45d167e6fd877b9fb1b11088ac90","7fa98efba59614cec0b7291aedee98764f8dc037b6cc798c93951a31208e9e32","65f4b9292e91abfa5adf42a03526932930c1c0a436bb186a7948fe6770295788","61a8f5add6c35f99c389012dbb2343061fd0b54611b40490b9a7f0b49d707da0","747b1d13bdf06956b5da5f47250fefd5284ebcf7961971732c3d348aa1a2d533","a13182699a12a8dd9d07c336dbd8de5e9b086b9b09793b7de2e9761aa03ce1dc","2f1513c822af0c6635dd3c69dc38f0b2f6e02012ea36415fff111a5d4d5fae05","a0e91085f08956a9a7034ace73cee60cb211f5d96f02bc91a026601bde8f2221","47f98dfe01759a464e22d5ec55d012dccb38ce010dd73e3ba8d7ffefca12b4b2","b3416726a064dd7f657bbb400adeb365eea7f8bb60783ad2d9da1a1d93768731","0a6fb71ab1362d065c7ec2678c1e73d9a0721b0e7099d392ba7559bb2eec4970","f0c1dc6d6daa4d010932c7818ed5f22929c182f58e5f495fabe2fb3cfc835b97","5555e904101689351a2a1359c9c06da0a57139a9470df7d26823c1b75db55041","5168a2696a0ed858f996f388bfe94f952d475158f4ee6206816608936db005ca","7c2ac9c040b3300bffa7d2e435dbb1bc12e7efd644d2216d603c72121266395c","d87201c1299a7f5854929645e6891c6c424d2a690031272bedacba7c5fe73a3e","334f39279ff3aae40fe74340c887ae018c75bc42790586bdf9070adb5889100c","077bd873217d8abfbb6482d11966ca34f3fef7ad5166f24fbc5dc3ddefe894a1","ad0bd2b45e2416fb1384bf30af068d857e7c06b4226615d66b55b610a34c5670","e2f59d8d5a81583ed482b6c7bf37699efdb2264e452cf7d8cfc0c54dfbd9ab3f","3a4c9020eeb5ef22a1ff443e606ccb6705fe287c583121c713d2c9f9f1f2a2af","4b614e5c37abaddca162119e42a969945caa681305e246e0ed0060ea9984008b","c8e1239d7276178b6620f47ec4880494be1cb394477b223fc54bffb0947bff50","079acd58a74479ac8b108b618d2a4da8a8bd560a04459cd90e2fec9da5027513","8e1d68906d6de92f359945d3a95da1480e72773a3e8dea7682d6bf0f6699f75f","170b0eee60a335f32c1d0c19a0bb8d8bbc0a5b298ea9486b546f58d25cc8a464","b31ca75f73a9363b0e35042a41216c3f581eaa0b9cd78cb58f089c2e40babd40","d753a615aedf8e58ffc75b2b7ebd320c0cbe6bcb5cbb885db749a2a85c55d3bf","133a46ba41136ca21c93fb08c28446826d8c0d9b7923a16f2d152d595a710098","9fc50cf28f86201fda8306926817b1ede41fdd993202515905dd072f6803542f","d4cb2f5df16ec9b9c5b796ae55848534e15d4f8b8806f0431108fc7a99a2548a","131ac3e0df777910e0a32e43d5744bccb0490750d4c2adc359da41d76d383c46","09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff","0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd","1fadc90b61ce536abda78eb387a7f3d745f00c16775d3f762845ccc0fde567da","40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d","5c5c060b272cd4a5c3767edc0e9478bd35b7e1756e183d0446a5491bd65519cb","971cb2448b5d67dcc1f5eaa10d12e77f213035ad31230dc2ac7a510610a2059d","9b7df409c9a89f7536d3ba7b6d43fb6dbac618c8bb52615ba34cc971ad71bbf3","b90a4e770869c28fd2140acb3ebdc50c113bb6f096b4bbdb9ac87c349c70e85e","ca14ad0344dc7216f6da29a5cbe4237d886cc5257e8c3a48fb4885a311c9b800","e2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530","e7e3b0bcd6798634adf8b49d305f3a7b7682e4b76db549682a183c5a186df4bb","fdbd047031c13a17c9f491c9355f44d587584ebe2b8927be8482e6c236c8e1c1","0173d1566dcd4fd49fa25f11f14bfe4c"],"ip":["103.27.110.220"],"d":["wps-cn.com","osc-cdn.com","oisadjfoinsiduhfnoisdnfosdnoifnsoid.pages.dev","d2nq35tel3ucuo.cloudfront.net","pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev","pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev","my-3lyt6wcp.pages.dev","my-qc39r814.pages.dev","my-662ylt3w.pages.dev","my-6g16qsfe.pages.dev","my-goq6xmbm.pages.dev","my-h3qli6kq.pages.dev","my-sv7c1fzs.pages.dev","my-u0up9qri.pages.dev","my-vtsdod2n.pages.dev","my-wgoxp32b.pages.dev","microsoft-flash.com","www.wps-cn.com"],"u":["https://microsoft-flash.com/download/flashcenter_pp_ax_install_en.exe","https://www.wps-cn.com/downloads/flashcenter_pp_ax_install_en.exe","https://my-662ylt3w.pages.dev/Institutional_Disciplinary_Action_Report_May_2026.hta","https://my-662ylt3w.pages.dev/Institutional_Disciplinary_Action_Report_May_2026.wsf","https://my-6g16qsfe.pages.dev/the%20May%2027%20inauguration%20of%20the%20TPiE.hta","https://my-6g16qsfe.pages.dev/the%20May%2027%20inauguration%20of%20the%20TPiE.wsf","https://my-goq6xmbm.pages.dev/Tehran_Bilateral_Summit_Proceedings_May2026.hta","https://my-goq6xmbm.pages.dev/Tehran_Bilateral_Summit_Proceedings_May2026.wsf","https://my-h3qli6kq.pages.dev/CrossBorder_Repression_Seminar_Agenda.hta","https://my-h3qli6kq.pages.dev/CrossBorder_Repression_Seminar_Agenda.wsf","https://my-sv7c1fzs.pages.dev/Extravaganza%20Latin%20Carnival.hta","https://my-sv7c1fzs.pages.dev/Extravaganza%20Latin%20Carnival.wsf","https://my-u0up9qri.pages.dev/UO%20-C-DAC%20%281%29.hta","https://my-u0up9qri.pages.dev/UO%20-C-DAC%20%281%29.wsf","https://my-vtsdod2n.pages.dev/Extravaganza%20Latin%20Carnival%20post%20copy.hta","https://my-vtsdod2n.pages.dev/Extravaganza%20Latin%20Carnival%20post%20copy.wsf","https://my-wgoxp32b.pages.dev/Internal_Review_Dossier_0520.hta","https://my-wgoxp32b.pages.dev/Internal_Review_Dossier_0520.wsf","http://d2nq35tel3ucuo.cloudfront.net/4oyE4n4ozLQ0.log","http://d2nq35tel3ucuo.cloudfront.net/LtVGUSsyUTDA.log","http://d2nq35tel3ucuo.cloudfront.net/TzzyYlYnJ40Z.log","http://d2nq35tel3ucuo.cloudfront.net/tdyvHHVcrci8.log","http://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/Qw7Womin4X6N","http://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/kVFPxm1uAjOY","http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/5SVIdjpRQjkZ","http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/PbyfSk69AwVf","http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/qMD71Z95clTf","http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/HenUWB51MwpG","http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/q9LgxIaU1CJK","http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/BKvYRxPiGpbM","http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/nswz3cb9lhuC","http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/6HJV5qV5BTLs","http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/MKJacn3hFt3Y","http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/cX8MChhuVvzz","http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/byrdvvZEZZlk","http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/5TGrbjCCLa8M","http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/s0p18dgHR4PZ","http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/zlKDeyO3HuUS","http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/icWMOGLJcfQO","http://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/5U7kzhvlYlVF","https://d2nq35tel3ucuo.cloudfront.net/9q9OlLKCm0an2ct1.js","https://d2nq35tel3ucuo.cloudfront.net/LwqPW64Xl0ti3q7s.txt","https://d2nq35tel3ucuo.cloudfront.net/HsOw0YU9s11dxyr1.txt","https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/0u25lAqY58or53ra.js","https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/gpv0IRMtvto6e8t2.txt","https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/HzjNPgRE9ir92e38.txt","https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/2laZiB2zvnx04jze.js","https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/wyLwwCu43j1wf2pg.js","https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/ThyI9pwewrh_a1pr.txt","https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/8ypvQLxJvggmrz94.txt","https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/vD68BdmB2ky28gcc.js","https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/oaFE7PJHk0h_emqt.txt","https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/AcPP9fCvdjztmho8.txt","https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/7ChyKauxbnuftp68.js","https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/KOOOT4a76st012bx.txt","https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/Ub4RJzNIrfleri8t.txt","https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/HeiqAW6ZGatherOsState.exe.luy","https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/HeiqAW6Zslc.dll.pzs","https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/HeiqAW6ZOsGather.dat.syk","https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/hjgzBskgGatherOsState.exe.lzj","https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/hjgzBskgslc.dll.iwq","https://pub-abfa7742e315485a98a5fafd6dbfb68e.r2.dev/hjgzBskgOsGather.dat.ael","https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/bzP3NcRPGatherOsState.exe.thl","https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/bzP3NcRPslc.dll.czh","https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/bzP3NcRPOsState.dat.mxb","https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/VD7F3WxnGatherOsState.exe.mtm","https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/VD7F3Wxnslc.dll.fsc","https://pub-0173d1566dcd4fd49fa25f11f14bfe4c.r2.dev/VD7F3WxnOsState.dat.pgy"]},"17tx5kc":{"src":"https://www.huntress.com/blog/parks-recreation-platform-webshell-attack","h":["0d8f7bf30aa1ac95d59fed24c433dd2b3d57767f38c088721699c841c6e861d3","5f69ff7a2e024f94cc5f816fa16c90054b09d9ac430b1f8b0631dfdd4472905e","e9dee286069afb6b411febb96b91a963cd16baffbf8b6aa951e0ef1a7e0e3879","0d93c3a8ded46887f79ac4ca7f238c458de2231243176f6c05062e34f238d19a","b06b581d91f4108900d188c3ee1af18502a8cb65d4e101663b791bd670867485","7bb594a77f726bf21a49f717024f2915f82f47eb623d2ad305259301de1f1ab4"],"ip":[],"d":["chat.ririmochii.workers.dev","fk.bubuneeko.workers.dev"],"u":["https://chat.ririmochii.workers.dev/core.js","https://fk.bubuneeko.workers.dev/_cf/rel","https://fk.bubuneeko.workers.dev/_cf/ice"]},"i4i2e9":{"src":"https://www.microsoft.com/en-us/security/blog/2026/09/29/phishing-abuses-rmm-tools-persistent-access/","h":["108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc","f34330d4c6e0aa978dc3af40360c14b31ad51127","f094b8263471c7b76dbed03d420736449920368fa0eca2ed6b1aea2645138d97","857c2f283de799faa74b56e862c0a9f96e67aa1b4fa4a9e46395098365b99de3","6a89de024ca62536de6f5fc10e49896bb1ac330ca39dce30203afdcc45ae237e","4188c6588f3dcda881c3f2d12df580051179a999f040b799af506edeb3211a26","ceb3f7fe9a618ff29a21b126383c23900fad58d6ae2b5552d7e306e4b6acf4b0","02f2ce03a2650f17bfe6e8744eebbf58522016cbdb92af8f2217b5dd4a1ad550","499d07894f730fb685ee3cbfc1a933e0da93750c1ed25a49b2eb9c32adef156a","d49cc01641c3045bf3119f9d71e7ffd29bfce32ca4b27cc96340716ed4d41cdc","67c979dc13961b09f24f85a801e4c918420adca6117c92efbeeeaa68a6344f55","6cc665057c4a4fe42a309afd3a7fa96cf1af126e9c6e08e56df5105e05378bcc","dd434f3ffcafeda538d43226665115ba136ad0fdb43dad8536e1368ca9a17b64","40f8e774e1e7a484b78c7ae4336bc47aa9cab20dc8e1e67d89838e807975f9b1","3ff5e49fd2f2bd0758467763c44d69e781b7460af84a6e3966e2621bc5bf7096","374c4934b14a1151ea68847c8627c3f1c0b878f4e673bda3f15e4388dfde0187","bc8b1b0c80512ba0e8ffccfee5b507df16a3355db1143c3ba81ef42dac1baa6c","c2c004a56de2a99f5b06ceb58d8a4b371fb60fd66ff5936786fe8d8037ead208","5bf8cf29ac6803e7269b045dea48003af7cfe48bedfc081b57ff9e86cb08971b","19035c8e2520fb70b3e2ec5338c14311b88a26cc1fb8304a01494260b6b55af1","d232d82e410de12702a67c58acf927304ee42f3e6d81a9d71eca99f9052126db","d3cb7ded277b49be06e6a1860f7c7e913e252802e9d32453a185e24797bf53ef","e31e5da7c58a7e8f89f9629f095edd7d741a1fb0b85fcb39f3818dbd9497b1e3","1a534d04bf30894d20764e91f7e94e0a73f060f0abacc9feeedba427995c83a8","77fb0e75f4396cb57bbbd28f6dc5310369a87abec9e2acc457aa99a0063ed27a","fc96a04c615847f0fb1391f04d9d1aac7f78ddfb7d459168df0a4172b98354e2","06ad69b9bebad3cc75b594cc5bb1ca0035ea22bb8a683002ca051d948566426b","a93c946c237b981189d2668d938a9d4d1d9681757e48dae8d9d65ed25b5da657","529543b4fe6a4c21d28be56dbf92fcac91d8df808d8518b4275c973fa547ad63","ccea4e1acc51ac43ba9da76ada00e7e308cc33d9c5c264dff82d1be83e957b88","a03c84ae9e569c04fdd271277f508bba5a299d53c3c0efe0819338d178fe1c5b"],"ip":[],"d":["adswre.cfd","trews.cfd","swedcorry.stefneyv.com","ojsuyw.niyari.org","bunstar.harej.si","adsaw.cfd","sdfghj.rd-team.ru"],"u":[]},"xsp006":{"src":"https://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/","h":["9707a8694e954e9ee13e839d6e5905ce626c0837c7c90da6d1025bfbe152866b","1f2096ff906915fbf80778f0636446206197351f7e271af97936eeb6f32c179d","699e92a9e0edf7835879d5697bc67138c0b137117f459caf1a44df357407cad9","24b6e36a09eb2acfc2a95478ca685acb7593b1689be6a4a639fe0d222393cfa7","dd98dbc1a55afe6fd0ed2ed53a79c76f6bde15081a0060422185b74eb1799ee4"],"ip":["103.245.231.248","2.57.241.246","89.125.209.168","103.245.231.79","45.84.59.66","103.160.59.97"],"d":["etia.ca","groy.cc","gliderrompercycl.com","muvb.net","divekickspolic.org","matjk.click","bpdaersa.click","stuseamandesilt.org","itechx.tel","guach.net","ruten.observer","byveo.org","secure-dns-hub.com","qumel.link","cyrna.top","drasw.club"],"u":[]},"jylj7t":{"src":"https://www.malwarebytes.com/blog/threat-intel/2026/09/fake-iphone-duo-preorder-scam-triggers-darksword-attack","h":[],"ip":[],"d":["pnmrud.cc","cloud.cmatgldn.click"],"u":[]},"1vw3e2i":{"src":"https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat","h":["14e3376befd4b7b52de0757b6264da294ac6b0f9e4ff51cb9bc5b19b243fe335","c4603646701069ebdeabc96f74e1f947355ace8575560986d8393fcc6b88d0b7","6761aad48a3f987238994d92bca97e4b8550e0150607bd67b47b1b6366a371fc","e58831766e8d4313db9f8b85f90c3a840aa0d84cfeac285beefa40e39ad0d1fb","b77575413c0f97eaf31e4a44c884c1ecdc0049ec89916ceb0bf3aaaedc0442fe","eff5d63ddf1813962f0d8ad1250cea5486c8bb5dd27c3f432b43957a33e43764","9c615db040b88c18ce6b96f30d08797045b7d506f940bea452dc7a6992fdbb8d","54c94f85ba6e950903d5ff42c0971c5a9d0741596be26e06afe7d60ec38edf31","e614b7d5a7a363fb1b355a87e2e8d9e8a05bbbca08f2cee3d606bdb5015ac53b","20c7befc174a61117770535e809046c75e93c71284bf1a9c6cd532f55b315f53","ab65bbfc505dbe1cebe6021fb36e2011f6aa1d64f5d87cee1cbee3fc2a0c7907","278e2f3e2f26c18666b89ef774b4af9ce954e36b2bf54a2392608619245d8c48","91a22cf3154944897cbcaffc7d20d4596e972d280ee134197d41d8d8eefb0fe2","22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4","0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f","3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621","b59a21a8d4c0c11a9ecbbdbe2a2938499c99c5ebb210c9c6db9683c7ad19f4c4","a27cafb84876a3374ef4aba1062345def6cd0b029eaf8e0dc44fa24fc943f3c6","d3fda1e6cf886fd530bf62e2d16c39ad23ed12a2c933fc211f1f4876ceaa033e","d5acf44658f0dce90bd160f15d8e07a96938c81661d87dc7e9cb0107863bfb90"],"ip":["96.62.224.81","45.140.205.28"],"d":["chatgpt.com","sites.google.com"],"u":["https://chatgpt.com/g/g-6ab595ad6554819181b686d4876efb80-plus-5-6?gad_source=1&gad_campaignid=[REDACTED","https://chatgpt.com/g/g-6ab6ba039440819185ed491740b11cf8-plus-5-6","https://chatgpt.com/g/g-6ab595ad6554819181b686d4876efb80-plus-5-6","https://sites.google.com/view/antibot172881","http://1614733393/app/afafa98279c9/ISOSimple.msi","http://1614733393/app/50d6565cf39e/IconEdit2Turb.msi","http://1614733393/app/a26b67343315/UltraFreeISOCreateWizardSolution.msi"]},"1lf96wh":{"src":"https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/","h":["e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e","9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077ef","c82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77"],"ip":[],"d":["corp.tripswithengine.com"],"u":[]},"20ul0r":{"src":"https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation","h":["6f5a2a452a7901323abd21879c6cecccb47c06aeeaccb1b467212f3b11e4b1e7"],"ip":["149.104.78.141"],"d":[],"u":[]},"zcxlxr":{"src":"https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772","h":["ed082f744f035035900f67edf438f2f7d0528ac501234f63d476d65273cdb9a1"],"ip":["149.104.78.208","143.198.7.94","157.254.167.12"],"d":[],"u":[]},"1fampq8":{"src":"https://opensourcemalware.com/blog/polinrider-is-a-b-testing-its-way-past-your-detections","h":["a322e5f3d311d3080e6f0121063e9adc2490ef1a","dc6992e9de01ddae4cada05fec24ac7010f40367","1a21bad1df69b51efebfd2fae849ac27722b0dfac7b1cb459cf81d38b36f9705","91e334655d31f84963e6b9369d41698f51b00d7a203cf314ceba01780e6f337c","fbf0e36dd7eb1e70fc4868a8d0d0cd8f6c80753241cd88a3518f40e9a67d232e","3b572a613f5013a64e1877dfed3873f2bcbd52e5259b199d41e02c33840abbcb","6200054e0ea8575c3af37e4da10e23249bf0a17d1d6843ecc81ee35af2f7d1f2","90a3875ff84a53473107a03cec6ad19636da0cc0eccb02c036d03b8f2a5dff28"],"ip":[],"d":["260120.vercel.app","github.com"],"u":["https://260120.vercel.app/settings/linux?flag=9-test","https://260120.vercel.app/settings/win?flag=9-test"]},"uflbxn":{"src":"https://www.zscaler.com/blogs/security-research/threat-actors-use-google-ads-target-ledger-users","h":[],"ip":[],"d":["urlstorage.googleapis.com","urlsites.google.com"],"u":[]},"12gxk0y":{"src":"https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/","h":[],"ip":["45.131.66.106","34.153.223.102","64.20.53.230"],"d":[],"u":[]},"16xtr5q":{"src":"https://www.malwarebytes.com/blog/threat-intel/2026/09/kothamine-malware-uses-tailscales-tailcat-to-evade-network-detection","h":["ec4219a7ecf132c29080fbb20e4ab410c57faa85aeed7acade1eb15d905a6ee0","74eca3973ad72a6ddc9397aff8250d9ee287211fc9a055d5ee290d01cf76a70c"],"ip":[],"d":["github.com"],"u":["https://github.com/cphc811-ui/"]},"42f4op":{"src":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/","h":["48b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe494","2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7","419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c86","ba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e07","3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3"],"ip":["162.219.30.165","104.219.234.138","5.199.162.157"],"d":[],"u":[]},"1gvo0k0":{"src":"https://isc.sans.edu/diary/rss/33368","h":["c6da028e0a8a25a35efa28ba508a556d1b53d1e61113c0aaebf31a49a5668912","457ed02b0a63ccf872e8459c91e2d1d6844a75414358849333f518cc538055b7","5a2242b862ef52fe7a08af596198412a7676c948bcd64a25ce5d2e6d4b35c6fb","3e26e006210ed398f98c090e9f1c982e76b3b73f1ce3e04ee1bf8d45c56e1a89","4a5952849232691849ed900609d7ff271ce296fe3cee4a81b58c28f2839fb5b6"],"ip":["45.131.215.56","95.163.153.80"],"d":["hollow-badger-moasfraum.life"],"u":["http://45.131.215.56/8031e818c7a46?force=1","http://45.131.215.56/a7a11f95?force=1","http://45.131.215.56/4e04813226b1b93?force=1","http://95.163.153.80:8133/api/t","http://95.163.153.80:8133/api/credentials","http://95.163.153.80:8133/api/shell/agent"]},"bgexn9":{"src":"https://www.malwarebytes.com/blog/news/2026/09/criminals-turn-placeholder-domain-into-clickfix-trap","h":[],"ip":[],"d":["third-party.com"],"u":[]},"1nm6nq7":{"src":"https://www.malwarebytes.com/blog/threat-intel/2026/09/that-shipping-rebate-offer-may-come-with-a-monthly-charge","h":[],"ip":[],"d":["free-shipments.com","freeshipments.com","freeshpmts.com","myshipmentsfree.com","shipmentfree.com","shipmentsfree.com","shipmentsfreeclub.com","shipmentsfreezone.com"],"u":[]},"19w523d":{"src":"https://socket.dev/blog/mini-shai-hulud-actions","h":["a0c53dd42fc842d2f9276c5a1d4f9a26abe8713d"],"ip":[],"d":[],"u":[]},"164qhh8":{"src":"https://blog.talosintelligence.com/trust-and-the-enticing-consultancy-offer/","h":["9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507","2915b3f8b703eb744fc54c81f4a9c67f","9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f","38de5b216c33833af710e88f7f64fc98","540080fea97d88ed902c5e4f9a026b4fcd32ab263706c520e00728f1a29578b8","d65c7b544a97b0c3f2773b5fcc57d30e","cfa1997682e4ed41bc691ba848d845abbe0b75ec97e640c2b015b4d1624a108a","415898f14843d4a6537cf8f43d328eaf","38d053135ddceaef0abb8296f3b0bf6114b25e10e6fa1bb8050aeecec4ba8f55","41444d7018601b599beac0c60ed1bf83"],"ip":[],"d":[],"u":[]},"1uluo7n":{"src":"https://censys.com/blog/introducing-censys-cli-skills/","h":["50582f8d52e49f549615ec7cd68629b9f939a0cfc5c5408f324b2f1cff070e99"],"ip":["85.137.243.49"],"d":[],"u":[]},"11zy2ml":{"src":"https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software","h":["a12ba3a3dcd70e02f89253c9ec78b11f","48d3ecbb9e0b6babe6e53e2082a076bad07ef61ccd98dcc8b9e4f390b937788b","37fcbcb21d16866784050682c58424c91d3a736f6fd599271fa6e53cf5ca8a92","efa07701570983909ef923ea79bb032f19fd9dac0b819fa0e4f6b1161a4cc221","95f6abd3c43ef4b33cd61d054527233dd2ce705804d44a04be96cfb73bb52e3a"],"ip":["98.142.252.140"],"d":["bsc-dataseed1.binance.org","bsc-dataseed2.binance.org","bsc-dataseed3.binance.org","bsc-dataseed4.binance.org","bsc-dataseed1.defibit.io","bsc-dataseed2.defibit.io","bsc-dataseed3.defibit.io","bsc-dataseed4.defibit.io","bsc-dataseed1.ninicoin.io","bsc-dataseed2.ninicoin.io","bsc-dataseed3.ninicoin.io","bsc-dataseed4.ninicoin.io"],"u":["https://bsc-dataseed1.binance.org/","https://bsc-dataseed2.binance.org/","https://bsc-dataseed3.binance.org/","https://bsc-dataseed4.binance.org/","https://bsc-dataseed1.defibit.io/","https://bsc-dataseed2.defibit.io/","https://bsc-dataseed3.defibit.io/","https://bsc-dataseed4.defibit.io/","https://bsc-dataseed1.ninicoin.io/","https://bsc-dataseed2.ninicoin.io/","https://bsc-dataseed3.ninicoin.io/","https://bsc-dataseed4.ninicoin.io/","http://98.142.252.140:9000/wmglb"]},"mufv1i":{"src":"https://www.huntress.com/blog/threat-actor-compiles-cryptominer","h":["0d202e16408770e8b6cceb14e1e3e72946b154bf881d27fe33d0060315b30dd1"],"ip":["194.87.89.30"],"d":[],"u":[]},"4fm2y1":{"src":"https://securelist.com/macsync-new-version/121383/","h":["cb09ff86cabde4f8cee2d3cdec370c623bfa6c2b72ae9750fc9a7b299c65d7ca","3a1af2b397c6958e6c3ba3c75912d60e","3744f975113dfc552df982dcae699f9154a448e05a743bdfb641a463352bc13a","8d371f8a7a6dcc2655544ae13cbca03d","ff664112d3215c5d184689fc836e0dc6c1a47e42c34e70b2c3d356864bc4cb4c","09425f72de8bba18893dcd6f04115891","b8b4b88205a8f594b95a841bc37342898f34cad8a5a9e4a22ce69a31a1208650","ff3ab9ef841630364818396f62e696b72aed162cf0b895b6643ef25dad79b51d","26a0f7cdb9f7dc5ace9a40af825b1538","2d69812584269699fade26622e6490c5","7df1049cbd56c0bfa4a3364a379b4c2c","9f15fe9c4415cd668334339f705b94d8","fb90887592655a8c989e443c640167aa","6791dad263cac6d63ebba6a4b57e7d71","3ded1d71a822b53b12c3b67bcaf633f5","781ce50001d4b449600afa347c9b0208","8e84b01d5ac9624f0b181ade0e737193","980e2134679bc0c609f7659882883d77","4203ec932bfcc0907f91732440d6d997","eb760d5c88f13f7ee0f8f86ba3407123","f9f70096aabb4d22a6657014f4853a53","3deeed48fd38f22e369f5c3092bd68a1","f97d24212fa6a21be0c4d211e10f044c","00d12d842596bf5ee1805effb4571d30","9a0043d900a9ac78c886c59c9a328fd0","7212229c85852c3bffaf9740002b2f39","c53d0ea45dbc622afb7f16ea3eec78bc","fc3ba5ed282d77127efd0b0f2403531b","8dc8561349d144d4661bc66f2ec49f9f"],"ip":[],"d":["caldav.icloud.com","toria.app","warpcast.asia","streamyard.appstore.com.mx","slack.apple03cloudstore.com","toria.apple03cloudstore.com","waaako.appstore.com.mx","docsend.appstore.com.mx","gateway.icloud.com"],"u":["http://caldav.icloud.com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08","https://toria.app/","https://warpcast.asia/Toria.dmg","https://streamyard.appstore.com.mx/installer.sh","https://slack.apple03cloudstore.com/installer.sh","https://toria.apple03cloudstore.com/","https://waaako.appstore.com.mx/installer.sh","https://toria.apple03cloudstore.com/e3c1a6b00bc31e14/stage2.enc","https://docsend.appstore.com.mx/dcc737d157ef4271/stage2.enc","https://docsend.appstore.com.mx/dcc737d157ef4271/CoreUpdate.pkg.enc","https://docsend.appstore.com.mx/dcc737d157ef4271/Helper.pkg.enc","https://caldav.icloud.com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08","https://gateway.icloud.com/caldav/1_MTk1NDMwMDMzNTUxOTU0M0pybtJB186GzhogprwCQUjY3oZNiDFHH8WVo6bmgUtI/attach/4GE4TKNBTGAYDGMZVGUYTSNJUGOAALDAFMDOJBGWNUCYJLZRNDCLCO2YMQ3I64RLGMNXVG3KYBPWQOGYIEI7MPBDDYHECFDYVENTXIYFNDCPOVRMCTYI236RCYZAE63V5U3RTUYGUMO2CO7PKCLWMCXE73M7OPTHSGRWH5DXQ4PCUQU4ELZTLW54JSTK2H7V","https://docsend.appstore.com.mx","https://toria.apple03cloudstore.com"]},"1krig9m":{"src":"https://isc.sans.edu/diary/rss/33366","h":[],"ip":[],"d":["gynd--.koncar-hr.com"],"u":["https://YKZjqa7A@gynd--.koncar-hr.com/handlers@isc.sans.edu"]},"1rsqd3s":{"src":"https://socket.dev/blog/firefox-google-account-takeover","h":["f1b8329075b1cbd1ae0a5dc947bd00f94642cb166a86c2455a1d0b10aee9f2b1","16447c70f8e3c99de95b92846460214a661915c89f5c10965bf18da4c279880a","dc717b5ab9a8eccf6b6187880ba90b004cb00f503ff8bceb8405ccc33d1c6e3e"],"ip":[],"d":["pdf.gusercontent.com","gusercontent.com"],"u":["https://pdf.gusercontent.com/oninstalled"]},"ifkpam":{"src":"https://socket.dev/blog/memtensor-compromise","h":["39ee644406829a4b630b31759c20478bc22d576d6a59b253ed86f72c360aa5ef","92b46d18fc553c494eda714f204459edb74c205bf53b18a9092bcf02c7a6c5be","381ac6dc1715d9298fe81b2a53a11f7b7d78e361ee3a6619ad54f8c4b062cc18","e077c387b223811064b7bbc5a55a0182fca9bf50894f949ff284d4be87d44b26","65faf8ccbcf5b34eb4f72c71bf82815fa9c1e2f947b9c898491540e866132c31","f8ccdd1da7dff1aef16377a2842bc7acf7c516e32122dd6e42dc4a4e57653fce","56cd3416d2ec2aa7e7cec2a06010cf0b58eb09c0a5486809df52afeaca8f14be","d6b3e77c36ee8017c9bf30d1da7218ec0ea843768d313eb8e35845c8a9b38a26","c1b0998347b489582bae7b7f4930f9831d9ef4b6bc150cfd488ee1a43272dd36","8f647f17a1934679c4095e21bee2b9bd83e28476603758bc91408a0c8443e3b4","9de0d5b0ca184f71f630be5781d134998883a02d5d7bc65aeb9559d8f9efb364","5405e330507602e803f7dd6f2a9d4555aec8558ab222b51413594a962da6888a","16de381deb978744535b10f68fe15165251374b86eef18ffc2c47f61ea673047","f7c4014e284f3d56c452b8b222a287c54f73dc4a40a7e022e765ac8376362947"],"ip":[],"d":["skyleen.fr","8a8acaf167b3.skyleen.fr","0b48fafd6fbe.skyleen.fr","266297c6df27.skyleen.fr","c747d139e7e9.skyleen.fr","73376a079d87.skyleen.fr","d4f77a3a8cb0.skyleen.fr","10729e014d0e.skyleen.fr"],"u":["https://","https://10729e014d0e.skyleen.fr/eb57efaa7365698fc1e4decc/initial-ci-v2"]},"r9m4ef":{"src":"https://www.aikido.dev/blog/supplychain-local-memtensor-npm-pypi","h":["65faf8ccbcf5b34eb4f72c71bf82815fa9c1e2f947b9c898491540e866132c31","f8ccdd1da7dff1aef16377a2842bc7acf7c516e32122dd6e42dc4a4e57653fce","381ac6dc1715d9298fe81b2a53a11f7b7d78e361ee3a6619ad54f8c4b062cc18","e077c387b223811064b7bbc5a55a0182fca9bf50894f949ff284d4be87d44b26","d6b3e77c36ee8017c9bf30d1da7218ec0ea843768d313eb8e35845c8a9b38a26","56cd3416d2ec2aa7e7cec2a06010cf0b58eb09c0a5486809df52afeaca8f14be"],"ip":["139.84.223.178"],"d":[],"u":[]},"2lzmai":{"src":"https://www.huntress.com/blog/darkme-rat-abandons-exploits","h":["54ed18aa883b53794810be0428b3a0167758183c5b3ba5660af747dc81dd5b76","394c93dfbb7581c66a23c52b20cd90b31415c0825a2eab7107e60ee3fe693c04","9fb5888f9ac99227a35f3e08ca08bfb9eed676e1f91638599eba0d7a5aac847f","1c923c685f97e556f241d0f1880283500a61dc7ecae8cafe75f34c720ff6b918","52b242047a8055c0936b384b952c1c16c1072a590610140b01f4acefa8ae883a","4a18f65ab7de7be385cbcebc78c9ae49334294f93726822b8900f9b7a324a6b0","3052352ac811c48590f0239281312c35560fc06b4dc39790e365eb1e7cab8634","d7185bd7b450b478c793ece3025bdd867eed70bb7b739a5f26375b5ba6cf0d93","2915efecf2a01ce0b3ef49c47666ec43c326e7804df10e5859db5f08eeca8a37"],"ip":["67.43.50.11"],"d":["readonline365.com","onlineview365.com","thatawful.boutique","effectivecpmnetwork.com","megchartedbk7.com","storageonline.me","viewdocument.live","advancedfuturetechnology.com","sharedfuturetech.com"],"u":["https://readonline365.com/view/image.png","https://onlineview365.com/propi.msi"]},"qubg1a":{"src":"https://www.proofpoint.com/us/blog/threat-insight/Spraying-in-the-Andes-TeamFiltration-Returns","h":[],"ip":["3.101.157.240","149.88.104.19"],"d":[],"u":[]},"1atyca":{"src":"https://www.aikido.dev/blog/graphalgo-terraform-go-modules","h":["b9966e3762e9a0d5d263b8cb3cca07294f81af9714d40ddf4628cb85d74e8ad5","5f892a5424e88a21a3eb3d7f82ebf04d8ac31cdb19ada25153be4165df977d0f","ad02b5cde693529d3bda0266299501ad0193036c","ab01686d87565250fc4989faddb877d793667b07ec217a61cbd798f5695d62f5"],"ip":[],"d":["portfolio-devs.slack.com","portfolio-testers.slack.com","gogets.dev","gocommunity.io","mediumstar.slack.com"],"u":["https://portfolio-devs.slack.com/","https://portfolio-testers.slack.com/","https://portfolio-devs.slack.com","https://portfolio-testers.slack.com","https://mediumstar.slack.com"]},"oed7a7":{"src":"https://blog.talosintelligence.com/the-closed-quorum-inside-the-first-reported-autonomous-ai-c2-implant/","h":["250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7","c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7","c13cea04f598e2b0c248d603a6e31bd13aabb64d8149c1b6a77b64e0b983a86f","f5f1f8c3e7b883793800ab6ccf21b3e60bd0730f300b4595fe74a33adc17a63c","5191cf625dfc209a347f137b50aea199e82040fd5ee9086fb3e2de73c133f3cb","eddbd0ecf7195d38fefae5b9d393abfa79e6f3f94bde19308ecef130a05a42e5"],"ip":[],"d":[],"u":[]},"1rpblrd":{"src":"https://www.volexity.com/blog/2026/09/21/mind-the-patch-gap-part-2-fake-websites-used-to-deploy-chrome-windows-0-day-exploits/","h":["177652713dad3c128bd9195abf2b7603","668aa5551315ab26b67118fbb29f8e4560a1e1af","8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb","cbeeb7dd5e89261cde032825fd10bb80bad2e3fbf5b91fdc9137ad463ffa8f21"],"ip":["96.9.125.52"],"d":["chinadigitaltimes.top","americanprgoress.top","thecovnresation.com","theconversation.com","personclouds.com","outsourcingwise.com","outsourcingwise.net","halal-navi.com","halal-navi.net","halalketak.net","halaltak.net","thecovnresation.net","borneobulletin.com.bn","borneobulletins.top"],"u":["https://americanprgoress.top/chrome_cleanup.exe"]},"kqpspg":{"src":"https://dti.domaintools.com/newsletters/twenty-flight-newsletter","h":[],"ip":[],"d":["thepaygate.store"],"u":[]},"1slkvrh":{"src":"https://www.zscaler.com/blogs/security-research/vidar-adds-virtual-machine-and-custom-stream-ciphers-string-obfuscation","h":["1628bb03db87f67661349e169d73ee14ed490bdbf22abfbda08ccc9ebe237974"],"ip":[],"d":[],"u":[]},"1y60ck6":{"src":"https://www.huntress.com/blog/two-inc-ransom-notes","h":[],"ip":["213.111.185.108"],"d":["throughoutes.net"],"u":[]},"s916q3":{"src":"https://securelist.com/tr/payload-ransomware-via-group-policy/121335/","h":["0108656a3e1ade6ca4f21b084f5e1208","bea5e267f24d7da59f6821bffdbff293"],"ip":["37.19.210.12","146.70.117.239","149.102.229.154","104.164.55.46","104.28.162.228","104.28.163.162","64.190.76.14","192.42.116.50","192.42.116.12","192.42.116.56","192.42.116.97","192.42.116.52"],"d":[],"u":[]},"1hbzlyh":{"src":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","h":["2ff2945b13a4cd0e9a65c85af29ea1539e162a516466c0de682dbf9f8a4000b1","0e81d80b40eaacbf6cb1e817fb1824c30a824af5cb4faca4aa9b03fd506d480f","0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6"],"ip":["74.48.66.73","104.225.153.141","172.245.247.21"],"d":[],"u":[]}}}