{ "aliases": [ "APT29", "BlueBravo", "CloudDuke", "CosmicDuke", "Cozy Bear", "CozyDuke", "GeminiDuke", "HammerDuke", "Midnight Blizzard", "MiniDuke", "NOBELIUM", "OnionDuke", "PinchDuke", "SeaDuke", "SilverFish", "SoreFang", "The Dukes", "WellMail", "WellMess", "captivecrunch", "chocoshell", "cloaked ursa", "cozylarch", "dark halo", "earth koshchei", "goldfinder", "goldmax", "icecap", "raindrop", "sibot", "solorigate", "stellarparticle", "storm-2945", "sunburst", "sunshuttle", "supernova", "teardrop" ], "attack_id": "G0016", "attack_name": "APT29", "attack_url": "https://attack.mitre.org/groups/G0016/", "counts": { "domain": 935, "ipv4": 39, "url": 105, "url_path": 9 }, "first_seen": { "domain": { "1597ebba.info.gtjas.site": "2023-07-07", "1cloudserver.com": "2021-04-23", "3bcc1bba.info.gtjas.site": "2023-07-07", "40ort.750.credit": "2021-03-20", "4freerussia.cloud": "2024-10-27", "6a57jk2ba1d9keg15cbg.appsync-api.eu-west-1.avsvmcloud.com": "2020-12-14", "74d6b7b2.app.giftbox4u.com": "2021-05-31", "7c291bbe.info.gtjas.site": "2023-07-07", "7sbvaemscs0mc925tb99.appsync-api.us-west-2.avsvmcloud.com": "2020-12-14", "acciaio.com.br": "2019-10-17", "accounts-google.online": "2024-10-27", "actualcombine.com": "2024-10-27", "actualityworld.com": "2021-04-23", "adagio.betterworldshopping.com": "2021-03-20", "adm.govua.cloud": "2024-10-22", "admin-ch.cloud": "2024-10-27", "admirer.onehourcfo.com": "2021-03-20", "adsprofitnetwork.com": "2021-03-20", "aeinc.solutions": "2024-12-17", "ahmed-ms.online": "2024-10-27", "aimsecurity.net": "2021-01-20", "airtravelabroad.com": "2015-10-23", "aka-ms.cloud": "2024-10-27", "albrightstonebridge.cloud": "2024-12-17", "alertmeter.info": "2021-03-20", "amazonmeeting.cloud": "2024-12-17", "amazonsolutions.cloud": "2024-10-30", "americanprogress.cloud": "2024-12-17", "ap-northeast-1-aws.s3-ua.cloud": "2024-10-30", "ap-northeast-1-aws.ukrainesec.cloud": "2024-10-30", "apexwebtech.com": "2021-04-23", "appsprovider.com": "2021-04-23", "appsync-api.eu-west-1.avsvmcloud.com": "2020-12-14", "appsync-api.us-east-1.avsvmcloud.com": "2020-12-14", "appsync-api.us-east-2.avsvmcloud.com": "2020-12-14", "appsync-api.us-west-2.avsvmcloud.com": "2020-12-14", "armrvrholo.com": "2021-04-23", "aspeninstitute.cloud": "2024-12-17", "assetdata.net": "2021-04-23", "asucloud.us": "2024-10-30", "autonetonline.com": "2021-04-23", "avis-google.online": "2024-10-27", "avsvmcloud.com": "2020-12-14", "aws-app.online": "2024-10-27", "aws-atshop.online": "2024-10-27", "aws-cert.online": "2024-10-27", "aws-cloud.online": "2024-10-27", "aws-cloud.tech": "2024-10-27", "aws-data.cloud": "2024-10-23", "aws-devops.site": "2024-10-27", "aws-exam.online": "2024-10-27", "aws-il.cloud": "2024-10-23", "aws-join.cloud": "2024-10-23", "aws-meet.cloud": "2024-10-23", "aws-meetings.cloud": "2024-10-23", "aws-ms.cloud": "2024-10-23", "aws-my.online": "2024-10-27", "aws-online.cloud": "2024-10-23", "aws-platform.cloud": "2024-10-23", "aws-s3.cloud": "2024-10-23", "aws-sagyo.site": "2024-10-27", "aws-sample.online": "2024-10-27", "aws-secure.cloud": "2024-10-23", "aws-talib.online": "2024-10-27", "aws-ukraine.cloud": "2024-10-23", "aws-yamada.site": "2024-10-27", "awsmeet.cloud": "2024-10-28", "awsmeetings.online": "2024-12-17", "awsplatform.online": "2024-10-23", "awsprotect.online": "2024-10-27", "bacionera.top": "2022-06-30", "backup.awarfaregaming.com": "2019-10-01", "backupify.cloud": "2024-10-28", "bakenhof.com": "2026-01-02", "bandabonga.fr": "2019-10-17", "barracuda.solutions": "2024-10-28", "beijingnewsblog.net": "2015-10-23", "bfilmnews.com": "2022-01-07", "bigdataanalysts.com": "2021-04-23", "bigtopweb.com": "2021-01-19", "bmlor.750.credit": "2021-03-20", "bravecup.com": "2026-01-02", "bringthenoiseappnew.s3.amazonaws.com": "2024-01-23", "brookings.cloud": "2024-10-25", "builder.visionarybusiness.net": "2021-03-20", "bund-de.cloud": "2024-10-27", "busseylawoffice.com": "2019-10-17", "c-r.services": "2024-12-17", "ca-central-1.awsplatform.online": "2024-10-23", "ca-central-1.gov-ua.cloud": "2024-10-30", "ca-central-1.ua-gov.cloud": "2024-10-30", "ca-west-1.aws-ukraine.cloud": "2024-10-30", "ca-west-1.mfa-gov.cloud": "2024-10-22", "ca-west-1.ukrtelecom.cloud": "2024-10-30", "cabemanis-ms.online": "2024-10-27", "caci.solutions": "2024-10-28", "cadastros-google.online": "2024-10-27", "camogit.com": "2021-12-07", "capgemini.services": "2024-12-17", "cdnappservice.firebaseio.com": "2021-05-31", "ceip.cloud": "2024-10-25", "central-2-aws.ua-aws.army": "2024-10-23", "central-2-aws.ua-mil.cloud": "2024-10-30", "central-2-aws.ua-sec.cloud": "2024-10-30", "central-2-aws.ukrainesec.cloud": "2024-10-30", "central-2-aws.ukrtelecom.cloud": "2024-10-30", "cepa.solutions": "2024-12-17", "cer.zone": "2024-10-28", "ceycarb.com": "2019-10-17", "cfr-aws.cloud": "2024-10-27", "champions.gdtc.org": "2021-03-20", "citoc.cloud": "2024-12-17", "cityloss.com": "2021-05-31", "clari.cloud": "2024-12-17", "clearancejobs.cloud": "2024-12-17", "cloudflare.redirectpartners.com": "2026-01-02", "cnas.zone": "2024-12-17", "coachandcook.at": "2019-10-17", "cod-ms.online": "2024-10-27", "coloradospringsroofing.info": "2021-03-20", "com-s3.cloud": "2024-10-27", "combat.strategyforgood.com": "2021-03-20", "commerce-mil.online": "2024-10-27", "computerrepublic.com": "2021-04-23", "console-google.cloud": "2024-10-27", "content.pcmsar.net": "2021-05-31", "context.septemberyears.org": "2021-03-20", "cribl-gov.cloud": "2024-10-22", "crisisgroup.services": "2024-10-28", "crochetnews.com": "2022-01-07", "cross-checking.com": "2021-05-31", "csbaonline.cloud": "2024-10-25", "csu-gov.cloud": "2024-10-22", "ctu-gov.cloud": "2024-10-22", "cwinc.cloud": "2024-12-17", "d1d66buv7blf1z.cloudfront.net": "2020-12-27", "d287-206-123-149-139.ngrok-free.app": "2023-10-20", "d3ser9acyt7cdp.cloudfront.net": "2020-11-06", "daddy.stlouisdemoday.com": "2021-03-20", "dailydews.com": "2021-05-31", "databasegalore.com": "2020-12-14", "dataplane.theyardservice.com": "2021-05-31", "datatidy.com": "2021-04-23", "datazr.com": "2021-01-20", "deervalleyassociation.com": "2015-10-23", "defence-au.cloud": "2024-12-17", "defender5.coachwithak.com": "2021-03-20", "defense-gouv.cloud": "2024-10-27", "deftsecurity.com": "2020-12-14", "democracyendowment.cloud": "2024-12-17", "dep-no.cloud": "2024-10-30", "devops-aws.cloud": "2024-10-27", "dgfip-gouv.online": "2024-10-27", "dia-gov.cloud": "2024-10-22", "diamondglobalnetwork.com": "2021-04-23", "difesa-it.cloud": "2024-10-28", "digitalcollege.org": "2020-12-15", "digitalphotohub.com": "2021-04-23", "dn-ms.online": "2024-10-27", "doggroomingnews.com": "2021-05-31", "dom-news.com": "2022-01-07", "domainingdirectory.com": "2021-04-23", "drive-google.cloud": "2024-10-27", "druva.cloud": "2024-10-27", "dtran-ms.online": "2024-10-27", "ebbcloud.com": "2021-04-23", "ebookstorelive.com": "2021-04-23", "ecfr.cloud": "2024-12-17", "ecolesndmessines.org": "2019-10-17", "email.theyardservice.com": "2021-05-31", "emergencystreet.com": "2021-05-31", "enpport.com": "2021-05-31", "eopgov.cloud": "2024-10-27", "ernesttheskoolie.com": "2022-03-23", "eros-ms.online": "2024-10-27", "eru-gov.cloud": "2024-10-22", "ervsystem.com": "2020-12-18", "eu-central-1-aws.amazonsolutions.cloud": "2024-10-30", "eu-central-1-aws.dep-no.cloud": "2024-10-30", "eu-central-1-aws.gov-pl.cloud": "2024-10-30", "eu-central-1-aws.gov-sk.cloud": "2024-10-30", "eu-central-1-aws.gov-trust.cloud": "2024-10-30", "eu-central-1-aws.govua.cloud": "2024-10-22", "eu-central-1-aws.mfa-gov.cloud": "2024-10-23", "eu-central-1-aws.minbuza.cloud": "2024-10-30", "eu-central-1-aws.mindef-nl.cloud": "2024-10-30", "eu-central-1-aws.msz-pl.cloud": "2024-10-30", "eu-central-1-aws.mzv-sk.cloud": "2024-10-30", "eu-central-1-aws.ncfta.cloud": "2024-10-30", "eu-central-1-aws.presidencia-pt.cloud": "2024-10-30", "eu-central-1-aws.quirinale.cloud": "2024-10-30", "eu-central-1-aws.regeringskansliet-se.cloud": "2024-10-30", "eu-central-1-aws.s3-be.cloud": "2024-10-30", "eu-central-1-aws.s3-ua.cloud": "2024-10-30", "eu-central-1-aws.ua-gov.cloud": "2024-10-30", "eu-central-1-aws.ukrainesec.cloud": "2024-10-30", "eu-central-1.difesa-it.cloud": "2024-10-30", "eu-central-1.mfa-gov.cloud": "2024-10-22", "eu-central-1.mil-be.cloud": "2024-10-30", "eu-central-1.mil-pl.cloud": "2024-10-30", "eu-central-1.minbuza.cloud": "2024-10-30", "eu-central-1.mindef-nl.cloud": "2024-10-30", "eu-central-1.msz-pl.cloud": "2024-10-30", "eu-central-1.quirinale.cloud": "2024-10-30", "eu-central-1.regeringskansliet-se.cloud": "2024-10-30", "eu-central-1.s3-be.cloud": "2024-10-30", "eu-central-1.s3-esa.cloud": "2024-10-30", "eu-central-1.s3-nato.cloud": "2024-10-30", "eu-central-1.ua-gov.cloud": "2024-10-30", "eu-central-1.ua-sec.cloud": "2024-10-30", "eu-central-1.ukrtelecom.cloud": "2024-10-23", "eu-central-2-aws.amazonsolutions.cloud": "2024-10-30", "eu-central-2-aws.aws-ukraine.cloud": "2024-10-30", "eu-central-2-aws.dep-no.cloud": "2024-10-30", "eu-central-2-aws.gov-pl.cloud": "2024-10-30", "eu-central-2-aws.gov-sk.cloud": "2024-10-30", "eu-central-2-aws.mil-be.cloud": "2024-10-30", "eu-central-2-aws.mil-pl.cloud": "2024-10-30", "eu-central-2-aws.mindef-nl.cloud": "2024-10-30", "eu-central-2-aws.msz-pl.cloud": "2024-10-30", "eu-central-2-aws.mzv-sk.cloud": "2024-10-30", "eu-central-2-aws.presidencia-pt.cloud": "2024-10-30", "eu-central-2-aws.regeringskansliet-se.cloud": "2024-10-30", "eu-central-2-aws.s3-be.cloud": "2024-10-30", "eu-central-2-aws.ua-aws.army": "2024-10-23", "eu-central-2-aws.ua-gov.cloud": "2024-10-30", "eu-central-2-aws.ua-mil.cloud": "2024-10-30", "eu-central-2-aws.ukrtelecom.cloud": "2024-10-30", "eu-east-1-aws.amazonsolutions.cloud": "2024-10-30", "eu-east-1-aws.dep-no.cloud": "2024-10-30", "eu-east-1-aws.gov-sk.cloud": "2024-10-30", "eu-east-1-aws.gov-ua.cloud": "2024-10-30", "eu-east-1-aws.mil-be.cloud": "2024-10-30", "eu-east-1-aws.mil-pl.cloud": "2024-10-30", "eu-east-1-aws.minbuza.cloud": "2024-10-30", "eu-east-1-aws.mindef-nl.cloud": "2024-10-30", "eu-east-1-aws.msz-pl.cloud": "2024-10-30", "eu-east-1-aws.mzv-sk.cloud": "2024-10-30", "eu-east-1-aws.quirinale.cloud": "2024-10-30", "eu-east-1-aws.regeringskansliet-se.cloud": "2024-10-30", "eu-east-1-aws.s3-be.cloud": "2024-10-30", "eu-east-1-aws.s3-de.cloud": "2024-10-30", "eu-east-1-aws.ua-gov.cloud": "2024-10-30", "eu-east-1-aws.ua-sec.cloud": "2024-10-30", "eu-east-1-aws.ukrtelecom.cloud": "2024-10-30", "eu-north-1-aws.dep-no.cloud": "2024-10-30", "eu-north-1-aws.difesa-it.cloud": "2024-10-30", "eu-north-1-aws.gov-pl.cloud": "2024-10-30", "eu-north-1-aws.gov-sk.cloud": "2024-10-30", "eu-north-1-aws.mil-be.cloud": "2024-10-30", "eu-north-1-aws.mil-pl.cloud": "2024-10-30", "eu-north-1-aws.minbuza.cloud": "2024-10-30", "eu-north-1-aws.ncfta.cloud": "2024-10-30", "eu-north-1-aws.presidencia-pt.cloud": "2024-10-30", "eu-north-1-aws.quirinale.cloud": "2024-10-30", "eu-north-1-aws.regeringskansliet-se.cloud": "2024-10-30", "eu-north-1-aws.s3-be.cloud": "2024-10-30", "eu-north-1-aws.s3-de.cloud": "2024-10-30", "eu-north-1-aws.ua-energy.cloud": "2024-10-22", "eu-north-1-aws.ua-gov.cloud": "2024-10-22", "eu-north-1.difesa-it.cloud": "2024-10-30", "eu-north-1.gov-trust.cloud": "2024-10-30", "eu-north-1.gov-ua.cloud": "2024-10-30", "eu-north-1.gv-at.cloud": "2024-10-30", "eu-north-1.mil-be.cloud": "2024-10-30", "eu-north-1.mil-pl.cloud": "2024-10-30", "eu-north-1.mzv-sk.cloud": "2024-10-30", "eu-north-1.ncfta.cloud": "2024-10-30", "eu-north-1.regeringskansliet-se.cloud": "2024-10-30", "eu-north-1.s3-be.cloud": "2024-10-30", "eu-north-1.s3-de.cloud": "2024-10-30", "eu-north-1.s3-ua.cloud": "2024-10-30", "eu-south-1-aws.admin-ch.cloud": "2024-10-30", "eu-south-1-aws.dep-no.cloud": "2024-10-30", "eu-south-1-aws.difesa-it.cloud": "2024-10-30", "eu-south-1-aws.gov-pl.cloud": "2024-10-30", "eu-south-1-aws.gov-trust.cloud": "2024-10-30", "eu-south-1-aws.mfa-gov.cloud": "2024-10-22", "eu-south-1-aws.mil-be.cloud": "2024-10-30", "eu-south-1-aws.minbuza.cloud": "2024-10-30", "eu-south-1-aws.mzv-sk.cloud": "2024-10-30", "eu-south-1-aws.quirinale.cloud": "2024-10-30", "eu-south-1-aws.s3-be.cloud": "2024-10-30", "eu-south-1-aws.s3-de.cloud": "2024-10-30", "eu-south-1-aws.ua-gov.cloud": "2024-10-30", "eu-south-2-aws.amazonsolutions.cloud": "2024-10-30", "eu-south-2-aws.dep-no.cloud": "2024-10-30", "eu-south-2-aws.gov-pl.cloud": "2024-10-30", "eu-south-2-aws.gov-sk.cloud": "2024-10-30", "eu-south-2-aws.mfa-gov.cloud": "2024-10-23", "eu-south-2-aws.mil-be.cloud": "2024-10-30", "eu-south-2-aws.mil-pl.cloud": "2024-10-30", "eu-south-2-aws.mil-pt.cloud": "2024-10-30", "eu-south-2-aws.minbuza.cloud": "2024-10-30", "eu-south-2-aws.msz-pl.cloud": "2024-10-30", "eu-south-2-aws.mzv-sk.cloud": "2024-10-30", "eu-south-2-aws.ncfta.cloud": "2024-10-30", "eu-south-2-aws.quirinale.cloud": "2024-10-30", "eu-south-2-aws.regeringskansliet-se.cloud": "2024-10-30", "eu-south-2-aws.s3-be.cloud": "2024-10-30", "eu-south-2-aws.s3-de.cloud": "2024-10-30", "eu-south-2-aws.s3-esa.cloud": "2024-10-30", "eu-south-2-aws.s3-nato.cloud": "2024-10-30", "eu-south-2-aws.s3-ua.cloud": "2024-10-30", "eu-south-2-aws.ua-gov.cloud": "2024-10-30", "eu-south-2.dep-no.cloud": "2024-10-30", "eu-south-2.gov-pl.cloud": "2024-10-30", "eu-south-2.gov-sk.cloud": "2024-10-30", "eu-south-2.mil-be.cloud": "2024-10-30", "eu-south-2.mil-pl.cloud": "2024-10-30", "eu-south-2.mindef-nl.cloud": "2024-10-30", "eu-south-2.s3-be.cloud": "2024-10-30", "eu-south-2.s3-de.cloud": "2024-10-30", "eu-south-2.s3-esa.cloud": "2024-10-30", "eu-south-2.s3-nato.cloud": "2024-10-30", "eu-south-2.ua-sec.cloud": "2024-10-30", "eu-south-2.ukrainesec.cloud": "2024-10-30", "eu-southeast-1-aws.amazonsolutions.cloud": "2024-10-30", "eu-southeast-1-aws.aws-ukraine.cloud": "2024-10-30", "eu-southeast-1-aws.dep-no.cloud": "2024-10-30", "eu-southeast-1-aws.difesa-it.cloud": "2024-10-30", "eu-southeast-1-aws.gov-sk.cloud": "2024-10-30", "eu-southeast-1-aws.gov-trust.cloud": "2024-10-30", "eu-southeast-1-aws.gov-ua.cloud": "2024-10-23", "eu-southeast-1-aws.govtr.cloud": "2024-10-23", "eu-southeast-1-aws.mil-be.cloud": "2024-10-30", "eu-southeast-1-aws.mil-pl.cloud": "2024-10-30", "eu-southeast-1-aws.mindef-nl.cloud": "2024-10-30", "eu-southeast-1-aws.msz-pl.cloud": "2024-10-30", "eu-southeast-1-aws.mzv-cz.cloud": "2024-10-30", "eu-southeast-1-aws.mzv-sk.cloud": "2024-10-30", "eu-southeast-1-aws.quirinale.cloud": "2024-10-30", "eu-southeast-1-aws.s3-be.cloud": "2024-10-30", "eu-southeast-1-aws.s3-de.cloud": "2024-10-30", "eu-southeast-1-aws.s3-esa.cloud": "2024-10-30", "eu-southeast-1-aws.s3-ua.cloud": "2024-10-30", "eu-southeast-1-aws.ua-energy.cloud": "2024-10-30", "eu-southeast-1-aws.ukrainesec.cloud": "2024-10-30", "eu-southeast-1-aws.zero-trust.solutions": "2024-10-23", "eu-west-1-aws.amazonsolutions.cloud": "2024-10-30", "eu-west-1-aws.aws-ukraine.cloud": "2024-10-30", "eu-west-1-aws.dep-no.cloud": "2024-10-30", "eu-west-1-aws.gov-pl.cloud": "2024-10-30", "eu-west-1-aws.gov-sk.cloud": "2024-10-30", "eu-west-1-aws.gov-trust.cloud": "2024-10-30", "eu-west-1-aws.gov-ua.cloud": "2024-10-30", "eu-west-1-aws.mil-be.cloud": "2024-10-30", "eu-west-1-aws.mil-pl.cloud": "2024-10-30", "eu-west-1-aws.minbuza.cloud": "2024-10-30", "eu-west-1-aws.quirinale.cloud": "2024-10-30", "eu-west-1-aws.s3-be.cloud": "2024-10-30", "eu-west-1-aws.s3-de.cloud": "2024-10-30", "eu-west-1-aws.s3-esa.cloud": "2024-10-30", "eu-west-1-aws.s3-nato.cloud": "2024-10-30", "eu-west-1-aws.ua-sec.cloud": "2024-10-30", "eu-west-1-aws.ukrainesec.cloud": "2024-10-30", "eu-west-1.aws-ukraine.cloud": "2024-10-30", "eu-west-1.difesa-it.cloud": "2024-10-30", "eu-west-1.gov-sk.cloud": "2024-10-30", "eu-west-1.mil-be.cloud": "2024-10-30", "eu-west-1.mil-pl.cloud": "2024-10-30", "eu-west-1.minbuza.cloud": "2024-10-30", "eu-west-1.msz-pl.cloud": "2024-10-30", "eu-west-1.mzv-sk.cloud": "2024-10-30", "eu-west-1.regeringskansliet-se.cloud": "2024-10-30", "eu-west-1.s3-de.cloud": "2024-10-30", "eu-west-1.s3-esa.cloud": "2024-10-30", "eu-west-1.s3-ua.cloud": "2024-10-30", "eu-west-1.ua-gov.cloud": "2024-10-30", "eu-west-1.ukrtelecom.cloud": "2024-10-30", "eu-west-2-aws.amazonsolutions.cloud": "2024-10-30", "eu-west-2-aws.dep-no.cloud": "2024-10-30", "eu-west-2-aws.difesa-it.cloud": "2024-10-30", "eu-west-2-aws.gov-pl.cloud": "2024-10-30", "eu-west-2-aws.gov-sk.cloud": "2024-10-30", "eu-west-2-aws.gv-at.cloud": "2024-10-30", "eu-west-2-aws.mil-be.cloud": "2024-10-30", "eu-west-2-aws.mil-pl.cloud": "2024-10-30", "eu-west-2-aws.minbuza.cloud": "2024-10-30", "eu-west-2-aws.mindef-nl.cloud": "2024-10-30", "eu-west-2-aws.msz-pl.cloud": "2024-10-30", "eu-west-2-aws.mzv-sk.cloud": "2024-10-30", "eu-west-2-aws.quirinale.cloud": "2024-10-30", "eu-west-2-aws.s3-be.cloud": "2024-10-30", "eu-west-2-aws.s3-de.cloud": "2024-10-30", "eu-west-2-aws.s3-esa.cloud": "2024-10-30", "eu-west-2-aws.s3-nato.cloud": "2024-10-30", "eu-west-2-aws.s3-ua.cloud": "2024-10-30", "eu-west-2-aws.ua-sec.cloud": "2024-10-30", "eu-west-3-aws.aws-ukraine.cloud": "2024-10-30", "eu-west-3-aws.dep-no.cloud": "2024-10-30", "eu-west-3-aws.difesa-it.cloud": "2024-10-30", "eu-west-3-aws.gov-pl.cloud": "2024-10-30", "eu-west-3-aws.gov-sk.cloud": "2024-10-30", "eu-west-3-aws.gov-trust.cloud": "2024-10-30", "eu-west-3-aws.mil-be.cloud": "2024-10-30", "eu-west-3-aws.mil-pl.cloud": "2024-10-30", "eu-west-3-aws.mil-pt.cloud": "2024-10-30", "eu-west-3-aws.minbuza.cloud": "2024-10-30", "eu-west-3-aws.mindef-nl.cloud": "2024-10-30", "eu-west-3-aws.msz-pl.cloud": "2024-10-30", "eu-west-3-aws.mzv-sk.cloud": "2024-10-30", "eu-west-3-aws.quirinale.cloud": "2024-10-30", "eu-west-3-aws.regeringskansliet-se.cloud": "2024-10-30", "eu-west-3-aws.s3-be.cloud": "2024-10-30", "eu-west-3-aws.s3-ua.cloud": "2024-10-30", "eu-west-3-aws.ua-mil.cloud": "2024-10-30", "eu-west-3.amazonsolutions.cloud": "2024-10-30", "eu-west-3.aws-ukraine.cloud": "2024-10-30", "eu-west-3.mil-be.cloud": "2024-10-30", "eu-west-3.mil-pl.cloud": "2024-10-30", "eu-west-3.minbuza.cloud": "2024-10-30", "eu-west-3.mindef-nl.cloud": "2024-10-30", "eu-west-3.msz-pl.cloud": "2024-10-30", "eu-west-3.mzv-sk.cloud": "2024-10-30", "eu-west-3.presidencia-pt.cloud": "2024-10-30", "eu-west-3.s3-be.cloud": "2024-10-30", "eu-west-3.s3-ua.cloud": "2024-10-30", "eu-west-3.ukrainesec.cloud": "2024-10-30", "eu-west-3.ukrtelecom.cloud": "2024-10-30", "europa-eu.cloud": "2024-12-17", "europeanvalues.cloud": "2024-10-27", "eventbrite-com-default-rtdb.firebaseio.com": "2021-05-31", "exclaimer.solutions": "2024-12-17", "eyetechltd.com": "2021-04-23", "fairfieldsch.org": "2019-10-17", "fanta.swofficefurniture.com": "2021-03-20", "feedzai-gov.cloud": "2024-10-22", "financialmarket.org": "2021-01-20", "findcloudflare.com": "2026-01-02", "fisheries-states-codes-camps.trycloudflare.com": "2024-01-23", "fisioterapiabb.it": "2019-10-17", "flowers.netplusplans.com": "2021-03-20", "flowers.thegardnerco.com": "2021-03-20", "forces-gc.cloud": "2024-10-27", "foreignhurry.com": "2024-10-26", "foreignpolicy.cloud": "2024-12-17", "fqtel.com": "2021-04-23", "freedomhouse.cloud": "2024-12-17", "freescanonline.com": "2020-12-14", "freespace.givingprofits.net": "2021-03-20", "ga-mil.online": "2024-10-27", "galatinonews.com": "2022-01-07", "gallery.wineadam.com": "2021-03-20", "gallerycenter.org": "2021-01-20", "gc-cloud.ca": "2024-12-17", "gd-ms.cloud": "2024-10-27", "gdbcloud.com": "2021-04-23", "giftbox4u.com": "2021-05-31", "globalnetworkissues.com": "2020-12-14", "globalsection.org": "2021-04-23", "globesoftwares.com": "2021-04-23", "gmfus.cloud": "2024-10-27", "gnadptech.com": "2021-04-23", "go-conference.cloud": "2024-12-17", "go-jp.cloud": "2024-12-17", "go-meet-up.com": "2024-12-17", "go-meet.pro": "2024-12-17", "go-meeting.cloud": "2024-12-17", "go-meeting.online": "2024-10-30", "google-accs.online": "2024-10-27", "google-ai.site": "2024-10-27", "google-analysis.cloud": "2024-10-27", "google-com.site": "2024-10-27", "google-com.website": "2024-10-27", "google-docs.online": "2024-10-27", "google-duo.online": "2024-10-27", "google-duo.site": "2024-10-27", "google-map.website": "2024-10-27", "google-meet.cloud": "2024-10-26", "google-pesquisa.online": "2024-10-27", "google-plays.site": "2024-10-27", "google-playstore.online": "2024-10-27", "google-sanctions.online": "2024-10-27", "google-seguro.site": "2024-10-27", "google-shopping.online": "2024-10-27", "google-support.site": "2024-10-27", "googlemeet.zone": "2024-12-17", "gouv-fr.cloud": "2024-10-25", "gov-au.cloud": "2024-10-22", "gov-aws.cloud": "2024-10-22", "gov-fi.cloud": "2024-10-22", "gov-gr.cloud": "2024-10-22", "gov-lt.cloud": "2024-10-22", "gov-lv.cloud": "2024-10-22", "gov-pl.cloud": "2024-10-22", "gov-sk.cloud": "2024-10-22", "gov-trust.cloud": "2024-10-22", "gov-ua.cloud": "2024-10-22", "govbook.cloud": "2024-10-22", "govdom.cloud": "2024-10-22", "govista.cloud": "2024-10-22", "govmr.cloud": "2024-10-22", "govps.cloud": "2024-10-22", "govtr.cloud": "2024-10-22", "govua.cloud": "2024-10-22", "gq1h856599gqh538acqn.appsync-api.us-west-2.avsvmcloud.com": "2020-12-14", "graphicscodex.net": "2021-04-23", "greencastleadvantage.com": "2015-10-23", "group3.pulsedesigngroup.us": "2021-03-20", "grouptumbler.com": "2015-10-23", "gtjas.site": "2023-07-07", "gv-at.cloud": "2024-10-30", "hanproud.com": "2021-05-31", "hcdc-ms.online": "2024-10-27", "heritagecloud.org": "2024-12-17", "highdatabase.com": "2020-12-14", "holescontracting.com": "2021-05-31", "hso-aws.cloud": "2024-10-27", "humanitarian-forum-default-rtdb.firebaseio.com": "2021-05-31", "ihvpgv9psvq02ffo77et.appsync-api.us-east-2.avsvmcloud.com": "2020-12-14", "iklan-google.online": "2024-10-27", "incomeupdate.com": "2020-12-14", "inferno.bigpurposebigimpact.com": "2021-03-20", "infinitysoftwares.com": "2020-12-18", "info.gtjas.site": "2023-07-07", "info.ophibre.com": "2026-01-02", "inovaoftalmologia.com.br": "2023-10-14", "inspirer.cartsandmowers.com": "2021-03-20", "ioxmesh.com": "2021-04-23", "ipadsreview.org": "2021-04-23", "jdm-s3.online": "2024-10-27", "jenkins.findfwd.com": "2021-03-20", "joke.webproduct.info": "2021-03-20", "joomla.lifepath.site": "2021-03-20", "jtf-mil.online": "2024-10-27", "justice.technology": "2024-12-17", "k5kcubuassl3alrf7gm3.appsync-api.eu-west-1.avsvmcloud.com": "2020-12-14", "kaceloj.com": "2021-12-07", "kam-lt.cloud": "2024-10-27", "kefas.id": "2023-07-07", "kegas.id": "2023-10-14", "kirute.com": "2021-12-07", "kitaeri.com": "2023-10-14", "kmu.govua.cloud": "2024-10-22", "kubecloud.com": "2020-12-15", "lamarfish.com": "2021-03-20", "lcomputers.com": "2020-12-15", "learn-ms.online": "2024-10-27", "leveldelta.com": "2015-10-23", "limoservicecompany.com": "2021-04-23", "lion.vipjoyeria.com": "2021-03-20", "lordfilm-ms.online": "2024-10-27", "loreaosvault.cloud": "2024-10-28", "lorriratzlaff.com": "2019-10-17", "m365-owa.com": "2026-08-01", "macfound.services": "2024-10-26", "mae-ro.cloud": "2024-10-25", "mail.bakenhof.com": "2026-01-02", "mail.bravecup.com": "2026-01-02", "mail.ophibre.com": "2026-01-02", "mail.silry.com": "2026-01-02", "mapn-ro.cloud": "2024-12-17", "mappsglobal.com": "2021-04-23", "maps-google.online": "2024-10-27", "matclick.com": "2023-12-16", "md-gov.cloud": "2024-10-22", "mde-es.cloud": "2024-10-28", "meet-google.cloud": "2024-10-27", "megatoolkit.com": "2021-04-16", "method.nonprofitsustainability.com": "2021-03-20", "mf-gov.cloud": "2024-10-22", "mfa-bg.website": "2024-10-27", "mfa-gov-il.cloud": "2024-10-23", "mfa-gov-tr.cloud": "2024-10-23", "mfa-gov.cloud": "2024-10-22", "mfa-gov.online": "2024-10-27", "mhdosoksaccf9sni9icp.appsync-api.eu-west-1.avsvmcloud.com": "2020-12-14", "microsoft-meeting.cloud": "2024-10-28", "microsoftmeeting.cloud": "2024-10-26", "microtransito.com": "2021-04-23", "midcitylanews.com": "2022-01-07", "mil-be.cloud": "2024-10-23", "mil-commerce.online": "2024-10-27", "mil-defense.online": "2024-10-27", "mil-ee.cloud": "2024-10-23", "mil-mza.online": "2024-10-27", "mil-mza.site": "2024-10-27", "mil-pl.cloud": "2024-10-23", "mil-pt.cloud": "2024-10-23", "mil-stat.online": "2024-10-27", "mil-tek.online": "2024-10-27", "mimecast.cloud": "2024-10-28", "minbuza.cloud": "2024-10-28", "mindef-nl.cloud": "2024-10-27", "ministernetwork.org": "2019-10-17", "mmr-gov.cloud": "2024-10-22", "mo-gov.cloud": "2024-10-22", "mobilnweb.com": "2021-01-20", "mod-cloud.uk": "2024-12-17", "mod-gov-il.cloud": "2024-10-23", "monitor.syn.cn": "2020-08-19", "morh-hr.cloud": "2024-12-17", "motherlodebulldogclub.com": "2019-10-17", "mpo-gov.cloud": "2024-10-22", "mpsv-gov.cloud": "2024-10-22", "ms-aid.site": "2024-10-27", "ms-antalia.online": "2024-10-27", "ms-aws.cloud": "2024-10-27", "ms-cabemanis.online": "2024-10-27", "ms-cabemanis.site": "2024-10-27", "ms-cabemanis.website": "2024-10-27", "ms-clean.site": "2024-10-27", "ms-company.site": "2024-10-27", "ms-conference.cloud": "2024-10-28", "ms-copilot.online": "2024-10-27", "ms-dining.site": "2024-10-27", "ms-exchange.online": "2024-10-27", "ms-flamex.online": "2024-10-27", "ms-gacor.online": "2024-10-27", "ms-gacor.site": "2024-10-27", "ms-gma.online": "2024-10-27", "ms-green.online": "2024-10-27", "ms-immo.online": "2024-10-27", "ms-irstatic.cloud": "2024-10-27", "ms-jpan.online": "2024-10-27", "ms-justme.online": "2024-10-27", "ms-justmetv.online": "2024-10-27", "ms-labs.site": "2024-10-27", "ms-legal.site": "2024-10-27", "ms-log.site": "2024-10-27", "ms-media.online": "2024-10-27", "ms-meeting.com": "2024-10-26", "ms-meeting.online": "2024-10-27", "ms-meetings.online": "2024-10-27", "ms-menu.online": "2024-10-27", "ms-mfa.online": "2024-10-27", "ms-moviez.site": "2024-10-27", "ms-mu.online": "2024-10-27", "ms-nas.online": "2024-10-27", "ms-offce.online": "2024-10-27", "ms-oiffce.online": "2024-10-27", "ms-oiffice.online": "2024-10-27", "ms-ok.site": "2024-10-27", "ms-org.tech": "2024-10-27", "ms-paint.online": "2024-10-27", "ms-perry.online": "2024-10-27", "ms-pmr.online": "2024-10-27", "ms-raskion.online": "2024-10-27", "ms-review.site": "2024-10-27", "ms-rp.site": "2024-10-27", "ms-sami.tech": "2024-10-27", "ms-schaefer.online": "2024-10-27", "ms-scribe.online": "2024-10-27", "ms-secure.cloud": "2024-10-27", "ms-security.online": "2024-10-27", "ms-sign.site": "2024-10-27", "ms-store.cloud": "2024-10-27", "ms-tcentr.online": "2024-10-27", "ms-toto.online": "2024-10-27", "ms-toto.site": "2024-10-27", "ms-wow.online": "2024-10-27", "ms365-device.com": "2026-08-01", "ms365-live.com": "2026-08-01", "msconferences.cloud": "2024-10-25", "msmt-gov.cloud": "2024-10-22", "msz-pl.cloud": "2024-10-27", "muslimnewsdaily.com": "2022-01-07", "muyipep.com": "2021-12-07", "mv-gov.cloud": "2024-10-22", "mvep-hr.cloud": "2024-12-17", "mx.ceip.cloud": "2024-10-25", "mx.ophibre.com": "2026-01-02", "my-gov.cloud": "2024-10-23", "my-invite.org": "2026-08-01", "myrric-uses.singlejets.com": "2020-12-27", "mzd-gov.cloud": "2024-10-22", "mze-gov.cloud": "2024-10-22", "mzp-gov.cloud": "2024-10-22", "mzv-cz.cloud": "2024-10-27", "mzv-gov.cloud": "2024-10-22", "mzv-sk.cloud": "2024-10-25", "nakit-gov.cloud": "2024-10-22", "nasdaqblog.net": "2015-10-23", "natureinhome.com": "2015-10-23", "nbu-gov.cloud": "2024-10-22", "ncfta.cloud": "2024-10-30", "ncsc.solutions": "2024-12-17", "ndu.solutions": "2024-12-17", "nestedmail.com": "2015-10-23", "newsplacec.com": "2021-05-31", "newstepsco.com": "2021-05-31", "nikeoutletinc.org": "2021-04-23", "nopogew.com": "2022-06-30", "nordicmademedia.com": "2021-12-06", "nore-aws.online": "2024-10-27", "nostressjob.com": "2015-10-23", "nrcc.cloud": "2024-12-17", "ns1.actualcombine.com": "2024-10-27", "ns1.foreignhurry.com": "2024-10-27", "ns1.secretiveleap.com": "2024-10-27", "ns2.actualcombine.com": "2024-10-27", "ns2.foreignhurry.com": "2024-10-27", "ns2.secretiveleap.com": "2024-10-27", "nukib-gov.cloud": "2024-10-22", "nytunion.com": "2015-10-23", "oilnewsblog.com": "2015-10-23", "oktacloud.us": "2024-10-27", "olapdatabase.com": "2021-01-20", "onetechcompany.com": "2021-03-05", "opennet.solutions": "2024-10-27", "opensocietyfoundations.cloud": "2024-12-17", "ophibre.com": "2026-01-02", "otzyv-ms.online": "2024-10-27", "overpict.com": "2015-10-23", "owa-ms365.com": "2026-08-01", "pahohu.com": "2021-12-07", "panhardware.com": "2020-12-14", "parseccomputer.cloud": "2024-10-26", "pcmsar.net": "2021-05-31", "pdv.govua.cloud": "2024-10-22", "pharaosjournal.com": "2022-01-07", "photos-google.online": "2024-10-27", "photos-ms.online": "2024-10-27", "phpmyadmin.xsunx.com": "2021-03-20", "pixelapn.adsprofitnetwork.com": "2021-03-20", "pixelapn2.adsprofitnetwork.com": "2021-03-20", "playstore-google.online": "2024-10-27", "plkiu.daniyalmedicaltech.com": "2021-03-20", "pointers.ecostratas.com": "2021-03-20", "police-gov.cloud": "2024-12-21", "policie-gov.cloud": "2024-10-22", "polycom.solutions": "2024-10-27", "popcorn.net-zerodesign.com": "2021-03-20", "porno-google.online": "2024-10-27", "portal.sbn.co.th": "2018-09-13", "powerpolymerindustry.com": "2019-10-17", "presidencia-pt.cloud": "2024-10-30", "printing.laminatesandthings.com": "2021-03-20", "prio.zone": "2024-12-17", "productpitfalls.com": "2021-04-23", "promo9.promossupply.com": "2021-03-20", "prompt.powerofpartnerships.net": "2021-03-20", "publiccouncil.org": "2019-10-17", "pulsesecure.cloud": "2024-12-17", "q.promossupply.com": "2021-03-20", "quirinale.cloud": "2024-10-30", "raq-ms.online": "2024-10-27", "readnewshot.com": "2022-01-07", "red-ms.online": "2024-10-27", "redirectpartners.com": "2026-01-02", "regeringskansliet-se.cloud": "2024-10-30", "reyweb.com": "2021-04-23", "rheinemetall.com": "2026-01-06", "robotvice.com": "2020-07-29", "rock.core-thought.com": "2021-03-20", "rollver.com": "2021-04-23", "roofingspecialists.info": "2021-03-20", "rrt.solutions": "2024-12-17", "rubrik.zone": "2024-12-17", "rulourialuminiu.co.uk": "2019-10-17", "ryaxtech.com": "2021-04-23", "s3-acronis.cloud": "2024-10-23", "s3-army.cloud": "2024-10-23", "s3-atlassian.cloud": "2024-10-23", "s3-aws.cloud": "2024-10-23", "s3-aws.global": "2024-12-17", "s3-bah.cloud": "2024-10-23", "s3-be.cloud": "2024-10-23", "s3-blackberry.cloud": "2024-10-23", "s3-cloud.us": "2024-10-28", "s3-csis.cloud": "2024-10-23", "s3-de.cloud": "2024-10-23", "s3-dgap.cloud": "2024-10-23", "s3-dk.cloud": "2024-10-23", "s3-dnc.cloud": "2024-10-23", "s3-esa.cloud": "2024-10-23", "s3-fbi.cloud": "2024-10-23", "s3-hudson.cloud": "2024-10-23", "s3-ida.cloud": "2024-10-23", "s3-iri.cloud": "2024-10-23", "s3-knowbe4.cloud": "2024-10-23", "s3-marcus.cloud": "2024-10-23", "s3-monitoring.cloud": "2024-10-23", "s3-nato.cloud": "2024-10-23", "s3-ned.cloud": "2024-10-23", "s3-nsa.cloud": "2024-10-23", "s3-proofpoint.cloud": "2024-10-23", "s3-pt.cloud": "2024-10-23", "s3-rackspace.cloud": "2024-10-23", "s3-rand.cloud": "2024-10-23", "s3-spacex.cloud": "2024-10-23", "s3-state.cloud": "2024-10-23", "s3-stig.cloud": "2024-10-23", "s3-ua.cloud": "2024-10-23", "s3-ucia.cloud": "2024-10-23", "s3-us.navy": "2024-12-17", "s3-zoho.cloud": "2024-10-23", "s3.army": "2024-10-28", "saiccloud.us": "2024-12-17", "salesappliances.com": "2019-10-17", "satkas.waw.pl": "2022-01-27", "secretiveleap.com": "2024-10-26", "secureconnectiongroup.com": "2021-03-20", "secured-ms.online": "2024-10-27", "securesearchnow.com": "2021-03-20", "security-updater-default-rtdb.firebaseio.com": "2021-05-31", "securitysystemnews.com": "2021-04-23", "sendbits.m2stor4ge.xyz": "2020-12-27", "sense4baby.fr": "2021-04-23", "seobundlekit.com": "2020-12-15", "servicenowinc.us": "2024-10-27", "sgrhf.org.pk": "2023-07-26", "shaines-aws.online": "2024-10-27", "shicloud.online": "2024-12-17", "signup-now.com": "2020-07-29", "silry.com": "2026-01-02", "sinitude.com": "2022-10-16", "sipacolumbia.us": "2024-12-17", "sisaf-ms.online": "2024-10-27", "sistemikan.com": "2019-10-17", "sixsquare.net": "2015-10-23", "skagenyoga.com": "2019-10-17", "skykick.solutions": "2024-12-17", "smtp2.theyardservice.com": "2021-05-31", "snuff.mybabyrose.com": "2021-03-20", "sobolpand.top": "2022-06-30", "softcat.cloud": "2024-12-17", "softhouse.store": "2022-04-16", "softwarelaunches.com": "2021-04-23", "softweblinks.com": "2021-04-23", "solartrackingsystem.net": "2020-12-15", "srfnetwork.org": "2021-03-05", "ssi-gouv-fr.cloud": "2024-12-17", "ssi-gouv.cloud": "2024-10-27", "standart.sdtranspo.com": "2021-03-20", "statecloud.us": "2024-10-27", "statistic-g.com": "2026-08-02", "stockmarketon.com": "2021-05-31", "stonecrestnews.com": "2021-12-06", "storagewithoutborders.com": "2021-04-23", "stratfor.cloud": "2024-10-26", "stsnews.com": "2021-05-31", "support-google.cloud": "2024-10-27", "supportcdn-default-rtdb.firebaseio.com": "2021-05-31", "swcloud.us": "2024-10-27", "swipeservice.com": "2021-01-20", "symbolsecurity.cloud": "2024-10-28", "tacomanewspaper.com": "2021-05-31", "techforefront.com": "2021-04-23", "techiefly.com": "2021-01-20", "test.directfwd.com": "2021-03-20", "test.news.pocketstay.com": "2021-03-20", "theadminforum.com": "2021-05-31", "theanalyticsnews.com": "2022-01-07", "thedoccloud.com": "2020-12-14", "theskoolieblog.com": "2022-03-23", "time.suehyatt.com": "2021-03-20", "tk-ms.online": "2024-10-27", "topwebservers.com": "2021-04-23", "trendignews.com": "2021-05-31", "trentry-ms.online": "2024-10-27", "trustifi.cloud": "2024-12-17", "twimg-us.azureedge.net": "2021-03-20", "ua-aws.army": "2024-10-23", "ua-energy.cloud": "2024-10-22", "ua-gov.cloud": "2024-10-22", "ua-mil.cloud": "2024-10-23", "ua-se.cloud": "2024-10-23", "ua-sec.cloud": "2024-10-23", "ua-sn.cloud": "2024-10-23", "ukrainesec.cloud": "2024-10-30", "ukrtelcom.com": "2025-02-07", "ukrtelecom.cloud": "2024-10-23", "ukrtelecom.eu": "2025-02-07", "uohs-gov.cloud": "2024-10-22", "uoou-gov.cloud": "2024-10-22", "update.softhouse.store": "2022-04-16", "us-army.cloud": "2024-12-17", "us-east-1-aws.mfa-gov.cloud": "2024-10-22", "us-east-1-aws.s3-ua.cloud": "2024-10-30", "us-east-1-aws.ua-gov.cloud": "2024-10-30", "us-east-1-aws.ua-sec.cloud": "2024-10-30", "us-east-2-aws.gov-ua.cloud": "2024-10-30", "us-east-2-aws.ua-gov.cloud": "2024-10-23", "us-east-2-aws.ukrtelecom.cloud": "2024-10-30", "us-east-2.aws-ukraine.cloud": "2024-10-30", "us-east-2.gov-ua.cloud": "2024-10-30", "us-east-2.ua-sec.cloud": "2024-10-30", "us-east-2.ukrainesec.cloud": "2024-10-30", "us-east-console.aws-ukraine.cloud": "2024-10-30", "us-east-console.awsplatform.online": "2024-10-23", "us-east-console.ua-energy.cloud": "2024-10-30", "us-mil.cloud": "2024-10-27", "us-west-1-amazon.ua-energy.cloud": "2024-10-22", "us-west-1-amazon.ua-mil.cloud": "2024-10-30", "us-west-1-amazon.ua-sec.cloud": "2024-10-30", "us-west-1-aws.gov-ua.cloud": "2024-10-30", "us-west-1.aws-ukraine.cloud": "2024-10-23", "us-west-1.ua-aws.army": "2024-10-23", "us-west-1.ua-energy.cloud": "2024-10-30", "us-west-1.ua-gov.cloud": "2024-10-30", "us-west-1.ukrtelecom.cloud": "2024-10-23", "us-west-2-aws.mfa-gov.cloud": "2024-10-22", "us-west-2-aws.s3-ua.cloud": "2024-10-30", "us-west-2-aws.ua-energy.cloud": "2024-10-30", "us-west-2.gov-ua.cloud": "2024-10-30", "us-west-2.ua-energy.cloud": "2024-10-30", "us-west-2.ua-sec.cloud": "2024-10-30", "usaid.cloud": "2024-10-27", "usaid.theyardservice.com": "2021-05-31", "usip.us": "2024-10-27", "ustradecomp.com": "2015-10-23", "varuhusmc.org": "2019-10-17", "veeam.solutions": "2024-12-17", "vibrant-ms.online": "2024-10-27", "vikas-aws.online": "2024-10-27", "virtualdataserver.com": "2020-12-15", "virtualwebdata.com": "2020-12-15", "visit-ms.online": "2024-10-27", "vlada-gov.cloud": "2024-10-22", "vm-srv-1.gel.ulaval.ca": "2022-01-27", "vmdisk.com": "2021-04-23", "voa-gov.cloud": "2024-10-22", "vuvalog.com": "2021-12-07", "webcodez.com": "2020-12-15", "webdox-aws.online": "2024-10-27", "webpp.com": "2021-04-23", "websitesline.com": "2021-04-23", "websitetheme.com": "2020-12-14", "westmedicalgroup.net": "2019-10-17", "wilsoncenter.cloud": "2024-10-26", "wrapsnet.cloud": "2024-10-27", "xrlinks.com": "2021-04-23", "zero-trust.solutions": "2024-10-23", "zixcorp.cloud": "2024-12-17", "zombie.susan-hyatt.com": "2021-03-20", "zoom-meeting.cloud": "2024-12-17", "zoom-meeting.live": "2024-12-17", "zoom-meeting.pro": "2024-12-17", "zoom-meeting.today": "2024-12-17", "zoom-meetings.cloud": "2024-12-17", "zoommeeting.today": "2024-12-17", "zoommeeting.zone": "2024-12-17", "zupertech.com": "2020-12-14" }, "ipv4": { "103.216.221.18:50031": "2020-08-19", "103.253.41.102:8081": "2020-09-09", "103.76.128.34:8080": "2024-01-23", "104.194.159.150:443": "2026-08-01", "107.189.26.194:443": "2026-08-01", "111.90.150.140:25": "2020-07-21", "138.197.202.81:3000": "2026-08-01", "138.68.160.124:3000": "2026-08-01", "141.98.212.55:121": "2020-07-29", "141.98.212.55:53": "2022-07-23", "165.22.146.161:3000": "2026-08-01", "179.43.141.188:81": "2021-03-20", "179.43.141.188:82": "2021-03-20", "179.43.141.188:83": "2021-03-20", "185.189.151.182:443": "2021-03-20", "185.225.69.69:443": "2021-03-05", "185.243.99.17:3389": "2025-02-07", "209.58.186.196:443": "2022-07-23", "213.145.86.112:443": "2026-08-01", "216.126.224.95:3000": "2026-08-01", "216.243.39.167:8090": "2021-02-05", "31.172.83.142:4000": "2026-08-01", "31.57.243.154:2000": "2026-08-01", "31.57.243.154:443": "2026-08-01", "38.146.28.132:443": "2026-08-01", "38.146.28.75:4000": "2026-08-01", "38.146.28.75:8443": "2026-08-01", "45.91.93.89:443": "2020-12-27", "5.75.159.186:22": "2023-03-08", "5.75.159.186:3306": "2023-03-08", "5.75.159.186:3389": "2023-03-08", "5.75.159.186:443": "2023-03-08", "5.75.159.186:5800": "2023-03-08", "5.75.159.186:5900": "2023-03-08", "84.200.154.162:4000": "2026-08-01", "91.219.239.43:143": "2021-03-20", "91.219.239.54:81": "2021-03-20", "91.219.239.54:82": "2021-03-20", "98.225.248.37:8090": "2021-02-05" }, "url": { "agencijazaregistraciju.rs/i.html": "2022-07-08", "agencijazaregistraciju.rs/t.php": "2022-07-08", "easym6.com/Information.php": "2023-07-28", "example.com/assets/index.php": "2021-03-08", "fondoftravel.com/contact.php": "2023-07-28", "gavice.ng/event_program.php": "2023-10-14", "http://103.13.240.46": "2020-07-18", "http://103.193.4.101": "2021-08-03", "http://103.205.8.72": "2020-07-18", "http://103.216.221.19": "2020-07-18", "http://103.253.41.102": "2020-07-18", "http://103.253.41.68": "2020-07-18", "http://103.253.41.82": "2020-07-18", "http://103.253.41.90": "2020-07-18", "http://103.73.188.101": "2020-07-18", "http://111.90.146.143": "2020-07-18", "http://111.90.147.248": "2021-08-02", "http://111.90.150.176": "2020-07-18", "http://111.90.151.120": "2021-08-03", "http://116.202.251.49": "2021-08-03", "http://116.202.251.5": "2021-08-03", "http://119.160.234.163": "2020-07-18", "http://119.160.234.194": "2020-07-18", "http://119.81.173.130": "2020-07-18", "http://119.81.178.105": "2020-07-18", "http://119.81.184.11": "2020-07-18", "http://120.53.12.132": "2020-07-18", "http://122.114.197.185": "2020-07-18", "http://122.114.226.172": "2020-07-18", "http://141.255.164.11": "2021-08-03", "http://141.255.164.29": "2020-07-18", "http://141.98.212.55": "2020-07-18", "http://141.98.214.14": "2021-08-03", "http://145.249.107.73": "2020-07-18", "http://146.0.76.37": "2020-07-18", "http://149.202.12.210": "2020-07-18", "http://152.44.45.10": "2021-08-03", "http://152.89.160.81": "2021-08-03", "http://169.239.128.110": "2020-07-18", "http://176.119.29.37": "2020-07-18", "http://178.157.13.168": "2021-08-03", "http://178.211.39.6": "2020-07-18", "http://185.140.55.35": "2021-08-03", "http://185.145.128.35": "2020-07-18", "http://185.193.126.172": "2022-04-16", "http://185.207.205.174": "2021-08-03", "http://185.225.226.16": "2020-07-18", "http://185.99.133.112": "2020-07-18", "http://188.241.68.137": "2020-07-18", "http://191.101.180.78": "2020-07-18", "http://192.48.88.107": "2020-07-18", "http://193.36.116.119": "2021-08-03", "http://193.36.119.162": "2021-08-03", "http://193.36.119.184": "2021-08-03", "http://202.59.9.59": "2020-07-18", "http://209.58.186.196": "2020-07-18", "http://209.58.186.197": "2020-07-18", "http://209.58.186.240": "2020-07-18", "http://220.158.216.130": "2020-07-18", "http://23.106.123.15": "2021-12-06", "http://27.102.130.115": "2020-07-18", "http://31.13.195.210": "2021-08-03", "http://31.170.107.186": "2020-07-18", "http://31.7.63.141": "2020-07-18", "http://37.120.247.163": "2021-08-03", "http://45.120.156.69": "2020-07-18", "http://45.123.190.167": "2020-07-18", "http://45.123.190.168": "2020-07-18", "http://45.124.132.10": "2021-08-03", "http://45.124.132.106": "2021-08-03", "http://45.129.229.48": "2020-07-18", "http://45.152.84.57": "2020-07-18", "http://46.19.143.69": "2020-07-18", "http://5.199.174.164": "2020-07-18", "http://5.75.159.186": "2023-03-08", "http://51.195.68.217": "2022-04-16", "http://66.70.247.215": "2020-07-18", "http://79.141.168.109": "2020-07-18", "http://81.17.17.213": "2020-07-18", "http://85.93.2.116": "2020-07-18", "http://91.132.139.195": "2021-08-03", "literaturaelsalvador.com/Instructions.html": "2023-03-10", "literaturaelsalvador.com/Schedule.html": "2023-03-10", "mightystake.com/sponsorship.php": "2023-07-28", "parquesanrafael.cl/note.html": "2023-09-23", "poetpages.com/pp/l4.php": "2023-05-18", "porodicno.ba/wp-content/Agenda.html": "2022-07-20", "reidao.com/dashboard.php": "2023-07-28", "resetlocations.com/bmw.htm": "2023-07-28", "reyweb.com/assets/index.php": "2021-03-08", "sgrfh.org.pk/wp-content/idx.php": "2023-09-23", "sharpledge.com/login.php": "2023-07-28", "siestakeying.com/auth.php": "2024-03-02", "signitivelogics.com/BMW.html": "2023-03-10", "signitivelogics.com/Schedule.html": "2023-03-10", "simplesalsamix.com/e-yazi.html": "2023-07-28", "sylvio.com.br/form.php": "2023-07-28", "te-as.no/wine.php": "2023-07-28", "theandersonco.com/wp_info.php": "2021-12-06", "tomasubiera.com/wp_getcontent.php": "2021-12-06", "totalmassasje.no/schedule.php": "2023-02-19", "waterforvoiceless.org/invite.php": "2024-03-22", "waterforvoiceless.org/util.php": "2024-03-02", "wethe6and9.ca/wp-content/Agenda.html": "2022-07-20", "willyminiatures.com/e-yazi.html": "2023-08-24" }, "url_path": { "/46tt83y6.ps1": "2021-03-20", "/build_eu.ps1": "2021-03-20", "/buildus9_3.ps1": "2021-03-20", "/p0fd798.ps1": "2021-03-20", "/pwrvw.ps1": "2021-03-20", "/rainloop/forecast": "2022-01-27", "/sk-jspark_init.php": "2021-03-20", "/t/pixel.gif?m=": "2026-08-01", "/ujwphtigdcokr": "2024-01-23" } }, "first_seen_precision": { "domain": { "bakenhof.com": "at-or-before", "bravecup.com": "at-or-before", "cloudflare.redirectpartners.com": "at-or-before", "findcloudflare.com": "at-or-before", "info.ophibre.com": "at-or-before", "mail.bakenhof.com": "at-or-before", "mail.bravecup.com": "at-or-before", "mail.ophibre.com": "at-or-before", "mail.silry.com": "at-or-before", "mx.ophibre.com": "at-or-before", "ophibre.com": "at-or-before", "redirectpartners.com": "at-or-before", "silry.com": "at-or-before" }, "ipv4": {}, "url": {}, "url_path": {} }, "first_seen_range": { "earliest": "2015-10-23", "latest": "2026-08-02" }, "generated_at": "2026-08-08T03:26:30+00:00", "indicators": { "domain": [ "1597ebba.info.gtjas.site", "1cloudserver.com", "3bcc1bba.info.gtjas.site", "40ort.750.credit", "4freerussia.cloud", "6a57jk2ba1d9keg15cbg.appsync-api.eu-west-1.avsvmcloud.com", "74d6b7b2.app.giftbox4u.com", "7c291bbe.info.gtjas.site", "7sbvaemscs0mc925tb99.appsync-api.us-west-2.avsvmcloud.com", "acciaio.com.br", "accounts-google.online", "actualcombine.com", "actualityworld.com", "adagio.betterworldshopping.com", "adm.govua.cloud", "admin-ch.cloud", "admirer.onehourcfo.com", "adsprofitnetwork.com", "aeinc.solutions", "ahmed-ms.online", "aimsecurity.net", "airtravelabroad.com", "aka-ms.cloud", "albrightstonebridge.cloud", "alertmeter.info", "amazonmeeting.cloud", "amazonsolutions.cloud", "americanprogress.cloud", "ap-northeast-1-aws.s3-ua.cloud", "ap-northeast-1-aws.ukrainesec.cloud", "apexwebtech.com", "appsprovider.com", "appsync-api.eu-west-1.avsvmcloud.com", "appsync-api.us-east-1.avsvmcloud.com", "appsync-api.us-east-2.avsvmcloud.com", "appsync-api.us-west-2.avsvmcloud.com", "armrvrholo.com", "aspeninstitute.cloud", "assetdata.net", "asucloud.us", "autonetonline.com", "avis-google.online", "avsvmcloud.com", "aws-app.online", "aws-atshop.online", "aws-cert.online", "aws-cloud.online", "aws-cloud.tech", "aws-data.cloud", "aws-devops.site", "aws-exam.online", "aws-il.cloud", "aws-join.cloud", "aws-meet.cloud", "aws-meetings.cloud", "aws-ms.cloud", "aws-my.online", "aws-online.cloud", "aws-platform.cloud", "aws-s3.cloud", "aws-sagyo.site", "aws-sample.online", "aws-secure.cloud", "aws-talib.online", "aws-ukraine.cloud", "aws-yamada.site", "awsmeet.cloud", "awsmeetings.online", "awsplatform.online", "awsprotect.online", "bacionera.top", "backup.awarfaregaming.com", "backupify.cloud", "bakenhof.com", "bandabonga.fr", "barracuda.solutions", "beijingnewsblog.net", "bfilmnews.com", "bigdataanalysts.com", "bigtopweb.com", "bmlor.750.credit", "bravecup.com", "bringthenoiseappnew.s3.amazonaws.com", "brookings.cloud", "builder.visionarybusiness.net", "bund-de.cloud", "busseylawoffice.com", "c-r.services", "ca-central-1.awsplatform.online", "ca-central-1.gov-ua.cloud", "ca-central-1.ua-gov.cloud", "ca-west-1.aws-ukraine.cloud", "ca-west-1.mfa-gov.cloud", "ca-west-1.ukrtelecom.cloud", "cabemanis-ms.online", "caci.solutions", "cadastros-google.online", "camogit.com", "capgemini.services", "cdnappservice.firebaseio.com", "ceip.cloud", "central-2-aws.ua-aws.army", "central-2-aws.ua-mil.cloud", "central-2-aws.ua-sec.cloud", "central-2-aws.ukrainesec.cloud", "central-2-aws.ukrtelecom.cloud", "cepa.solutions", "cer.zone", "ceycarb.com", "cfr-aws.cloud", "champions.gdtc.org", "citoc.cloud", "cityloss.com", "clari.cloud", "clearancejobs.cloud", "cloudflare.redirectpartners.com", "cnas.zone", "coachandcook.at", "cod-ms.online", "coloradospringsroofing.info", "com-s3.cloud", "combat.strategyforgood.com", "commerce-mil.online", "computerrepublic.com", "console-google.cloud", "content.pcmsar.net", "context.septemberyears.org", "cribl-gov.cloud", "crisisgroup.services", "crochetnews.com", "cross-checking.com", "csbaonline.cloud", "csu-gov.cloud", "ctu-gov.cloud", "cwinc.cloud", "d1d66buv7blf1z.cloudfront.net", "d287-206-123-149-139.ngrok-free.app", "d3ser9acyt7cdp.cloudfront.net", "daddy.stlouisdemoday.com", "dailydews.com", "databasegalore.com", "dataplane.theyardservice.com", "datatidy.com", "datazr.com", "deervalleyassociation.com", "defence-au.cloud", "defender5.coachwithak.com", "defense-gouv.cloud", "deftsecurity.com", "democracyendowment.cloud", "dep-no.cloud", "devops-aws.cloud", "dgfip-gouv.online", "dia-gov.cloud", "diamondglobalnetwork.com", "difesa-it.cloud", "digitalcollege.org", "digitalphotohub.com", "dn-ms.online", "doggroomingnews.com", "dom-news.com", "domainingdirectory.com", "drive-google.cloud", "druva.cloud", "dtran-ms.online", "ebbcloud.com", "ebookstorelive.com", "ecfr.cloud", "ecolesndmessines.org", "email.theyardservice.com", "emergencystreet.com", "enpport.com", "eopgov.cloud", "ernesttheskoolie.com", "eros-ms.online", "eru-gov.cloud", "ervsystem.com", "eu-central-1-aws.amazonsolutions.cloud", "eu-central-1-aws.dep-no.cloud", "eu-central-1-aws.gov-pl.cloud", "eu-central-1-aws.gov-sk.cloud", "eu-central-1-aws.gov-trust.cloud", "eu-central-1-aws.govua.cloud", "eu-central-1-aws.mfa-gov.cloud", "eu-central-1-aws.minbuza.cloud", "eu-central-1-aws.mindef-nl.cloud", "eu-central-1-aws.msz-pl.cloud", "eu-central-1-aws.mzv-sk.cloud", "eu-central-1-aws.ncfta.cloud", "eu-central-1-aws.presidencia-pt.cloud", "eu-central-1-aws.quirinale.cloud", "eu-central-1-aws.regeringskansliet-se.cloud", "eu-central-1-aws.s3-be.cloud", "eu-central-1-aws.s3-ua.cloud", "eu-central-1-aws.ua-gov.cloud", "eu-central-1-aws.ukrainesec.cloud", "eu-central-1.difesa-it.cloud", "eu-central-1.mfa-gov.cloud", "eu-central-1.mil-be.cloud", "eu-central-1.mil-pl.cloud", "eu-central-1.minbuza.cloud", "eu-central-1.mindef-nl.cloud", "eu-central-1.msz-pl.cloud", "eu-central-1.quirinale.cloud", "eu-central-1.regeringskansliet-se.cloud", "eu-central-1.s3-be.cloud", "eu-central-1.s3-esa.cloud", "eu-central-1.s3-nato.cloud", "eu-central-1.ua-gov.cloud", "eu-central-1.ua-sec.cloud", "eu-central-1.ukrtelecom.cloud", "eu-central-2-aws.amazonsolutions.cloud", "eu-central-2-aws.aws-ukraine.cloud", "eu-central-2-aws.dep-no.cloud", "eu-central-2-aws.gov-pl.cloud", "eu-central-2-aws.gov-sk.cloud", "eu-central-2-aws.mil-be.cloud", "eu-central-2-aws.mil-pl.cloud", "eu-central-2-aws.mindef-nl.cloud", "eu-central-2-aws.msz-pl.cloud", "eu-central-2-aws.mzv-sk.cloud", "eu-central-2-aws.presidencia-pt.cloud", "eu-central-2-aws.regeringskansliet-se.cloud", "eu-central-2-aws.s3-be.cloud", "eu-central-2-aws.ua-aws.army", "eu-central-2-aws.ua-gov.cloud", "eu-central-2-aws.ua-mil.cloud", "eu-central-2-aws.ukrtelecom.cloud", "eu-east-1-aws.amazonsolutions.cloud", "eu-east-1-aws.dep-no.cloud", "eu-east-1-aws.gov-sk.cloud", "eu-east-1-aws.gov-ua.cloud", "eu-east-1-aws.mil-be.cloud", "eu-east-1-aws.mil-pl.cloud", "eu-east-1-aws.minbuza.cloud", "eu-east-1-aws.mindef-nl.cloud", "eu-east-1-aws.msz-pl.cloud", "eu-east-1-aws.mzv-sk.cloud", "eu-east-1-aws.quirinale.cloud", "eu-east-1-aws.regeringskansliet-se.cloud", "eu-east-1-aws.s3-be.cloud", "eu-east-1-aws.s3-de.cloud", "eu-east-1-aws.ua-gov.cloud", "eu-east-1-aws.ua-sec.cloud", "eu-east-1-aws.ukrtelecom.cloud", "eu-north-1-aws.dep-no.cloud", "eu-north-1-aws.difesa-it.cloud", "eu-north-1-aws.gov-pl.cloud", "eu-north-1-aws.gov-sk.cloud", "eu-north-1-aws.mil-be.cloud", "eu-north-1-aws.mil-pl.cloud", "eu-north-1-aws.minbuza.cloud", "eu-north-1-aws.ncfta.cloud", "eu-north-1-aws.presidencia-pt.cloud", "eu-north-1-aws.quirinale.cloud", "eu-north-1-aws.regeringskansliet-se.cloud", "eu-north-1-aws.s3-be.cloud", "eu-north-1-aws.s3-de.cloud", "eu-north-1-aws.ua-energy.cloud", "eu-north-1-aws.ua-gov.cloud", "eu-north-1.difesa-it.cloud", "eu-north-1.gov-trust.cloud", "eu-north-1.gov-ua.cloud", "eu-north-1.gv-at.cloud", "eu-north-1.mil-be.cloud", "eu-north-1.mil-pl.cloud", "eu-north-1.mzv-sk.cloud", "eu-north-1.ncfta.cloud", "eu-north-1.regeringskansliet-se.cloud", "eu-north-1.s3-be.cloud", "eu-north-1.s3-de.cloud", "eu-north-1.s3-ua.cloud", "eu-south-1-aws.admin-ch.cloud", "eu-south-1-aws.dep-no.cloud", "eu-south-1-aws.difesa-it.cloud", "eu-south-1-aws.gov-pl.cloud", "eu-south-1-aws.gov-trust.cloud", "eu-south-1-aws.mfa-gov.cloud", "eu-south-1-aws.mil-be.cloud", "eu-south-1-aws.minbuza.cloud", "eu-south-1-aws.mzv-sk.cloud", "eu-south-1-aws.quirinale.cloud", "eu-south-1-aws.s3-be.cloud", "eu-south-1-aws.s3-de.cloud", "eu-south-1-aws.ua-gov.cloud", "eu-south-2-aws.amazonsolutions.cloud", "eu-south-2-aws.dep-no.cloud", "eu-south-2-aws.gov-pl.cloud", "eu-south-2-aws.gov-sk.cloud", "eu-south-2-aws.mfa-gov.cloud", "eu-south-2-aws.mil-be.cloud", "eu-south-2-aws.mil-pl.cloud", "eu-south-2-aws.mil-pt.cloud", "eu-south-2-aws.minbuza.cloud", "eu-south-2-aws.msz-pl.cloud", "eu-south-2-aws.mzv-sk.cloud", "eu-south-2-aws.ncfta.cloud", "eu-south-2-aws.quirinale.cloud", "eu-south-2-aws.regeringskansliet-se.cloud", "eu-south-2-aws.s3-be.cloud", "eu-south-2-aws.s3-de.cloud", "eu-south-2-aws.s3-esa.cloud", "eu-south-2-aws.s3-nato.cloud", "eu-south-2-aws.s3-ua.cloud", "eu-south-2-aws.ua-gov.cloud", "eu-south-2.dep-no.cloud", "eu-south-2.gov-pl.cloud", "eu-south-2.gov-sk.cloud", "eu-south-2.mil-be.cloud", "eu-south-2.mil-pl.cloud", "eu-south-2.mindef-nl.cloud", "eu-south-2.s3-be.cloud", "eu-south-2.s3-de.cloud", "eu-south-2.s3-esa.cloud", "eu-south-2.s3-nato.cloud", "eu-south-2.ua-sec.cloud", "eu-south-2.ukrainesec.cloud", "eu-southeast-1-aws.amazonsolutions.cloud", "eu-southeast-1-aws.aws-ukraine.cloud", "eu-southeast-1-aws.dep-no.cloud", "eu-southeast-1-aws.difesa-it.cloud", "eu-southeast-1-aws.gov-sk.cloud", "eu-southeast-1-aws.gov-trust.cloud", "eu-southeast-1-aws.gov-ua.cloud", "eu-southeast-1-aws.govtr.cloud", "eu-southeast-1-aws.mil-be.cloud", "eu-southeast-1-aws.mil-pl.cloud", "eu-southeast-1-aws.mindef-nl.cloud", "eu-southeast-1-aws.msz-pl.cloud", "eu-southeast-1-aws.mzv-cz.cloud", "eu-southeast-1-aws.mzv-sk.cloud", "eu-southeast-1-aws.quirinale.cloud", "eu-southeast-1-aws.s3-be.cloud", "eu-southeast-1-aws.s3-de.cloud", "eu-southeast-1-aws.s3-esa.cloud", "eu-southeast-1-aws.s3-ua.cloud", "eu-southeast-1-aws.ua-energy.cloud", "eu-southeast-1-aws.ukrainesec.cloud", "eu-southeast-1-aws.zero-trust.solutions", "eu-west-1-aws.amazonsolutions.cloud", "eu-west-1-aws.aws-ukraine.cloud", "eu-west-1-aws.dep-no.cloud", "eu-west-1-aws.gov-pl.cloud", "eu-west-1-aws.gov-sk.cloud", "eu-west-1-aws.gov-trust.cloud", "eu-west-1-aws.gov-ua.cloud", "eu-west-1-aws.mil-be.cloud", "eu-west-1-aws.mil-pl.cloud", "eu-west-1-aws.minbuza.cloud", "eu-west-1-aws.quirinale.cloud", "eu-west-1-aws.s3-be.cloud", "eu-west-1-aws.s3-de.cloud", "eu-west-1-aws.s3-esa.cloud", "eu-west-1-aws.s3-nato.cloud", "eu-west-1-aws.ua-sec.cloud", "eu-west-1-aws.ukrainesec.cloud", "eu-west-1.aws-ukraine.cloud", "eu-west-1.difesa-it.cloud", "eu-west-1.gov-sk.cloud", "eu-west-1.mil-be.cloud", "eu-west-1.mil-pl.cloud", "eu-west-1.minbuza.cloud", "eu-west-1.msz-pl.cloud", "eu-west-1.mzv-sk.cloud", "eu-west-1.regeringskansliet-se.cloud", "eu-west-1.s3-de.cloud", "eu-west-1.s3-esa.cloud", "eu-west-1.s3-ua.cloud", "eu-west-1.ua-gov.cloud", "eu-west-1.ukrtelecom.cloud", "eu-west-2-aws.amazonsolutions.cloud", "eu-west-2-aws.dep-no.cloud", "eu-west-2-aws.difesa-it.cloud", "eu-west-2-aws.gov-pl.cloud", "eu-west-2-aws.gov-sk.cloud", "eu-west-2-aws.gv-at.cloud", "eu-west-2-aws.mil-be.cloud", "eu-west-2-aws.mil-pl.cloud", "eu-west-2-aws.minbuza.cloud", "eu-west-2-aws.mindef-nl.cloud", "eu-west-2-aws.msz-pl.cloud", "eu-west-2-aws.mzv-sk.cloud", "eu-west-2-aws.quirinale.cloud", "eu-west-2-aws.s3-be.cloud", "eu-west-2-aws.s3-de.cloud", "eu-west-2-aws.s3-esa.cloud", "eu-west-2-aws.s3-nato.cloud", "eu-west-2-aws.s3-ua.cloud", "eu-west-2-aws.ua-sec.cloud", "eu-west-3-aws.aws-ukraine.cloud", "eu-west-3-aws.dep-no.cloud", "eu-west-3-aws.difesa-it.cloud", "eu-west-3-aws.gov-pl.cloud", "eu-west-3-aws.gov-sk.cloud", "eu-west-3-aws.gov-trust.cloud", "eu-west-3-aws.mil-be.cloud", "eu-west-3-aws.mil-pl.cloud", "eu-west-3-aws.mil-pt.cloud", "eu-west-3-aws.minbuza.cloud", "eu-west-3-aws.mindef-nl.cloud", "eu-west-3-aws.msz-pl.cloud", "eu-west-3-aws.mzv-sk.cloud", "eu-west-3-aws.quirinale.cloud", "eu-west-3-aws.regeringskansliet-se.cloud", "eu-west-3-aws.s3-be.cloud", "eu-west-3-aws.s3-ua.cloud", "eu-west-3-aws.ua-mil.cloud", "eu-west-3.amazonsolutions.cloud", "eu-west-3.aws-ukraine.cloud", "eu-west-3.mil-be.cloud", "eu-west-3.mil-pl.cloud", "eu-west-3.minbuza.cloud", "eu-west-3.mindef-nl.cloud", "eu-west-3.msz-pl.cloud", "eu-west-3.mzv-sk.cloud", "eu-west-3.presidencia-pt.cloud", "eu-west-3.s3-be.cloud", "eu-west-3.s3-ua.cloud", "eu-west-3.ukrainesec.cloud", "eu-west-3.ukrtelecom.cloud", "europa-eu.cloud", "europeanvalues.cloud", "eventbrite-com-default-rtdb.firebaseio.com", "exclaimer.solutions", "eyetechltd.com", "fairfieldsch.org", "fanta.swofficefurniture.com", "feedzai-gov.cloud", "financialmarket.org", "findcloudflare.com", "fisheries-states-codes-camps.trycloudflare.com", "fisioterapiabb.it", "flowers.netplusplans.com", "flowers.thegardnerco.com", "forces-gc.cloud", "foreignhurry.com", "foreignpolicy.cloud", "fqtel.com", "freedomhouse.cloud", "freescanonline.com", "freespace.givingprofits.net", "ga-mil.online", "galatinonews.com", "gallery.wineadam.com", "gallerycenter.org", "gc-cloud.ca", "gd-ms.cloud", "gdbcloud.com", "giftbox4u.com", "globalnetworkissues.com", "globalsection.org", "globesoftwares.com", "gmfus.cloud", "gnadptech.com", "go-conference.cloud", "go-jp.cloud", "go-meet-up.com", "go-meet.pro", "go-meeting.cloud", "go-meeting.online", "google-accs.online", "google-ai.site", "google-analysis.cloud", "google-com.site", "google-com.website", "google-docs.online", "google-duo.online", "google-duo.site", "google-map.website", "google-meet.cloud", "google-pesquisa.online", "google-plays.site", "google-playstore.online", "google-sanctions.online", "google-seguro.site", "google-shopping.online", "google-support.site", "googlemeet.zone", "gouv-fr.cloud", "gov-au.cloud", "gov-aws.cloud", "gov-fi.cloud", "gov-gr.cloud", "gov-lt.cloud", "gov-lv.cloud", "gov-pl.cloud", "gov-sk.cloud", "gov-trust.cloud", "gov-ua.cloud", "govbook.cloud", "govdom.cloud", "govista.cloud", "govmr.cloud", "govps.cloud", "govtr.cloud", "govua.cloud", "gq1h856599gqh538acqn.appsync-api.us-west-2.avsvmcloud.com", "graphicscodex.net", "greencastleadvantage.com", "group3.pulsedesigngroup.us", "grouptumbler.com", "gtjas.site", "gv-at.cloud", "hanproud.com", "hcdc-ms.online", "heritagecloud.org", "highdatabase.com", "holescontracting.com", "hso-aws.cloud", "humanitarian-forum-default-rtdb.firebaseio.com", "ihvpgv9psvq02ffo77et.appsync-api.us-east-2.avsvmcloud.com", "iklan-google.online", "incomeupdate.com", "inferno.bigpurposebigimpact.com", "infinitysoftwares.com", "info.gtjas.site", "info.ophibre.com", "inovaoftalmologia.com.br", "inspirer.cartsandmowers.com", "ioxmesh.com", "ipadsreview.org", "jdm-s3.online", "jenkins.findfwd.com", "joke.webproduct.info", "joomla.lifepath.site", "jtf-mil.online", "justice.technology", "k5kcubuassl3alrf7gm3.appsync-api.eu-west-1.avsvmcloud.com", "kaceloj.com", "kam-lt.cloud", "kefas.id", "kegas.id", "kirute.com", "kitaeri.com", "kmu.govua.cloud", "kubecloud.com", "lamarfish.com", "lcomputers.com", "learn-ms.online", "leveldelta.com", "limoservicecompany.com", "lion.vipjoyeria.com", "lordfilm-ms.online", "loreaosvault.cloud", "lorriratzlaff.com", "m365-owa.com", "macfound.services", "mae-ro.cloud", "mail.bakenhof.com", "mail.bravecup.com", "mail.ophibre.com", "mail.silry.com", "mapn-ro.cloud", "mappsglobal.com", "maps-google.online", "matclick.com", "md-gov.cloud", "mde-es.cloud", "meet-google.cloud", "megatoolkit.com", "method.nonprofitsustainability.com", "mf-gov.cloud", "mfa-bg.website", "mfa-gov-il.cloud", "mfa-gov-tr.cloud", "mfa-gov.cloud", "mfa-gov.online", "mhdosoksaccf9sni9icp.appsync-api.eu-west-1.avsvmcloud.com", "microsoft-meeting.cloud", "microsoftmeeting.cloud", "microtransito.com", "midcitylanews.com", "mil-be.cloud", "mil-commerce.online", "mil-defense.online", "mil-ee.cloud", "mil-mza.online", "mil-mza.site", "mil-pl.cloud", "mil-pt.cloud", "mil-stat.online", "mil-tek.online", "mimecast.cloud", "minbuza.cloud", "mindef-nl.cloud", "ministernetwork.org", "mmr-gov.cloud", "mo-gov.cloud", "mobilnweb.com", "mod-cloud.uk", "mod-gov-il.cloud", "monitor.syn.cn", "morh-hr.cloud", "motherlodebulldogclub.com", "mpo-gov.cloud", "mpsv-gov.cloud", "ms-aid.site", "ms-antalia.online", "ms-aws.cloud", "ms-cabemanis.online", "ms-cabemanis.site", "ms-cabemanis.website", "ms-clean.site", "ms-company.site", "ms-conference.cloud", "ms-copilot.online", "ms-dining.site", "ms-exchange.online", "ms-flamex.online", "ms-gacor.online", "ms-gacor.site", "ms-gma.online", "ms-green.online", "ms-immo.online", "ms-irstatic.cloud", "ms-jpan.online", "ms-justme.online", "ms-justmetv.online", "ms-labs.site", "ms-legal.site", "ms-log.site", "ms-media.online", "ms-meeting.com", "ms-meeting.online", "ms-meetings.online", "ms-menu.online", "ms-mfa.online", "ms-moviez.site", "ms-mu.online", "ms-nas.online", "ms-offce.online", "ms-oiffce.online", "ms-oiffice.online", "ms-ok.site", "ms-org.tech", "ms-paint.online", "ms-perry.online", "ms-pmr.online", "ms-raskion.online", "ms-review.site", "ms-rp.site", "ms-sami.tech", "ms-schaefer.online", "ms-scribe.online", "ms-secure.cloud", "ms-security.online", "ms-sign.site", "ms-store.cloud", "ms-tcentr.online", "ms-toto.online", "ms-toto.site", "ms-wow.online", "ms365-device.com", "ms365-live.com", "msconferences.cloud", "msmt-gov.cloud", "msz-pl.cloud", "muslimnewsdaily.com", "muyipep.com", "mv-gov.cloud", "mvep-hr.cloud", "mx.ceip.cloud", "mx.ophibre.com", "my-gov.cloud", "my-invite.org", "myrric-uses.singlejets.com", "mzd-gov.cloud", "mze-gov.cloud", "mzp-gov.cloud", "mzv-cz.cloud", "mzv-gov.cloud", "mzv-sk.cloud", "nakit-gov.cloud", "nasdaqblog.net", "natureinhome.com", "nbu-gov.cloud", "ncfta.cloud", "ncsc.solutions", "ndu.solutions", "nestedmail.com", "newsplacec.com", "newstepsco.com", "nikeoutletinc.org", "nopogew.com", "nordicmademedia.com", "nore-aws.online", "nostressjob.com", "nrcc.cloud", "ns1.actualcombine.com", "ns1.foreignhurry.com", "ns1.secretiveleap.com", "ns2.actualcombine.com", "ns2.foreignhurry.com", "ns2.secretiveleap.com", "nukib-gov.cloud", "nytunion.com", "oilnewsblog.com", "oktacloud.us", "olapdatabase.com", "onetechcompany.com", "opennet.solutions", "opensocietyfoundations.cloud", "ophibre.com", "otzyv-ms.online", "overpict.com", "owa-ms365.com", "pahohu.com", "panhardware.com", "parseccomputer.cloud", "pcmsar.net", "pdv.govua.cloud", "pharaosjournal.com", "photos-google.online", "photos-ms.online", "phpmyadmin.xsunx.com", "pixelapn.adsprofitnetwork.com", "pixelapn2.adsprofitnetwork.com", "playstore-google.online", "plkiu.daniyalmedicaltech.com", "pointers.ecostratas.com", "police-gov.cloud", "policie-gov.cloud", "polycom.solutions", "popcorn.net-zerodesign.com", "porno-google.online", "portal.sbn.co.th", "powerpolymerindustry.com", "presidencia-pt.cloud", "printing.laminatesandthings.com", "prio.zone", "productpitfalls.com", "promo9.promossupply.com", "prompt.powerofpartnerships.net", "publiccouncil.org", "pulsesecure.cloud", "q.promossupply.com", "quirinale.cloud", "raq-ms.online", "readnewshot.com", "red-ms.online", "redirectpartners.com", "regeringskansliet-se.cloud", "reyweb.com", "rheinemetall.com", "robotvice.com", "rock.core-thought.com", "rollver.com", "roofingspecialists.info", "rrt.solutions", "rubrik.zone", "rulourialuminiu.co.uk", "ryaxtech.com", "s3-acronis.cloud", "s3-army.cloud", "s3-atlassian.cloud", "s3-aws.cloud", "s3-aws.global", "s3-bah.cloud", "s3-be.cloud", "s3-blackberry.cloud", "s3-cloud.us", "s3-csis.cloud", "s3-de.cloud", "s3-dgap.cloud", "s3-dk.cloud", "s3-dnc.cloud", "s3-esa.cloud", "s3-fbi.cloud", "s3-hudson.cloud", "s3-ida.cloud", "s3-iri.cloud", "s3-knowbe4.cloud", "s3-marcus.cloud", "s3-monitoring.cloud", "s3-nato.cloud", "s3-ned.cloud", "s3-nsa.cloud", "s3-proofpoint.cloud", "s3-pt.cloud", "s3-rackspace.cloud", "s3-rand.cloud", "s3-spacex.cloud", "s3-state.cloud", "s3-stig.cloud", "s3-ua.cloud", "s3-ucia.cloud", "s3-us.navy", "s3-zoho.cloud", "s3.army", "saiccloud.us", "salesappliances.com", "satkas.waw.pl", "secretiveleap.com", "secureconnectiongroup.com", "secured-ms.online", "securesearchnow.com", "security-updater-default-rtdb.firebaseio.com", "securitysystemnews.com", "sendbits.m2stor4ge.xyz", "sense4baby.fr", "seobundlekit.com", "servicenowinc.us", "sgrhf.org.pk", "shaines-aws.online", "shicloud.online", "signup-now.com", "silry.com", "sinitude.com", "sipacolumbia.us", "sisaf-ms.online", "sistemikan.com", "sixsquare.net", "skagenyoga.com", "skykick.solutions", "smtp2.theyardservice.com", "snuff.mybabyrose.com", "sobolpand.top", "softcat.cloud", "softhouse.store", "softwarelaunches.com", "softweblinks.com", "solartrackingsystem.net", "srfnetwork.org", "ssi-gouv-fr.cloud", "ssi-gouv.cloud", "standart.sdtranspo.com", "statecloud.us", "statistic-g.com", "stockmarketon.com", "stonecrestnews.com", "storagewithoutborders.com", "stratfor.cloud", "stsnews.com", "support-google.cloud", "supportcdn-default-rtdb.firebaseio.com", "swcloud.us", "swipeservice.com", "symbolsecurity.cloud", "tacomanewspaper.com", "techforefront.com", "techiefly.com", "test.directfwd.com", "test.news.pocketstay.com", "theadminforum.com", "theanalyticsnews.com", "thedoccloud.com", "theskoolieblog.com", "time.suehyatt.com", "tk-ms.online", "topwebservers.com", "trendignews.com", "trentry-ms.online", "trustifi.cloud", "twimg-us.azureedge.net", "ua-aws.army", "ua-energy.cloud", "ua-gov.cloud", "ua-mil.cloud", "ua-se.cloud", "ua-sec.cloud", "ua-sn.cloud", "ukrainesec.cloud", "ukrtelcom.com", "ukrtelecom.cloud", "ukrtelecom.eu", "uohs-gov.cloud", "uoou-gov.cloud", "update.softhouse.store", "us-army.cloud", "us-east-1-aws.mfa-gov.cloud", "us-east-1-aws.s3-ua.cloud", "us-east-1-aws.ua-gov.cloud", "us-east-1-aws.ua-sec.cloud", "us-east-2-aws.gov-ua.cloud", "us-east-2-aws.ua-gov.cloud", "us-east-2-aws.ukrtelecom.cloud", "us-east-2.aws-ukraine.cloud", "us-east-2.gov-ua.cloud", "us-east-2.ua-sec.cloud", "us-east-2.ukrainesec.cloud", "us-east-console.aws-ukraine.cloud", "us-east-console.awsplatform.online", "us-east-console.ua-energy.cloud", "us-mil.cloud", "us-west-1-amazon.ua-energy.cloud", "us-west-1-amazon.ua-mil.cloud", "us-west-1-amazon.ua-sec.cloud", "us-west-1-aws.gov-ua.cloud", "us-west-1.aws-ukraine.cloud", "us-west-1.ua-aws.army", "us-west-1.ua-energy.cloud", "us-west-1.ua-gov.cloud", "us-west-1.ukrtelecom.cloud", "us-west-2-aws.mfa-gov.cloud", "us-west-2-aws.s3-ua.cloud", "us-west-2-aws.ua-energy.cloud", "us-west-2.gov-ua.cloud", "us-west-2.ua-energy.cloud", "us-west-2.ua-sec.cloud", "usaid.cloud", "usaid.theyardservice.com", "usip.us", "ustradecomp.com", "varuhusmc.org", "veeam.solutions", "vibrant-ms.online", "vikas-aws.online", "virtualdataserver.com", "virtualwebdata.com", "visit-ms.online", "vlada-gov.cloud", "vm-srv-1.gel.ulaval.ca", "vmdisk.com", "voa-gov.cloud", "vuvalog.com", "webcodez.com", "webdox-aws.online", "webpp.com", "websitesline.com", "websitetheme.com", "westmedicalgroup.net", "wilsoncenter.cloud", "wrapsnet.cloud", "xrlinks.com", "zero-trust.solutions", "zixcorp.cloud", "zombie.susan-hyatt.com", "zoom-meeting.cloud", "zoom-meeting.live", "zoom-meeting.pro", "zoom-meeting.today", "zoom-meetings.cloud", "zoommeeting.today", "zoommeeting.zone", "zupertech.com" ], "ipv4": [ "103.216.221.18:50031", "103.253.41.102:8081", "103.76.128.34:8080", "104.194.159.150:443", "107.189.26.194:443", "111.90.150.140:25", "138.197.202.81:3000", "138.68.160.124:3000", "141.98.212.55:121", "141.98.212.55:53", "165.22.146.161:3000", "179.43.141.188:81", "179.43.141.188:82", "179.43.141.188:83", "185.189.151.182:443", "185.225.69.69:443", "185.243.99.17:3389", "209.58.186.196:443", "213.145.86.112:443", "216.126.224.95:3000", "216.243.39.167:8090", "31.172.83.142:4000", "31.57.243.154:2000", "31.57.243.154:443", "38.146.28.132:443", "38.146.28.75:4000", "38.146.28.75:8443", "45.91.93.89:443", "5.75.159.186:22", "5.75.159.186:3306", "5.75.159.186:3389", "5.75.159.186:443", "5.75.159.186:5800", "5.75.159.186:5900", "84.200.154.162:4000", "91.219.239.43:143", "91.219.239.54:81", "91.219.239.54:82", "98.225.248.37:8090" ], "url": [ "agencijazaregistraciju.rs/i.html", "agencijazaregistraciju.rs/t.php", "easym6.com/Information.php", "example.com/assets/index.php", "fondoftravel.com/contact.php", "gavice.ng/event_program.php", "http://103.13.240.46", "http://103.193.4.101", "http://103.205.8.72", "http://103.216.221.19", "http://103.253.41.102", "http://103.253.41.68", "http://103.253.41.82", "http://103.253.41.90", "http://103.73.188.101", "http://111.90.146.143", "http://111.90.147.248", "http://111.90.150.176", "http://111.90.151.120", "http://116.202.251.49", "http://116.202.251.5", "http://119.160.234.163", "http://119.160.234.194", "http://119.81.173.130", "http://119.81.178.105", "http://119.81.184.11", "http://120.53.12.132", "http://122.114.197.185", "http://122.114.226.172", "http://141.255.164.11", "http://141.255.164.29", "http://141.98.212.55", "http://141.98.214.14", "http://145.249.107.73", "http://146.0.76.37", "http://149.202.12.210", "http://152.44.45.10", "http://152.89.160.81", "http://169.239.128.110", "http://176.119.29.37", "http://178.157.13.168", "http://178.211.39.6", "http://185.140.55.35", "http://185.145.128.35", "http://185.193.126.172", "http://185.207.205.174", "http://185.225.226.16", "http://185.99.133.112", "http://188.241.68.137", "http://191.101.180.78", "http://192.48.88.107", "http://193.36.116.119", "http://193.36.119.162", "http://193.36.119.184", "http://202.59.9.59", "http://209.58.186.196", "http://209.58.186.197", "http://209.58.186.240", "http://220.158.216.130", "http://23.106.123.15", "http://27.102.130.115", "http://31.13.195.210", "http://31.170.107.186", "http://31.7.63.141", "http://37.120.247.163", "http://45.120.156.69", "http://45.123.190.167", "http://45.123.190.168", "http://45.124.132.10", "http://45.124.132.106", "http://45.129.229.48", "http://45.152.84.57", "http://46.19.143.69", "http://5.199.174.164", "http://5.75.159.186", "http://51.195.68.217", "http://66.70.247.215", "http://79.141.168.109", "http://81.17.17.213", "http://85.93.2.116", "http://91.132.139.195", "literaturaelsalvador.com/Instructions.html", "literaturaelsalvador.com/Schedule.html", "mightystake.com/sponsorship.php", "parquesanrafael.cl/note.html", "poetpages.com/pp/l4.php", "porodicno.ba/wp-content/Agenda.html", "reidao.com/dashboard.php", "resetlocations.com/bmw.htm", "reyweb.com/assets/index.php", "sgrfh.org.pk/wp-content/idx.php", "sharpledge.com/login.php", "siestakeying.com/auth.php", "signitivelogics.com/BMW.html", "signitivelogics.com/Schedule.html", "simplesalsamix.com/e-yazi.html", "sylvio.com.br/form.php", "te-as.no/wine.php", "theandersonco.com/wp_info.php", "tomasubiera.com/wp_getcontent.php", "totalmassasje.no/schedule.php", "waterforvoiceless.org/invite.php", "waterforvoiceless.org/util.php", "wethe6and9.ca/wp-content/Agenda.html", "willyminiatures.com/e-yazi.html" ], "url_path": [ "/46tt83y6.ps1", "/build_eu.ps1", "/buildus9_3.ps1", "/p0fd798.ps1", "/pwrvw.ps1", "/rainloop/forecast", "/sk-jspark_init.php", "/t/pixel.gif?m=", "/ujwphtigdcokr" ] }, "last_modified": "2026-08-02T13:31:15+00:00", "maltrail_groups": [ "DUKE", "UNC2452" ], "references": [ "https://app.validin.com/detail?find=151.236.16.138&type=ip4&ref_id=7e3792beeb8#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.149&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.193&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.22&type=ip4&ref_id=9a0b40a1dad#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.220&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.236&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.245&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=174.122.28.185&type=ip4&ref_id=d394fab0bcd#tab=resolutions", "https://app.validin.com/detail?find=185.243.99.17&type=ip4&ref_id=27436e81e5c#tab=resolutions", "https://app.validin.com/detail?find=185.76.79.0%2F24&type=ip&ref_id=f1bfad41f10#tab=resolutions", "https://app.validin.com/detail?find=185.76.79.49&type=ip4&ref_id=b0d4a3c06eb#tab=resolutions", "https://app.validin.com/detail?find=3.85.194.174&type=ip4&ref_id=2d521bb95dc#tab=resolutions", "https://app.validin.com/detail?find=45.141.58.30&type=ip4&ref_id=2f7b7741b82#tab=resolutions", "https://app.validin.com/detail?find=54.234.40.119&type=ip4&ref_id=24403506e8c#tab=resolutions", "https://app.validin.com/detail?type=ip&find=185.76.79.178#tab=resolutions", "https://app.validin.com/detail?type=ip&find=2.58.201.112#tab=resolutions", "https://app.validin.com/detail?type=ip&find=45.80.193.9#tab=resolutions", "https://app.validin.com/detail?type=ip&find=52.91.32.251#tab=resolutions", "https://aws.amazon.com/ru/blogs/security/amazon-disrupts-watering-hole-campaign-by-russias-apt29/", "https://blog.talosintelligence.com/2020/12/solarwinds-supplychain-coverage.html", "https://blog.truesec.com/2020/12/22/collaboration-between-fin7-and-the-ryuk-group-a-truesec-investigation/", "https://cert.gov.ua/article/6281076 (# UAC-0215)", "https://community.riskiq.com/article/9a515637/description", "https://github.com/blackorbird/APT_REPORT/blob/master/SunBurst/SilverFish_Solarwinds.pdf", "https://github.com/pan-unit42/tweets/blob/master/2023-03-10-IOCs-for-CloakedUrsa-APT29-Activity.txt", "https://go.recordedfuture.com/hubfs/reports/cta-2023-0127.pdf (# GraphicalNeutrino)", "https://go.recordedfuture.com/hubfs/reports/cta-2023-0727-1.pdf", "https://lab52.io/blog/beyond-appearances-unknown-actor-using-apt29s-ttp-against-chinese-users/", "https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/", "https://news.sophos.com/en-us/2021/02/03/mtr-casebook-uncovering-a-backdoor-implant-in-a-solarwinds-orion-server/", "https://otx.alienvault.com/pulse/55fae83567db8c6fb3518bcd/", "https://otx.alienvault.com/pulse/5da83c7c104ff3553f418443", "https://otx.alienvault.com/pulse/5f107c022dfb7a7c8fec7903", "https://otx.alienvault.com/pulse/5fd6df943558e0b56eaf3da8", "https://otx.alienvault.com/pulse/5fdce61ef056eff2ce0a90de", "https://otx.alienvault.com/pulse/6007149a5ff246c7c18229c1", "https://otx.alienvault.com/pulse/60088b53da5e673bc2825ce8", "https://otx.alienvault.com/pulse/601da173ed7d3e7e31c67c3d/", "https://otx.alienvault.com/pulse/60b689c652cd41240e77cfbe", "https://otx.alienvault.com/pulse/61090c601d7bda90aed534df", "https://otx.alienvault.com/pulse/61558f3021612e32de83311f", "https://otx.alienvault.com/pulse/62bdd4f0a8d82702782ea614", "https://otx.alienvault.com/pulse/63d95dd289e5b68a19e9c791", "https://otx.alienvault.com/pulse/64aed22c405b3e8f605125e8", "https://otx.alienvault.com/pulse/6511f107da5fed8d065d9477", "https://otx.alienvault.com/pulse/657a2c924ea0e3e9e95e9433", "https://raw.githubusercontent.com/microsoft/mstic/master/Indicators/May21-NOBELIUM/May21NOBELIUMIoCs.csv", "https://research.checkpoint.com/2025/apt29-phishing-campaign/", "https://securelist.com/darkhalo-after-solarwinds-the-tomiris-connection/104311/", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/sunburst-supply-chain-attack-solarwinds", "https://tria.ge/220721-s7pqcageb5", "https://twitter.com/BushidoToken/status/1633459935697838081", "https://twitter.com/IntezerLabs/status/1285487000091598863", "https://twitter.com/JAMESWT_MHT/status/1545303433959411714", "https://twitter.com/MalwareRE/status/1399407960368025609", "https://twitter.com/RedDrip7/status/1545245625662418945", "https://twitter.com/RexorVc0/status/1684820825998774272", "https://twitter.com/ShadowChasing1/status/1288403929462530049", "https://twitter.com/ShadowChasing1/status/1368831762114093059", "https://twitter.com/SinghSoodeep/status/1763808104221737156 (# SPIKEDWINE)", "https://twitter.com/StopMalvertisin/status/1684084388546633728", "https://twitter.com/WhichbufferArda/status/1581688188938358785", "https://twitter.com/WhichbufferArda/status/1659254174620557314", "https://twitter.com/_CPResearch_/status/1339952318717063168", "https://twitter.com/blackorbird/status/1385433029938614274", "https://twitter.com/c3rb3ru5d3d53c/status/1383113919405903873", "https://twitter.com/cyb3rops/status/1367794498965766144", "https://twitter.com/doc_guard/status/1683971701023932416", "https://twitter.com/felixaime/status/1632448523995103232", "https://twitter.com/h2jazi/status/1506439550968676360", "https://twitter.com/h2jazi/status/1677027834890469376", "https://twitter.com/h2jazi/status/1714986809229251067", "https://twitter.com/joakimkennedy/status/1303626343830167552", "https://twitter.com/kyleehmke/status/1341107219673341954", "https://twitter.com/kyleehmke/status/1351617582340694025", "https://twitter.com/malwrhunterteam/status/1677023534294487049", "https://twitter.com/s1ckb017/status/1468160915883315204", "https://unit42.paloaltonetworks.com/cloaked-ursa-online-storage-services-campaigns/", "https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/", "https://unit42.paloaltonetworks.com/fireeye-solarstorm-sunburst/", "https://unit42.paloaltonetworks.com/unit-42-technical-analysis-seaduke/", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a", "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/ (# GoldMax)", "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/ (# TrailBlazer)", "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf", "https://www.f-secure.com/weblog/archives/00002822.html", "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://www.fireeye.com/blog/threat-research/2021/03/sunshuttle-second-stage-backdoor-targeting-us-based-entity.html", "https://www.fortinet.com/blog/threat-research/teamcity-intrusion-saga-apt29-suspected-exploiting-cve-2023-42793", "https://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing", "https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties", "https://www.mandiant.com/resources/russian-targeting-gov-business", "https://www.menlosecurity.com/blog/ta551-targeted-malicious-campaign-breakdown/", "https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/", "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/", "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/", "https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/", "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/", "https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development.pdf", "https://www.pwc.co.uk/issues/cyber-security-services/insights/wellmess-analysis-command-control.html", "https://www.riskiq.com/blog/external-threat-management/apt29-bear-tracks/", "https://www.sekoia.io/en/nobeliums-envyscout-infection-chain-goes-in-the-registry-targeting-embassies/", "https://www.shodan.io/host/5.75.159.186", "https://www.telsy.com/nobelium-again-or-ecrime-operation/", "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/l/earth-koshchei/IOClist-EarthKoshchei.txt", "https://www.trendmicro.com/en_no/research/24/l/earth-koshchei.html", "https://www.virustotal.com/gui/file/05d8b678bc3f14295fe6e8089e144b8adc622d5510e3a8fd7d0dda8f15c4bd13/detection", "https://www.virustotal.com/gui/file/1916af4debbeaa0ee688c95d2d9d25196bd5765bad5c7a9c1ed7e934e6ffb9ba/detection", "https://www.virustotal.com/gui/file/2375da7528de541b7e60eae80ab14bb88e39f30b798869b26ad67c6cc46af765/detection", "https://www.virustotal.com/gui/file/302c0d553c9e7f2561864d79022b780a53ec0a5927e8962d883b88dde249d044/detection", "https://www.virustotal.com/gui/file/34e7482d689429745dd3866caf5ddd5de52a179db7068f6b545ff51542abb76c/detection", "https://www.virustotal.com/gui/file/4875a9c4af3044db281c5dc02e5386c77f331e3b92e5ae79ff9961d8cd1f7c4f/detection", "https://www.virustotal.com/gui/file/4e8f24fb50a08c12636f3d50c94772f355d5229e58110cccb3b4835cb2371aec/detection", "https://www.virustotal.com/gui/file/56ddc93f0555b4934eef3c5ccd3cf09291240465aaccf373c28e2a0d1eb292a5/detection", "https://www.virustotal.com/gui/file/6e3b557b1a9c1ecd89eb3be978f8c1b775ee4822262aae9c1ee6c08399a37f73/detection", "https://www.virustotal.com/gui/file/6ee1e629494d7b5138386d98bd718b010ee774fe4a4c9d0e069525408bb7b1f7/detection", "https://www.virustotal.com/gui/file/775eff1087c9e134a370cc767aa8fee128ed0ede436a1860119bb1a5ea91111f/detection", "https://www.virustotal.com/gui/file/7c20ef1547da114c15da8dd617d22dfd5c7fb08bb9eb07e30df35834619b915a/detection", "https://www.virustotal.com/gui/file/7cfb5e14c49ed3c9425ae995a2f7f260c564d552a29c5bdeb3665769e687cce5/detection", "https://www.virustotal.com/gui/file/7fc9e830756e23aa4b050f4ceaeb2a83cd71cfc0145392a0bc03037af373066b/detection", "https://www.virustotal.com/gui/file/85e72976b9448295034a8d4c26462b8f1ebe1ca0a4e4b897c7f2404d0de948c2/detection", "https://www.virustotal.com/gui/file/95193266e37a3401a0becace6d41171ab2968ed5289d666043251d05552d02fc/detection", "https://www.virustotal.com/gui/file/966e070a52de1c51976f6ea1fc48ec77f6b89f4bf5e5007650755e9cd0d73281/detection", "https://www.virustotal.com/gui/file/a0f183ea54cb25dd8bdba586935a258f0ecd3cba0d94657985bb1ea02af8d42c/detection", "https://www.virustotal.com/gui/file/a25fc5af86296dcd5bb41668443a36947bccd17a1687f9b118675f1503b3e376/detection", "https://www.virustotal.com/gui/file/af1922c665e9be6b29a5e3d0d3ac5916ae1fc74ac2fe9931e5273f3c4043f395/detection", "https://www.virustotal.com/gui/file/b9a2c986b6ad1eb4cfb0303baede906936fe96396f3cf490b0984a4798d741d8/detection", "https://www.virustotal.com/gui/file/e5de12f16af0b174537bbdf779b34a7c66287591323c2ec86845cecdd9d57f53/detection", "https://www.virustotal.com/gui/file/e8da0c4416f4353aad4620b5a83ff84d6d8b9b8a748fdbe96d8a4d02a4a1a03c/detection", "https://www.virustotal.com/gui/file/ebfe9cc39dfdc1d1abe7fd4b1e248b16238234c5261610456de0317c2045555d/detection", "https://www.virustotal.com/gui/file/f39dc0dfd43477d65c1380a7cff89296ad72bfa7fc3afcfd8e294f195632030e/detection", "https://www.virustotal.com/gui/file/f78ee3005ca9f0e78a9dd136fc69afe7c06d69d1fc6218bc9e7eb3adec045977/detection", "https://www.virustotal.com/gui/ip-address/162.252.175.146/relations", "https://www.virustotal.com/gui/ip-address/185.76.79.178/relations", "https://www.virustotal.com/gui/ip-address/2.58.201.112/relations", "https://www.virustotal.com/gui/ip-address/45.80.193.9/relations", "https://www.virustotal.com/gui/ip-address/52.91.32.251/relations", "https://www.virustotal.com/gui/ip-address/84.32.188.148/relations", "https://www.virustotal.com/gui/ip-address/98.81.98.142/relations", "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/", "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf", "https://www.zscaler.com/blogs/security-research/european-diplomats-targeted-spikedwine-wineloader", "https://x.com/BlinkzSec/status/2008479066635039174", "https://x.com/LloydLabs/status/2083594247547068883", "https://x.com/MichalKoczwara/status/1849738432823644297", "https://x.com/ShanHolo/status/1887817002649047162", "https://x.com/banthisguy9349/status/2008490747134439456", "https://x.com/blackorbird/status/1849713901807518125", "https://x.com/blackorbird/status/1868948019854643666" ], "related": [ { "evidence": [ { "detail": "3 shared indicators", "kind": "infrastructure", "weight": 3.0 }, { "detail": "shares Tor, reGeorg", "kind": "software", "weight": 0.667 } ], "slug": "G0007" }, { "evidence": [ { "detail": "shares BloodHound, reGeorg", "kind": "software", "weight": 0.833 } ], "slug": "G1003" }, { "evidence": [ { "detail": "shares SDelete", "kind": "software", "weight": 0.333 } ], "slug": "G0034" }, { "evidence": [ { "detail": "shares Tor", "kind": "software", "weight": 0.333 } ], "slug": "G0065" }, { "evidence": [ { "detail": "shares SDelete", "kind": "software", "weight": 0.333 } ], "slug": "G0091" } ], "slug": "G0016", "timeline": [ { "counts": { "domain": 1 }, "first_seen": "2026-08-02", "indicators": { "domain": [ "statistic-g.com" ] }, "precision": "exact", "references": [ "https://x.com/LloydLabs/status/2083594247547068883", "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/" ], "total": 1 }, { "counts": { "domain": 5, "ipv4": 14, "url_path": 1 }, "first_seen": "2026-08-01", "indicators": { "domain": [ "m365-owa.com", "ms365-device.com", "ms365-live.com", "my-invite.org", "owa-ms365.com" ], "ipv4": [ "104.194.159.150:443", "107.189.26.194:443", "138.197.202.81:3000", "138.68.160.124:3000", "165.22.146.161:3000", "213.145.86.112:443", "216.126.224.95:3000", "31.172.83.142:4000", "31.57.243.154:2000", "31.57.243.154:443", "38.146.28.132:443", "38.146.28.75:4000", "38.146.28.75:8443", "84.200.154.162:4000" ], "url_path": [ "/t/pixel.gif?m=" ] }, "precision": "exact", "references": [ "https://x.com/LloydLabs/status/2083594247547068883", "https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/" ], "total": 20 }, { "counts": { "domain": 1 }, "first_seen": "2026-01-06", "indicators": { "domain": [ "rheinemetall.com" ] }, "precision": "exact", "references": [ "https://x.com/BlinkzSec/status/2008479066635039174", "https://x.com/banthisguy9349/status/2008490747134439456" ], "total": 1 }, { "counts": { "domain": 10 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "bakenhof.com", "bravecup.com", "info.ophibre.com", "mail.bakenhof.com", "mail.bravecup.com", "mail.ophibre.com", "mail.silry.com", "mx.ophibre.com", "ophibre.com", "silry.com" ] }, "precision": "at-or-before", "references": [ "https://research.checkpoint.com/2025/apt29-phishing-campaign/" ], "total": 10 }, { "counts": { "domain": 3 }, "first_seen": "2026-01-02", "indicators": { "domain": [ "cloudflare.redirectpartners.com", "findcloudflare.com", "redirectpartners.com" ] }, "precision": "at-or-before", "references": [ "https://aws.amazon.com/ru/blogs/security/amazon-disrupts-watering-hole-campaign-by-russias-apt29/" ], "total": 3 }, { "counts": { "domain": 2, "ipv4": 1 }, "first_seen": "2025-02-07", "indicators": { "domain": [ "ukrtelcom.com", "ukrtelecom.eu" ], "ipv4": [ "185.243.99.17:3389" ] }, "precision": "exact", "references": [ "https://x.com/ShanHolo/status/1887817002649047162", "https://app.validin.com/detail?find=185.243.99.17&type=ip4&ref_id=27436e81e5c#tab=resolutions", "https://www.virustotal.com/gui/file/1916af4debbeaa0ee688c95d2d9d25196bd5765bad5c7a9c1ed7e934e6ffb9ba/detection", "https://www.virustotal.com/gui/file/7cfb5e14c49ed3c9425ae995a2f7f260c564d552a29c5bdeb3665769e687cce5/detection" ], "total": 3 }, { "counts": { "domain": 1 }, "first_seen": "2024-12-21", "indicators": { "domain": [ "police-gov.cloud" ] }, "precision": "exact", "references": [ "https://x.com/blackorbird/status/1868948019854643666", "https://www.trendmicro.com/en_no/research/24/l/earth-koshchei.html", "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/l/earth-koshchei/IOClist-EarthKoshchei.txt" ], "total": 1 }, { "counts": { "domain": 61 }, "first_seen": "2024-12-17", "indicators": { "domain": [ "aeinc.solutions", "albrightstonebridge.cloud", "amazonmeeting.cloud", "americanprogress.cloud", "aspeninstitute.cloud", "awsmeetings.online", "c-r.services", "capgemini.services", "cepa.solutions", "citoc.cloud", "clari.cloud", "clearancejobs.cloud", "cnas.zone", "cwinc.cloud", "defence-au.cloud", "democracyendowment.cloud", "ecfr.cloud", "europa-eu.cloud", "exclaimer.solutions", "foreignpolicy.cloud", "freedomhouse.cloud", "gc-cloud.ca", "go-conference.cloud", "go-jp.cloud", "go-meet-up.com", "go-meet.pro", "go-meeting.cloud", "googlemeet.zone", "heritagecloud.org", "justice.technology", "mapn-ro.cloud", "mod-cloud.uk", "morh-hr.cloud", "mvep-hr.cloud", "ncsc.solutions", "ndu.solutions", "nrcc.cloud", "opensocietyfoundations.cloud", "prio.zone", "pulsesecure.cloud", "rrt.solutions", "rubrik.zone", "s3-aws.global", "s3-us.navy", "saiccloud.us", "shicloud.online", "sipacolumbia.us", "skykick.solutions", "softcat.cloud", "ssi-gouv-fr.cloud", "trustifi.cloud", "us-army.cloud", "veeam.solutions", "zixcorp.cloud", "zoom-meeting.cloud", "zoom-meeting.live", "zoom-meeting.pro", "zoom-meeting.today", "zoom-meetings.cloud", "zoommeeting.today", "zoommeeting.zone" ] }, "precision": "exact", "references": [ "https://x.com/blackorbird/status/1868948019854643666", "https://www.trendmicro.com/en_no/research/24/l/earth-koshchei.html", "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/l/earth-koshchei/IOClist-EarthKoshchei.txt" ], "total": 61 }, { "counts": { "domain": 270 }, "first_seen": "2024-10-30", "indicators": { "domain": [ "amazonsolutions.cloud", "ap-northeast-1-aws.s3-ua.cloud", "ap-northeast-1-aws.ukrainesec.cloud", "ca-central-1.gov-ua.cloud", "ca-central-1.ua-gov.cloud", "ca-west-1.aws-ukraine.cloud", "ca-west-1.ukrtelecom.cloud", "central-2-aws.ua-mil.cloud", "central-2-aws.ua-sec.cloud", "central-2-aws.ukrainesec.cloud", "central-2-aws.ukrtelecom.cloud", "dep-no.cloud", "eu-central-1-aws.amazonsolutions.cloud", "eu-central-1-aws.dep-no.cloud", "eu-central-1-aws.gov-pl.cloud", "eu-central-1-aws.gov-sk.cloud", "eu-central-1-aws.gov-trust.cloud", "eu-central-1-aws.minbuza.cloud", "eu-central-1-aws.mindef-nl.cloud", "eu-central-1-aws.msz-pl.cloud", "eu-central-1-aws.mzv-sk.cloud", "eu-central-1-aws.ncfta.cloud", "eu-central-1-aws.presidencia-pt.cloud", "eu-central-1-aws.quirinale.cloud", "eu-central-1-aws.regeringskansliet-se.cloud", "eu-central-1-aws.s3-be.cloud", "eu-central-1-aws.s3-ua.cloud", "eu-central-1-aws.ua-gov.cloud", "eu-central-1-aws.ukrainesec.cloud", "eu-central-1.difesa-it.cloud", "eu-central-1.mil-be.cloud", "eu-central-1.mil-pl.cloud", "eu-central-1.minbuza.cloud", "eu-central-1.mindef-nl.cloud", "eu-central-1.msz-pl.cloud", "eu-central-1.quirinale.cloud", "eu-central-1.regeringskansliet-se.cloud", "eu-central-1.s3-be.cloud", "eu-central-1.s3-esa.cloud", "eu-central-1.s3-nato.cloud", "eu-central-1.ua-gov.cloud", "eu-central-1.ua-sec.cloud", "eu-central-2-aws.amazonsolutions.cloud", "eu-central-2-aws.aws-ukraine.cloud", "eu-central-2-aws.dep-no.cloud", "eu-central-2-aws.gov-pl.cloud", "eu-central-2-aws.gov-sk.cloud", "eu-central-2-aws.mil-be.cloud", "eu-central-2-aws.mil-pl.cloud", "eu-central-2-aws.mindef-nl.cloud", "eu-central-2-aws.msz-pl.cloud", "eu-central-2-aws.mzv-sk.cloud", "eu-central-2-aws.presidencia-pt.cloud", "eu-central-2-aws.regeringskansliet-se.cloud", "eu-central-2-aws.s3-be.cloud", "eu-central-2-aws.ua-gov.cloud", "eu-central-2-aws.ua-mil.cloud", "eu-central-2-aws.ukrtelecom.cloud", "eu-east-1-aws.amazonsolutions.cloud", "eu-east-1-aws.dep-no.cloud", "eu-east-1-aws.gov-sk.cloud", "eu-east-1-aws.gov-ua.cloud", "eu-east-1-aws.mil-be.cloud", "eu-east-1-aws.mil-pl.cloud", "eu-east-1-aws.minbuza.cloud", "eu-east-1-aws.mindef-nl.cloud", "eu-east-1-aws.msz-pl.cloud", "eu-east-1-aws.mzv-sk.cloud", "eu-east-1-aws.quirinale.cloud", "eu-east-1-aws.regeringskansliet-se.cloud", "eu-east-1-aws.s3-be.cloud", "eu-east-1-aws.s3-de.cloud", "eu-east-1-aws.ua-gov.cloud", "eu-east-1-aws.ua-sec.cloud", "eu-east-1-aws.ukrtelecom.cloud", "eu-north-1-aws.dep-no.cloud", "eu-north-1-aws.difesa-it.cloud", "eu-north-1-aws.gov-pl.cloud", "eu-north-1-aws.gov-sk.cloud", "eu-north-1-aws.mil-be.cloud", "eu-north-1-aws.mil-pl.cloud", "eu-north-1-aws.minbuza.cloud", "eu-north-1-aws.ncfta.cloud", "eu-north-1-aws.presidencia-pt.cloud", "eu-north-1-aws.quirinale.cloud", "eu-north-1-aws.regeringskansliet-se.cloud", "eu-north-1-aws.s3-be.cloud", "eu-north-1-aws.s3-de.cloud", "eu-north-1.difesa-it.cloud", "eu-north-1.gov-trust.cloud", "eu-north-1.gov-ua.cloud", "eu-north-1.gv-at.cloud", "eu-north-1.mil-be.cloud", "eu-north-1.mil-pl.cloud", "eu-north-1.mzv-sk.cloud", "eu-north-1.ncfta.cloud", "eu-north-1.regeringskansliet-se.cloud", "eu-north-1.s3-be.cloud", "eu-north-1.s3-de.cloud", "eu-north-1.s3-ua.cloud", "eu-south-1-aws.admin-ch.cloud", "eu-south-1-aws.dep-no.cloud", "eu-south-1-aws.difesa-it.cloud", "eu-south-1-aws.gov-pl.cloud", "eu-south-1-aws.gov-trust.cloud", "eu-south-1-aws.mil-be.cloud", "eu-south-1-aws.minbuza.cloud", "eu-south-1-aws.mzv-sk.cloud", "eu-south-1-aws.quirinale.cloud", "eu-south-1-aws.s3-be.cloud", "eu-south-1-aws.s3-de.cloud", "eu-south-1-aws.ua-gov.cloud", "eu-south-2-aws.amazonsolutions.cloud", "eu-south-2-aws.dep-no.cloud", "eu-south-2-aws.gov-pl.cloud", "eu-south-2-aws.gov-sk.cloud", "eu-south-2-aws.mil-be.cloud", "eu-south-2-aws.mil-pl.cloud", "eu-south-2-aws.mil-pt.cloud", "eu-south-2-aws.minbuza.cloud", "eu-south-2-aws.msz-pl.cloud", "eu-south-2-aws.mzv-sk.cloud", "eu-south-2-aws.ncfta.cloud", "eu-south-2-aws.quirinale.cloud", "eu-south-2-aws.regeringskansliet-se.cloud", "eu-south-2-aws.s3-be.cloud", "eu-south-2-aws.s3-de.cloud", "eu-south-2-aws.s3-esa.cloud", "eu-south-2-aws.s3-nato.cloud", "eu-south-2-aws.s3-ua.cloud", "eu-south-2-aws.ua-gov.cloud", "eu-south-2.dep-no.cloud", "eu-south-2.gov-pl.cloud", "eu-south-2.gov-sk.cloud", "eu-south-2.mil-be.cloud", "eu-south-2.mil-pl.cloud", "eu-south-2.mindef-nl.cloud", "eu-south-2.s3-be.cloud", "eu-south-2.s3-de.cloud", "eu-south-2.s3-esa.cloud", "eu-south-2.s3-nato.cloud", "eu-south-2.ua-sec.cloud", "eu-south-2.ukrainesec.cloud", "eu-southeast-1-aws.amazonsolutions.cloud", "eu-southeast-1-aws.aws-ukraine.cloud", "eu-southeast-1-aws.dep-no.cloud", "eu-southeast-1-aws.difesa-it.cloud", "eu-southeast-1-aws.gov-sk.cloud", "eu-southeast-1-aws.gov-trust.cloud", "eu-southeast-1-aws.mil-be.cloud", "eu-southeast-1-aws.mil-pl.cloud", "eu-southeast-1-aws.mindef-nl.cloud", "eu-southeast-1-aws.msz-pl.cloud", "eu-southeast-1-aws.mzv-cz.cloud", "eu-southeast-1-aws.mzv-sk.cloud", "eu-southeast-1-aws.quirinale.cloud", "eu-southeast-1-aws.s3-be.cloud", "eu-southeast-1-aws.s3-de.cloud", "eu-southeast-1-aws.s3-esa.cloud", "eu-southeast-1-aws.s3-ua.cloud", "eu-southeast-1-aws.ua-energy.cloud", "eu-southeast-1-aws.ukrainesec.cloud", "eu-west-1-aws.amazonsolutions.cloud", "eu-west-1-aws.aws-ukraine.cloud", "eu-west-1-aws.dep-no.cloud", "eu-west-1-aws.gov-pl.cloud", "eu-west-1-aws.gov-sk.cloud", "eu-west-1-aws.gov-trust.cloud", "eu-west-1-aws.gov-ua.cloud", "eu-west-1-aws.mil-be.cloud", "eu-west-1-aws.mil-pl.cloud", "eu-west-1-aws.minbuza.cloud", "eu-west-1-aws.quirinale.cloud", "eu-west-1-aws.s3-be.cloud", "eu-west-1-aws.s3-de.cloud", "eu-west-1-aws.s3-esa.cloud", "eu-west-1-aws.s3-nato.cloud", "eu-west-1-aws.ua-sec.cloud", "eu-west-1-aws.ukrainesec.cloud", "eu-west-1.aws-ukraine.cloud", "eu-west-1.difesa-it.cloud", "eu-west-1.gov-sk.cloud", "eu-west-1.mil-be.cloud", "eu-west-1.mil-pl.cloud", "eu-west-1.minbuza.cloud", "eu-west-1.msz-pl.cloud", "eu-west-1.mzv-sk.cloud", "eu-west-1.regeringskansliet-se.cloud", "eu-west-1.s3-de.cloud", "eu-west-1.s3-esa.cloud", "eu-west-1.s3-ua.cloud", "eu-west-1.ua-gov.cloud", "eu-west-1.ukrtelecom.cloud", "eu-west-2-aws.amazonsolutions.cloud", "eu-west-2-aws.dep-no.cloud", "eu-west-2-aws.difesa-it.cloud", "eu-west-2-aws.gov-pl.cloud", "eu-west-2-aws.gov-sk.cloud", "eu-west-2-aws.gv-at.cloud", "eu-west-2-aws.mil-be.cloud", "eu-west-2-aws.mil-pl.cloud", "eu-west-2-aws.minbuza.cloud", "eu-west-2-aws.mindef-nl.cloud", "eu-west-2-aws.msz-pl.cloud", "eu-west-2-aws.mzv-sk.cloud", "eu-west-2-aws.quirinale.cloud", "eu-west-2-aws.s3-be.cloud", "eu-west-2-aws.s3-de.cloud", "eu-west-2-aws.s3-esa.cloud", "eu-west-2-aws.s3-nato.cloud", "eu-west-2-aws.s3-ua.cloud", "eu-west-2-aws.ua-sec.cloud", "eu-west-3-aws.aws-ukraine.cloud", "eu-west-3-aws.dep-no.cloud", "eu-west-3-aws.difesa-it.cloud", "eu-west-3-aws.gov-pl.cloud", "eu-west-3-aws.gov-sk.cloud", "eu-west-3-aws.gov-trust.cloud", "eu-west-3-aws.mil-be.cloud", "eu-west-3-aws.mil-pl.cloud", "eu-west-3-aws.mil-pt.cloud", "eu-west-3-aws.minbuza.cloud", "eu-west-3-aws.mindef-nl.cloud", "eu-west-3-aws.msz-pl.cloud", "eu-west-3-aws.mzv-sk.cloud", "eu-west-3-aws.quirinale.cloud", "eu-west-3-aws.regeringskansliet-se.cloud", "eu-west-3-aws.s3-be.cloud", "eu-west-3-aws.s3-ua.cloud", "eu-west-3-aws.ua-mil.cloud", "eu-west-3.amazonsolutions.cloud", "eu-west-3.aws-ukraine.cloud", "eu-west-3.mil-be.cloud", "eu-west-3.mil-pl.cloud", "eu-west-3.minbuza.cloud", "eu-west-3.mindef-nl.cloud", "eu-west-3.msz-pl.cloud", "eu-west-3.mzv-sk.cloud", "eu-west-3.presidencia-pt.cloud", "eu-west-3.s3-be.cloud", "eu-west-3.s3-ua.cloud", "eu-west-3.ukrainesec.cloud", "eu-west-3.ukrtelecom.cloud", "gv-at.cloud", "ncfta.cloud", "presidencia-pt.cloud", "quirinale.cloud", "regeringskansliet-se.cloud", "ukrainesec.cloud", "us-east-1-aws.s3-ua.cloud", "us-east-1-aws.ua-gov.cloud", "us-east-1-aws.ua-sec.cloud", "us-east-2-aws.gov-ua.cloud", "us-east-2-aws.ukrtelecom.cloud", "us-east-2.aws-ukraine.cloud", "us-east-2.gov-ua.cloud", "us-east-2.ua-sec.cloud", "us-east-2.ukrainesec.cloud", "us-east-console.aws-ukraine.cloud", "us-east-console.ua-energy.cloud", "us-west-1-amazon.ua-mil.cloud", "us-west-1-amazon.ua-sec.cloud", "us-west-1-aws.gov-ua.cloud", "us-west-1.ua-energy.cloud", "us-west-1.ua-gov.cloud", "us-west-2-aws.s3-ua.cloud", "us-west-2-aws.ua-energy.cloud", "us-west-2.gov-ua.cloud", "us-west-2.ua-energy.cloud", "us-west-2.ua-sec.cloud" ] }, "precision": "exact", "references": [ "https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/" ], "total": 270 }, { "counts": { "domain": 1 }, "first_seen": "2024-10-30", "indicators": { "domain": [ "go-meeting.online" ] }, "precision": "exact", "references": [ "https://app.validin.com/detail?find=54.234.40.119&type=ip4&ref_id=24403506e8c#tab=resolutions" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2024-10-30", "indicators": { "domain": [ "asucloud.us" ] }, "precision": "exact", "references": [ "https://app.validin.com/detail?find=3.85.194.174&type=ip4&ref_id=2d521bb95dc#tab=resolutions" ], "total": 1 }, { "counts": { "domain": 16 }, "first_seen": "2024-10-28", "indicators": { "domain": [ "awsmeet.cloud", "backupify.cloud", "barracuda.solutions", "caci.solutions", "cer.zone", "crisisgroup.services", "difesa-it.cloud", "loreaosvault.cloud", "mde-es.cloud", "microsoft-meeting.cloud", "mimecast.cloud", "minbuza.cloud", "ms-conference.cloud", "s3-cloud.us", "s3.army", "symbolsecurity.cloud" ] }, "precision": "exact", "references": [ "https://x.com/blackorbird/status/1849713901807518125", "https://x.com/MichalKoczwara/status/1849738432823644297", "https://www.virustotal.com/gui/ip-address/162.252.175.146/relations", "https://app.validin.com/detail?find=151.236.16.138&type=ip4&ref_id=7e3792beeb8#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.149&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.193&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.22&type=ip4&ref_id=9a0b40a1dad#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.220&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.236&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.245&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=174.122.28.185&type=ip4&ref_id=d394fab0bcd#tab=resolutions", "https://app.validin.com/detail?find=185.76.79.49&type=ip4&ref_id=b0d4a3c06eb#tab=resolutions", "https://app.validin.com/detail?type=ip&find=185.76.79.178#tab=resolutions", "https://app.validin.com/detail?find=185.76.79.0%2F24&type=ip&ref_id=f1bfad41f10#tab=resolutions", "https://www.virustotal.com/gui/ip-address/185.76.79.178/relations", "https://app.validin.com/detail?type=ip&find=2.58.201.112#tab=resolutions", "https://www.virustotal.com/gui/ip-address/2.58.201.112/relations", "https://app.validin.com/detail?find=45.141.58.30&type=ip4&ref_id=2f7b7741b82#tab=resolutions", "https://app.validin.com/detail?type=ip&find=45.80.193.9#tab=resolutions", "https://www.virustotal.com/gui/ip-address/45.80.193.9/relations", "https://app.validin.com/detail?type=ip&find=52.91.32.251#tab=resolutions", "https://www.virustotal.com/gui/ip-address/52.91.32.251/relations", "https://www.virustotal.com/gui/ip-address/84.32.188.148/relations", "https://www.virustotal.com/gui/ip-address/98.81.98.142/relations", "https://cert.gov.ua/article/6281076 (# UAC-0215)" ], "total": 16 }, { "counts": { "domain": 168 }, "first_seen": "2024-10-27", "indicators": { "domain": [ "4freerussia.cloud", "accounts-google.online", "actualcombine.com", "admin-ch.cloud", "ahmed-ms.online", "aka-ms.cloud", "avis-google.online", "aws-app.online", "aws-atshop.online", "aws-cert.online", "aws-cloud.online", "aws-cloud.tech", "aws-devops.site", "aws-exam.online", "aws-my.online", "aws-sagyo.site", "aws-sample.online", "aws-talib.online", "aws-yamada.site", "awsprotect.online", "bund-de.cloud", "cabemanis-ms.online", "cadastros-google.online", "cfr-aws.cloud", "cod-ms.online", "com-s3.cloud", "commerce-mil.online", "console-google.cloud", "defense-gouv.cloud", "devops-aws.cloud", "dgfip-gouv.online", "dn-ms.online", "drive-google.cloud", "druva.cloud", "dtran-ms.online", "eopgov.cloud", "eros-ms.online", "europeanvalues.cloud", "forces-gc.cloud", "ga-mil.online", "gd-ms.cloud", "gmfus.cloud", "google-accs.online", "google-ai.site", "google-analysis.cloud", "google-com.site", "google-com.website", "google-docs.online", "google-duo.online", "google-duo.site", "google-map.website", "google-pesquisa.online", "google-plays.site", "google-playstore.online", "google-sanctions.online", "google-seguro.site", "google-shopping.online", "google-support.site", "hcdc-ms.online", "hso-aws.cloud", "iklan-google.online", "jdm-s3.online", "jtf-mil.online", "kam-lt.cloud", "learn-ms.online", "lordfilm-ms.online", "maps-google.online", "meet-google.cloud", "mfa-bg.website", "mfa-gov.online", "mil-commerce.online", "mil-defense.online", "mil-mza.online", "mil-mza.site", "mil-stat.online", "mil-tek.online", "mindef-nl.cloud", "ms-aid.site", "ms-antalia.online", "ms-aws.cloud", "ms-cabemanis.online", "ms-cabemanis.site", "ms-cabemanis.website", "ms-clean.site", "ms-company.site", "ms-copilot.online", "ms-dining.site", "ms-exchange.online", "ms-flamex.online", "ms-gacor.online", "ms-gacor.site", "ms-gma.online", "ms-green.online", "ms-immo.online", "ms-irstatic.cloud", "ms-jpan.online", "ms-justme.online", "ms-justmetv.online", "ms-labs.site", "ms-legal.site", "ms-log.site", "ms-media.online", "ms-meeting.online", "ms-meetings.online", "ms-menu.online", "ms-mfa.online", "ms-moviez.site", "ms-mu.online", "ms-nas.online", "ms-offce.online", "ms-oiffce.online", "ms-oiffice.online", "ms-ok.site", "ms-org.tech", "ms-paint.online", "ms-perry.online", "ms-pmr.online", "ms-raskion.online", "ms-review.site", "ms-rp.site", "ms-sami.tech", "ms-schaefer.online", "ms-scribe.online", "ms-secure.cloud", "ms-security.online", "ms-sign.site", "ms-store.cloud", "ms-tcentr.online", "ms-toto.online", "ms-toto.site", "ms-wow.online", "msz-pl.cloud", "mzv-cz.cloud", "nore-aws.online", "ns1.actualcombine.com", "ns1.foreignhurry.com", "ns1.secretiveleap.com", "ns2.actualcombine.com", "ns2.foreignhurry.com", "ns2.secretiveleap.com", "oktacloud.us", "opennet.solutions", "otzyv-ms.online", "photos-google.online", "photos-ms.online", "playstore-google.online", "polycom.solutions", "porno-google.online", "raq-ms.online", "red-ms.online", "secured-ms.online", "servicenowinc.us", "shaines-aws.online", "sisaf-ms.online", "ssi-gouv.cloud", "statecloud.us", "support-google.cloud", "swcloud.us", "tk-ms.online", "trentry-ms.online", "us-mil.cloud", "usaid.cloud", "usip.us", "vibrant-ms.online", "vikas-aws.online", "visit-ms.online", "webdox-aws.online", "wrapsnet.cloud" ] }, "precision": "exact", "references": [ "https://x.com/blackorbird/status/1849713901807518125", "https://x.com/MichalKoczwara/status/1849738432823644297", "https://www.virustotal.com/gui/ip-address/162.252.175.146/relations", "https://app.validin.com/detail?find=151.236.16.138&type=ip4&ref_id=7e3792beeb8#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.149&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.193&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.22&type=ip4&ref_id=9a0b40a1dad#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.220&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.236&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.245&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=174.122.28.185&type=ip4&ref_id=d394fab0bcd#tab=resolutions", "https://app.validin.com/detail?find=185.76.79.49&type=ip4&ref_id=b0d4a3c06eb#tab=resolutions", "https://app.validin.com/detail?type=ip&find=185.76.79.178#tab=resolutions", "https://app.validin.com/detail?find=185.76.79.0%2F24&type=ip&ref_id=f1bfad41f10#tab=resolutions", "https://www.virustotal.com/gui/ip-address/185.76.79.178/relations", "https://app.validin.com/detail?type=ip&find=2.58.201.112#tab=resolutions", "https://www.virustotal.com/gui/ip-address/2.58.201.112/relations", "https://app.validin.com/detail?find=45.141.58.30&type=ip4&ref_id=2f7b7741b82#tab=resolutions", "https://app.validin.com/detail?type=ip&find=45.80.193.9#tab=resolutions", "https://www.virustotal.com/gui/ip-address/45.80.193.9/relations", "https://app.validin.com/detail?type=ip&find=52.91.32.251#tab=resolutions", "https://www.virustotal.com/gui/ip-address/52.91.32.251/relations", "https://www.virustotal.com/gui/ip-address/84.32.188.148/relations", "https://www.virustotal.com/gui/ip-address/98.81.98.142/relations", "https://cert.gov.ua/article/6281076 (# UAC-0215)" ], "total": 168 }, { "counts": { "domain": 9 }, "first_seen": "2024-10-26", "indicators": { "domain": [ "foreignhurry.com", "google-meet.cloud", "macfound.services", "microsoftmeeting.cloud", "ms-meeting.com", "parseccomputer.cloud", "secretiveleap.com", "stratfor.cloud", "wilsoncenter.cloud" ] }, "precision": "exact", "references": [ "https://x.com/blackorbird/status/1849713901807518125", "https://x.com/MichalKoczwara/status/1849738432823644297", "https://www.virustotal.com/gui/ip-address/162.252.175.146/relations", "https://app.validin.com/detail?find=151.236.16.138&type=ip4&ref_id=7e3792beeb8#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.149&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.193&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.22&type=ip4&ref_id=9a0b40a1dad#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.220&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.236&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.245&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=174.122.28.185&type=ip4&ref_id=d394fab0bcd#tab=resolutions", "https://app.validin.com/detail?find=185.76.79.49&type=ip4&ref_id=b0d4a3c06eb#tab=resolutions", "https://app.validin.com/detail?type=ip&find=185.76.79.178#tab=resolutions", "https://app.validin.com/detail?find=185.76.79.0%2F24&type=ip&ref_id=f1bfad41f10#tab=resolutions", "https://www.virustotal.com/gui/ip-address/185.76.79.178/relations", "https://app.validin.com/detail?type=ip&find=2.58.201.112#tab=resolutions", "https://www.virustotal.com/gui/ip-address/2.58.201.112/relations", "https://app.validin.com/detail?find=45.141.58.30&type=ip4&ref_id=2f7b7741b82#tab=resolutions", "https://app.validin.com/detail?type=ip&find=45.80.193.9#tab=resolutions", "https://www.virustotal.com/gui/ip-address/45.80.193.9/relations", "https://app.validin.com/detail?type=ip&find=52.91.32.251#tab=resolutions", "https://www.virustotal.com/gui/ip-address/52.91.32.251/relations", "https://www.virustotal.com/gui/ip-address/84.32.188.148/relations", "https://www.virustotal.com/gui/ip-address/98.81.98.142/relations", "https://cert.gov.ua/article/6281076 (# UAC-0215)" ], "total": 9 }, { "counts": { "domain": 8 }, "first_seen": "2024-10-25", "indicators": { "domain": [ "brookings.cloud", "ceip.cloud", "csbaonline.cloud", "gouv-fr.cloud", "mae-ro.cloud", "msconferences.cloud", "mx.ceip.cloud", "mzv-sk.cloud" ] }, "precision": "exact", "references": [ "https://x.com/blackorbird/status/1849713901807518125", "https://x.com/MichalKoczwara/status/1849738432823644297", "https://www.virustotal.com/gui/ip-address/162.252.175.146/relations", "https://app.validin.com/detail?find=151.236.16.138&type=ip4&ref_id=7e3792beeb8#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.149&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.193&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.22&type=ip4&ref_id=9a0b40a1dad#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.220&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.236&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.245&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=174.122.28.185&type=ip4&ref_id=d394fab0bcd#tab=resolutions", "https://app.validin.com/detail?find=185.76.79.49&type=ip4&ref_id=b0d4a3c06eb#tab=resolutions", "https://app.validin.com/detail?type=ip&find=185.76.79.178#tab=resolutions", "https://app.validin.com/detail?find=185.76.79.0%2F24&type=ip&ref_id=f1bfad41f10#tab=resolutions", "https://www.virustotal.com/gui/ip-address/185.76.79.178/relations", "https://app.validin.com/detail?type=ip&find=2.58.201.112#tab=resolutions", "https://www.virustotal.com/gui/ip-address/2.58.201.112/relations", "https://app.validin.com/detail?find=45.141.58.30&type=ip4&ref_id=2f7b7741b82#tab=resolutions", "https://app.validin.com/detail?type=ip&find=45.80.193.9#tab=resolutions", "https://www.virustotal.com/gui/ip-address/45.80.193.9/relations", "https://app.validin.com/detail?type=ip&find=52.91.32.251#tab=resolutions", "https://www.virustotal.com/gui/ip-address/52.91.32.251/relations", "https://www.virustotal.com/gui/ip-address/84.32.188.148/relations", "https://www.virustotal.com/gui/ip-address/98.81.98.142/relations", "https://cert.gov.ua/article/6281076 (# UAC-0215)" ], "total": 8 }, { "counts": { "domain": 74 }, "first_seen": "2024-10-23", "indicators": { "domain": [ "aws-data.cloud", "aws-il.cloud", "aws-join.cloud", "aws-meet.cloud", "aws-meetings.cloud", "aws-ms.cloud", "aws-online.cloud", "aws-platform.cloud", "aws-s3.cloud", "aws-secure.cloud", "aws-ukraine.cloud", "awsplatform.online", "ca-central-1.awsplatform.online", "central-2-aws.ua-aws.army", "eu-central-1-aws.mfa-gov.cloud", "eu-central-1.ukrtelecom.cloud", "eu-central-2-aws.ua-aws.army", "eu-south-2-aws.mfa-gov.cloud", "eu-southeast-1-aws.gov-ua.cloud", "eu-southeast-1-aws.govtr.cloud", "eu-southeast-1-aws.zero-trust.solutions", "mfa-gov-il.cloud", "mfa-gov-tr.cloud", "mil-be.cloud", "mil-ee.cloud", "mil-pl.cloud", "mil-pt.cloud", "mod-gov-il.cloud", "my-gov.cloud", "s3-acronis.cloud", "s3-army.cloud", "s3-atlassian.cloud", "s3-aws.cloud", "s3-bah.cloud", "s3-be.cloud", "s3-blackberry.cloud", "s3-csis.cloud", "s3-de.cloud", "s3-dgap.cloud", "s3-dk.cloud", "s3-dnc.cloud", "s3-esa.cloud", "s3-fbi.cloud", "s3-hudson.cloud", "s3-ida.cloud", "s3-iri.cloud", "s3-knowbe4.cloud", "s3-marcus.cloud", "s3-monitoring.cloud", "s3-nato.cloud", "s3-ned.cloud", "s3-nsa.cloud", "s3-proofpoint.cloud", "s3-pt.cloud", "s3-rackspace.cloud", "s3-rand.cloud", "s3-spacex.cloud", "s3-state.cloud", "s3-stig.cloud", "s3-ua.cloud", "s3-ucia.cloud", "s3-zoho.cloud", "ua-aws.army", "ua-mil.cloud", "ua-se.cloud", "ua-sec.cloud", "ua-sn.cloud", "ukrtelecom.cloud", "us-east-2-aws.ua-gov.cloud", "us-east-console.awsplatform.online", "us-west-1.aws-ukraine.cloud", "us-west-1.ua-aws.army", "us-west-1.ukrtelecom.cloud", "zero-trust.solutions" ] }, "precision": "exact", "references": [ "https://x.com/blackorbird/status/1849713901807518125", "https://x.com/MichalKoczwara/status/1849738432823644297", "https://www.virustotal.com/gui/ip-address/162.252.175.146/relations", "https://app.validin.com/detail?find=151.236.16.138&type=ip4&ref_id=7e3792beeb8#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.149&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.193&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.22&type=ip4&ref_id=9a0b40a1dad#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.220&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.236&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.245&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=174.122.28.185&type=ip4&ref_id=d394fab0bcd#tab=resolutions", "https://app.validin.com/detail?find=185.76.79.49&type=ip4&ref_id=b0d4a3c06eb#tab=resolutions", "https://app.validin.com/detail?type=ip&find=185.76.79.178#tab=resolutions", "https://app.validin.com/detail?find=185.76.79.0%2F24&type=ip&ref_id=f1bfad41f10#tab=resolutions", "https://www.virustotal.com/gui/ip-address/185.76.79.178/relations", "https://app.validin.com/detail?type=ip&find=2.58.201.112#tab=resolutions", "https://www.virustotal.com/gui/ip-address/2.58.201.112/relations", "https://app.validin.com/detail?find=45.141.58.30&type=ip4&ref_id=2f7b7741b82#tab=resolutions", "https://app.validin.com/detail?type=ip&find=45.80.193.9#tab=resolutions", "https://www.virustotal.com/gui/ip-address/45.80.193.9/relations", "https://app.validin.com/detail?type=ip&find=52.91.32.251#tab=resolutions", "https://www.virustotal.com/gui/ip-address/52.91.32.251/relations", "https://www.virustotal.com/gui/ip-address/84.32.188.148/relations", "https://www.virustotal.com/gui/ip-address/98.81.98.142/relations", "https://cert.gov.ua/article/6281076 (# UAC-0215)" ], "total": 74 }, { "counts": { "domain": 58 }, "first_seen": "2024-10-22", "indicators": { "domain": [ "adm.govua.cloud", "ca-west-1.mfa-gov.cloud", "cribl-gov.cloud", "csu-gov.cloud", "ctu-gov.cloud", "dia-gov.cloud", "eru-gov.cloud", "eu-central-1-aws.govua.cloud", "eu-central-1.mfa-gov.cloud", "eu-north-1-aws.ua-energy.cloud", "eu-north-1-aws.ua-gov.cloud", "eu-south-1-aws.mfa-gov.cloud", "feedzai-gov.cloud", "gov-au.cloud", "gov-aws.cloud", "gov-fi.cloud", "gov-gr.cloud", "gov-lt.cloud", "gov-lv.cloud", "gov-pl.cloud", "gov-sk.cloud", "gov-trust.cloud", "gov-ua.cloud", "govbook.cloud", "govdom.cloud", "govista.cloud", "govmr.cloud", "govps.cloud", "govtr.cloud", "govua.cloud", "kmu.govua.cloud", "md-gov.cloud", "mf-gov.cloud", "mfa-gov.cloud", "mmr-gov.cloud", "mo-gov.cloud", "mpo-gov.cloud", "mpsv-gov.cloud", "msmt-gov.cloud", "mv-gov.cloud", "mzd-gov.cloud", "mze-gov.cloud", "mzp-gov.cloud", "mzv-gov.cloud", "nakit-gov.cloud", "nbu-gov.cloud", "nukib-gov.cloud", "pdv.govua.cloud", "policie-gov.cloud", "ua-energy.cloud", "ua-gov.cloud", "uohs-gov.cloud", "uoou-gov.cloud", "us-east-1-aws.mfa-gov.cloud", "us-west-1-amazon.ua-energy.cloud", "us-west-2-aws.mfa-gov.cloud", "vlada-gov.cloud", "voa-gov.cloud" ] }, "precision": "exact", "references": [ "https://x.com/blackorbird/status/1849713901807518125", "https://x.com/MichalKoczwara/status/1849738432823644297", "https://www.virustotal.com/gui/ip-address/162.252.175.146/relations", "https://app.validin.com/detail?find=151.236.16.138&type=ip4&ref_id=7e3792beeb8#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.149&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.193&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.22&type=ip4&ref_id=9a0b40a1dad#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.220&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.236&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=151.236.16.245&type=ip4&ref_id=d53e5a59923#tab=resolutions", "https://app.validin.com/detail?find=174.122.28.185&type=ip4&ref_id=d394fab0bcd#tab=resolutions", "https://app.validin.com/detail?find=185.76.79.49&type=ip4&ref_id=b0d4a3c06eb#tab=resolutions", "https://app.validin.com/detail?type=ip&find=185.76.79.178#tab=resolutions", "https://app.validin.com/detail?find=185.76.79.0%2F24&type=ip&ref_id=f1bfad41f10#tab=resolutions", "https://www.virustotal.com/gui/ip-address/185.76.79.178/relations", "https://app.validin.com/detail?type=ip&find=2.58.201.112#tab=resolutions", "https://www.virustotal.com/gui/ip-address/2.58.201.112/relations", "https://app.validin.com/detail?find=45.141.58.30&type=ip4&ref_id=2f7b7741b82#tab=resolutions", "https://app.validin.com/detail?type=ip&find=45.80.193.9#tab=resolutions", "https://www.virustotal.com/gui/ip-address/45.80.193.9/relations", "https://app.validin.com/detail?type=ip&find=52.91.32.251#tab=resolutions", "https://www.virustotal.com/gui/ip-address/52.91.32.251/relations", "https://www.virustotal.com/gui/ip-address/84.32.188.148/relations", "https://www.virustotal.com/gui/ip-address/98.81.98.142/relations", "https://cert.gov.ua/article/6281076 (# UAC-0215)" ], "total": 58 }, { "counts": { "url": 1 }, "first_seen": "2024-03-22", "indicators": { "url": [ "waterforvoiceless.org/invite.php" ] }, "precision": "exact", "references": [ "https://twitter.com/SinghSoodeep/status/1763808104221737156 (# SPIKEDWINE)", "https://www.zscaler.com/blogs/security-research/european-diplomats-targeted-spikedwine-wineloader", "https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties", "https://www.virustotal.com/gui/file/a0f183ea54cb25dd8bdba586935a258f0ecd3cba0d94657985bb1ea02af8d42c/detection" ], "total": 1 }, { "counts": { "url": 2 }, "first_seen": "2024-03-02", "indicators": { "url": [ "siestakeying.com/auth.php", "waterforvoiceless.org/util.php" ] }, "precision": "exact", "references": [ "https://twitter.com/SinghSoodeep/status/1763808104221737156 (# SPIKEDWINE)", "https://www.zscaler.com/blogs/security-research/european-diplomats-targeted-spikedwine-wineloader", "https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties", "https://www.virustotal.com/gui/file/a0f183ea54cb25dd8bdba586935a258f0ecd3cba0d94657985bb1ea02af8d42c/detection" ], "total": 2 }, { "counts": { "domain": 2, "ipv4": 1, "url_path": 1 }, "first_seen": "2024-01-23", "indicators": { "domain": [ "bringthenoiseappnew.s3.amazonaws.com", "fisheries-states-codes-camps.trycloudflare.com" ], "ipv4": [ "103.76.128.34:8080" ], "url_path": [ "/ujwphtigdcokr" ] }, "precision": "exact", "references": [ "https://www.fortinet.com/blog/threat-research/teamcity-intrusion-saga-apt29-suspected-exploiting-cve-2023-42793" ], "total": 4 }, { "counts": { "domain": 1 }, "first_seen": "2023-12-16", "indicators": { "domain": [ "matclick.com" ] }, "precision": "exact", "references": [ "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a", "https://otx.alienvault.com/pulse/657a2c924ea0e3e9e95e9433" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2023-10-20", "indicators": { "domain": [ "d287-206-123-149-139.ngrok-free.app" ] }, "precision": "exact", "references": [ "https://twitter.com/h2jazi/status/1714986809229251067", "https://www.virustotal.com/gui/file/f78ee3005ca9f0e78a9dd136fc69afe7c06d69d1fc6218bc9e7eb3adec045977/detection" ], "total": 1 }, { "counts": { "domain": 3, "url": 1 }, "first_seen": "2023-10-14", "indicators": { "domain": [ "inovaoftalmologia.com.br", "kegas.id", "kitaeri.com" ], "url": [ "gavice.ng/event_program.php" ] }, "precision": "exact", "references": [ "https://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing", "https://otx.alienvault.com/pulse/6511f107da5fed8d065d9477" ], "total": 4 }, { "counts": { "url": 2 }, "first_seen": "2023-09-23", "indicators": { "url": [ "parquesanrafael.cl/note.html", "sgrfh.org.pk/wp-content/idx.php" ] }, "precision": "exact", "references": [ "https://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing", "https://otx.alienvault.com/pulse/6511f107da5fed8d065d9477" ], "total": 2 }, { "counts": { "url": 1 }, "first_seen": "2023-08-24", "indicators": { "url": [ "willyminiatures.com/e-yazi.html" ] }, "precision": "exact", "references": [ "https://twitter.com/RexorVc0/status/1684820825998774272", "https://go.recordedfuture.com/hubfs/reports/cta-2023-0727-1.pdf", "https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/", "https://otx.alienvault.com/pulse/64aed22c405b3e8f605125e8" ], "total": 1 }, { "counts": { "url": 9 }, "first_seen": "2023-07-28", "indicators": { "url": [ "easym6.com/Information.php", "fondoftravel.com/contact.php", "mightystake.com/sponsorship.php", "reidao.com/dashboard.php", "resetlocations.com/bmw.htm", "sharpledge.com/login.php", "simplesalsamix.com/e-yazi.html", "sylvio.com.br/form.php", "te-as.no/wine.php" ] }, "precision": "exact", "references": [ "https://twitter.com/RexorVc0/status/1684820825998774272", "https://go.recordedfuture.com/hubfs/reports/cta-2023-0727-1.pdf", "https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/", "https://otx.alienvault.com/pulse/64aed22c405b3e8f605125e8" ], "total": 9 }, { "counts": { "domain": 1 }, "first_seen": "2023-07-26", "indicators": { "domain": [ "sgrhf.org.pk" ] }, "precision": "exact", "references": [ "https://twitter.com/doc_guard/status/1683971701023932416", "https://twitter.com/StopMalvertisin/status/1684084388546633728", "https://www.virustotal.com/gui/file/302c0d553c9e7f2561864d79022b780a53ec0a5927e8962d883b88dde249d044/detection" ], "total": 1 }, { "counts": { "domain": 5 }, "first_seen": "2023-07-07", "indicators": { "domain": [ "1597ebba.info.gtjas.site", "3bcc1bba.info.gtjas.site", "7c291bbe.info.gtjas.site", "gtjas.site", "info.gtjas.site" ] }, "precision": "exact", "references": [ "https://lab52.io/blog/beyond-appearances-unknown-actor-using-apt29s-ttp-against-chinese-users/" ], "total": 5 }, { "counts": { "domain": 1 }, "first_seen": "2023-07-07", "indicators": { "domain": [ "kefas.id" ] }, "precision": "exact", "references": [ "https://twitter.com/malwrhunterteam/status/1677023534294487049", "https://twitter.com/h2jazi/status/1677027834890469376", "https://www.virustotal.com/gui/file/966e070a52de1c51976f6ea1fc48ec77f6b89f4bf5e5007650755e9cd0d73281/detection", "https://www.virustotal.com/gui/file/4875a9c4af3044db281c5dc02e5386c77f331e3b92e5ae79ff9961d8cd1f7c4f/detection", "https://www.virustotal.com/gui/file/af1922c665e9be6b29a5e3d0d3ac5916ae1fc74ac2fe9931e5273f3c4043f395/detection", "https://www.virustotal.com/gui/file/7fc9e830756e23aa4b050f4ceaeb2a83cd71cfc0145392a0bc03037af373066b/detection" ], "total": 1 }, { "counts": { "url": 1 }, "first_seen": "2023-05-18", "indicators": { "url": [ "poetpages.com/pp/l4.php" ] }, "precision": "exact", "references": [ "https://twitter.com/WhichbufferArda/status/1659254174620557314", "https://www.virustotal.com/gui/file/6e3b557b1a9c1ecd89eb3be978f8c1b775ee4822262aae9c1ee6c08399a37f73/detection" ], "total": 1 }, { "counts": { "url": 4 }, "first_seen": "2023-03-10", "indicators": { "url": [ "literaturaelsalvador.com/Instructions.html", "literaturaelsalvador.com/Schedule.html", "signitivelogics.com/BMW.html", "signitivelogics.com/Schedule.html" ] }, "precision": "exact", "references": [ "https://twitter.com/felixaime/status/1632448523995103232", "https://github.com/pan-unit42/tweets/blob/master/2023-03-10-IOCs-for-CloakedUrsa-APT29-Activity.txt" ], "total": 4 }, { "counts": { "ipv4": 6, "url": 1 }, "first_seen": "2023-03-08", "indicators": { "ipv4": [ "5.75.159.186:22", "5.75.159.186:3306", "5.75.159.186:3389", "5.75.159.186:443", "5.75.159.186:5800", "5.75.159.186:5900" ], "url": [ "http://5.75.159.186" ] }, "precision": "exact", "references": [ "https://twitter.com/BushidoToken/status/1633459935697838081", "https://www.shodan.io/host/5.75.159.186" ], "total": 7 }, { "counts": { "url": 1 }, "first_seen": "2023-02-19", "indicators": { "url": [ "totalmassasje.no/schedule.php" ] }, "precision": "exact", "references": [ "https://go.recordedfuture.com/hubfs/reports/cta-2023-0127.pdf (# GraphicalNeutrino)", "https://otx.alienvault.com/pulse/63d95dd289e5b68a19e9c791" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2022-10-16", "indicators": { "domain": [ "sinitude.com" ] }, "precision": "exact", "references": [ "https://twitter.com/WhichbufferArda/status/1581688188938358785", "https://www.virustotal.com/gui/file/56ddc93f0555b4934eef3c5ccd3cf09291240465aaccf373c28e2a0d1eb292a5/detection", "https://www.virustotal.com/gui/file/05d8b678bc3f14295fe6e8089e144b8adc622d5510e3a8fd7d0dda8f15c4bd13/detection", "https://www.virustotal.com/gui/file/6ee1e629494d7b5138386d98bd718b010ee774fe4a4c9d0e069525408bb7b1f7/detection" ], "total": 1 }, { "counts": { "ipv4": 2 }, "first_seen": "2022-07-23", "indicators": { "ipv4": [ "141.98.212.55:53", "209.58.186.196:443" ] }, "precision": "exact", "references": [ "https://tria.ge/220721-s7pqcageb5" ], "total": 2 }, { "counts": { "url": 2 }, "first_seen": "2022-07-20", "indicators": { "url": [ "porodicno.ba/wp-content/Agenda.html", "wethe6and9.ca/wp-content/Agenda.html" ] }, "precision": "exact", "references": [ "https://unit42.paloaltonetworks.com/cloaked-ursa-online-storage-services-campaigns/" ], "total": 2 }, { "counts": { "url": 2 }, "first_seen": "2022-07-08", "indicators": { "url": [ "agencijazaregistraciju.rs/i.html", "agencijazaregistraciju.rs/t.php" ] }, "precision": "exact", "references": [ "https://twitter.com/RedDrip7/status/1545245625662418945", "https://twitter.com/JAMESWT_MHT/status/1545303433959411714" ], "total": 2 }, { "counts": { "domain": 3 }, "first_seen": "2022-06-30", "indicators": { "domain": [ "bacionera.top", "nopogew.com", "sobolpand.top" ] }, "precision": "exact", "references": [ "https://www.menlosecurity.com/blog/ta551-targeted-malicious-campaign-breakdown/", "https://otx.alienvault.com/pulse/62bdd4f0a8d82702782ea614" ], "total": 3 }, { "counts": { "domain": 2, "url": 2 }, "first_seen": "2022-04-16", "indicators": { "domain": [ "softhouse.store", "update.softhouse.store" ], "url": [ "http://185.193.126.172", "http://51.195.68.217" ] }, "precision": "exact", "references": [ "https://securelist.com/darkhalo-after-solarwinds-the-tomiris-connection/104311/", "https://otx.alienvault.com/pulse/61558f3021612e32de83311f" ], "total": 4 }, { "counts": { "domain": 2 }, "first_seen": "2022-03-23", "indicators": { "domain": [ "ernesttheskoolie.com", "theskoolieblog.com" ] }, "precision": "exact", "references": [ "https://twitter.com/h2jazi/status/1506439550968676360", "https://www.virustotal.com/gui/file/34e7482d689429745dd3866caf5ddd5de52a179db7068f6b545ff51542abb76c/detection", "https://www.virustotal.com/gui/file/e5de12f16af0b174537bbdf779b34a7c66287591323c2ec86845cecdd9d57f53/detection", "https://www.virustotal.com/gui/file/e8da0c4416f4353aad4620b5a83ff84d6d8b9b8a748fdbe96d8a4d02a4a1a03c/detection" ], "total": 2 }, { "counts": { "domain": 1, "url_path": 1 }, "first_seen": "2022-01-27", "indicators": { "domain": [ "satkas.waw.pl" ], "url_path": [ "/rainloop/forecast" ] }, "precision": "exact", "references": [ "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/ (# TrailBlazer)" ], "total": 2 }, { "counts": { "domain": 1 }, "first_seen": "2022-01-27", "indicators": { "domain": [ "vm-srv-1.gel.ulaval.ca" ] }, "precision": "exact", "references": [ "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/ (# GoldMax)" ], "total": 1 }, { "counts": { "domain": 9 }, "first_seen": "2022-01-07", "indicators": { "domain": [ "bfilmnews.com", "crochetnews.com", "dom-news.com", "galatinonews.com", "midcitylanews.com", "muslimnewsdaily.com", "pharaosjournal.com", "readnewshot.com", "theanalyticsnews.com" ] }, "precision": "exact", "references": [ "https://www.sekoia.io/en/nobeliums-envyscout-infection-chain-goes-in-the-registry-targeting-embassies/" ], "total": 9 }, { "counts": { "domain": 6 }, "first_seen": "2021-12-07", "indicators": { "domain": [ "camogit.com", "kaceloj.com", "kirute.com", "muyipep.com", "pahohu.com", "vuvalog.com" ] }, "precision": "exact", "references": [ "https://twitter.com/s1ckb017/status/1468160915883315204", "https://www.telsy.com/nobelium-again-or-ecrime-operation/" ], "total": 6 }, { "counts": { "domain": 2, "url": 3 }, "first_seen": "2021-12-06", "indicators": { "domain": [ "nordicmademedia.com", "stonecrestnews.com" ], "url": [ "http://23.106.123.15", "theandersonco.com/wp_info.php", "tomasubiera.com/wp_getcontent.php" ] }, "precision": "exact", "references": [ "https://www.mandiant.com/resources/russian-targeting-gov-business" ], "total": 5 }, { "counts": { "url": 19 }, "first_seen": "2021-08-03", "indicators": { "url": [ "http://103.193.4.101", "http://111.90.151.120", "http://116.202.251.49", "http://116.202.251.5", "http://141.255.164.11", "http://141.98.214.14", "http://152.44.45.10", "http://152.89.160.81", "http://178.157.13.168", "http://185.140.55.35", "http://185.207.205.174", "http://193.36.116.119", "http://193.36.119.162", "http://193.36.119.184", "http://31.13.195.210", "http://37.120.247.163", "http://45.124.132.10", "http://45.124.132.106", "http://91.132.139.195" ] }, "precision": "exact", "references": [ "https://www.riskiq.com/blog/external-threat-management/apt29-bear-tracks/", "https://otx.alienvault.com/pulse/61090c601d7bda90aed534df", "https://www.virustotal.com/gui/file/775eff1087c9e134a370cc767aa8fee128ed0ede436a1860119bb1a5ea91111f/detection" ], "total": 19 }, { "counts": { "url": 1 }, "first_seen": "2021-08-02", "indicators": { "url": [ "http://111.90.147.248" ] }, "precision": "exact", "references": [ "https://www.riskiq.com/blog/external-threat-management/apt29-bear-tracks/", "https://otx.alienvault.com/pulse/61090c601d7bda90aed534df", "https://www.virustotal.com/gui/file/775eff1087c9e134a370cc767aa8fee128ed0ede436a1860119bb1a5ea91111f/detection" ], "total": 1 }, { "counts": { "domain": 24 }, "first_seen": "2021-05-31", "indicators": { "domain": [ "cdnappservice.firebaseio.com", "cityloss.com", "cross-checking.com", "dailydews.com", "dataplane.theyardservice.com", "email.theyardservice.com", "emergencystreet.com", "enpport.com", "eventbrite-com-default-rtdb.firebaseio.com", "giftbox4u.com", "holescontracting.com", "humanitarian-forum-default-rtdb.firebaseio.com", "newsplacec.com", "newstepsco.com", "pcmsar.net", "security-updater-default-rtdb.firebaseio.com", "smtp2.theyardservice.com", "stockmarketon.com", "stsnews.com", "supportcdn-default-rtdb.firebaseio.com", "tacomanewspaper.com", "theadminforum.com", "trendignews.com", "usaid.theyardservice.com" ] }, "precision": "exact", "references": [ "https://twitter.com/MalwareRE/status/1399407960368025609", "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/", "https://raw.githubusercontent.com/microsoft/mstic/master/Indicators/May21-NOBELIUM/May21NOBELIUMIoCs.csv" ], "total": 24 }, { "counts": { "domain": 4 }, "first_seen": "2021-05-31", "indicators": { "domain": [ "74d6b7b2.app.giftbox4u.com", "content.pcmsar.net", "doggroomingnews.com", "hanproud.com" ] }, "precision": "exact", "references": [ "https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/", "https://otx.alienvault.com/pulse/60b689c652cd41240e77cfbe", "https://twitter.com/MalwareRE/status/1399407960368025609", "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/", "https://raw.githubusercontent.com/microsoft/mstic/master/Indicators/May21-NOBELIUM/May21NOBELIUMIoCs.csv" ], "total": 4 }, { "counts": { "domain": 43 }, "first_seen": "2021-04-23", "indicators": { "domain": [ "1cloudserver.com", "actualityworld.com", "apexwebtech.com", "appsprovider.com", "armrvrholo.com", "assetdata.net", "autonetonline.com", "bigdataanalysts.com", "computerrepublic.com", "datatidy.com", "diamondglobalnetwork.com", "digitalphotohub.com", "domainingdirectory.com", "ebbcloud.com", "ebookstorelive.com", "eyetechltd.com", "fqtel.com", "gdbcloud.com", "globalsection.org", "globesoftwares.com", "gnadptech.com", "graphicscodex.net", "ioxmesh.com", "ipadsreview.org", "limoservicecompany.com", "mappsglobal.com", "microtransito.com", "nikeoutletinc.org", "productpitfalls.com", "reyweb.com", "rollver.com", "ryaxtech.com", "securitysystemnews.com", "sense4baby.fr", "softwarelaunches.com", "softweblinks.com", "storagewithoutborders.com", "techforefront.com", "topwebservers.com", "vmdisk.com", "webpp.com", "websitesline.com", "xrlinks.com" ] }, "precision": "exact", "references": [ "https://twitter.com/kyleehmke/status/1341107219673341954", "https://twitter.com/kyleehmke/status/1351617582340694025", "https://twitter.com/blackorbird/status/1385433029938614274", "https://community.riskiq.com/article/9a515637/description" ], "total": 43 }, { "counts": { "domain": 1 }, "first_seen": "2021-04-16", "indicators": { "domain": [ "megatoolkit.com" ] }, "precision": "exact", "references": [ "https://twitter.com/c3rb3ru5d3d53c/status/1383113919405903873", "https://www.virustotal.com/gui/file/4e8f24fb50a08c12636f3d50c94772f355d5229e58110cccb3b4835cb2371aec/detection", "https://twitter.com/kyleehmke/status/1341107219673341954", "https://twitter.com/kyleehmke/status/1351617582340694025", "https://twitter.com/blackorbird/status/1385433029938614274", "https://community.riskiq.com/article/9a515637/description" ], "total": 1 }, { "counts": { "domain": 48, "ipv4": 7, "url_path": 1 }, "first_seen": "2021-03-20", "indicators": { "domain": [ "40ort.750.credit", "adagio.betterworldshopping.com", "admirer.onehourcfo.com", "adsprofitnetwork.com", "alertmeter.info", "bmlor.750.credit", "builder.visionarybusiness.net", "champions.gdtc.org", "coloradospringsroofing.info", "combat.strategyforgood.com", "context.septemberyears.org", "daddy.stlouisdemoday.com", "defender5.coachwithak.com", "fanta.swofficefurniture.com", "flowers.netplusplans.com", "flowers.thegardnerco.com", "freespace.givingprofits.net", "gallery.wineadam.com", "group3.pulsedesigngroup.us", "inferno.bigpurposebigimpact.com", "inspirer.cartsandmowers.com", "jenkins.findfwd.com", "joke.webproduct.info", "joomla.lifepath.site", "lamarfish.com", "lion.vipjoyeria.com", "method.nonprofitsustainability.com", "phpmyadmin.xsunx.com", "pixelapn.adsprofitnetwork.com", "pixelapn2.adsprofitnetwork.com", "plkiu.daniyalmedicaltech.com", "pointers.ecostratas.com", "popcorn.net-zerodesign.com", "printing.laminatesandthings.com", "promo9.promossupply.com", "prompt.powerofpartnerships.net", "q.promossupply.com", "rock.core-thought.com", "roofingspecialists.info", "secureconnectiongroup.com", "securesearchnow.com", "snuff.mybabyrose.com", "standart.sdtranspo.com", "test.directfwd.com", "test.news.pocketstay.com", "time.suehyatt.com", "twimg-us.azureedge.net", "zombie.susan-hyatt.com" ], "ipv4": [ "179.43.141.188:81", "179.43.141.188:82", "179.43.141.188:83", "185.189.151.182:443", "91.219.239.43:143", "91.219.239.54:81", "91.219.239.54:82" ], "url_path": [ "/sk-jspark_init.php" ] }, "precision": "exact", "references": [ "https://github.com/blackorbird/APT_REPORT/blob/master/SunBurst/SilverFish_Solarwinds.pdf" ], "total": 56 }, { "counts": { "url_path": 5 }, "first_seen": "2021-03-20", "indicators": { "url_path": [ "/46tt83y6.ps1", "/build_eu.ps1", "/buildus9_3.ps1", "/p0fd798.ps1", "/pwrvw.ps1" ] }, "precision": "exact", "references": [ "https://twitter.com/malwrhunterteam/status/1677023534294487049", "https://twitter.com/h2jazi/status/1677027834890469376", "https://www.virustotal.com/gui/file/966e070a52de1c51976f6ea1fc48ec77f6b89f4bf5e5007650755e9cd0d73281/detection", "https://www.virustotal.com/gui/file/4875a9c4af3044db281c5dc02e5386c77f331e3b92e5ae79ff9961d8cd1f7c4f/detection", "https://www.virustotal.com/gui/file/af1922c665e9be6b29a5e3d0d3ac5916ae1fc74ac2fe9931e5273f3c4043f395/detection", "https://www.virustotal.com/gui/file/7fc9e830756e23aa4b050f4ceaeb2a83cd71cfc0145392a0bc03037af373066b/detection" ], "total": 5 }, { "counts": { "url": 1 }, "first_seen": "2021-03-08", "indicators": { "url": [ "reyweb.com/assets/index.php" ] }, "precision": "exact", "references": [ "https://www.fireeye.com/blog/threat-research/2021/03/sunshuttle-second-stage-backdoor-targeting-us-based-entity.html", "https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/", "https://www.virustotal.com/gui/file/b9a2c986b6ad1eb4cfb0303baede906936fe96396f3cf490b0984a4798d741d8/detection", "https://twitter.com/cyb3rops/status/1367794498965766144" ], "total": 1 }, { "counts": { "url": 1 }, "first_seen": "2021-03-08", "indicators": { "url": [ "example.com/assets/index.php" ] }, "precision": "exact", "references": [ "https://twitter.com/ShadowChasing1/status/1368831762114093059", "https://www.virustotal.com/gui/file/2375da7528de541b7e60eae80ab14bb88e39f30b798869b26ad67c6cc46af765/detection" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2021-03-05", "indicators": { "domain": [ "onetechcompany.com", "srfnetwork.org" ] }, "precision": "exact", "references": [ "https://www.fireeye.com/blog/threat-research/2021/03/sunshuttle-second-stage-backdoor-targeting-us-based-entity.html", "https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/", "https://www.virustotal.com/gui/file/b9a2c986b6ad1eb4cfb0303baede906936fe96396f3cf490b0984a4798d741d8/detection", "https://twitter.com/cyb3rops/status/1367794498965766144", "https://twitter.com/kyleehmke/status/1341107219673341954", "https://twitter.com/kyleehmke/status/1351617582340694025", "https://twitter.com/blackorbird/status/1385433029938614274", "https://community.riskiq.com/article/9a515637/description" ], "total": 2 }, { "counts": { "ipv4": 1 }, "first_seen": "2021-03-05", "indicators": { "ipv4": [ "185.225.69.69:443" ] }, "precision": "exact", "references": [ "https://www.fireeye.com/blog/threat-research/2021/03/sunshuttle-second-stage-backdoor-targeting-us-based-entity.html", "https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/", "https://www.virustotal.com/gui/file/b9a2c986b6ad1eb4cfb0303baede906936fe96396f3cf490b0984a4798d741d8/detection", "https://twitter.com/cyb3rops/status/1367794498965766144" ], "total": 1 }, { "counts": { "ipv4": 2 }, "first_seen": "2021-02-05", "indicators": { "ipv4": [ "216.243.39.167:8090", "98.225.248.37:8090" ] }, "precision": "exact", "references": [ "https://news.sophos.com/en-us/2021/02/03/mtr-casebook-uncovering-a-backdoor-implant-in-a-solarwinds-orion-server/", "https://otx.alienvault.com/pulse/601da173ed7d3e7e31c67c3d/", "https://www.virustotal.com/gui/file/a25fc5af86296dcd5bb41668443a36947bccd17a1687f9b118675f1503b3e376/detection", "https://www.virustotal.com/gui/file/f39dc0dfd43477d65c1380a7cff89296ad72bfa7fc3afcfd8e294f195632030e/detection" ], "total": 2 }, { "counts": { "domain": 8 }, "first_seen": "2021-01-20", "indicators": { "domain": [ "aimsecurity.net", "datazr.com", "financialmarket.org", "gallerycenter.org", "mobilnweb.com", "olapdatabase.com", "swipeservice.com", "techiefly.com" ] }, "precision": "exact", "references": [ "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/", "https://otx.alienvault.com/pulse/60088b53da5e673bc2825ce8", "https://twitter.com/kyleehmke/status/1341107219673341954", "https://twitter.com/kyleehmke/status/1351617582340694025", "https://twitter.com/blackorbird/status/1385433029938614274", "https://community.riskiq.com/article/9a515637/description" ], "total": 8 }, { "counts": { "domain": 1 }, "first_seen": "2021-01-19", "indicators": { "domain": [ "bigtopweb.com" ] }, "precision": "exact", "references": [ "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://blog.talosintelligence.com/2020/12/solarwinds-supplychain-coverage.html", "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/", "https://unit42.paloaltonetworks.com/fireeye-solarstorm-sunburst/", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/sunburst-supply-chain-attack-solarwinds", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware", "https://twitter.com/_CPResearch_/status/1339952318717063168", "https://otx.alienvault.com/pulse/5fd6df943558e0b56eaf3da8", "https://otx.alienvault.com/pulse/5fdce61ef056eff2ce0a90de", "https://otx.alienvault.com/pulse/6007149a5ff246c7c18229c1", "https://twitter.com/kyleehmke/status/1341107219673341954", "https://twitter.com/kyleehmke/status/1351617582340694025", "https://twitter.com/blackorbird/status/1385433029938614274", "https://community.riskiq.com/article/9a515637/description" ], "total": 1 }, { "counts": { "domain": 3, "ipv4": 1 }, "first_seen": "2020-12-27", "indicators": { "domain": [ "d1d66buv7blf1z.cloudfront.net", "myrric-uses.singlejets.com", "sendbits.m2stor4ge.xyz" ], "ipv4": [ "45.91.93.89:443" ] }, "precision": "exact", "references": [ "https://blog.truesec.com/2020/12/22/collaboration-between-fin7-and-the-ryuk-group-a-truesec-investigation/", "https://www.virustotal.com/gui/file/7c20ef1547da114c15da8dd617d22dfd5c7fb08bb9eb07e30df35834619b915a/detection" ], "total": 4 }, { "counts": { "domain": 2 }, "first_seen": "2020-12-18", "indicators": { "domain": [ "ervsystem.com", "infinitysoftwares.com" ] }, "precision": "exact", "references": [ "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://blog.talosintelligence.com/2020/12/solarwinds-supplychain-coverage.html", "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/", "https://unit42.paloaltonetworks.com/fireeye-solarstorm-sunburst/", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/sunburst-supply-chain-attack-solarwinds", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware", "https://twitter.com/_CPResearch_/status/1339952318717063168", "https://otx.alienvault.com/pulse/5fd6df943558e0b56eaf3da8", "https://otx.alienvault.com/pulse/5fdce61ef056eff2ce0a90de", "https://otx.alienvault.com/pulse/6007149a5ff246c7c18229c1", "https://twitter.com/kyleehmke/status/1341107219673341954", "https://twitter.com/kyleehmke/status/1351617582340694025", "https://twitter.com/blackorbird/status/1385433029938614274", "https://community.riskiq.com/article/9a515637/description" ], "total": 2 }, { "counts": { "domain": 8 }, "first_seen": "2020-12-15", "indicators": { "domain": [ "digitalcollege.org", "kubecloud.com", "lcomputers.com", "seobundlekit.com", "solartrackingsystem.net", "virtualdataserver.com", "virtualwebdata.com", "webcodez.com" ] }, "precision": "exact", "references": [ "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://blog.talosintelligence.com/2020/12/solarwinds-supplychain-coverage.html", "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/", "https://unit42.paloaltonetworks.com/fireeye-solarstorm-sunburst/", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/sunburst-supply-chain-attack-solarwinds", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware", "https://twitter.com/_CPResearch_/status/1339952318717063168", "https://otx.alienvault.com/pulse/5fd6df943558e0b56eaf3da8", "https://otx.alienvault.com/pulse/5fdce61ef056eff2ce0a90de", "https://otx.alienvault.com/pulse/6007149a5ff246c7c18229c1", "https://twitter.com/kyleehmke/status/1341107219673341954", "https://twitter.com/kyleehmke/status/1351617582340694025", "https://twitter.com/blackorbird/status/1385433029938614274", "https://community.riskiq.com/article/9a515637/description" ], "total": 8 }, { "counts": { "domain": 11 }, "first_seen": "2020-12-14", "indicators": { "domain": [ "6a57jk2ba1d9keg15cbg.appsync-api.eu-west-1.avsvmcloud.com", "7sbvaemscs0mc925tb99.appsync-api.us-west-2.avsvmcloud.com", "appsync-api.eu-west-1.avsvmcloud.com", "appsync-api.us-east-1.avsvmcloud.com", "appsync-api.us-east-2.avsvmcloud.com", "appsync-api.us-west-2.avsvmcloud.com", "avsvmcloud.com", "gq1h856599gqh538acqn.appsync-api.us-west-2.avsvmcloud.com", "ihvpgv9psvq02ffo77et.appsync-api.us-east-2.avsvmcloud.com", "k5kcubuassl3alrf7gm3.appsync-api.eu-west-1.avsvmcloud.com", "mhdosoksaccf9sni9icp.appsync-api.eu-west-1.avsvmcloud.com" ] }, "precision": "exact", "references": [ "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://blog.talosintelligence.com/2020/12/solarwinds-supplychain-coverage.html", "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/", "https://unit42.paloaltonetworks.com/fireeye-solarstorm-sunburst/", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/sunburst-supply-chain-attack-solarwinds", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware", "https://twitter.com/_CPResearch_/status/1339952318717063168", "https://otx.alienvault.com/pulse/5fd6df943558e0b56eaf3da8", "https://otx.alienvault.com/pulse/5fdce61ef056eff2ce0a90de", "https://otx.alienvault.com/pulse/6007149a5ff246c7c18229c1" ], "total": 11 }, { "counts": { "domain": 10 }, "first_seen": "2020-12-14", "indicators": { "domain": [ "databasegalore.com", "deftsecurity.com", "freescanonline.com", "globalnetworkissues.com", "highdatabase.com", "incomeupdate.com", "panhardware.com", "thedoccloud.com", "websitetheme.com", "zupertech.com" ] }, "precision": "exact", "references": [ "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://blog.talosintelligence.com/2020/12/solarwinds-supplychain-coverage.html", "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/", "https://unit42.paloaltonetworks.com/fireeye-solarstorm-sunburst/", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/sunburst-supply-chain-attack-solarwinds", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware", "https://twitter.com/_CPResearch_/status/1339952318717063168", "https://otx.alienvault.com/pulse/5fd6df943558e0b56eaf3da8", "https://otx.alienvault.com/pulse/5fdce61ef056eff2ce0a90de", "https://otx.alienvault.com/pulse/6007149a5ff246c7c18229c1", "https://twitter.com/kyleehmke/status/1341107219673341954", "https://twitter.com/kyleehmke/status/1351617582340694025", "https://twitter.com/blackorbird/status/1385433029938614274", "https://community.riskiq.com/article/9a515637/description" ], "total": 10 }, { "counts": { "domain": 1 }, "first_seen": "2020-11-06", "indicators": { "domain": [ "d3ser9acyt7cdp.cloudfront.net" ] }, "precision": "exact", "references": [ "https://github.com/blackorbird/APT_REPORT/blob/master/SunBurst/SilverFish_Solarwinds.pdf" ], "total": 1 }, { "counts": { "ipv4": 1 }, "first_seen": "2020-09-09", "indicators": { "ipv4": [ "103.253.41.102:8081" ] }, "precision": "exact", "references": [ "https://twitter.com/joakimkennedy/status/1303626343830167552", "https://www.virustotal.com/gui/file/ebfe9cc39dfdc1d1abe7fd4b1e248b16238234c5261610456de0317c2045555d/detection" ], "total": 1 }, { "counts": { "ipv4": 1 }, "first_seen": "2020-08-19", "indicators": { "ipv4": [ "103.216.221.18:50031" ] }, "precision": "exact", "references": [ "https://www.pwc.co.uk/issues/cyber-security-services/insights/wellmess-analysis-command-control.html" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2020-08-19", "indicators": { "domain": [ "monitor.syn.cn" ] }, "precision": "exact", "references": [ "https://unit42.paloaltonetworks.com/unit-42-technical-analysis-seaduke/" ], "total": 1 }, { "counts": { "domain": 2 }, "first_seen": "2020-07-29", "indicators": { "domain": [ "robotvice.com", "signup-now.com" ] }, "precision": "exact", "references": [ "https://github.com/blackorbird/APT_REPORT/blob/master/SunBurst/SilverFish_Solarwinds.pdf" ], "total": 2 }, { "counts": { "ipv4": 1 }, "first_seen": "2020-07-29", "indicators": { "ipv4": [ "141.98.212.55:121" ] }, "precision": "exact", "references": [ "https://twitter.com/ShadowChasing1/status/1288403929462530049", "https://www.virustotal.com/gui/file/95193266e37a3401a0becace6d41171ab2968ed5289d666043251d05552d02fc/detection" ], "total": 1 }, { "counts": { "ipv4": 1 }, "first_seen": "2020-07-21", "indicators": { "ipv4": [ "111.90.150.140:25" ] }, "precision": "exact", "references": [ "https://twitter.com/IntezerLabs/status/1285487000091598863", "https://www.virustotal.com/gui/file/85e72976b9448295034a8d4c26462b8f1ebe1ca0a4e4b897c7f2404d0de948c2/detection" ], "total": 1 }, { "counts": { "url": 50 }, "first_seen": "2020-07-18", "indicators": { "url": [ "http://103.13.240.46", "http://103.205.8.72", "http://103.216.221.19", "http://103.253.41.102", "http://103.253.41.68", "http://103.253.41.82", "http://103.253.41.90", "http://103.73.188.101", "http://111.90.146.143", "http://111.90.150.176", "http://119.160.234.163", "http://119.160.234.194", "http://119.81.173.130", "http://119.81.178.105", "http://119.81.184.11", "http://120.53.12.132", "http://122.114.197.185", "http://122.114.226.172", "http://141.255.164.29", "http://141.98.212.55", "http://145.249.107.73", "http://146.0.76.37", "http://149.202.12.210", "http://169.239.128.110", "http://176.119.29.37", "http://185.145.128.35", "http://185.225.226.16", "http://185.99.133.112", "http://188.241.68.137", "http://191.101.180.78", "http://192.48.88.107", "http://202.59.9.59", "http://209.58.186.196", "http://209.58.186.197", "http://209.58.186.240", "http://220.158.216.130", "http://27.102.130.115", "http://31.170.107.186", "http://31.7.63.141", "http://45.120.156.69", "http://45.123.190.167", "http://45.123.190.168", "http://45.129.229.48", "http://45.152.84.57", "http://46.19.143.69", "http://5.199.174.164", "http://66.70.247.215", "http://79.141.168.109", "http://81.17.17.213", "http://85.93.2.116" ] }, "precision": "exact", "references": [ "https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development.pdf", "https://otx.alienvault.com/pulse/5f107c022dfb7a7c8fec7903" ], "total": 50 }, { "counts": { "url": 1 }, "first_seen": "2020-07-18", "indicators": { "url": [ "http://178.211.39.6" ] }, "precision": "exact", "references": [ "https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development.pdf", "https://otx.alienvault.com/pulse/5f107c022dfb7a7c8fec7903", "https://twitter.com/ShadowChasing1/status/1288403929462530049", "https://www.virustotal.com/gui/file/95193266e37a3401a0becace6d41171ab2968ed5289d666043251d05552d02fc/detection" ], "total": 1 }, { "counts": { "domain": 19 }, "first_seen": "2019-10-17", "indicators": { "domain": [ "acciaio.com.br", "bandabonga.fr", "busseylawoffice.com", "ceycarb.com", "coachandcook.at", "ecolesndmessines.org", "fairfieldsch.org", "fisioterapiabb.it", "lorriratzlaff.com", "ministernetwork.org", "motherlodebulldogclub.com", "powerpolymerindustry.com", "publiccouncil.org", "rulourialuminiu.co.uk", "salesappliances.com", "sistemikan.com", "skagenyoga.com", "varuhusmc.org", "westmedicalgroup.net" ] }, "precision": "exact", "references": [ "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf", "https://otx.alienvault.com/pulse/5da83c7c104ff3553f418443" ], "total": 19 }, { "counts": { "domain": 1 }, "first_seen": "2019-10-01", "indicators": { "domain": [ "backup.awarfaregaming.com" ] }, "precision": "exact", "references": [ "https://github.com/blackorbird/APT_REPORT/blob/master/SunBurst/SilverFish_Solarwinds.pdf" ], "total": 1 }, { "counts": { "domain": 1 }, "first_seen": "2018-09-13", "indicators": { "domain": [ "portal.sbn.co.th" ] }, "precision": "exact", "references": [ "https://www.f-secure.com/weblog/archives/00002822.html" ], "total": 1 }, { "counts": { "domain": 15 }, "first_seen": "2015-10-23", "indicators": { "domain": [ "airtravelabroad.com", "beijingnewsblog.net", "deervalleyassociation.com", "greencastleadvantage.com", "grouptumbler.com", "leveldelta.com", "nasdaqblog.net", "natureinhome.com", "nestedmail.com", "nostressjob.com", "nytunion.com", "oilnewsblog.com", "overpict.com", "sixsquare.net", "ustradecomp.com" ] }, "precision": "exact", "references": [ "https://otx.alienvault.com/pulse/55fae83567db8c6fb3518bcd/", "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf" ], "total": 15 } ] }