{
  "aliases": [
    "KALAMBUR backdoor",
    "apt44",
    "blackenergy",
    "iron viking",
    "quedagh",
    "seashell blizzard",
    "temp.noble",
    "voodoo bear"
  ],
  "attack_id": "G0034",
  "attack_name": "Sandworm Team",
  "attack_url": "https://attack.mitre.org/groups/G0034/",
  "counts": {
    "domain": 303,
    "ipv4": 394,
    "url": 58,
    "url_path": 16
  },
  "first_seen": {
    "domain": {
      "1o.cdn-googel.com": "2026-07-15",
      "2zilmiystfbjib2k4hvhpnv2uhni4ax5ce4xlpb7swkjimfnszxbkaid.onion": "2026-01-02",
      "365softupdate.com": "2026-07-15",
      "389424.xyz": "2026-07-15",
      "445600.xyz": "2026-07-15",
      "4b.cdn-banamex.com": "2026-07-15",
      "abaronaweb.net": "2016-02-24",
      "account-check.hostapp.link": "2024-06-16",
      "account-googlmail.ml": "2019-11-22",
      "account-loginserv.com": "2019-11-22",
      "account.adfs.kyivstar.online": "2024-06-16",
      "accounts.google-account-settings.spdup.art": "2024-06-16",
      "activationsmicrosoft.com": "2025-02-12",
      "adfs.kyivstar.online": "2024-06-16",
      "adobeprotectcheck.com": "2024-12-01",
      "ads.ew.com.cn": "2016-02-24",
      "ads.tolinkhub.com": "2026-07-15",
      "aiads.best": "2026-07-15",
      "akamaizes.com": "2026-07-15",
      "all-invite.org": "2016-03-09",
      "allserve.xyz": "2026-07-15",
      "annualgieconferenceinmunich2024.com": "2024-12-01",
      "antimailspam.com": "2024-12-01",
      "api-to-now.allserve.xyz": "2026-07-15",
      "api.beesapp.top": "2026-07-15",
      "api.budandan.com": "2026-07-15",
      "api.chaboshi.cc": "2026-07-15",
      "api.click2mine.top": "2026-07-15",
      "api.degendogs.top": "2026-07-15",
      "api.fastrig.top": "2026-07-15",
      "api.globalsimc.com": "2026-07-15",
      "api.gmc-doge.top": "2026-07-15",
      "api.jackpotsure.win": "2026-07-15",
      "api.luckytonspin.top": "2026-07-15",
      "api.omgton.xyz": "2026-07-15",
      "api.plantton.top": "2026-07-15",
      "api.powerdigger.top": "2026-07-15",
      "api.powerton.top": "2026-07-15",
      "api.surewinsgjackpot.com": "2026-07-15",
      "api.tonblastrun.top": "2026-07-15",
      "api.tonchainer.top": "2026-07-15",
      "api.toncore.top": "2026-07-15",
      "api.tondaily.top": "2026-07-15",
      "api.tondrillx.top": "2026-07-15",
      "api.tonengine.top": "2026-07-15",
      "api.tonfarmers.top": "2026-07-15",
      "api.tonforgex.top": "2026-07-15",
      "api.tonhive.top": "2026-07-15",
      "api.tonmineplus.top": "2026-07-15",
      "api.tonow.top": "2026-07-15",
      "api.tonrushgo.top": "2026-07-15",
      "api.tonvaultchain.top": "2026-07-15",
      "api.tribikauction.co.id": "2026-07-15",
      "api.urvega.com": "2026-07-15",
      "api.xmtk01.xyz": "2026-07-15",
      "api.xsms.ng": "2026-07-15",
      "api.yangsany.cn": "2026-07-15",
      "apiali.huangma188.cc": "2026-07-15",
      "apidocs.ataas.cl": "2026-03-25",
      "aplusdesktop.workers.dev": "2024-12-18",
      "aplusmodgovua.workers.dev": "2024-12-18",
      "app.chaboshi.cc": "2026-07-15",
      "armylpus.workers.dev": "2024-12-18",
      "armyplus-desktop.workers.dev": "2024-12-18",
      "aut0mat.info": "2016-02-24",
      "backup.yuhspace.top": "2026-07-15",
      "bbxgames.top": "2026-07-15",
      "beesapp.top": "2026-07-15",
      "beta-0-110.armyplus-desktop.workers.dev": "2024-12-18",
      "beta-0-2237.desktopapluscom.workers.dev": "2024-12-18",
      "bitooex.com": "2026-07-15",
      "bka.im": "2016-02-24",
      "bot.swapbot.ru": "2026-07-15",
      "botservice.tgtool.org": "2026-07-15",
      "budandan.com": "2026-07-15",
      "cazino-game.com": "2016-02-24",
      "cdn-banamex.com": "2026-07-15",
      "cdn-googel.com": "2026-07-15",
      "cdn-health-service.com": "2026-07-15",
      "cdn-images-world.com": "2026-07-15",
      "cdn-javascript-source.com": "2026-07-15",
      "cdn-sat.com": "2026-07-15",
      "cdnauthsoft.com": "2026-01-02",
      "cfaccount.ccwu.cc": "2026-07-15",
      "chaboshi.cc": "2026-07-15",
      "checknetworkstatus.com": "2026-07-15",
      "checknetwstatus.com": "2026-07-15",
      "checksystem.nl": "2026-03-25",
      "claud.in": "2024-06-16",
      "click2mine.top": "2026-07-15",
      "cloud-sync.org": "2025-02-12",
      "cloue.link": "2024-06-16",
      "codvya.cc": "2026-07-15",
      "cohpoint.com": "2026-07-15",
      "cols.melfordco.com": "2026-07-15",
      "convoai.club": "2026-07-15",
      "ctulocal1.com": "2026-07-15",
      "cxim.asia": "2016-02-24",
      "darkett.ddns.net": "2022-09-19",
      "darksea.ddns.net": "2024-06-16",
      "dashboard.viktor.id.vn": "2026-07-15",
      "datasafereader.com": "2026-07-15",
      "ddumasz.info": "2016-02-24",
      "degendogs.top": "2026-07-15",
      "delta.smartlinkupload.com": "2026-07-15",
      "deltaexchange.net": "2026-03-25",
      "deploynewcdn.com": "2026-07-15",
      "desktopaplus.workers.dev": "2024-12-18",
      "desktopapluscom.workers.dev": "2024-12-18",
      "dev-api-ton-mine-x.bbxgames.top": "2026-07-15",
      "dev-tg-clound.jsxgate.xyz": "2026-07-15",
      "devcr.cc": "2026-07-15",
      "diagnostics-monitoring.com": "2026-07-15",
      "dimsumshop.goodomensplus.com": "2026-07-15",
      "do5.net": "2026-07-15",
      "documentreader.net": "2026-01-02",
      "documents-reader.com": "2026-01-02",
      "dontgivedamn.com": "2026-03-25",
      "dontgivefuck.com": "2026-03-25",
      "drive.google.com.filepreview.auth.userarea.click": "2024-06-16",
      "dvjbn4sg4p1ck.cloudfront.net": "2023-08-10",
      "ealingbikes.com": "2026-07-15",
      "email.jsxgate.xyz": "2026-07-15",
      "entouchnetworks.com": "2026-07-15",
      "esetpremium.com": "2026-01-02",
      "esetsmart.org": "2018-10-12",
      "ett.ddns.net": "2022-09-19",
      "ett.hopto.org": "2022-09-19",
      "f16auto.com": "2026-07-15",
      "fastrig.top": "2026-07-15",
      "fbapp.info": "2020-10-05",
      "fbapp.link": "2020-10-05",
      "fbapp.top": "2020-10-05",
      "feirobot.youdianfuli.com": "2026-07-15",
      "filepreview.auth.userarea.click": "2024-06-16",
      "fileprotectloader.com": "2026-07-15",
      "freezeblank.online": "2026-07-15",
      "fullycap.com": "2026-07-15",
      "gieannualconferenceinmunich.com": "2024-12-01",
      "globalsimc.com": "2026-07-15",
      "globdomain.ru": "2016-02-24",
      "gmc-doge.top": "2026-07-15",
      "goodomensplus.com": "2026-07-15",
      "goodsmatch.goodomensplus.com": "2026-07-15",
      "google-account-settings.spdup.art": "2024-06-16",
      "h5.xincheng.baby": "2026-07-15",
      "hackzona.tk": "2016-02-24",
      "horse-fun.com": "2026-07-15",
      "hostapp.be": "2020-05-29",
      "hp.do5.net": "2026-07-15",
      "htrjhb.npm.ng": "2026-07-15",
      "huangma188.cc": "2026-07-15",
      "hwupdates.com": "2025-02-12",
      "i.ua.account-check.hostapp.link": "2024-06-16",
      "i2.cdn-images-world.com": "2026-07-15",
      "i2rgcvog6cypjohfzfzw3d5kqgoobkzlbchsdxx4gm7lyaxn5nfp6bid.onion": "2026-03-25",
      "ios2026.top": "2026-07-15",
      "ivoryhire.com": "2026-07-15",
      "jackpotsure.win": "2026-07-15",
      "jakkaru.ru": "2016-02-24",
      "jsxgate.xyz": "2026-07-15",
      "jw.445600.xyz": "2026-07-15",
      "k0x.ru": "2016-02-24",
      "kalambur.net": "2025-02-12",
      "kandagarka.net": "2016-02-24",
      "kf.pezxdf.cn": "2026-07-15",
      "kievstar.online": "2022-09-19",
      "kms-win11-update.net": "2025-02-12",
      "kmsupdate2023.com": "2025-02-12",
      "knight3xppu263m7g4ag3xlit2qxpryjwueobh7vjdc3zrscqlfu3pqd.onion": "2023-08-04",
      "knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion": "2023-08-29",
      "kyiv-star.ddns.net": "2022-09-19",
      "kyivstar.me": "2024-06-16",
      "kyivstar.online": "2024-06-16",
      "lantian123.xyz": "2026-07-15",
      "lc2023.com": "2026-07-15",
      "login.adfs.kyivstar.online": "2024-06-16",
      "login.antimailspam.com": "2024-12-01",
      "login.kyivstar.online": "2024-06-16",
      "luckytonspin.top": "2026-07-15",
      "magic.horse-fun.com": "2026-07-15",
      "massgrave.link": "2026-03-25",
      "may.convoai.club": "2026-07-15",
      "me-cloud.link": "2024-06-16",
      "melfordco.com": "2026-07-15",
      "mixu.ai": "2026-07-15",
      "mscloudedge.com": "2026-03-25",
      "msoayvri.com": "2026-07-15",
      "myaccount.click": "2020-10-05",
      "myaccount.one": "2020-10-05",
      "myprodjs.ru": "2016-02-24",
      "n6b6j4vlkc4ak343j4fmuwmosxtwrft6bph5s5562lefji4a475smuad.onion": "2026-03-25",
      "nalog.in": "2024-06-16",
      "nefzawa.net": "2026-07-15",
      "new-activity.tgtool.org": "2026-07-15",
      "nn.cdn-health-service.com": "2026-07-15",
      "node3-cdn.com": "2026-07-15",
      "nt3rrzq5hcyznvdkpslvqbbc2jqecqrinhi5jtwoae2x7psqtcb6dcad.onion": "2023-08-04",
      "object-storage-service.com": "2026-01-02",
      "offlce366.com": "2026-07-15",
      "old-lab-1001.armyplus-desktop.workers.dev": "2024-12-18",
      "olololo.in": "2016-02-24",
      "omgton.xyz": "2026-07-15",
      "onedrivestandaloneupdater.com": "2025-02-12",
      "onlinejobsnet.co.cc": "2016-02-24",
      "opennetworkconnect.com": "2026-07-15",
      "oq.codvya.cc": "2026-07-15",
      "outlook.adfs.kyivstar.online": "2024-06-16",
      "ovhphpmyadmin.xtreme-vision.net": "2026-03-25",
      "pack.softpacker.org": "2026-07-15",
      "pezxdf.cn": "2026-07-15",
      "plantton.top": "2026-07-15",
      "platform.mixu.ai": "2026-07-15",
      "powerdigger.top": "2026-07-15",
      "powerton.top": "2026-07-15",
      "prava-servise.ru": "2016-02-24",
      "protectconnections.com": "2024-12-01",
      "protectraid.com": "2024-12-01",
      "ratiborus2023.com": "2025-02-12",
      "s.akamaizes.com": "2026-07-15",
      "sealisten.jsxgate.xyz": "2026-07-15",
      "sharp.mcdir.ru": "2016-03-09",
      "sjuosdt.top": "2026-07-15",
      "skewertime.goodomensplus.com": "2026-07-15",
      "smartlinkupload.com": "2026-07-15",
      "smartscreenua.com": "2026-03-25",
      "soft.softchecker.org": "2026-07-15",
      "softchecker.org": "2026-07-15",
      "softpacker.org": "2026-07-15",
      "softupdater.org": "2026-07-15",
      "solntsepek.com": "2024-06-16",
      "spdup.art": "2024-06-16",
      "star-cz.ddns.net": "2022-06-27",
      "star-link.ddns.net": "2022-09-19",
      "static.diagnostics-monitoring.com": "2026-07-15",
      "static.opennetworkconnect.com": "2026-07-15",
      "status.ealingbikes.com": "2026-07-15",
      "sumbur.net": "2026-03-25",
      "surewinsgjackpot.com": "2026-07-15",
      "swapbot.ru": "2026-07-15",
      "t3.cdn-sat.com": "2026-07-15",
      "tailchat.lc2023.com": "2026-07-15",
      "tapakweb.my": "2026-07-15",
      "telegramweb.us": "2024-06-16",
      "tgcloud.link": "2024-06-16",
      "tgeo.link": "2024-06-16",
      "tgme.contact": "2024-06-16",
      "tgset.click": "2024-06-16",
      "thedatingadvise.com": "2026-07-15",
      "tolinkhub.com": "2026-07-15",
      "tonblastrun.top": "2026-07-15",
      "tonchainer.top": "2026-07-15",
      "toncore.top": "2026-07-15",
      "tondaily.top": "2026-07-15",
      "tondrillx.top": "2026-07-15",
      "tonengine.top": "2026-07-15",
      "tonfarmers.top": "2026-07-15",
      "tonforgex.top": "2026-07-15",
      "tonhive.top": "2026-07-15",
      "tonmineplus.top": "2026-07-15",
      "tonow.top": "2026-07-15",
      "tonrushgo.top": "2026-07-15",
      "tonvaultchain.top": "2026-07-15",
      "tribikauction.co": "2026-07-15",
      "tx.chaboshi.cc": "2026-07-15",
      "ua.account-check.hostapp.link": "2024-06-16",
      "ukrnet24.com": "2024-06-16",
      "um10eset.net": "2018-10-12",
      "update-requirements.com": "2026-07-15",
      "uploader.social": "2026-07-15",
      "urvega.com": "2026-07-15",
      "userarea.click": "2020-06-03",
      "userarea.eu": "2020-06-03",
      "userarea.in": "2020-10-05",
      "userarea.top": "2020-10-05",
      "userzone.eu": "2020-10-05",
      "userzone.one": "2020-10-05",
      "utm.checknetwstatus.com": "2026-07-15",
      "vb.bitooex.com": "2026-07-15",
      "viktor.id.vn": "2026-07-15",
      "wd.sjuosdt.top": "2026-07-15",
      "web-v2.yunmx.com": "2026-07-15",
      "webcache.one": "2020-10-05",
      "webman.vip": "2026-07-15",
      "webprofiler.cc": "2016-02-24",
      "well-sold.com": "2026-07-15",
      "windowsdrivepack.com": "2025-02-12",
      "windowsupdatesystem.org": "2025-02-12",
      "write-dream.ru": "2016-02-24",
      "wvtmsouaa2gt6jmcuxj5hkfrqdss5lhecoqijt5dl7gfruueu3i5mkad.onion": "2024-12-18",
      "xaknet.team": "2024-06-16",
      "xg.cdn-javascript-source.com": "2026-07-15",
      "xincheng.baby": "2026-07-15",
      "xmtk01.xyz": "2026-07-15",
      "xtreme-vision.net": "2026-03-25",
      "yangsany.cn": "2026-07-15",
      "yanoo.com.userarea.eu": "2024-06-16",
      "yellow-butterfly-6fcd.armyplus-desktop.workers.dev": "2024-12-18",
      "yf.aiads.best": "2026-07-15",
      "youdianfuli.com": "2026-07-15",
      "yuhspace.top": "2026-07-15",
      "yv.msoayvri.com": "2026-07-15",
      "zz.ios2026.top": "2026-07-15"
    },
    "ipv4": {
      "1.9.85.247:3269": "2022-03-17",
      "1.9.85.247:636": "2022-03-17",
      "1.9.85.247:8443": "2022-03-17",
      "1.9.85.247:989": "2022-03-17",
      "1.9.85.247:990": "2022-03-17",
      "1.9.85.247:994": "2022-03-17",
      "1.9.85.247:995": "2022-03-17",
      "1.9.85.248:3269": "2022-03-17",
      "1.9.85.248:636": "2022-03-17",
      "1.9.85.248:8443": "2022-03-17",
      "1.9.85.248:989": "2022-03-17",
      "1.9.85.248:990": "2022-03-17",
      "1.9.85.248:994": "2022-03-17",
      "1.9.85.248:995": "2022-03-17",
      "1.9.85.249:3269": "2022-03-17",
      "1.9.85.249:636": "2022-03-17",
      "1.9.85.249:8443": "2022-03-17",
      "1.9.85.249:989": "2022-03-17",
      "1.9.85.249:990": "2022-03-17",
      "1.9.85.249:994": "2022-03-17",
      "1.9.85.249:995": "2022-03-17",
      "1.9.85.252:3269": "2022-03-17",
      "1.9.85.252:636": "2022-03-17",
      "1.9.85.252:8443": "2022-03-17",
      "1.9.85.252:989": "2022-03-17",
      "1.9.85.252:990": "2022-03-17",
      "1.9.85.252:994": "2022-03-17",
      "1.9.85.252:995": "2022-03-17",
      "1.9.85.253:3269": "2022-03-17",
      "1.9.85.253:636": "2022-03-17",
      "1.9.85.253:8443": "2022-03-17",
      "1.9.85.253:989": "2022-03-17",
      "1.9.85.253:990": "2022-03-17",
      "1.9.85.253:994": "2022-03-17",
      "1.9.85.253:995": "2022-03-17",
      "1.9.85.254:3269": "2022-03-17",
      "1.9.85.254:636": "2022-03-17",
      "1.9.85.254:8443": "2022-03-17",
      "1.9.85.254:989": "2022-03-17",
      "1.9.85.254:990": "2022-03-17",
      "1.9.85.254:994": "2022-03-17",
      "1.9.85.254:995": "2022-03-17",
      "100.43.220.234:3269": "2022-04-06",
      "100.43.220.234:636": "2022-04-06",
      "100.43.220.234:8443": "2022-04-06",
      "100.43.220.234:989": "2022-04-06",
      "100.43.220.234:990": "2022-04-06",
      "100.43.220.234:994": "2022-04-06",
      "100.43.220.234:995": "2022-04-06",
      "100.43.220.234:996": "2022-04-06",
      "102.50.244.205:3269": "2022-03-17",
      "102.50.244.205:636": "2022-03-17",
      "102.50.244.205:8443": "2022-03-17",
      "102.50.244.205:989": "2022-03-17",
      "102.50.244.205:990": "2022-03-17",
      "102.50.244.205:994": "2022-03-17",
      "102.50.244.205:995": "2022-04-06",
      "103.201.129.130:443": "2025-02-13",
      "105.159.248.137:3269": "2022-04-06",
      "105.159.248.137:636": "2022-04-06",
      "105.159.248.137:8443": "2022-04-06",
      "105.159.248.137:989": "2022-04-06",
      "105.159.248.137:990": "2022-04-06",
      "105.159.248.137:994": "2022-04-06",
      "105.159.248.137:995": "2022-04-06",
      "105.159.248.137:996": "2022-04-06",
      "109.192.30.125:3269": "2022-04-06",
      "109.192.30.125:636": "2022-04-06",
      "109.192.30.125:8443": "2022-04-06",
      "109.192.30.125:989": "2022-04-06",
      "109.192.30.125:990": "2022-04-06",
      "109.192.30.125:994": "2022-04-06",
      "109.192.30.125:995": "2022-04-06",
      "109.192.30.125:996": "2022-04-06",
      "124.115.171.103:443": "2022-11-09",
      "146.0.74.7:443": "2022-08-06",
      "146.59.116.226:50845": "2026-03-25",
      "148.251.82.21:443": "2022-08-06",
      "148.76.89.2:3269": "2022-03-17",
      "148.76.89.2:636": "2022-03-17",
      "148.76.89.2:8443": "2022-03-17",
      "148.76.89.2:989": "2022-03-17",
      "148.76.89.2:990": "2022-03-17",
      "148.76.89.2:994": "2022-03-17",
      "148.76.89.2:995": "2022-03-17",
      "148.76.89.3:3269": "2022-03-17",
      "148.76.89.3:636": "2022-03-17",
      "148.76.89.3:8443": "2022-03-17",
      "148.76.89.3:989": "2022-03-17",
      "148.76.89.3:990": "2022-03-17",
      "148.76.89.3:994": "2022-03-17",
      "148.76.89.3:995": "2022-03-17",
      "148.76.89.4:3269": "2022-03-17",
      "148.76.89.4:636": "2022-03-17",
      "148.76.89.4:8443": "2022-03-17",
      "148.76.89.4:989": "2022-03-17",
      "148.76.89.4:990": "2022-03-17",
      "148.76.89.4:994": "2022-03-17",
      "148.76.89.4:995": "2022-03-17",
      "148.76.89.5:3269": "2022-03-17",
      "148.76.89.5:636": "2022-03-17",
      "148.76.89.5:8443": "2022-03-17",
      "148.76.89.5:989": "2022-03-17",
      "148.76.89.5:990": "2022-03-17",
      "148.76.89.5:994": "2022-03-17",
      "148.76.89.5:995": "2022-03-17",
      "148.76.89.6:3269": "2022-03-17",
      "148.76.89.6:636": "2022-03-17",
      "148.76.89.6:8443": "2022-03-17",
      "148.76.89.6:989": "2022-03-17",
      "148.76.89.6:990": "2022-03-17",
      "148.76.89.6:994": "2022-03-17",
      "148.76.89.6:995": "2022-03-17",
      "150.107.31.194:18000": "2026-01-02",
      "151.0.169.250:3269": "2022-04-06",
      "151.0.169.250:636": "2022-04-06",
      "151.0.169.250:8443": "2022-04-06",
      "151.0.169.250:989": "2022-04-06",
      "151.0.169.250:990": "2022-04-06",
      "151.0.169.250:994": "2022-04-06",
      "151.0.169.250:995": "2022-04-06",
      "151.0.169.250:996": "2022-04-06",
      "151.0.185.146:3269": "2022-03-17",
      "151.0.185.146:636": "2022-03-17",
      "151.0.185.146:8443": "2022-03-17",
      "151.0.185.146:989": "2022-03-17",
      "151.0.185.146:990": "2022-03-17",
      "151.0.185.146:994": "2022-03-17",
      "151.0.185.146:995": "2022-03-17",
      "151.0.185.147:3269": "2022-03-17",
      "151.0.185.147:636": "2022-03-17",
      "151.0.185.147:8443": "2022-03-17",
      "151.0.185.147:989": "2022-03-17",
      "151.0.185.147:990": "2022-03-17",
      "151.0.185.147:994": "2022-03-17",
      "151.0.185.147:995": "2022-03-17",
      "151.0.185.148:3269": "2022-03-17",
      "151.0.185.148:636": "2022-03-17",
      "151.0.185.148:8443": "2022-03-17",
      "151.0.185.148:989": "2022-03-17",
      "151.0.185.148:990": "2022-03-17",
      "151.0.185.148:994": "2022-03-17",
      "151.0.185.148:995": "2022-03-17",
      "151.0.185.149:3269": "2022-03-17",
      "151.0.185.149:636": "2022-03-17",
      "151.0.185.149:8443": "2022-03-17",
      "151.0.185.149:989": "2022-03-17",
      "151.0.185.149:990": "2022-03-17",
      "151.0.185.149:994": "2022-03-17",
      "151.0.185.149:995": "2022-03-17",
      "151.0.185.150:3269": "2022-03-17",
      "151.0.185.150:636": "2022-03-17",
      "151.0.185.150:8443": "2022-03-17",
      "151.0.185.150:989": "2022-03-17",
      "151.0.185.150:990": "2022-03-17",
      "151.0.185.150:994": "2022-03-17",
      "151.0.185.150:995": "2022-03-17",
      "165.231.34.106:443": "2024-04-19",
      "178.250.188.114:443": "2024-04-19",
      "182.73.50.114:3269": "2022-03-17",
      "182.73.50.114:636": "2022-03-17",
      "182.73.50.114:8443": "2022-03-17",
      "182.73.50.114:989": "2022-03-17",
      "182.73.50.114:990": "2022-03-17",
      "182.73.50.114:994": "2022-03-17",
      "182.73.50.114:995": "2022-03-17",
      "182.73.50.115:3269": "2022-03-17",
      "182.73.50.115:636": "2022-03-17",
      "182.73.50.115:8443": "2022-03-17",
      "182.73.50.115:989": "2022-03-17",
      "182.73.50.115:990": "2022-03-17",
      "182.73.50.115:994": "2022-03-17",
      "182.73.50.115:995": "2022-03-17",
      "185.225.114.108:48765": "2022-11-10",
      "185.225.114.90:443": "2024-04-19",
      "185.80.92.143:8998": "2022-06-10",
      "185.82.169.99:3269": "2022-04-06",
      "185.82.169.99:636": "2022-04-06",
      "185.82.169.99:8443": "2022-04-06",
      "185.82.169.99:989": "2022-04-06",
      "185.82.169.99:990": "2022-04-06",
      "185.82.169.99:994": "2022-04-06",
      "185.82.169.99:995": "2022-04-06",
      "185.82.169.99:996": "2022-04-06",
      "188.152.254.170:3269": "2022-04-06",
      "188.152.254.170:636": "2022-04-06",
      "188.152.254.170:8443": "2022-04-06",
      "188.152.254.170:989": "2022-04-06",
      "188.152.254.170:990": "2022-04-06",
      "188.152.254.170:994": "2022-04-06",
      "188.152.254.170:995": "2022-04-06",
      "188.152.254.170:996": "2022-04-06",
      "188.40.8.72:443": "2022-08-06",
      "194.61.121.211:443": "2024-04-19",
      "195.154.182.165:443": "2024-04-19",
      "195.230.23.19:443": "2022-04-16",
      "196.245.156.154:443": "2024-04-19",
      "2.230.110.137:3269": "2022-04-06",
      "2.230.110.137:636": "2022-04-06",
      "2.230.110.137:8443": "2022-04-06",
      "2.230.110.137:989": "2022-04-06",
      "2.230.110.137:990": "2022-04-06",
      "2.230.110.137:994": "2022-04-06",
      "2.230.110.137:995": "2022-04-06",
      "2.230.110.137:996": "2022-04-06",
      "208.81.37.50:3269": "2022-04-06",
      "208.81.37.50:636": "2022-04-06",
      "208.81.37.50:8443": "2022-04-06",
      "208.81.37.50:989": "2022-04-06",
      "208.81.37.50:990": "2022-04-06",
      "208.81.37.50:994": "2022-04-06",
      "208.81.37.50:995": "2022-04-06",
      "208.81.37.50:996": "2022-04-06",
      "212.103.208.182:3269": "2022-04-06",
      "212.103.208.182:636": "2022-04-06",
      "212.103.208.182:8443": "2022-04-06",
      "212.103.208.182:989": "2022-04-06",
      "212.103.208.182:990": "2022-04-06",
      "212.103.208.182:994": "2022-04-06",
      "212.103.208.182:995": "2022-04-06",
      "212.103.208.182:996": "2022-04-06",
      "212.202.147.10:3269": "2022-04-06",
      "212.202.147.10:636": "2022-04-06",
      "212.202.147.10:8443": "2022-04-06",
      "212.202.147.10:989": "2022-04-06",
      "212.202.147.10:990": "2022-04-06",
      "212.202.147.10:994": "2022-04-06",
      "212.202.147.10:995": "2022-04-06",
      "212.202.147.10:996": "2022-04-06",
      "212.234.179.113:3269": "2022-04-06",
      "212.234.179.113:636": "2022-04-06",
      "212.234.179.113:8443": "2022-04-06",
      "212.234.179.113:989": "2022-04-06",
      "212.234.179.113:990": "2022-04-06",
      "212.234.179.113:994": "2022-04-06",
      "212.234.179.113:995": "2022-04-06",
      "212.234.179.113:996": "2022-04-06",
      "217.57.80.18:3269": "2022-03-17",
      "217.57.80.18:636": "2022-03-17",
      "217.57.80.18:8443": "2022-03-17",
      "217.57.80.18:989": "2022-03-17",
      "217.57.80.18:990": "2022-03-17",
      "217.57.80.18:994": "2022-03-17",
      "217.57.80.18:995": "2022-03-17",
      "24.199.247.222:3269": "2022-04-06",
      "24.199.247.222:636": "2022-04-06",
      "24.199.247.222:8443": "2022-04-06",
      "24.199.247.222:989": "2022-04-06",
      "24.199.247.222:990": "2022-04-06",
      "24.199.247.222:994": "2022-04-06",
      "24.199.247.222:995": "2022-04-06",
      "24.199.247.222:996": "2022-04-06",
      "31.210.111.154:443": "2022-08-06",
      "37.71.147.186:3269": "2022-03-17",
      "37.71.147.186:636": "2022-03-17",
      "37.71.147.186:8443": "2022-03-17",
      "37.71.147.186:989": "2022-03-17",
      "37.71.147.186:990": "2022-03-17",
      "37.71.147.186:994": "2022-03-17",
      "37.71.147.186:995": "2022-03-17",
      "37.99.163.162:3269": "2022-04-06",
      "37.99.163.162:636": "2022-04-06",
      "37.99.163.162:8443": "2022-04-06",
      "37.99.163.162:989": "2022-04-06",
      "37.99.163.162:990": "2022-04-06",
      "37.99.163.162:994": "2022-04-06",
      "37.99.163.162:995": "2022-04-06",
      "37.99.163.162:996": "2022-04-06",
      "41.77.136.250:443": "2022-08-06",
      "46.165.222.28:443": "2022-08-06",
      "5.149.254.114:443": "2022-08-06",
      "5.9.32.230:443": "2022-08-06",
      "50.192.49.210:3269": "2022-03-17",
      "50.192.49.210:636": "2022-03-17",
      "50.192.49.210:8443": "2022-03-17",
      "50.192.49.210:989": "2022-03-17",
      "50.192.49.210:990": "2022-03-17",
      "50.192.49.210:994": "2022-03-17",
      "50.192.49.210:995": "2022-03-17",
      "50.255.126.65:3269": "2022-04-06",
      "50.255.126.65:636": "2022-04-06",
      "50.255.126.65:8443": "2022-04-06",
      "50.255.126.65:989": "2022-04-06",
      "50.255.126.65:990": "2022-04-06",
      "50.255.126.65:994": "2022-04-06",
      "50.255.126.65:995": "2022-04-06",
      "50.255.126.65:996": "2022-04-06",
      "57.128.59.134:24102": "2026-03-25",
      "70.62.153.174:3269": "2022-04-06",
      "70.62.153.174:636": "2022-04-06",
      "70.62.153.174:8443": "2022-04-06",
      "70.62.153.174:989": "2022-04-06",
      "70.62.153.174:990": "2022-04-06",
      "70.62.153.174:994": "2022-04-06",
      "70.62.153.174:995": "2022-04-06",
      "70.62.153.174:996": "2022-04-06",
      "78.134.89.167:3269": "2022-04-06",
      "78.134.89.167:636": "2022-04-06",
      "78.134.89.167:8443": "2022-04-06",
      "78.134.89.167:989": "2022-04-06",
      "78.134.89.167:990": "2022-04-06",
      "78.134.89.167:994": "2022-04-06",
      "78.134.89.167:995": "2022-04-06",
      "78.134.89.167:996": "2022-04-06",
      "80.15.113.188:3269": "2022-04-06",
      "80.15.113.188:636": "2022-04-06",
      "80.15.113.188:8443": "2022-04-06",
      "80.15.113.188:989": "2022-04-06",
      "80.15.113.188:990": "2022-04-06",
      "80.15.113.188:994": "2022-04-06",
      "80.15.113.188:995": "2022-04-06",
      "80.15.113.188:996": "2022-04-06",
      "80.153.75.103:3269": "2022-04-06",
      "80.153.75.103:636": "2022-04-06",
      "80.153.75.103:8443": "2022-04-06",
      "80.153.75.103:989": "2022-04-06",
      "80.153.75.103:990": "2022-04-06",
      "80.153.75.103:994": "2022-04-06",
      "80.153.75.103:995": "2022-04-06",
      "80.153.75.103:996": "2022-04-06",
      "80.155.38.210:3269": "2022-04-06",
      "80.155.38.210:636": "2022-04-06",
      "80.155.38.210:8443": "2022-04-06",
      "80.155.38.210:989": "2022-04-06",
      "80.155.38.210:990": "2022-04-06",
      "80.155.38.210:994": "2022-04-06",
      "80.155.38.210:995": "2022-04-06",
      "80.155.38.210:996": "2022-04-06",
      "81.4.177.118:3269": "2022-04-06",
      "81.4.177.118:636": "2022-04-06",
      "81.4.177.118:8443": "2022-04-06",
      "81.4.177.118:989": "2022-04-06",
      "81.4.177.118:990": "2022-04-06",
      "81.4.177.118:994": "2022-04-06",
      "81.4.177.118:995": "2022-04-06",
      "81.4.177.118:996": "2022-04-06",
      "87.236.161.43:443": "2022-06-10",
      "88.198.25.92:443": "2022-08-06",
      "90.63.245.175:3269": "2022-04-06",
      "90.63.245.175:636": "2022-04-06",
      "90.63.245.175:8443": "2022-04-06",
      "90.63.245.175:989": "2022-04-06",
      "90.63.245.175:990": "2022-04-06",
      "90.63.245.175:994": "2022-04-06",
      "90.63.245.175:995": "2022-04-06",
      "90.63.245.175:996": "2022-04-06",
      "91.232.31.178:873": "2026-01-02",
      "91.245.255.243:443": "2022-04-16",
      "91.92.137.164:443": "2024-04-19",
      "93.51.177.66:3269": "2022-04-06",
      "93.51.177.66:636": "2022-04-06",
      "93.51.177.66:8443": "2022-04-06",
      "93.51.177.66:989": "2022-04-06",
      "93.51.177.66:990": "2022-04-06",
      "93.51.177.66:994": "2022-04-06",
      "93.51.177.66:995": "2022-04-06",
      "93.51.177.66:996": "2022-04-06",
      "95.216.13.196:53": "2020-05-29",
      "95.216.13.196:8080": "2020-05-29",
      "96.80.68.193:3269": "2022-03-17",
      "96.80.68.193:636": "2022-03-17",
      "96.80.68.193:8443": "2022-03-17",
      "96.80.68.193:989": "2022-03-17",
      "96.80.68.193:990": "2022-03-17",
      "96.80.68.193:994": "2022-03-17",
      "96.80.68.193:995": "2022-03-17",
      "96.80.68.194:3269": "2022-03-17",
      "96.80.68.194:636": "2022-03-17",
      "96.80.68.194:8443": "2022-03-17",
      "96.80.68.194:989": "2022-03-17",
      "96.80.68.194:990": "2022-03-17",
      "96.80.68.194:994": "2022-03-17",
      "96.80.68.194:995": "2022-03-17",
      "96.80.68.195:3269": "2022-03-17",
      "96.80.68.195:636": "2022-03-17",
      "96.80.68.195:8443": "2022-03-17",
      "96.80.68.195:989": "2022-03-17",
      "96.80.68.195:990": "2022-03-17",
      "96.80.68.195:994": "2022-03-17",
      "96.80.68.195:995": "2022-03-17",
      "96.80.68.196:3269": "2022-03-17",
      "96.80.68.196:636": "2022-03-17",
      "96.80.68.196:8443": "2022-03-17",
      "96.80.68.196:989": "2022-03-17",
      "96.80.68.196:990": "2022-03-17",
      "96.80.68.196:994": "2022-03-17",
      "96.80.68.196:995": "2022-03-17",
      "96.80.68.197:3269": "2022-03-17",
      "96.80.68.197:636": "2022-03-17",
      "96.80.68.197:8443": "2022-03-17",
      "96.80.68.197:989": "2022-03-17",
      "96.80.68.197:990": "2022-03-17",
      "96.80.68.197:994": "2022-03-17",
      "96.80.68.197:995": "2022-03-17"
    },
    "url": {
      "adobeprotectcheck.com/Downloads/zayavka.lnk": "2026-01-02",
      "afi-ukraine.org/wp-includes/bestone.php": "2024-12-01",
      "annualgieconferenceinmunich2024.com/Downloads/": "2026-01-02",
      "calendar.stib.com.ua/bestone.php": "2024-12-01",
      "dobeprotectcheck.com/Downloads/": "2026-01-02",
      "ertel-audit.com/wp-includes/GIE_Annual_Conference_2024_Participant_Form.pdf": "2026-01-02",
      "ertel-audit.com/wp-includes/Zayava_pro_vitik_gasu.pdf": "2026-01-02",
      "ertel-audit.com/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEK.php": "2026-01-02",
      "ertel-audit.com/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEKb1.php": "2026-01-02",
      "ertel-audit.com/wp-includes/caramel.php": "2024-12-01",
      "furqaanenergy.com/wp-includes/Text/November/": "2026-01-02",
      "furqaanenergy.com/wp-includes/Text/November2/": "2026-01-02",
      "furqaanenergy.com/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEK.php": "2024-11-13",
      "furqaanenergy.com/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEKb1.php": "2024-11-13",
      "gieannualconferenceinmunich.com/Downloads/": "2026-01-02",
      "gurt.duna.ua/programy-nauczania/": "2024-12-01",
      "gurt.duna.ua/programy-nauczania/GIEAnnualConferenceStage2": "2024-12-01",
      "gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5": "2024-12-01",
      "gurt.duna.ua/programy-nauczania/arst.dll": "2026-01-02",
      "gurt.duna.ua/programy-nauczania/ssowoface.dll": "2024-12-01",
      "helpdesk.katolik.bydgoszcz.pl/bydgoszcz.php": "2024-12-01",
      "helpdesk.katolik.bydgoszcz.pl/eliot.php": "2026-01-02",
      "http://103.201.129.130": "2025-02-13",
      "http://146.0.74.7": "2022-08-06",
      "http://148.251.82.21": "2022-08-06",
      "http://178.250.188.114": "2024-04-19",
      "http://185.225.114.90": "2024-04-19",
      "http://188.40.8.72": "2022-08-06",
      "http://193.239.152.131": "2022-08-06",
      "http://194.61.121.211": "2024-04-19",
      "http://195.154.182.165": "2024-04-19",
      "http://195.230.23.19": "2022-04-16",
      "http://196.245.156.154": "2024-04-19",
      "http://212.237.217.78": "2026-01-02",
      "http://31.210.111.154": "2022-08-06",
      "http://41.77.136.250": "2022-08-06",
      "http://46.165.222.28": "2022-08-06",
      "http://5.149.254.114": "2022-08-06",
      "http://5.255.101.146": "2025-02-12",
      "http://5.255.114.16": "2025-02-12",
      "http://5.255.119.183": "2025-02-12",
      "http://5.255.119.195": "2025-02-12",
      "http://5.255.121.218": "2025-02-12",
      "http://5.255.122.118": "2025-02-12",
      "http://5.255.99.169": "2025-02-12",
      "http://5.9.32.230": "2022-08-06",
      "http://51.222.43.200": "2026-01-02",
      "http://66.63.187.79": "2026-01-02",
      "http://88.198.25.92": "2022-08-06",
      "http://91.232.31.178": "2026-01-02",
      "http://91.245.255.243": "2022-04-16",
      "http://91.92.137.164": "2024-04-19",
      "http://94.185.85.122": "2022-08-06",
      "http://95.211.122.36": "2022-08-06",
      "protectraid.com/Downloads/": "2026-01-02",
      "protectraid.com/Downloads/Resume.lnk": "2026-01-02",
      "protectraid.com/Downloads/Resume.pdf.lnk": "2026-01-02",
      "protectraid.com/Downloads/VASY.lnk": "2026-01-02"
    },
    "url_path": {
      "/Microsoft/Update/KC074913.php": "2022-08-06",
      "/Microsoft/Update/KS081274.php": "2022-08-06",
      "/Microsoft/Update/KS1945777.php": "2022-08-06",
      "/Microsoft/Update/KS4567890.php": "2022-08-06",
      "/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEK.php": "2026-01-02",
      "/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEKb1.php": "2026-01-02",
      "/eegL7p.php": "2022-08-06",
      "/fHKfvEhleQ/": "2022-08-06",
      "/fHKfvEhleQ/maincraft/": "2022-08-06",
      "/fHKfvEhleQ/maincraft/derstatus.php": "2022-08-06",
      "/l7vogLG/BVZ99/": "2022-08-06",
      "/l7vogLG/BVZ99/rt170v/": "2022-08-06",
      "/l7vogLG/BVZ99/rt170v/solocVI/": "2022-08-06",
      "/l7vogLG/BVZ99/rt170v/solocVI/eegL7p.php": "2022-08-06",
      "/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEK.php": "2026-01-02",
      "/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEKb1.php": "2026-01-02"
    }
  },
  "first_seen_precision": {
    "domain": {
      "2zilmiystfbjib2k4hvhpnv2uhni4ax5ce4xlpb7swkjimfnszxbkaid.onion": "at-or-before",
      "cdnauthsoft.com": "at-or-before",
      "documentreader.net": "at-or-before",
      "documents-reader.com": "at-or-before",
      "esetpremium.com": "at-or-before",
      "object-storage-service.com": "at-or-before"
    },
    "ipv4": {
      "150.107.31.194:18000": "at-or-before",
      "91.232.31.178:873": "at-or-before"
    },
    "url": {
      "adobeprotectcheck.com/Downloads/zayavka.lnk": "at-or-before",
      "annualgieconferenceinmunich2024.com/Downloads/": "at-or-before",
      "dobeprotectcheck.com/Downloads/": "at-or-before",
      "ertel-audit.com/wp-includes/GIE_Annual_Conference_2024_Participant_Form.pdf": "at-or-before",
      "ertel-audit.com/wp-includes/Zayava_pro_vitik_gasu.pdf": "at-or-before",
      "ertel-audit.com/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEK.php": "at-or-before",
      "ertel-audit.com/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEKb1.php": "at-or-before",
      "furqaanenergy.com/wp-includes/Text/November/": "at-or-before",
      "furqaanenergy.com/wp-includes/Text/November2/": "at-or-before",
      "gieannualconferenceinmunich.com/Downloads/": "at-or-before",
      "gurt.duna.ua/programy-nauczania/arst.dll": "at-or-before",
      "helpdesk.katolik.bydgoszcz.pl/eliot.php": "at-or-before",
      "http://212.237.217.78": "at-or-before",
      "http://51.222.43.200": "at-or-before",
      "http://66.63.187.79": "at-or-before",
      "http://91.232.31.178": "at-or-before",
      "protectraid.com/Downloads/": "at-or-before",
      "protectraid.com/Downloads/Resume.lnk": "at-or-before",
      "protectraid.com/Downloads/Resume.pdf.lnk": "at-or-before",
      "protectraid.com/Downloads/VASY.lnk": "at-or-before"
    },
    "url_path": {
      "/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEK.php": "at-or-before",
      "/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEKb1.php": "at-or-before",
      "/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEK.php": "at-or-before",
      "/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEKb1.php": "at-or-before"
    }
  },
  "first_seen_range": {
    "earliest": "2016-02-24",
    "latest": "2026-07-15"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "1o.cdn-googel.com",
      "2zilmiystfbjib2k4hvhpnv2uhni4ax5ce4xlpb7swkjimfnszxbkaid.onion",
      "365softupdate.com",
      "389424.xyz",
      "445600.xyz",
      "4b.cdn-banamex.com",
      "abaronaweb.net",
      "account-check.hostapp.link",
      "account-googlmail.ml",
      "account-loginserv.com",
      "account.adfs.kyivstar.online",
      "accounts.google-account-settings.spdup.art",
      "activationsmicrosoft.com",
      "adfs.kyivstar.online",
      "adobeprotectcheck.com",
      "ads.ew.com.cn",
      "ads.tolinkhub.com",
      "aiads.best",
      "akamaizes.com",
      "all-invite.org",
      "allserve.xyz",
      "annualgieconferenceinmunich2024.com",
      "antimailspam.com",
      "api-to-now.allserve.xyz",
      "api.beesapp.top",
      "api.budandan.com",
      "api.chaboshi.cc",
      "api.click2mine.top",
      "api.degendogs.top",
      "api.fastrig.top",
      "api.globalsimc.com",
      "api.gmc-doge.top",
      "api.jackpotsure.win",
      "api.luckytonspin.top",
      "api.omgton.xyz",
      "api.plantton.top",
      "api.powerdigger.top",
      "api.powerton.top",
      "api.surewinsgjackpot.com",
      "api.tonblastrun.top",
      "api.tonchainer.top",
      "api.toncore.top",
      "api.tondaily.top",
      "api.tondrillx.top",
      "api.tonengine.top",
      "api.tonfarmers.top",
      "api.tonforgex.top",
      "api.tonhive.top",
      "api.tonmineplus.top",
      "api.tonow.top",
      "api.tonrushgo.top",
      "api.tonvaultchain.top",
      "api.tribikauction.co.id",
      "api.urvega.com",
      "api.xmtk01.xyz",
      "api.xsms.ng",
      "api.yangsany.cn",
      "apiali.huangma188.cc",
      "apidocs.ataas.cl",
      "aplusdesktop.workers.dev",
      "aplusmodgovua.workers.dev",
      "app.chaboshi.cc",
      "armylpus.workers.dev",
      "armyplus-desktop.workers.dev",
      "aut0mat.info",
      "backup.yuhspace.top",
      "bbxgames.top",
      "beesapp.top",
      "beta-0-110.armyplus-desktop.workers.dev",
      "beta-0-2237.desktopapluscom.workers.dev",
      "bitooex.com",
      "bka.im",
      "bot.swapbot.ru",
      "botservice.tgtool.org",
      "budandan.com",
      "cazino-game.com",
      "cdn-banamex.com",
      "cdn-googel.com",
      "cdn-health-service.com",
      "cdn-images-world.com",
      "cdn-javascript-source.com",
      "cdn-sat.com",
      "cdnauthsoft.com",
      "cfaccount.ccwu.cc",
      "chaboshi.cc",
      "checknetworkstatus.com",
      "checknetwstatus.com",
      "checksystem.nl",
      "claud.in",
      "click2mine.top",
      "cloud-sync.org",
      "cloue.link",
      "codvya.cc",
      "cohpoint.com",
      "cols.melfordco.com",
      "convoai.club",
      "ctulocal1.com",
      "cxim.asia",
      "darkett.ddns.net",
      "darksea.ddns.net",
      "dashboard.viktor.id.vn",
      "datasafereader.com",
      "ddumasz.info",
      "degendogs.top",
      "delta.smartlinkupload.com",
      "deltaexchange.net",
      "deploynewcdn.com",
      "desktopaplus.workers.dev",
      "desktopapluscom.workers.dev",
      "dev-api-ton-mine-x.bbxgames.top",
      "dev-tg-clound.jsxgate.xyz",
      "devcr.cc",
      "diagnostics-monitoring.com",
      "dimsumshop.goodomensplus.com",
      "do5.net",
      "documentreader.net",
      "documents-reader.com",
      "dontgivedamn.com",
      "dontgivefuck.com",
      "drive.google.com.filepreview.auth.userarea.click",
      "dvjbn4sg4p1ck.cloudfront.net",
      "ealingbikes.com",
      "email.jsxgate.xyz",
      "entouchnetworks.com",
      "esetpremium.com",
      "esetsmart.org",
      "ett.ddns.net",
      "ett.hopto.org",
      "f16auto.com",
      "fastrig.top",
      "fbapp.info",
      "fbapp.link",
      "fbapp.top",
      "feirobot.youdianfuli.com",
      "filepreview.auth.userarea.click",
      "fileprotectloader.com",
      "freezeblank.online",
      "fullycap.com",
      "gieannualconferenceinmunich.com",
      "globalsimc.com",
      "globdomain.ru",
      "gmc-doge.top",
      "goodomensplus.com",
      "goodsmatch.goodomensplus.com",
      "google-account-settings.spdup.art",
      "h5.xincheng.baby",
      "hackzona.tk",
      "horse-fun.com",
      "hostapp.be",
      "hp.do5.net",
      "htrjhb.npm.ng",
      "huangma188.cc",
      "hwupdates.com",
      "i.ua.account-check.hostapp.link",
      "i2.cdn-images-world.com",
      "i2rgcvog6cypjohfzfzw3d5kqgoobkzlbchsdxx4gm7lyaxn5nfp6bid.onion",
      "ios2026.top",
      "ivoryhire.com",
      "jackpotsure.win",
      "jakkaru.ru",
      "jsxgate.xyz",
      "jw.445600.xyz",
      "k0x.ru",
      "kalambur.net",
      "kandagarka.net",
      "kf.pezxdf.cn",
      "kievstar.online",
      "kms-win11-update.net",
      "kmsupdate2023.com",
      "knight3xppu263m7g4ag3xlit2qxpryjwueobh7vjdc3zrscqlfu3pqd.onion",
      "knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion",
      "kyiv-star.ddns.net",
      "kyivstar.me",
      "kyivstar.online",
      "lantian123.xyz",
      "lc2023.com",
      "login.adfs.kyivstar.online",
      "login.antimailspam.com",
      "login.kyivstar.online",
      "luckytonspin.top",
      "magic.horse-fun.com",
      "massgrave.link",
      "may.convoai.club",
      "me-cloud.link",
      "melfordco.com",
      "mixu.ai",
      "mscloudedge.com",
      "msoayvri.com",
      "myaccount.click",
      "myaccount.one",
      "myprodjs.ru",
      "n6b6j4vlkc4ak343j4fmuwmosxtwrft6bph5s5562lefji4a475smuad.onion",
      "nalog.in",
      "nefzawa.net",
      "new-activity.tgtool.org",
      "nn.cdn-health-service.com",
      "node3-cdn.com",
      "nt3rrzq5hcyznvdkpslvqbbc2jqecqrinhi5jtwoae2x7psqtcb6dcad.onion",
      "object-storage-service.com",
      "offlce366.com",
      "old-lab-1001.armyplus-desktop.workers.dev",
      "olololo.in",
      "omgton.xyz",
      "onedrivestandaloneupdater.com",
      "onlinejobsnet.co.cc",
      "opennetworkconnect.com",
      "oq.codvya.cc",
      "outlook.adfs.kyivstar.online",
      "ovhphpmyadmin.xtreme-vision.net",
      "pack.softpacker.org",
      "pezxdf.cn",
      "plantton.top",
      "platform.mixu.ai",
      "powerdigger.top",
      "powerton.top",
      "prava-servise.ru",
      "protectconnections.com",
      "protectraid.com",
      "ratiborus2023.com",
      "s.akamaizes.com",
      "sealisten.jsxgate.xyz",
      "sharp.mcdir.ru",
      "sjuosdt.top",
      "skewertime.goodomensplus.com",
      "smartlinkupload.com",
      "smartscreenua.com",
      "soft.softchecker.org",
      "softchecker.org",
      "softpacker.org",
      "softupdater.org",
      "solntsepek.com",
      "spdup.art",
      "star-cz.ddns.net",
      "star-link.ddns.net",
      "static.diagnostics-monitoring.com",
      "static.opennetworkconnect.com",
      "status.ealingbikes.com",
      "sumbur.net",
      "surewinsgjackpot.com",
      "swapbot.ru",
      "t3.cdn-sat.com",
      "tailchat.lc2023.com",
      "tapakweb.my",
      "telegramweb.us",
      "tgcloud.link",
      "tgeo.link",
      "tgme.contact",
      "tgset.click",
      "thedatingadvise.com",
      "tolinkhub.com",
      "tonblastrun.top",
      "tonchainer.top",
      "toncore.top",
      "tondaily.top",
      "tondrillx.top",
      "tonengine.top",
      "tonfarmers.top",
      "tonforgex.top",
      "tonhive.top",
      "tonmineplus.top",
      "tonow.top",
      "tonrushgo.top",
      "tonvaultchain.top",
      "tribikauction.co",
      "tx.chaboshi.cc",
      "ua.account-check.hostapp.link",
      "ukrnet24.com",
      "um10eset.net",
      "update-requirements.com",
      "uploader.social",
      "urvega.com",
      "userarea.click",
      "userarea.eu",
      "userarea.in",
      "userarea.top",
      "userzone.eu",
      "userzone.one",
      "utm.checknetwstatus.com",
      "vb.bitooex.com",
      "viktor.id.vn",
      "wd.sjuosdt.top",
      "web-v2.yunmx.com",
      "webcache.one",
      "webman.vip",
      "webprofiler.cc",
      "well-sold.com",
      "windowsdrivepack.com",
      "windowsupdatesystem.org",
      "write-dream.ru",
      "wvtmsouaa2gt6jmcuxj5hkfrqdss5lhecoqijt5dl7gfruueu3i5mkad.onion",
      "xaknet.team",
      "xg.cdn-javascript-source.com",
      "xincheng.baby",
      "xmtk01.xyz",
      "xtreme-vision.net",
      "yangsany.cn",
      "yanoo.com.userarea.eu",
      "yellow-butterfly-6fcd.armyplus-desktop.workers.dev",
      "yf.aiads.best",
      "youdianfuli.com",
      "yuhspace.top",
      "yv.msoayvri.com",
      "zz.ios2026.top"
    ],
    "ipv4": [
      "1.9.85.247:3269",
      "1.9.85.247:636",
      "1.9.85.247:8443",
      "1.9.85.247:989",
      "1.9.85.247:990",
      "1.9.85.247:994",
      "1.9.85.247:995",
      "1.9.85.248:3269",
      "1.9.85.248:636",
      "1.9.85.248:8443",
      "1.9.85.248:989",
      "1.9.85.248:990",
      "1.9.85.248:994",
      "1.9.85.248:995",
      "1.9.85.249:3269",
      "1.9.85.249:636",
      "1.9.85.249:8443",
      "1.9.85.249:989",
      "1.9.85.249:990",
      "1.9.85.249:994",
      "1.9.85.249:995",
      "1.9.85.252:3269",
      "1.9.85.252:636",
      "1.9.85.252:8443",
      "1.9.85.252:989",
      "1.9.85.252:990",
      "1.9.85.252:994",
      "1.9.85.252:995",
      "1.9.85.253:3269",
      "1.9.85.253:636",
      "1.9.85.253:8443",
      "1.9.85.253:989",
      "1.9.85.253:990",
      "1.9.85.253:994",
      "1.9.85.253:995",
      "1.9.85.254:3269",
      "1.9.85.254:636",
      "1.9.85.254:8443",
      "1.9.85.254:989",
      "1.9.85.254:990",
      "1.9.85.254:994",
      "1.9.85.254:995",
      "100.43.220.234:3269",
      "100.43.220.234:636",
      "100.43.220.234:8443",
      "100.43.220.234:989",
      "100.43.220.234:990",
      "100.43.220.234:994",
      "100.43.220.234:995",
      "100.43.220.234:996",
      "102.50.244.205:3269",
      "102.50.244.205:636",
      "102.50.244.205:8443",
      "102.50.244.205:989",
      "102.50.244.205:990",
      "102.50.244.205:994",
      "102.50.244.205:995",
      "103.201.129.130:443",
      "105.159.248.137:3269",
      "105.159.248.137:636",
      "105.159.248.137:8443",
      "105.159.248.137:989",
      "105.159.248.137:990",
      "105.159.248.137:994",
      "105.159.248.137:995",
      "105.159.248.137:996",
      "109.192.30.125:3269",
      "109.192.30.125:636",
      "109.192.30.125:8443",
      "109.192.30.125:989",
      "109.192.30.125:990",
      "109.192.30.125:994",
      "109.192.30.125:995",
      "109.192.30.125:996",
      "124.115.171.103:443",
      "146.0.74.7:443",
      "146.59.116.226:50845",
      "148.251.82.21:443",
      "148.76.89.2:3269",
      "148.76.89.2:636",
      "148.76.89.2:8443",
      "148.76.89.2:989",
      "148.76.89.2:990",
      "148.76.89.2:994",
      "148.76.89.2:995",
      "148.76.89.3:3269",
      "148.76.89.3:636",
      "148.76.89.3:8443",
      "148.76.89.3:989",
      "148.76.89.3:990",
      "148.76.89.3:994",
      "148.76.89.3:995",
      "148.76.89.4:3269",
      "148.76.89.4:636",
      "148.76.89.4:8443",
      "148.76.89.4:989",
      "148.76.89.4:990",
      "148.76.89.4:994",
      "148.76.89.4:995",
      "148.76.89.5:3269",
      "148.76.89.5:636",
      "148.76.89.5:8443",
      "148.76.89.5:989",
      "148.76.89.5:990",
      "148.76.89.5:994",
      "148.76.89.5:995",
      "148.76.89.6:3269",
      "148.76.89.6:636",
      "148.76.89.6:8443",
      "148.76.89.6:989",
      "148.76.89.6:990",
      "148.76.89.6:994",
      "148.76.89.6:995",
      "150.107.31.194:18000",
      "151.0.169.250:3269",
      "151.0.169.250:636",
      "151.0.169.250:8443",
      "151.0.169.250:989",
      "151.0.169.250:990",
      "151.0.169.250:994",
      "151.0.169.250:995",
      "151.0.169.250:996",
      "151.0.185.146:3269",
      "151.0.185.146:636",
      "151.0.185.146:8443",
      "151.0.185.146:989",
      "151.0.185.146:990",
      "151.0.185.146:994",
      "151.0.185.146:995",
      "151.0.185.147:3269",
      "151.0.185.147:636",
      "151.0.185.147:8443",
      "151.0.185.147:989",
      "151.0.185.147:990",
      "151.0.185.147:994",
      "151.0.185.147:995",
      "151.0.185.148:3269",
      "151.0.185.148:636",
      "151.0.185.148:8443",
      "151.0.185.148:989",
      "151.0.185.148:990",
      "151.0.185.148:994",
      "151.0.185.148:995",
      "151.0.185.149:3269",
      "151.0.185.149:636",
      "151.0.185.149:8443",
      "151.0.185.149:989",
      "151.0.185.149:990",
      "151.0.185.149:994",
      "151.0.185.149:995",
      "151.0.185.150:3269",
      "151.0.185.150:636",
      "151.0.185.150:8443",
      "151.0.185.150:989",
      "151.0.185.150:990",
      "151.0.185.150:994",
      "151.0.185.150:995",
      "165.231.34.106:443",
      "178.250.188.114:443",
      "182.73.50.114:3269",
      "182.73.50.114:636",
      "182.73.50.114:8443",
      "182.73.50.114:989",
      "182.73.50.114:990",
      "182.73.50.114:994",
      "182.73.50.114:995",
      "182.73.50.115:3269",
      "182.73.50.115:636",
      "182.73.50.115:8443",
      "182.73.50.115:989",
      "182.73.50.115:990",
      "182.73.50.115:994",
      "182.73.50.115:995",
      "185.225.114.108:48765",
      "185.225.114.90:443",
      "185.80.92.143:8998",
      "185.82.169.99:3269",
      "185.82.169.99:636",
      "185.82.169.99:8443",
      "185.82.169.99:989",
      "185.82.169.99:990",
      "185.82.169.99:994",
      "185.82.169.99:995",
      "185.82.169.99:996",
      "188.152.254.170:3269",
      "188.152.254.170:636",
      "188.152.254.170:8443",
      "188.152.254.170:989",
      "188.152.254.170:990",
      "188.152.254.170:994",
      "188.152.254.170:995",
      "188.152.254.170:996",
      "188.40.8.72:443",
      "194.61.121.211:443",
      "195.154.182.165:443",
      "195.230.23.19:443",
      "196.245.156.154:443",
      "2.230.110.137:3269",
      "2.230.110.137:636",
      "2.230.110.137:8443",
      "2.230.110.137:989",
      "2.230.110.137:990",
      "2.230.110.137:994",
      "2.230.110.137:995",
      "2.230.110.137:996",
      "208.81.37.50:3269",
      "208.81.37.50:636",
      "208.81.37.50:8443",
      "208.81.37.50:989",
      "208.81.37.50:990",
      "208.81.37.50:994",
      "208.81.37.50:995",
      "208.81.37.50:996",
      "212.103.208.182:3269",
      "212.103.208.182:636",
      "212.103.208.182:8443",
      "212.103.208.182:989",
      "212.103.208.182:990",
      "212.103.208.182:994",
      "212.103.208.182:995",
      "212.103.208.182:996",
      "212.202.147.10:3269",
      "212.202.147.10:636",
      "212.202.147.10:8443",
      "212.202.147.10:989",
      "212.202.147.10:990",
      "212.202.147.10:994",
      "212.202.147.10:995",
      "212.202.147.10:996",
      "212.234.179.113:3269",
      "212.234.179.113:636",
      "212.234.179.113:8443",
      "212.234.179.113:989",
      "212.234.179.113:990",
      "212.234.179.113:994",
      "212.234.179.113:995",
      "212.234.179.113:996",
      "217.57.80.18:3269",
      "217.57.80.18:636",
      "217.57.80.18:8443",
      "217.57.80.18:989",
      "217.57.80.18:990",
      "217.57.80.18:994",
      "217.57.80.18:995",
      "24.199.247.222:3269",
      "24.199.247.222:636",
      "24.199.247.222:8443",
      "24.199.247.222:989",
      "24.199.247.222:990",
      "24.199.247.222:994",
      "24.199.247.222:995",
      "24.199.247.222:996",
      "31.210.111.154:443",
      "37.71.147.186:3269",
      "37.71.147.186:636",
      "37.71.147.186:8443",
      "37.71.147.186:989",
      "37.71.147.186:990",
      "37.71.147.186:994",
      "37.71.147.186:995",
      "37.99.163.162:3269",
      "37.99.163.162:636",
      "37.99.163.162:8443",
      "37.99.163.162:989",
      "37.99.163.162:990",
      "37.99.163.162:994",
      "37.99.163.162:995",
      "37.99.163.162:996",
      "41.77.136.250:443",
      "46.165.222.28:443",
      "5.149.254.114:443",
      "5.9.32.230:443",
      "50.192.49.210:3269",
      "50.192.49.210:636",
      "50.192.49.210:8443",
      "50.192.49.210:989",
      "50.192.49.210:990",
      "50.192.49.210:994",
      "50.192.49.210:995",
      "50.255.126.65:3269",
      "50.255.126.65:636",
      "50.255.126.65:8443",
      "50.255.126.65:989",
      "50.255.126.65:990",
      "50.255.126.65:994",
      "50.255.126.65:995",
      "50.255.126.65:996",
      "57.128.59.134:24102",
      "70.62.153.174:3269",
      "70.62.153.174:636",
      "70.62.153.174:8443",
      "70.62.153.174:989",
      "70.62.153.174:990",
      "70.62.153.174:994",
      "70.62.153.174:995",
      "70.62.153.174:996",
      "78.134.89.167:3269",
      "78.134.89.167:636",
      "78.134.89.167:8443",
      "78.134.89.167:989",
      "78.134.89.167:990",
      "78.134.89.167:994",
      "78.134.89.167:995",
      "78.134.89.167:996",
      "80.15.113.188:3269",
      "80.15.113.188:636",
      "80.15.113.188:8443",
      "80.15.113.188:989",
      "80.15.113.188:990",
      "80.15.113.188:994",
      "80.15.113.188:995",
      "80.15.113.188:996",
      "80.153.75.103:3269",
      "80.153.75.103:636",
      "80.153.75.103:8443",
      "80.153.75.103:989",
      "80.153.75.103:990",
      "80.153.75.103:994",
      "80.153.75.103:995",
      "80.153.75.103:996",
      "80.155.38.210:3269",
      "80.155.38.210:636",
      "80.155.38.210:8443",
      "80.155.38.210:989",
      "80.155.38.210:990",
      "80.155.38.210:994",
      "80.155.38.210:995",
      "80.155.38.210:996",
      "81.4.177.118:3269",
      "81.4.177.118:636",
      "81.4.177.118:8443",
      "81.4.177.118:989",
      "81.4.177.118:990",
      "81.4.177.118:994",
      "81.4.177.118:995",
      "81.4.177.118:996",
      "87.236.161.43:443",
      "88.198.25.92:443",
      "90.63.245.175:3269",
      "90.63.245.175:636",
      "90.63.245.175:8443",
      "90.63.245.175:989",
      "90.63.245.175:990",
      "90.63.245.175:994",
      "90.63.245.175:995",
      "90.63.245.175:996",
      "91.232.31.178:873",
      "91.245.255.243:443",
      "91.92.137.164:443",
      "93.51.177.66:3269",
      "93.51.177.66:636",
      "93.51.177.66:8443",
      "93.51.177.66:989",
      "93.51.177.66:990",
      "93.51.177.66:994",
      "93.51.177.66:995",
      "93.51.177.66:996",
      "95.216.13.196:53",
      "95.216.13.196:8080",
      "96.80.68.193:3269",
      "96.80.68.193:636",
      "96.80.68.193:8443",
      "96.80.68.193:989",
      "96.80.68.193:990",
      "96.80.68.193:994",
      "96.80.68.193:995",
      "96.80.68.194:3269",
      "96.80.68.194:636",
      "96.80.68.194:8443",
      "96.80.68.194:989",
      "96.80.68.194:990",
      "96.80.68.194:994",
      "96.80.68.194:995",
      "96.80.68.195:3269",
      "96.80.68.195:636",
      "96.80.68.195:8443",
      "96.80.68.195:989",
      "96.80.68.195:990",
      "96.80.68.195:994",
      "96.80.68.195:995",
      "96.80.68.196:3269",
      "96.80.68.196:636",
      "96.80.68.196:8443",
      "96.80.68.196:989",
      "96.80.68.196:990",
      "96.80.68.196:994",
      "96.80.68.196:995",
      "96.80.68.197:3269",
      "96.80.68.197:636",
      "96.80.68.197:8443",
      "96.80.68.197:989",
      "96.80.68.197:990",
      "96.80.68.197:994",
      "96.80.68.197:995"
    ],
    "url": [
      "adobeprotectcheck.com/Downloads/zayavka.lnk",
      "afi-ukraine.org/wp-includes/bestone.php",
      "annualgieconferenceinmunich2024.com/Downloads/",
      "calendar.stib.com.ua/bestone.php",
      "dobeprotectcheck.com/Downloads/",
      "ertel-audit.com/wp-includes/GIE_Annual_Conference_2024_Participant_Form.pdf",
      "ertel-audit.com/wp-includes/Zayava_pro_vitik_gasu.pdf",
      "ertel-audit.com/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEK.php",
      "ertel-audit.com/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEKb1.php",
      "ertel-audit.com/wp-includes/caramel.php",
      "furqaanenergy.com/wp-includes/Text/November/",
      "furqaanenergy.com/wp-includes/Text/November2/",
      "furqaanenergy.com/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEK.php",
      "furqaanenergy.com/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEKb1.php",
      "gieannualconferenceinmunich.com/Downloads/",
      "gurt.duna.ua/programy-nauczania/",
      "gurt.duna.ua/programy-nauczania/GIEAnnualConferenceStage2",
      "gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5",
      "gurt.duna.ua/programy-nauczania/arst.dll",
      "gurt.duna.ua/programy-nauczania/ssowoface.dll",
      "helpdesk.katolik.bydgoszcz.pl/bydgoszcz.php",
      "helpdesk.katolik.bydgoszcz.pl/eliot.php",
      "http://103.201.129.130",
      "http://146.0.74.7",
      "http://148.251.82.21",
      "http://178.250.188.114",
      "http://185.225.114.90",
      "http://188.40.8.72",
      "http://193.239.152.131",
      "http://194.61.121.211",
      "http://195.154.182.165",
      "http://195.230.23.19",
      "http://196.245.156.154",
      "http://212.237.217.78",
      "http://31.210.111.154",
      "http://41.77.136.250",
      "http://46.165.222.28",
      "http://5.149.254.114",
      "http://5.255.101.146",
      "http://5.255.114.16",
      "http://5.255.119.183",
      "http://5.255.119.195",
      "http://5.255.121.218",
      "http://5.255.122.118",
      "http://5.255.99.169",
      "http://5.9.32.230",
      "http://51.222.43.200",
      "http://66.63.187.79",
      "http://88.198.25.92",
      "http://91.232.31.178",
      "http://91.245.255.243",
      "http://91.92.137.164",
      "http://94.185.85.122",
      "http://95.211.122.36",
      "protectraid.com/Downloads/",
      "protectraid.com/Downloads/Resume.lnk",
      "protectraid.com/Downloads/Resume.pdf.lnk",
      "protectraid.com/Downloads/VASY.lnk"
    ],
    "url_path": [
      "/Microsoft/Update/KC074913.php",
      "/Microsoft/Update/KS081274.php",
      "/Microsoft/Update/KS1945777.php",
      "/Microsoft/Update/KS4567890.php",
      "/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEK.php",
      "/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEKb1.php",
      "/eegL7p.php",
      "/fHKfvEhleQ/",
      "/fHKfvEhleQ/maincraft/",
      "/fHKfvEhleQ/maincraft/derstatus.php",
      "/l7vogLG/BVZ99/",
      "/l7vogLG/BVZ99/rt170v/",
      "/l7vogLG/BVZ99/rt170v/solocVI/",
      "/l7vogLG/BVZ99/rt170v/solocVI/eegL7p.php",
      "/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEK.php",
      "/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEKb1.php"
    ]
  },
  "last_modified": "2026-07-15T19:52:03+00:00",
  "maltrail_groups": [
    "SANDWORM",
    "TELEBOTS"
  ],
  "references": [
    "https://app.validin.com/detail?find=a78dda24e41edb22c214a4d5db1caf2671b5dff7&type=hash&ref_id=4c558f1ca34#tab=host_pairs (# 2025-02-12)",
    "https://app.validin.com/detail?find=dca40e790cd76198c6748dc8d5c90ee58d3f0f84&type=hash&ref_id=6ad15c0868a#tab=host_pairs (# 2025-02-12)",
    "https://blog.eclecticiq.com/sandworm-apt-targets-ukrainian-users-with-trojanized-microsoft-kms-activation-tools-in-cyber-espionage-campaigns",
    "https://cert.gov.ua/article/160530 (Ukrainian)",
    "https://cert.gov.ua/article/2698320 (Ukrainian, UAC-0133)",
    "https://cert.gov.ua/article/39518 (Ukranian)",
    "https://cert.gov.ua/article/6278706 (# UAC-0133)",
    "https://cert.gov.ua/article/6282517",
    "https://cert.gov.ua/article/6318437",
    "https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger",
    "https://cys-centrum.com/ru/news/black_energy_2_3 (Russian)",
    "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf",
    "https://mp.weixin.qq.com/s?__biz=MzUyMjk4NzExMA==&mid=2247508035&idx=1&sn=4d58712823b2121714adf4edbea69f60&chksm=f9c1934aceb61a5c9f3a225a38ac04498862d4a49f7c1aeb76dd2c15ed572cd3fc667fa2b0f3&scene=178&cur_album_id=1955835290309230595&search_click_id",
    "https://otx.alienvault.com/pulse/623319918d3021c70ec8f396",
    "https://otx.alienvault.com/pulse/62552abdd7e44d9aba08636d",
    "https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/",
    "https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf",
    "https://strikeready.com/blog/ru-apt-targeting-energy-infrastructure-unknown-unknowns-part-3/",
    "https://threatconnect.com/blog/threatconnect-research-roundup-probable-sandworm-infrastructure/",
    "https://twitter.com/Des00464472/status/1590213508423352320",
    "https://twitter.com/RakeshKrish12/status/1687344650963804160 (# Cyclops Ransomware group had discontinued their ops & rebranded themselves as \"Knight\" Group (Knight ransomware)!)",
    "https://twitter.com/RecordedFuture/status/1571946803427414016",
    "https://twitter.com/felixw3000/status/1689541933062868992",
    "https://twitter.com/fr0s7_/status/1696485604630970879",
    "https://twitter.com/kyleehmke/status/1267222198588145664",
    "https://web.archive.org/web/20120106212034/http://amada.abuse.ch/blocklist.php?download=domainblocklist",
    "https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/",
    "https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf",
    "https://www.recordedfuture.com/russia-nexus-uac-0113-emulating-telecommunication-providers-in-ukraine",
    "https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html",
    "https://www.virustotal.com/gui/file/05285298ae543665503ab8880204607078f63fd87c10f966838aa6ee0325f222/detection",
    "https://www.virustotal.com/gui/file/0a2a18aac9f5683d4a65e402e22503d1b20a736d12ac71d0f1eff2f9bc0788a8/detection",
    "https://www.virustotal.com/gui/file/0bb5e98f77e69d85bf5068bcbc5b5876f8e5855d34d9201d1caffbf83460cccc/detection",
    "https://www.virustotal.com/gui/file/25497816b84a44be526c4cf048b53fe64118dbda5fdde45bdffe5ce3e2fe259f/detection",
    "https://www.virustotal.com/gui/file/36db27f5eb3343cfc72d261d78da44957a49cb6731acb50a96ea5694f4d616c5/detection",
    "https://www.virustotal.com/gui/file/43b69a81693488905ef655d22e395c3f8dee2486aba976d571d3b12433d10c93/detection",
    "https://www.virustotal.com/gui/file/4a302c0ed3c47231bc7c34cf2d41bc0ceb60d9c7b0023df015f75a58853f43d2/detection",
    "https://www.virustotal.com/gui/file/5ace35adeb360b9e165e7c55065d12f192a3ec0ca601dd73b332bd8cd68d51fe/detection",
    "https://www.virustotal.com/gui/file/6472d2f027e25639b98381affdeb6932a82a530aa593198d6d85f99a1d74c114/detection",
    "https://www.virustotal.com/gui/file/806b5269e7aa9c2c82ce247b30a3e92a4f7285b21e2bcf54c8ffad86bd92ea68/detection",
    "https://www.virustotal.com/gui/file/9507beb5f00ae19cbd3fc3ac74d761fd497d5e999abf5f6d4e2b3af30706389d/detection",
    "https://www.virustotal.com/gui/file/a1b41f7ee862ee9703afda7793d22728e4f8fa571241520b97d523875d81333e/detection",
    "https://www.virustotal.com/gui/file/b8d97d29e99e1f96e06836468db56855dc09305e3ed663c720fe700ea4bf6e73/detection",
    "https://www.virustotal.com/gui/file/baa76590f0917782ca070401feb83cf11ee001b644a4ef44219df81d4eb1ecb5/detection",
    "https://www.virustotal.com/gui/file/d0a6c1f647ae9f21789bc12f88f00e44f0e92c77cb901f3f80da08b033aa9f36/detection",
    "https://www.virustotal.com/gui/file/d2049157980b7ee0a54948d4def4ab62303ca51cadaada06fb51c583ecbce1a2/detection",
    "https://www.virustotal.com/gui/file/dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730/detection",
    "https://www.virustotal.com/gui/ip-address/185.80.53.22/relations",
    "https://www.virustotal.com/gui/ip-address/193.239.152.131/relations",
    "https://www.welivesecurity.com/2016/01/20/new-wave-attacks-ukrainian-power-industry/",
    "https://www.welivesecurity.com/2018/10/11/new-telebots-backdoor-linking-industroyer-notpetya/",
    "https://x.com/BaoshengbinCumt/status/1889865641223659527",
    "https://x.com/Cyber0verload/status/1893952471342428182",
    "https://x.com/DailyDarkWeb/status/1802234656039051511",
    "https://x.com/DaveLikesMalwre/status/1893691921995878762",
    "https://x.com/Now_on_VT/status/1889750562230407235",
    "https://x.com/RexorVc0/status/2036703151303065880",
    "https://x.com/StrikeReadyLabs/status/1847329950443184313",
    "https://x.com/StrikeReadyLabs/status/1869210151439253673",
    "https://x.com/StrikeReadyLabs/status/1869359670290468993",
    "https://x.com/TLP_R3D/status/1889627590970757502",
    "https://x.com/TLP_R3D/status/1892221224094445666",
    "https://x.com/WhichbufferArda/status/1972012355983720623",
    "https://x.com/byrne_emmy12099/status/1856178461515362623"
  ],
  "related": [
    {
      "evidence": [
        {
          "detail": "2 shared indicators",
          "kind": "infrastructure",
          "weight": 2.0
        }
      ],
      "slug": "G0007"
    },
    {
      "evidence": [
        {
          "detail": "2 reports cite both",
          "kind": "reporting",
          "weight": 2.0
        }
      ],
      "slug": "UNC4221"
    },
    {
      "evidence": [
        {
          "detail": "2 reports cite both",
          "kind": "reporting",
          "weight": 2.0
        }
      ],
      "slug": "UNC5792"
    },
    {
      "evidence": [
        {
          "detail": "shares KillDisk",
          "kind": "software",
          "weight": 0.5
        }
      ],
      "slug": "G0082"
    },
    {
      "evidence": [
        {
          "detail": "shares P.A.S. Webshell",
          "kind": "software",
          "weight": 0.5
        }
      ],
      "slug": "G1003"
    },
    {
      "evidence": [
        {
          "detail": "shares SDelete",
          "kind": "software",
          "weight": 0.333
        }
      ],
      "slug": "G0016"
    },
    {
      "evidence": [
        {
          "detail": "shares PoshC2",
          "kind": "software",
          "weight": 0.333
        }
      ],
      "slug": "G0064"
    },
    {
      "evidence": [
        {
          "detail": "shares SDelete",
          "kind": "software",
          "weight": 0.333
        }
      ],
      "slug": "G0091"
    },
    {
      "evidence": [
        {
          "detail": "shares PoshC2",
          "kind": "software",
          "weight": 0.333
        }
      ],
      "slug": "G1001"
    }
  ],
  "slug": "G0034",
  "timeline": [
    {
      "counts": {
        "domain": 179
      },
      "first_seen": "2026-07-15",
      "indicators": {
        "domain": [
          "1o.cdn-googel.com",
          "365softupdate.com",
          "389424.xyz",
          "445600.xyz",
          "4b.cdn-banamex.com",
          "ads.tolinkhub.com",
          "aiads.best",
          "akamaizes.com",
          "allserve.xyz",
          "api-to-now.allserve.xyz",
          "api.beesapp.top",
          "api.budandan.com",
          "api.chaboshi.cc",
          "api.click2mine.top",
          "api.degendogs.top",
          "api.fastrig.top",
          "api.globalsimc.com",
          "api.gmc-doge.top",
          "api.jackpotsure.win",
          "api.luckytonspin.top",
          "api.omgton.xyz",
          "api.plantton.top",
          "api.powerdigger.top",
          "api.powerton.top",
          "api.surewinsgjackpot.com",
          "api.tonblastrun.top",
          "api.tonchainer.top",
          "api.toncore.top",
          "api.tondaily.top",
          "api.tondrillx.top",
          "api.tonengine.top",
          "api.tonfarmers.top",
          "api.tonforgex.top",
          "api.tonhive.top",
          "api.tonmineplus.top",
          "api.tonow.top",
          "api.tonrushgo.top",
          "api.tonvaultchain.top",
          "api.tribikauction.co.id",
          "api.urvega.com",
          "api.xmtk01.xyz",
          "api.xsms.ng",
          "api.yangsany.cn",
          "apiali.huangma188.cc",
          "app.chaboshi.cc",
          "backup.yuhspace.top",
          "bbxgames.top",
          "beesapp.top",
          "bitooex.com",
          "bot.swapbot.ru",
          "botservice.tgtool.org",
          "budandan.com",
          "cdn-banamex.com",
          "cdn-googel.com",
          "cdn-health-service.com",
          "cdn-images-world.com",
          "cdn-javascript-source.com",
          "cdn-sat.com",
          "cfaccount.ccwu.cc",
          "chaboshi.cc",
          "checknetworkstatus.com",
          "checknetwstatus.com",
          "click2mine.top",
          "codvya.cc",
          "cohpoint.com",
          "cols.melfordco.com",
          "convoai.club",
          "ctulocal1.com",
          "dashboard.viktor.id.vn",
          "datasafereader.com",
          "degendogs.top",
          "delta.smartlinkupload.com",
          "deploynewcdn.com",
          "dev-api-ton-mine-x.bbxgames.top",
          "dev-tg-clound.jsxgate.xyz",
          "devcr.cc",
          "diagnostics-monitoring.com",
          "dimsumshop.goodomensplus.com",
          "do5.net",
          "ealingbikes.com",
          "email.jsxgate.xyz",
          "entouchnetworks.com",
          "f16auto.com",
          "fastrig.top",
          "feirobot.youdianfuli.com",
          "fileprotectloader.com",
          "freezeblank.online",
          "fullycap.com",
          "globalsimc.com",
          "gmc-doge.top",
          "goodomensplus.com",
          "goodsmatch.goodomensplus.com",
          "h5.xincheng.baby",
          "horse-fun.com",
          "hp.do5.net",
          "htrjhb.npm.ng",
          "huangma188.cc",
          "i2.cdn-images-world.com",
          "ios2026.top",
          "ivoryhire.com",
          "jackpotsure.win",
          "jsxgate.xyz",
          "jw.445600.xyz",
          "kf.pezxdf.cn",
          "lantian123.xyz",
          "lc2023.com",
          "luckytonspin.top",
          "magic.horse-fun.com",
          "may.convoai.club",
          "melfordco.com",
          "mixu.ai",
          "msoayvri.com",
          "nefzawa.net",
          "new-activity.tgtool.org",
          "nn.cdn-health-service.com",
          "node3-cdn.com",
          "offlce366.com",
          "omgton.xyz",
          "opennetworkconnect.com",
          "oq.codvya.cc",
          "pack.softpacker.org",
          "pezxdf.cn",
          "plantton.top",
          "platform.mixu.ai",
          "powerdigger.top",
          "powerton.top",
          "s.akamaizes.com",
          "sealisten.jsxgate.xyz",
          "sjuosdt.top",
          "skewertime.goodomensplus.com",
          "smartlinkupload.com",
          "soft.softchecker.org",
          "softchecker.org",
          "softpacker.org",
          "softupdater.org",
          "static.diagnostics-monitoring.com",
          "static.opennetworkconnect.com",
          "status.ealingbikes.com",
          "surewinsgjackpot.com",
          "swapbot.ru",
          "t3.cdn-sat.com",
          "tailchat.lc2023.com",
          "tapakweb.my",
          "thedatingadvise.com",
          "tolinkhub.com",
          "tonblastrun.top",
          "tonchainer.top",
          "toncore.top",
          "tondaily.top",
          "tondrillx.top",
          "tonengine.top",
          "tonfarmers.top",
          "tonforgex.top",
          "tonhive.top",
          "tonmineplus.top",
          "tonow.top",
          "tonrushgo.top",
          "tonvaultchain.top",
          "tribikauction.co",
          "tx.chaboshi.cc",
          "update-requirements.com",
          "uploader.social",
          "urvega.com",
          "utm.checknetwstatus.com",
          "vb.bitooex.com",
          "viktor.id.vn",
          "wd.sjuosdt.top",
          "web-v2.yunmx.com",
          "webman.vip",
          "well-sold.com",
          "xg.cdn-javascript-source.com",
          "xincheng.baby",
          "xmtk01.xyz",
          "yangsany.cn",
          "yf.aiads.best",
          "youdianfuli.com",
          "yuhspace.top",
          "yv.msoayvri.com",
          "zz.ios2026.top"
        ]
      },
      "precision": "exact",
      "references": [
        "https://cert.gov.ua/article/6318437"
      ],
      "total": 179
    },
    {
      "counts": {
        "domain": 13,
        "ipv4": 2
      },
      "first_seen": "2026-03-25",
      "indicators": {
        "domain": [
          "apidocs.ataas.cl",
          "checksystem.nl",
          "deltaexchange.net",
          "dontgivedamn.com",
          "dontgivefuck.com",
          "i2rgcvog6cypjohfzfzw3d5kqgoobkzlbchsdxx4gm7lyaxn5nfp6bid.onion",
          "massgrave.link",
          "mscloudedge.com",
          "n6b6j4vlkc4ak343j4fmuwmosxtwrft6bph5s5562lefji4a475smuad.onion",
          "ovhphpmyadmin.xtreme-vision.net",
          "smartscreenua.com",
          "sumbur.net",
          "xtreme-vision.net"
        ],
        "ipv4": [
          "146.59.116.226:50845",
          "57.128.59.134:24102"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/RexorVc0/status/2036703151303065880",
        "https://mp.weixin.qq.com/s?__biz=MzUyMjk4NzExMA==&mid=2247508035&idx=1&sn=4d58712823b2121714adf4edbea69f60&chksm=f9c1934aceb61a5c9f3a225a38ac04498862d4a49f7c1aeb76dd2c15ed572cd3fc667fa2b0f3&scene=178&cur_album_id=1955835290309230595&search_click_id"
      ],
      "total": 15
    },
    {
      "counts": {
        "domain": 4,
        "ipv4": 1,
        "url": 20,
        "url_path": 4
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "cdnauthsoft.com",
          "documentreader.net",
          "documents-reader.com",
          "object-storage-service.com"
        ],
        "ipv4": [
          "91.232.31.178:873"
        ],
        "url": [
          "adobeprotectcheck.com/Downloads/zayavka.lnk",
          "annualgieconferenceinmunich2024.com/Downloads/",
          "dobeprotectcheck.com/Downloads/",
          "ertel-audit.com/wp-includes/GIE_Annual_Conference_2024_Participant_Form.pdf",
          "ertel-audit.com/wp-includes/Zayava_pro_vitik_gasu.pdf",
          "ertel-audit.com/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEK.php",
          "ertel-audit.com/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEKb1.php",
          "furqaanenergy.com/wp-includes/Text/November/",
          "furqaanenergy.com/wp-includes/Text/November2/",
          "gieannualconferenceinmunich.com/Downloads/",
          "gurt.duna.ua/programy-nauczania/arst.dll",
          "helpdesk.katolik.bydgoszcz.pl/eliot.php",
          "http://212.237.217.78",
          "http://51.222.43.200",
          "http://66.63.187.79",
          "http://91.232.31.178",
          "protectraid.com/Downloads/",
          "protectraid.com/Downloads/Resume.lnk",
          "protectraid.com/Downloads/Resume.pdf.lnk",
          "protectraid.com/Downloads/VASY.lnk"
        ],
        "url_path": [
          "/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEK.php",
          "/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEKb1.php",
          "/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEK.php",
          "/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEKb1.php"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/byrne_emmy12099/status/1856178461515362623",
        "https://x.com/DaveLikesMalwre/status/1893691921995878762",
        "https://x.com/Cyber0verload/status/1893952471342428182",
        "https://cert.gov.ua/article/6282517",
        "https://www.virustotal.com/gui/file/36db27f5eb3343cfc72d261d78da44957a49cb6731acb50a96ea5694f4d616c5/detection",
        "https://www.virustotal.com/gui/file/d0a6c1f647ae9f21789bc12f88f00e44f0e92c77cb901f3f80da08b033aa9f36/detection",
        "https://www.virustotal.com/gui/file/baa76590f0917782ca070401feb83cf11ee001b644a4ef44219df81d4eb1ecb5/detection",
        "https://www.virustotal.com/gui/file/9507beb5f00ae19cbd3fc3ac74d761fd497d5e999abf5f6d4e2b3af30706389d/detection",
        "https://www.virustotal.com/gui/file/05285298ae543665503ab8880204607078f63fd87c10f966838aa6ee0325f222/detection",
        "https://www.virustotal.com/gui/file/0a2a18aac9f5683d4a65e402e22503d1b20a736d12ac71d0f1eff2f9bc0788a8/detection",
        "https://www.virustotal.com/gui/file/4a302c0ed3c47231bc7c34cf2d41bc0ceb60d9c7b0023df015f75a58853f43d2/detection"
      ],
      "total": 29
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "esetpremium.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/WhichbufferArda/status/1972012355983720623",
        "https://www.virustotal.com/gui/file/6472d2f027e25639b98381affdeb6932a82a530aa593198d6d85f99a1d74c114/detection",
        "https://www.virustotal.com/gui/file/a1b41f7ee862ee9703afda7793d22728e4f8fa571241520b97d523875d81333e/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "ipv4": [
          "150.107.31.194:18000"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/TLP_R3D/status/1892221224094445666",
        "https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "2zilmiystfbjib2k4hvhpnv2uhni4ax5ce4xlpb7swkjimfnszxbkaid.onion"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/TLP_R3D/status/1889627590970757502",
        "https://app.validin.com/detail?find=a78dda24e41edb22c214a4d5db1caf2671b5dff7&type=hash&ref_id=4c558f1ca34#tab=host_pairs (# 2025-02-12)",
        "https://app.validin.com/detail?find=dca40e790cd76198c6748dc8d5c90ee58d3f0f84&type=hash&ref_id=6ad15c0868a#tab=host_pairs (# 2025-02-12)",
        "https://blog.eclecticiq.com/sandworm-apt-targets-ukrainian-users-with-trojanized-microsoft-kms-activation-tools-in-cyber-espionage-campaigns"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1,
        "url": 1
      },
      "first_seen": "2025-02-13",
      "indicators": {
        "ipv4": [
          "103.201.129.130:443"
        ],
        "url": [
          "http://103.201.129.130"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/Now_on_VT/status/1889750562230407235",
        "https://x.com/BaoshengbinCumt/status/1889865641223659527",
        "https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 8,
        "url": 7
      },
      "first_seen": "2025-02-12",
      "indicators": {
        "domain": [
          "activationsmicrosoft.com",
          "kalambur.net",
          "kms-win11-update.net",
          "kmsupdate2023.com",
          "onedrivestandaloneupdater.com",
          "ratiborus2023.com",
          "windowsdrivepack.com",
          "windowsupdatesystem.org"
        ],
        "url": [
          "http://5.255.101.146",
          "http://5.255.114.16",
          "http://5.255.119.183",
          "http://5.255.119.195",
          "http://5.255.121.218",
          "http://5.255.122.118",
          "http://5.255.99.169"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/TLP_R3D/status/1889627590970757502",
        "https://app.validin.com/detail?find=a78dda24e41edb22c214a4d5db1caf2671b5dff7&type=hash&ref_id=4c558f1ca34#tab=host_pairs (# 2025-02-12)",
        "https://app.validin.com/detail?find=dca40e790cd76198c6748dc8d5c90ee58d3f0f84&type=hash&ref_id=6ad15c0868a#tab=host_pairs (# 2025-02-12)",
        "https://blog.eclecticiq.com/sandworm-apt-targets-ukrainian-users-with-trojanized-microsoft-kms-activation-tools-in-cyber-espionage-campaigns"
      ],
      "total": 15
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2025-02-12",
      "indicators": {
        "domain": [
          "cloud-sync.org",
          "hwupdates.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/Now_on_VT/status/1889750562230407235",
        "https://x.com/BaoshengbinCumt/status/1889865641223659527",
        "https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 11
      },
      "first_seen": "2024-12-18",
      "indicators": {
        "domain": [
          "aplusdesktop.workers.dev",
          "aplusmodgovua.workers.dev",
          "armylpus.workers.dev",
          "armyplus-desktop.workers.dev",
          "beta-0-110.armyplus-desktop.workers.dev",
          "beta-0-2237.desktopapluscom.workers.dev",
          "desktopaplus.workers.dev",
          "desktopapluscom.workers.dev",
          "old-lab-1001.armyplus-desktop.workers.dev",
          "wvtmsouaa2gt6jmcuxj5hkfrqdss5lhecoqijt5dl7gfruueu3i5mkad.onion",
          "yellow-butterfly-6fcd.armyplus-desktop.workers.dev"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1869210151439253673",
        "https://x.com/StrikeReadyLabs/status/1869359670290468993",
        "https://www.virustotal.com/gui/file/d2049157980b7ee0a54948d4def4ab62303ca51cadaada06fb51c583ecbce1a2/detection"
      ],
      "total": 11
    },
    {
      "counts": {
        "domain": 7,
        "url": 4
      },
      "first_seen": "2024-12-01",
      "indicators": {
        "domain": [
          "adobeprotectcheck.com",
          "annualgieconferenceinmunich2024.com",
          "antimailspam.com",
          "gieannualconferenceinmunich.com",
          "login.antimailspam.com",
          "protectconnections.com",
          "protectraid.com"
        ],
        "url": [
          "gurt.duna.ua/programy-nauczania/",
          "gurt.duna.ua/programy-nauczania/GIEAnnualConferenceStage2",
          "gurt.duna.ua/programy-nauczania/GTSvitikgasuStage5",
          "gurt.duna.ua/programy-nauczania/ssowoface.dll"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1847329950443184313",
        "https://strikeready.com/blog/ru-apt-targeting-energy-infrastructure-unknown-unknowns-part-3/",
        "https://www.virustotal.com/gui/file/b8d97d29e99e1f96e06836468db56855dc09305e3ed663c720fe700ea4bf6e73/detection",
        "https://www.virustotal.com/gui/file/806b5269e7aa9c2c82ce247b30a3e92a4f7285b21e2bcf54c8ffad86bd92ea68/detection"
      ],
      "total": 11
    },
    {
      "counts": {
        "url": 4
      },
      "first_seen": "2024-12-01",
      "indicators": {
        "url": [
          "afi-ukraine.org/wp-includes/bestone.php",
          "calendar.stib.com.ua/bestone.php",
          "ertel-audit.com/wp-includes/caramel.php",
          "helpdesk.katolik.bydgoszcz.pl/bydgoszcz.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1847329950443184313",
        "https://strikeready.com/blog/ru-apt-targeting-energy-infrastructure-unknown-unknowns-part-3/",
        "https://www.virustotal.com/gui/file/b8d97d29e99e1f96e06836468db56855dc09305e3ed663c720fe700ea4bf6e73/detection",
        "https://www.virustotal.com/gui/file/806b5269e7aa9c2c82ce247b30a3e92a4f7285b21e2bcf54c8ffad86bd92ea68/detection",
        "https://x.com/byrne_emmy12099/status/1856178461515362623",
        "https://x.com/DaveLikesMalwre/status/1893691921995878762",
        "https://x.com/Cyber0verload/status/1893952471342428182",
        "https://cert.gov.ua/article/6282517",
        "https://www.virustotal.com/gui/file/36db27f5eb3343cfc72d261d78da44957a49cb6731acb50a96ea5694f4d616c5/detection",
        "https://www.virustotal.com/gui/file/d0a6c1f647ae9f21789bc12f88f00e44f0e92c77cb901f3f80da08b033aa9f36/detection",
        "https://www.virustotal.com/gui/file/baa76590f0917782ca070401feb83cf11ee001b644a4ef44219df81d4eb1ecb5/detection",
        "https://www.virustotal.com/gui/file/9507beb5f00ae19cbd3fc3ac74d761fd497d5e999abf5f6d4e2b3af30706389d/detection",
        "https://www.virustotal.com/gui/file/05285298ae543665503ab8880204607078f63fd87c10f966838aa6ee0325f222/detection",
        "https://www.virustotal.com/gui/file/0a2a18aac9f5683d4a65e402e22503d1b20a736d12ac71d0f1eff2f9bc0788a8/detection",
        "https://www.virustotal.com/gui/file/4a302c0ed3c47231bc7c34cf2d41bc0ceb60d9c7b0023df015f75a58853f43d2/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "url": 2
      },
      "first_seen": "2024-11-13",
      "indicators": {
        "url": [
          "furqaanenergy.com/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEK.php",
          "furqaanenergy.com/wp-includes/b1tuZmhqZXJbaGZkYmdhbmFkZmhyZmEKb1.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/byrne_emmy12099/status/1856178461515362623",
        "https://x.com/DaveLikesMalwre/status/1893691921995878762",
        "https://x.com/Cyber0verload/status/1893952471342428182",
        "https://cert.gov.ua/article/6282517",
        "https://www.virustotal.com/gui/file/36db27f5eb3343cfc72d261d78da44957a49cb6731acb50a96ea5694f4d616c5/detection",
        "https://www.virustotal.com/gui/file/d0a6c1f647ae9f21789bc12f88f00e44f0e92c77cb901f3f80da08b033aa9f36/detection",
        "https://www.virustotal.com/gui/file/baa76590f0917782ca070401feb83cf11ee001b644a4ef44219df81d4eb1ecb5/detection",
        "https://www.virustotal.com/gui/file/9507beb5f00ae19cbd3fc3ac74d761fd497d5e999abf5f6d4e2b3af30706389d/detection",
        "https://www.virustotal.com/gui/file/05285298ae543665503ab8880204607078f63fd87c10f966838aa6ee0325f222/detection",
        "https://www.virustotal.com/gui/file/0a2a18aac9f5683d4a65e402e22503d1b20a736d12ac71d0f1eff2f9bc0788a8/detection",
        "https://www.virustotal.com/gui/file/4a302c0ed3c47231bc7c34cf2d41bc0ceb60d9c7b0023df015f75a58853f43d2/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 29
      },
      "first_seen": "2024-06-16",
      "indicators": {
        "domain": [
          "account-check.hostapp.link",
          "account.adfs.kyivstar.online",
          "accounts.google-account-settings.spdup.art",
          "adfs.kyivstar.online",
          "claud.in",
          "cloue.link",
          "darksea.ddns.net",
          "drive.google.com.filepreview.auth.userarea.click",
          "filepreview.auth.userarea.click",
          "google-account-settings.spdup.art",
          "i.ua.account-check.hostapp.link",
          "kyivstar.me",
          "kyivstar.online",
          "login.adfs.kyivstar.online",
          "login.kyivstar.online",
          "me-cloud.link",
          "nalog.in",
          "outlook.adfs.kyivstar.online",
          "solntsepek.com",
          "spdup.art",
          "telegramweb.us",
          "tgcloud.link",
          "tgeo.link",
          "tgme.contact",
          "tgset.click",
          "ua.account-check.hostapp.link",
          "ukrnet24.com",
          "xaknet.team",
          "yanoo.com.userarea.eu"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/DailyDarkWeb/status/1802234656039051511",
        "https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"
      ],
      "total": 29
    },
    {
      "counts": {
        "ipv4": 7,
        "url": 6
      },
      "first_seen": "2024-04-19",
      "indicators": {
        "ipv4": [
          "165.231.34.106:443",
          "178.250.188.114:443",
          "185.225.114.90:443",
          "194.61.121.211:443",
          "195.154.182.165:443",
          "196.245.156.154:443",
          "91.92.137.164:443"
        ],
        "url": [
          "http://178.250.188.114",
          "http://185.225.114.90",
          "http://194.61.121.211",
          "http://195.154.182.165",
          "http://196.245.156.154",
          "http://91.92.137.164"
        ]
      },
      "precision": "exact",
      "references": [
        "https://cert.gov.ua/article/6278706 (# UAC-0133)"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-08-29",
      "indicators": {
        "domain": [
          "knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/fr0s7_/status/1696485604630970879",
        "https://www.virustotal.com/gui/file/25497816b84a44be526c4cf048b53fe64118dbda5fdde45bdffe5ce3e2fe259f/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-08-10",
      "indicators": {
        "domain": [
          "dvjbn4sg4p1ck.cloudfront.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/felixw3000/status/1689541933062868992",
        "https://www.virustotal.com/gui/file/5ace35adeb360b9e165e7c55065d12f192a3ec0ca601dd73b332bd8cd68d51fe/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-08-04",
      "indicators": {
        "domain": [
          "knight3xppu263m7g4ag3xlit2qxpryjwueobh7vjdc3zrscqlfu3pqd.onion",
          "nt3rrzq5hcyznvdkpslvqbbc2jqecqrinhi5jtwoae2x7psqtcb6dcad.onion"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RakeshKrish12/status/1687344650963804160 (# Cyclops Ransomware group had discontinued their ops & rebranded themselves as \"Knight\" Group (Knight ransomware)!)"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2022-11-10",
      "indicators": {
        "ipv4": [
          "185.225.114.108:48765"
        ]
      },
      "precision": "exact",
      "references": [
        "https://cert.gov.ua/article/2698320 (Ukrainian, UAC-0133)"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2022-11-09",
      "indicators": {
        "ipv4": [
          "124.115.171.103:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Des00464472/status/1590213508423352320"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2022-09-19",
      "indicators": {
        "domain": [
          "darkett.ddns.net",
          "ett.ddns.net",
          "ett.hopto.org",
          "kievstar.online",
          "kyiv-star.ddns.net",
          "star-link.ddns.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RecordedFuture/status/1571946803427414016",
        "https://www.recordedfuture.com/russia-nexus-uac-0113-emulating-telecommunication-providers-in-ukraine"
      ],
      "total": 6
    },
    {
      "counts": {
        "ipv4": 8,
        "url": 9,
        "url_path": 12
      },
      "first_seen": "2022-08-06",
      "indicators": {
        "ipv4": [
          "146.0.74.7:443",
          "148.251.82.21:443",
          "188.40.8.72:443",
          "31.210.111.154:443",
          "41.77.136.250:443",
          "5.149.254.114:443",
          "5.9.32.230:443",
          "88.198.25.92:443"
        ],
        "url": [
          "http://146.0.74.7",
          "http://148.251.82.21",
          "http://188.40.8.72",
          "http://31.210.111.154",
          "http://41.77.136.250",
          "http://5.149.254.114",
          "http://5.9.32.230",
          "http://88.198.25.92",
          "http://95.211.122.36"
        ],
        "url_path": [
          "/Microsoft/Update/KC074913.php",
          "/Microsoft/Update/KS081274.php",
          "/Microsoft/Update/KS1945777.php",
          "/Microsoft/Update/KS4567890.php",
          "/eegL7p.php",
          "/fHKfvEhleQ/",
          "/fHKfvEhleQ/maincraft/",
          "/fHKfvEhleQ/maincraft/derstatus.php",
          "/l7vogLG/BVZ99/",
          "/l7vogLG/BVZ99/rt170v/",
          "/l7vogLG/BVZ99/rt170v/solocVI/",
          "/l7vogLG/BVZ99/rt170v/solocVI/eegL7p.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://cys-centrum.com/ru/news/black_energy_2_3 (Russian)"
      ],
      "total": 29
    },
    {
      "counts": {
        "ipv4": 1,
        "url": 2
      },
      "first_seen": "2022-08-06",
      "indicators": {
        "ipv4": [
          "46.165.222.28:443"
        ],
        "url": [
          "http://46.165.222.28",
          "http://94.185.85.122"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/"
      ],
      "total": 3
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2022-08-06",
      "indicators": {
        "url": [
          "http://193.239.152.131"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.welivesecurity.com/2016/01/20/new-wave-attacks-ukrainian-power-industry/",
        "https://www.virustotal.com/gui/ip-address/193.239.152.131/relations",
        "https://www.virustotal.com/gui/file/43b69a81693488905ef655d22e395c3f8dee2486aba976d571d3b12433d10c93/detection",
        "https://www.virustotal.com/gui/file/0bb5e98f77e69d85bf5068bcbc5b5876f8e5855d34d9201d1caffbf83460cccc/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-06-27",
      "indicators": {
        "domain": [
          "star-cz.ddns.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RecordedFuture/status/1571946803427414016",
        "https://www.recordedfuture.com/russia-nexus-uac-0113-emulating-telecommunication-providers-in-ukraine"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2022-06-10",
      "indicators": {
        "ipv4": [
          "185.80.92.143:8998",
          "87.236.161.43:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://cert.gov.ua/article/160530 (Ukrainian)"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 2,
        "url": 2
      },
      "first_seen": "2022-04-16",
      "indicators": {
        "ipv4": [
          "195.230.23.19:443",
          "91.245.255.243:443"
        ],
        "url": [
          "http://195.230.23.19",
          "http://91.245.255.243"
        ]
      },
      "precision": "exact",
      "references": [
        "https://cert.gov.ua/article/39518 (Ukranian)",
        "https://otx.alienvault.com/pulse/62552abdd7e44d9aba08636d"
      ],
      "total": 4
    },
    {
      "counts": {
        "ipv4": 176
      },
      "first_seen": "2022-04-06",
      "indicators": {
        "ipv4": [
          "100.43.220.234:3269",
          "100.43.220.234:636",
          "100.43.220.234:8443",
          "100.43.220.234:989",
          "100.43.220.234:990",
          "100.43.220.234:994",
          "100.43.220.234:995",
          "100.43.220.234:996",
          "105.159.248.137:3269",
          "105.159.248.137:636",
          "105.159.248.137:8443",
          "105.159.248.137:989",
          "105.159.248.137:990",
          "105.159.248.137:994",
          "105.159.248.137:995",
          "105.159.248.137:996",
          "109.192.30.125:3269",
          "109.192.30.125:636",
          "109.192.30.125:8443",
          "109.192.30.125:989",
          "109.192.30.125:990",
          "109.192.30.125:994",
          "109.192.30.125:995",
          "109.192.30.125:996",
          "151.0.169.250:3269",
          "151.0.169.250:636",
          "151.0.169.250:8443",
          "151.0.169.250:989",
          "151.0.169.250:990",
          "151.0.169.250:994",
          "151.0.169.250:995",
          "151.0.169.250:996",
          "185.82.169.99:3269",
          "185.82.169.99:636",
          "185.82.169.99:8443",
          "185.82.169.99:989",
          "185.82.169.99:990",
          "185.82.169.99:994",
          "185.82.169.99:995",
          "185.82.169.99:996",
          "188.152.254.170:3269",
          "188.152.254.170:636",
          "188.152.254.170:8443",
          "188.152.254.170:989",
          "188.152.254.170:990",
          "188.152.254.170:994",
          "188.152.254.170:995",
          "188.152.254.170:996",
          "2.230.110.137:3269",
          "2.230.110.137:636",
          "2.230.110.137:8443",
          "2.230.110.137:989",
          "2.230.110.137:990",
          "2.230.110.137:994",
          "2.230.110.137:995",
          "2.230.110.137:996",
          "208.81.37.50:3269",
          "208.81.37.50:636",
          "208.81.37.50:8443",
          "208.81.37.50:989",
          "208.81.37.50:990",
          "208.81.37.50:994",
          "208.81.37.50:995",
          "208.81.37.50:996",
          "212.103.208.182:3269",
          "212.103.208.182:636",
          "212.103.208.182:8443",
          "212.103.208.182:989",
          "212.103.208.182:990",
          "212.103.208.182:994",
          "212.103.208.182:995",
          "212.103.208.182:996",
          "212.202.147.10:3269",
          "212.202.147.10:636",
          "212.202.147.10:8443",
          "212.202.147.10:989",
          "212.202.147.10:990",
          "212.202.147.10:994",
          "212.202.147.10:995",
          "212.202.147.10:996",
          "212.234.179.113:3269",
          "212.234.179.113:636",
          "212.234.179.113:8443",
          "212.234.179.113:989",
          "212.234.179.113:990",
          "212.234.179.113:994",
          "212.234.179.113:995",
          "212.234.179.113:996",
          "24.199.247.222:3269",
          "24.199.247.222:636",
          "24.199.247.222:8443",
          "24.199.247.222:989",
          "24.199.247.222:990",
          "24.199.247.222:994",
          "24.199.247.222:995",
          "24.199.247.222:996",
          "37.99.163.162:3269",
          "37.99.163.162:636",
          "37.99.163.162:8443",
          "37.99.163.162:989",
          "37.99.163.162:990",
          "37.99.163.162:994",
          "37.99.163.162:995",
          "37.99.163.162:996",
          "50.255.126.65:3269",
          "50.255.126.65:636",
          "50.255.126.65:8443",
          "50.255.126.65:989",
          "50.255.126.65:990",
          "50.255.126.65:994",
          "50.255.126.65:995",
          "50.255.126.65:996",
          "70.62.153.174:3269",
          "70.62.153.174:636",
          "70.62.153.174:8443",
          "70.62.153.174:989",
          "70.62.153.174:990",
          "70.62.153.174:994",
          "70.62.153.174:995",
          "70.62.153.174:996",
          "78.134.89.167:3269",
          "78.134.89.167:636",
          "78.134.89.167:8443",
          "78.134.89.167:989",
          "78.134.89.167:990",
          "78.134.89.167:994",
          "78.134.89.167:995",
          "78.134.89.167:996",
          "80.15.113.188:3269",
          "80.15.113.188:636",
          "80.15.113.188:8443",
          "80.15.113.188:989",
          "80.15.113.188:990",
          "80.15.113.188:994",
          "80.15.113.188:995",
          "80.15.113.188:996",
          "80.153.75.103:3269",
          "80.153.75.103:636",
          "80.153.75.103:8443",
          "80.153.75.103:989",
          "80.153.75.103:990",
          "80.153.75.103:994",
          "80.153.75.103:995",
          "80.153.75.103:996",
          "80.155.38.210:3269",
          "80.155.38.210:636",
          "80.155.38.210:8443",
          "80.155.38.210:989",
          "80.155.38.210:990",
          "80.155.38.210:994",
          "80.155.38.210:995",
          "80.155.38.210:996",
          "81.4.177.118:3269",
          "81.4.177.118:636",
          "81.4.177.118:8443",
          "81.4.177.118:989",
          "81.4.177.118:990",
          "81.4.177.118:994",
          "81.4.177.118:995",
          "81.4.177.118:996",
          "90.63.245.175:3269",
          "90.63.245.175:636",
          "90.63.245.175:8443",
          "90.63.245.175:989",
          "90.63.245.175:990",
          "90.63.245.175:994",
          "90.63.245.175:995",
          "90.63.245.175:996",
          "93.51.177.66:3269",
          "93.51.177.66:636",
          "93.51.177.66:8443",
          "93.51.177.66:989",
          "93.51.177.66:990",
          "93.51.177.66:994",
          "93.51.177.66:995",
          "93.51.177.66:996"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf"
      ],
      "total": 176
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2022-04-06",
      "indicators": {
        "ipv4": [
          "102.50.244.205:995"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html",
        "https://otx.alienvault.com/pulse/623319918d3021c70ec8f396"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 188
      },
      "first_seen": "2022-03-17",
      "indicators": {
        "ipv4": [
          "1.9.85.247:3269",
          "1.9.85.247:636",
          "1.9.85.247:8443",
          "1.9.85.247:989",
          "1.9.85.247:990",
          "1.9.85.247:994",
          "1.9.85.247:995",
          "1.9.85.248:3269",
          "1.9.85.248:636",
          "1.9.85.248:8443",
          "1.9.85.248:989",
          "1.9.85.248:990",
          "1.9.85.248:994",
          "1.9.85.248:995",
          "1.9.85.249:3269",
          "1.9.85.249:636",
          "1.9.85.249:8443",
          "1.9.85.249:989",
          "1.9.85.249:990",
          "1.9.85.249:994",
          "1.9.85.249:995",
          "1.9.85.252:3269",
          "1.9.85.252:636",
          "1.9.85.252:8443",
          "1.9.85.252:989",
          "1.9.85.252:990",
          "1.9.85.252:994",
          "1.9.85.252:995",
          "1.9.85.253:3269",
          "1.9.85.253:636",
          "1.9.85.253:8443",
          "1.9.85.253:989",
          "1.9.85.253:990",
          "1.9.85.253:994",
          "1.9.85.253:995",
          "1.9.85.254:3269",
          "1.9.85.254:636",
          "1.9.85.254:8443",
          "1.9.85.254:989",
          "1.9.85.254:990",
          "1.9.85.254:994",
          "1.9.85.254:995",
          "102.50.244.205:3269",
          "102.50.244.205:636",
          "102.50.244.205:8443",
          "102.50.244.205:989",
          "102.50.244.205:990",
          "102.50.244.205:994",
          "148.76.89.2:3269",
          "148.76.89.2:636",
          "148.76.89.2:8443",
          "148.76.89.2:989",
          "148.76.89.2:990",
          "148.76.89.2:994",
          "148.76.89.2:995",
          "148.76.89.3:3269",
          "148.76.89.3:636",
          "148.76.89.3:8443",
          "148.76.89.3:989",
          "148.76.89.3:990",
          "148.76.89.3:994",
          "148.76.89.3:995",
          "148.76.89.4:3269",
          "148.76.89.4:636",
          "148.76.89.4:8443",
          "148.76.89.4:989",
          "148.76.89.4:990",
          "148.76.89.4:994",
          "148.76.89.4:995",
          "148.76.89.5:3269",
          "148.76.89.5:636",
          "148.76.89.5:8443",
          "148.76.89.5:989",
          "148.76.89.5:990",
          "148.76.89.5:994",
          "148.76.89.5:995",
          "148.76.89.6:3269",
          "148.76.89.6:636",
          "148.76.89.6:8443",
          "148.76.89.6:989",
          "148.76.89.6:990",
          "148.76.89.6:994",
          "148.76.89.6:995",
          "151.0.185.146:3269",
          "151.0.185.146:636",
          "151.0.185.146:8443",
          "151.0.185.146:989",
          "151.0.185.146:990",
          "151.0.185.146:994",
          "151.0.185.146:995",
          "151.0.185.147:3269",
          "151.0.185.147:636",
          "151.0.185.147:8443",
          "151.0.185.147:989",
          "151.0.185.147:990",
          "151.0.185.147:994",
          "151.0.185.147:995",
          "151.0.185.148:3269",
          "151.0.185.148:636",
          "151.0.185.148:8443",
          "151.0.185.148:989",
          "151.0.185.148:990",
          "151.0.185.148:994",
          "151.0.185.148:995",
          "151.0.185.149:3269",
          "151.0.185.149:636",
          "151.0.185.149:8443",
          "151.0.185.149:989",
          "151.0.185.149:990",
          "151.0.185.149:994",
          "151.0.185.149:995",
          "151.0.185.150:3269",
          "151.0.185.150:636",
          "151.0.185.150:8443",
          "151.0.185.150:989",
          "151.0.185.150:990",
          "151.0.185.150:994",
          "151.0.185.150:995",
          "182.73.50.114:3269",
          "182.73.50.114:636",
          "182.73.50.114:8443",
          "182.73.50.114:989",
          "182.73.50.114:990",
          "182.73.50.114:994",
          "182.73.50.114:995",
          "182.73.50.115:3269",
          "182.73.50.115:636",
          "182.73.50.115:8443",
          "182.73.50.115:989",
          "182.73.50.115:990",
          "182.73.50.115:994",
          "182.73.50.115:995",
          "217.57.80.18:3269",
          "217.57.80.18:636",
          "217.57.80.18:8443",
          "217.57.80.18:989",
          "217.57.80.18:990",
          "217.57.80.18:994",
          "217.57.80.18:995",
          "37.71.147.186:3269",
          "37.71.147.186:636",
          "37.71.147.186:8443",
          "37.71.147.186:989",
          "37.71.147.186:990",
          "37.71.147.186:994",
          "37.71.147.186:995",
          "50.192.49.210:3269",
          "50.192.49.210:636",
          "50.192.49.210:8443",
          "50.192.49.210:989",
          "50.192.49.210:990",
          "50.192.49.210:994",
          "50.192.49.210:995",
          "96.80.68.193:3269",
          "96.80.68.193:636",
          "96.80.68.193:8443",
          "96.80.68.193:989",
          "96.80.68.193:990",
          "96.80.68.193:994",
          "96.80.68.193:995",
          "96.80.68.194:3269",
          "96.80.68.194:636",
          "96.80.68.194:8443",
          "96.80.68.194:989",
          "96.80.68.194:990",
          "96.80.68.194:994",
          "96.80.68.194:995",
          "96.80.68.195:3269",
          "96.80.68.195:636",
          "96.80.68.195:8443",
          "96.80.68.195:989",
          "96.80.68.195:990",
          "96.80.68.195:994",
          "96.80.68.195:995",
          "96.80.68.196:3269",
          "96.80.68.196:636",
          "96.80.68.196:8443",
          "96.80.68.196:989",
          "96.80.68.196:990",
          "96.80.68.196:994",
          "96.80.68.196:995",
          "96.80.68.197:3269",
          "96.80.68.197:636",
          "96.80.68.197:8443",
          "96.80.68.197:989",
          "96.80.68.197:990",
          "96.80.68.197:994",
          "96.80.68.197:995"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html",
        "https://otx.alienvault.com/pulse/623319918d3021c70ec8f396"
      ],
      "total": 188
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2020-10-05",
      "indicators": {
        "domain": [
          "fbapp.info",
          "fbapp.link",
          "fbapp.top",
          "myaccount.click",
          "myaccount.one",
          "userarea.in",
          "userarea.top",
          "userzone.eu",
          "userzone.one",
          "webcache.one"
        ]
      },
      "precision": "exact",
      "references": [
        "https://threatconnect.com/blog/threatconnect-research-roundup-probable-sandworm-infrastructure/"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2020-06-03",
      "indicators": {
        "domain": [
          "userarea.click",
          "userarea.eu"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/kyleehmke/status/1267222198588145664",
        "https://threatconnect.com/blog/threatconnect-research-roundup-probable-sandworm-infrastructure/"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 2
      },
      "first_seen": "2020-05-29",
      "indicators": {
        "domain": [
          "hostapp.be"
        ],
        "ipv4": [
          "95.216.13.196:53",
          "95.216.13.196:8080"
        ]
      },
      "precision": "exact",
      "references": [
        "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf",
        "https://www.virustotal.com/gui/file/dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2019-11-22",
      "indicators": {
        "domain": [
          "account-googlmail.ml",
          "account-loginserv.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/185.80.53.22/relations"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2018-10-12",
      "indicators": {
        "domain": [
          "esetsmart.org",
          "um10eset.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.welivesecurity.com/2018/10/11/new-telebots-backdoor-linking-industroyer-notpetya/"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2016-03-09",
      "indicators": {
        "domain": [
          "all-invite.org",
          "sharp.mcdir.ru"
        ]
      },
      "precision": "exact",
      "references": [
        "https://web.archive.org/web/20120106212034/http://amada.abuse.ch/blocklist.php?download=domainblocklist"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 18
      },
      "first_seen": "2016-02-24",
      "indicators": {
        "domain": [
          "abaronaweb.net",
          "ads.ew.com.cn",
          "aut0mat.info",
          "bka.im",
          "cazino-game.com",
          "cxim.asia",
          "ddumasz.info",
          "globdomain.ru",
          "hackzona.tk",
          "jakkaru.ru",
          "k0x.ru",
          "kandagarka.net",
          "myprodjs.ru",
          "olololo.in",
          "onlinejobsnet.co.cc",
          "prava-servise.ru",
          "webprofiler.cc",
          "write-dream.ru"
        ]
      },
      "precision": "exact",
      "references": [
        "https://web.archive.org/web/20120106212034/http://amada.abuse.ch/blocklist.php?download=domainblocklist"
      ],
      "total": 18
    }
  ]
}