{
  "aliases": [
    "rare werewolf"
  ],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 310,
    "ipv4": 1
  },
  "first_seen": {
    "domain": {
      "4t-niagara.com": "2026-02-19",
      "4tniagara.com": "2026-02-19",
      "9mmenergy.biz": "2026-06-25",
      "accouts-verification.ru": "2024-12-21",
      "acountservices.nl": "2026-01-02",
      "acountservices.online": "2024-12-21",
      "aemiliuszathe.nl": "2026-02-19",
      "aeternus.be": "2026-02-19",
      "alcor-as.com": "2026-02-19",
      "allroundvideomedia.nl": "2026-02-19",
      "almaz-aero.site": "2026-02-19",
      "amaryllisclinic.nl": "2026-06-25",
      "amorapersoneel.nl": "2026-02-19",
      "anyhostings.ru": "2026-01-02",
      "anyinfos.ru": "2026-01-02",
      "aoffices.ru": "2026-02-19",
      "ardensonlineconsultancyfirm.com": "2026-06-25",
      "artichi.be": "2026-06-25",
      "artonlinemarketing.nl": "2026-06-25",
      "autodegroenehoek.nl": "2026-02-19",
      "autoopkoperbenny.be": "2026-02-19",
      "autotificate.com": "2026-02-19",
      "aviatronika.online": "2026-06-25",
      "barbershopwbd.nl": "2026-02-19",
      "batwoman-fashion.nl": "2026-02-19",
      "beeldspraakfotografie.nl": "2026-02-19",
      "berkelgame.com": "2026-02-19",
      "bewustopvoedenenbegeleiden.com": "2026-06-25",
      "bharatsingh-logistics.nl": "2026-02-19",
      "biesbeauty.nl": "2026-02-19",
      "bijbelseexpressie.nl": "2026-06-25",
      "blijlekkernij.nl": "2026-02-19",
      "bloomakay.be": "2026-02-19",
      "bmapps.org": "2026-01-02",
      "boefjes.nl": "2026-02-19",
      "boelit-pvlog.be": "2026-02-19",
      "bouwwerkennoten.be": "2026-02-19",
      "broodjesboutique.nl": "2026-02-19",
      "bulletpointband.com": "2026-06-25",
      "cafestationskoffiehuis.nl": "2026-02-19",
      "camperbilly.nl": "2026-02-19",
      "camperreiseuropa.nl": "2026-02-19",
      "careforhealing.com": "2026-02-19",
      "cc-int.online": "2026-06-25",
      "center-mail.ru": "2026-01-02",
      "choosingchange.nl": "2026-02-19",
      "cirkelvoordeelshop.nl": "2026-02-19",
      "claud-mail.ru": "2026-01-02",
      "climatexperts.be": "2026-02-19",
      "codevalley.nl": "2026-02-19",
      "dagboekvaneenoverlever.nl": "2026-02-19",
      "dakzaken.nl": "2026-02-19",
      "daniel-stunnenberg.nl": "2026-02-19",
      "danonnapinuccia.nl": "2026-02-19",
      "datagiants.be": "2026-02-19",
      "daydrinkingdisco.com": "2026-02-19",
      "deauthorization.online": "2024-12-21",
      "deboswachteramsterdam.nl": "2026-02-19",
      "dedienstenpraktijk.nl": "2026-02-19",
      "degrotewebwinkel.nl": "2026-06-25",
      "dennisbaptist.com": "2026-02-19",
      "dentaldegroenehoek.nl": "2026-02-19",
      "denux.nl": "2026-02-19",
      "derksenadvocatuur.nl": "2026-02-19",
      "detectis.ru": "2024-12-21",
      "dev-techniek.nl": "2026-06-25",
      "deverstandigeraadgever.nl": "2026-02-19",
      "digitalbulls.nl": "2026-02-19",
      "digitalplanit.nl": "2026-02-19",
      "doacare.nl": "2026-02-19",
      "doacarethuiszorg.nl": "2026-02-19",
      "donbosco-wijnegem.be": "2026-02-19",
      "dooperprojects.nl": "2026-02-19",
      "dorpsplatformlinschoten.nl": "2026-06-25",
      "downdown.ru": "2026-01-02",
      "dragonfires.ru": "2026-01-02",
      "drunken-bumble.be": "2026-02-19",
      "drzabaleta.com": "2026-02-19",
      "dv-personenvervoer.be": "2026-02-19",
      "eclipsettt.eu": "2026-06-25",
      "ecoshelter.be": "2026-02-19",
      "edses.com": "2026-02-19",
      "eetsmakelijketulp.nl": "2026-02-19",
      "email-informer.ru": "2024-12-21",
      "email-office.ru": "2026-01-02",
      "email-rembler.ru": "2026-02-19",
      "emailoff.ru": "2026-02-19",
      "emailoffice.ru": "2026-02-19",
      "emailon.ru": "2026-02-19",
      "empiremuziek.nl": "2026-02-19",
      "etnicom.nl": "2026-02-19",
      "exz-warehousing.nl": "2026-02-19",
      "fgub-vniir.ph": "2026-06-25",
      "fgub-vniir.space": "2026-06-25",
      "fidelfloris.eu": "2026-02-19",
      "fidelfloris.nl": "2026-02-19",
      "flytechaviationgroup.com": "2026-06-25",
      "forukrainians.eu": "2026-06-25",
      "frontend.fr.po21.net": "2026-02-19",
      "ftfinancial.nl": "2026-06-25",
      "fysio-bos.nl": "2026-02-19",
      "fysiobos.nl": "2026-02-19",
      "gijsrijbewijs.nl": "2026-02-19",
      "girell.nl": "2026-06-25",
      "greensane.nl": "2026-02-19",
      "groen-atelier.nl": "2026-02-19",
      "guafbouw.nl": "2026-02-19",
      "haxaria.com": "2026-02-19",
      "hcsloop.online": "2026-06-25",
      "heemkundekringcranendonck.nl": "2026-02-19",
      "heerenveenpadel.nl": "2026-02-19",
      "hekkenwerk.be": "2026-02-19",
      "helene-schotman.nl": "2026-02-19",
      "herstelhub.com": "2026-02-19",
      "hetdigitaalcollectief.nl": "2026-02-19",
      "hildemetz.be": "2026-02-19",
      "hondengedragverbeteren.nl": "2026-02-19",
      "horseteam.nl": "2026-02-19",
      "hostingforme.nl": "2024-12-21",
      "hpsysteemplafond.nl": "2026-02-19",
      "huibertsbodemadvies.nl": "2026-02-19",
      "hulp-in-huis.be": "2026-02-19",
      "hulpbijzoekmachineoptimalisatie.nl": "2026-06-25",
      "hverstappen.nl": "2026-02-19",
      "hvkshop.site": "2026-06-25",
      "hyperbolae.studio": "2026-02-19",
      "infojdl-holding.be": "2026-02-19",
      "infojdl-holding.com": "2026-02-19",
      "infojdl-holding.eu": "2026-02-19",
      "infojdl-investment.be": "2026-02-19",
      "infojdl-investment.com": "2026-02-19",
      "infojdl-investment.eu": "2026-02-19",
      "infojdl-realestate.be": "2026-02-19",
      "infojdl-realestate.com": "2026-02-19",
      "infojdl-realestate.eu": "2026-02-19",
      "ingridtenbrink.nl": "2026-02-19",
      "internostyling.nl": "2026-02-19",
      "ip211.ip-94-23-158.eu": "2026-02-19",
      "jaapvermeulen.com": "2026-02-19",
      "janacle.be": "2026-02-19",
      "jepevents.nl": "2026-02-19",
      "jmltermeer.nl": "2026-02-19",
      "jobbink.nl": "2026-02-19",
      "jodaniels.photography": "2026-02-19",
      "johannahuiberts.nl": "2026-02-19",
      "justicedrinks.nl": "2026-02-19",
      "jvepatisserie.nl": "2026-02-19",
      "kermisclub.nl": "2026-02-19",
      "ketelstechnics.be": "2026-02-19",
      "kinected.nl": "2026-02-19",
      "kinected.org": "2026-02-19",
      "kingkool.nl": "2026-02-19",
      "kismanstudio.nl": "2026-02-19",
      "koerdischnieuws.nl": "2026-02-19",
      "kooldesign.eu": "2026-02-19",
      "krazychickenz.com": "2026-02-19",
      "laarbeeksetuinen.nl": "2026-02-19",
      "lafaimtoujours.be": "2026-02-19",
      "lafemmefatale.nl": "2026-02-19",
      "langenhandelsonderneming.nl": "2026-02-19",
      "leaderfitdevelopment.com": "2026-02-19",
      "lillyharen.nl": "2026-06-25",
      "limedesign.eu": "2026-06-25",
      "livelozzp.nl": "2026-02-19",
      "lotseventmanagement.nl": "2026-02-19",
      "luxzuz.fashion": "2026-02-19",
      "lxb-solutions.site": "2026-06-25",
      "maartenornstein.com": "2026-02-19",
      "madelenevanulden.com": "2026-02-19",
      "mail-cheker.nl": "2026-01-02",
      "mail-rambler.ru": "2026-02-19",
      "mail-rembler.ru": "2026-02-19",
      "mail.vniir.nl": "2026-01-02",
      "matthewbaker.nl": "2026-02-19",
      "mealprepgemak.nl": "2026-02-19",
      "metis-digital.nl": "2026-06-25",
      "michelharmsen.nl": "2026-02-19",
      "mijnkeur.nl": "2026-06-25",
      "mkboudoir.nl": "2026-06-25",
      "modesocieteit.nl": "2026-02-19",
      "mofice.store": "2026-02-19",
      "music4youraalte.nl": "2026-02-19",
      "my-stepup.be": "2026-02-19",
      "nagelsalon-pellegrino.nl": "2026-06-25",
      "natuurlijk-sophie.nl": "2026-02-19",
      "nazaro-catering.nl": "2026-02-19",
      "nehirvloeren.nl": "2026-02-19",
      "nericards.nl": "2026-02-19",
      "neurofeedbackdrenthe.nl": "2026-02-19",
      "nickyonderwater.com": "2026-02-19",
      "nieland.eu": "2026-02-19",
      "nieuw.jodaniels.photography": "2026-02-19",
      "noordloom.com": "2026-02-19",
      "nosuhealth.com": "2026-02-19",
      "nova-stream.site": "2026-06-25",
      "office-account.ru": "2024-12-21",
      "office-email.ru": "2026-01-02",
      "onbelast-bijverdienen.be": "2026-02-19",
      "ont-zien.nl": "2026-02-19",
      "ontwerpstudiospanjaard.com": "2026-02-19",
      "outinfo.ru": "2026-01-02",
      "paulineottenhof.nl": "2026-06-25",
      "paulissenwitgoed.nl": "2026-06-25",
      "pdns-17-04-25.nl": "2026-02-19",
      "pedicuremolenlanden.nl": "2026-02-19",
      "pietersperspectief.nl": "2026-02-19",
      "povmgmt.com": "2026-02-19",
      "purplegrape.be": "2026-02-19",
      "qinformer.ru": "2026-02-19",
      "qqoffice.ru": "2026-02-19",
      "qqqoffice.ru": "2026-02-19",
      "quaakpotatobv.nl": "2026-02-19",
      "quizthet.nl": "2026-02-19",
      "raf-infrabouw.nl": "2026-02-19",
      "rankconsultant.be": "2026-02-19",
      "realysemarketing.nl": "2026-02-19",
      "recomfort.nl": "2026-02-19",
      "redaction-voenmeh.info": "2026-01-02",
      "rentvacationhousecostablanca.nl": "2026-02-19",
      "reworn.nl": "2026-06-25",
      "rijschoolameland.nl": "2026-02-19",
      "rijschoolbelbas.nl": "2026-02-19",
      "rubiamoone.nl": "2026-02-19",
      "rubicom-media.com": "2026-02-19",
      "sanderskeus.nl": "2026-06-25",
      "sandersmodelbouw.nl": "2026-06-25",
      "schildersbedrijfdanielvedder.nl": "2026-06-25",
      "seniorenorkestamstelland.nl": "2026-02-19",
      "shinemarketing.nl": "2026-02-19",
      "skidusoleil.com": "2026-06-25",
      "skynexaviation.com": "2026-06-25",
      "smulthuis.nl": "2026-02-19",
      "snijderstotaalonderhoud.nl": "2026-06-25",
      "sonnenberg-bpo.nl": "2026-02-19",
      "sopraan.info": "2026-02-19",
      "start-rambler.help": "2026-02-19",
      "stickonthings.be": "2026-02-19",
      "studiostylez.nl": "2026-02-19",
      "supersuit.site": "2026-01-02",
      "teleklantenservice.nl": "2026-02-19",
      "test2646243.nl": "2026-02-19",
      "theitnails.nl": "2026-06-25",
      "thesoos.nl": "2026-02-19",
      "thomasbruil.nl": "2026-02-19",
      "timeanddecission.nl": "2026-02-19",
      "toevallige-ontmoetingen.nl": "2026-02-19",
      "toffice.site": "2026-02-19",
      "tofice.space": "2026-02-19",
      "toomonkeys.com": "2026-02-19",
      "toothfairyproductions.nl": "2026-02-19",
      "touchedbytouch.be": "2026-02-19",
      "tremv.nl": "2026-02-19",
      "trustedsecondopinions.com": "2026-02-19",
      "trustedsecondopinions.nl": "2026-02-19",
      "tuinenvanpost.nl": "2026-02-19",
      "twinshairstyling.nl": "2026-02-19",
      "uitzendbureaustartpunt.nl": "2026-06-25",
      "unifikator.ru": "2026-01-02",
      "user-mail.ru": "2026-02-19",
      "user-rembler.ru": "2026-02-19",
      "users-mail.ru": "2026-01-02",
      "users-office.ru": "2026-02-19",
      "users-offices.ru": "2026-02-19",
      "vanbesienbvba.be": "2026-02-19",
      "vas-verbeek.eu": "2026-02-19",
      "vds-a.be": "2026-02-19",
      "verhuisbedrijfkiezer.online": "2026-06-25",
      "verhuisgarantkeurmerk.nl": "2026-02-19",
      "verificationc.nl": "2024-12-21",
      "verificationc.online": "2024-12-21",
      "verifikations.ru": "2024-12-21",
      "villalegrandbleu.nl": "2026-02-19",
      "visadirect.eu": "2026-02-19",
      "vitasmovingandcars.nl": "2026-06-25",
      "vniir-admin.site": "2026-06-25",
      "vniir-avia.space": "2026-06-25",
      "vniir-buh.site": "2026-06-25",
      "vniir-center.space": "2026-06-25",
      "vniir-info.jm": "2026-06-25",
      "vniir-info.site": "2026-06-25",
      "vniir-info.space": "2026-06-25",
      "vniir-info.website": "2026-06-25",
      "vniir-kadr.online": "2026-06-25",
      "vniir-monitor.space": "2026-06-25",
      "vniir-reception.site": "2026-06-25",
      "vniir.nl": "2026-01-02",
      "vniir.space": "2026-01-02",
      "vrijstelling5b.nl": "2026-02-19",
      "vshlholding.online": "2026-06-25",
      "wackogeckogame.store": "2026-02-19",
      "wattmore.nl": "2026-02-19",
      "wdagroup.nl": "2026-02-19",
      "webmade.be": "2026-06-25",
      "webshopdegroenehoek.nl": "2026-02-19",
      "werkenbijvanaalsburg.com": "2026-02-19",
      "wijsopitreis.nl": "2026-06-25",
      "wijzerinmantelzorgen.nl": "2026-06-25",
      "wimcollectie.com": "2026-02-19",
      "windan.be": "2026-02-19",
      "winformation.ru": "2026-02-19",
      "woffice.top": "2026-02-19",
      "woningverhuizers.com": "2026-06-25",
      "wordpressverhuizen.nl": "2026-02-19",
      "wpt-diensten.nl": "2026-02-19",
      "yourecho.be": "2026-02-19",
      "zaakgeslotenlichtuit.nl": "2026-02-19",
      "zaeyen.com": "2026-06-25",
      "zanji.vision": "2026-02-19",
      "zelfuitvinders.nl": "2026-02-19",
      "ziggo0189386.nl": "2026-02-19"
    },
    "ipv4": {
      "92.63.173.61:587": "2026-01-02"
    }
  },
  "first_seen_precision": {
    "domain": {
      "acountservices.nl": "at-or-before",
      "anyhostings.ru": "at-or-before",
      "anyinfos.ru": "at-or-before",
      "bmapps.org": "at-or-before",
      "center-mail.ru": "at-or-before",
      "claud-mail.ru": "at-or-before",
      "downdown.ru": "at-or-before",
      "dragonfires.ru": "at-or-before",
      "email-office.ru": "at-or-before",
      "mail-cheker.nl": "at-or-before",
      "mail.vniir.nl": "at-or-before",
      "office-email.ru": "at-or-before",
      "outinfo.ru": "at-or-before",
      "redaction-voenmeh.info": "at-or-before",
      "supersuit.site": "at-or-before",
      "unifikator.ru": "at-or-before",
      "users-mail.ru": "at-or-before",
      "vniir.nl": "at-or-before",
      "vniir.space": "at-or-before"
    },
    "ipv4": {
      "92.63.173.61:587": "at-or-before"
    }
  },
  "first_seen_range": {
    "earliest": "2024-12-21",
    "latest": "2026-06-25"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "4t-niagara.com",
      "4tniagara.com",
      "9mmenergy.biz",
      "accouts-verification.ru",
      "acountservices.nl",
      "acountservices.online",
      "aemiliuszathe.nl",
      "aeternus.be",
      "alcor-as.com",
      "allroundvideomedia.nl",
      "almaz-aero.site",
      "amaryllisclinic.nl",
      "amorapersoneel.nl",
      "anyhostings.ru",
      "anyinfos.ru",
      "aoffices.ru",
      "ardensonlineconsultancyfirm.com",
      "artichi.be",
      "artonlinemarketing.nl",
      "autodegroenehoek.nl",
      "autoopkoperbenny.be",
      "autotificate.com",
      "aviatronika.online",
      "barbershopwbd.nl",
      "batwoman-fashion.nl",
      "beeldspraakfotografie.nl",
      "berkelgame.com",
      "bewustopvoedenenbegeleiden.com",
      "bharatsingh-logistics.nl",
      "biesbeauty.nl",
      "bijbelseexpressie.nl",
      "blijlekkernij.nl",
      "bloomakay.be",
      "bmapps.org",
      "boefjes.nl",
      "boelit-pvlog.be",
      "bouwwerkennoten.be",
      "broodjesboutique.nl",
      "bulletpointband.com",
      "cafestationskoffiehuis.nl",
      "camperbilly.nl",
      "camperreiseuropa.nl",
      "careforhealing.com",
      "cc-int.online",
      "center-mail.ru",
      "choosingchange.nl",
      "cirkelvoordeelshop.nl",
      "claud-mail.ru",
      "climatexperts.be",
      "codevalley.nl",
      "dagboekvaneenoverlever.nl",
      "dakzaken.nl",
      "daniel-stunnenberg.nl",
      "danonnapinuccia.nl",
      "datagiants.be",
      "daydrinkingdisco.com",
      "deauthorization.online",
      "deboswachteramsterdam.nl",
      "dedienstenpraktijk.nl",
      "degrotewebwinkel.nl",
      "dennisbaptist.com",
      "dentaldegroenehoek.nl",
      "denux.nl",
      "derksenadvocatuur.nl",
      "detectis.ru",
      "dev-techniek.nl",
      "deverstandigeraadgever.nl",
      "digitalbulls.nl",
      "digitalplanit.nl",
      "doacare.nl",
      "doacarethuiszorg.nl",
      "donbosco-wijnegem.be",
      "dooperprojects.nl",
      "dorpsplatformlinschoten.nl",
      "downdown.ru",
      "dragonfires.ru",
      "drunken-bumble.be",
      "drzabaleta.com",
      "dv-personenvervoer.be",
      "eclipsettt.eu",
      "ecoshelter.be",
      "edses.com",
      "eetsmakelijketulp.nl",
      "email-informer.ru",
      "email-office.ru",
      "email-rembler.ru",
      "emailoff.ru",
      "emailoffice.ru",
      "emailon.ru",
      "empiremuziek.nl",
      "etnicom.nl",
      "exz-warehousing.nl",
      "fgub-vniir.ph",
      "fgub-vniir.space",
      "fidelfloris.eu",
      "fidelfloris.nl",
      "flytechaviationgroup.com",
      "forukrainians.eu",
      "frontend.fr.po21.net",
      "ftfinancial.nl",
      "fysio-bos.nl",
      "fysiobos.nl",
      "gijsrijbewijs.nl",
      "girell.nl",
      "greensane.nl",
      "groen-atelier.nl",
      "guafbouw.nl",
      "haxaria.com",
      "hcsloop.online",
      "heemkundekringcranendonck.nl",
      "heerenveenpadel.nl",
      "hekkenwerk.be",
      "helene-schotman.nl",
      "herstelhub.com",
      "hetdigitaalcollectief.nl",
      "hildemetz.be",
      "hondengedragverbeteren.nl",
      "horseteam.nl",
      "hostingforme.nl",
      "hpsysteemplafond.nl",
      "huibertsbodemadvies.nl",
      "hulp-in-huis.be",
      "hulpbijzoekmachineoptimalisatie.nl",
      "hverstappen.nl",
      "hvkshop.site",
      "hyperbolae.studio",
      "infojdl-holding.be",
      "infojdl-holding.com",
      "infojdl-holding.eu",
      "infojdl-investment.be",
      "infojdl-investment.com",
      "infojdl-investment.eu",
      "infojdl-realestate.be",
      "infojdl-realestate.com",
      "infojdl-realestate.eu",
      "ingridtenbrink.nl",
      "internostyling.nl",
      "ip211.ip-94-23-158.eu",
      "jaapvermeulen.com",
      "janacle.be",
      "jepevents.nl",
      "jmltermeer.nl",
      "jobbink.nl",
      "jodaniels.photography",
      "johannahuiberts.nl",
      "justicedrinks.nl",
      "jvepatisserie.nl",
      "kermisclub.nl",
      "ketelstechnics.be",
      "kinected.nl",
      "kinected.org",
      "kingkool.nl",
      "kismanstudio.nl",
      "koerdischnieuws.nl",
      "kooldesign.eu",
      "krazychickenz.com",
      "laarbeeksetuinen.nl",
      "lafaimtoujours.be",
      "lafemmefatale.nl",
      "langenhandelsonderneming.nl",
      "leaderfitdevelopment.com",
      "lillyharen.nl",
      "limedesign.eu",
      "livelozzp.nl",
      "lotseventmanagement.nl",
      "luxzuz.fashion",
      "lxb-solutions.site",
      "maartenornstein.com",
      "madelenevanulden.com",
      "mail-cheker.nl",
      "mail-rambler.ru",
      "mail-rembler.ru",
      "mail.vniir.nl",
      "matthewbaker.nl",
      "mealprepgemak.nl",
      "metis-digital.nl",
      "michelharmsen.nl",
      "mijnkeur.nl",
      "mkboudoir.nl",
      "modesocieteit.nl",
      "mofice.store",
      "music4youraalte.nl",
      "my-stepup.be",
      "nagelsalon-pellegrino.nl",
      "natuurlijk-sophie.nl",
      "nazaro-catering.nl",
      "nehirvloeren.nl",
      "nericards.nl",
      "neurofeedbackdrenthe.nl",
      "nickyonderwater.com",
      "nieland.eu",
      "nieuw.jodaniels.photography",
      "noordloom.com",
      "nosuhealth.com",
      "nova-stream.site",
      "office-account.ru",
      "office-email.ru",
      "onbelast-bijverdienen.be",
      "ont-zien.nl",
      "ontwerpstudiospanjaard.com",
      "outinfo.ru",
      "paulineottenhof.nl",
      "paulissenwitgoed.nl",
      "pdns-17-04-25.nl",
      "pedicuremolenlanden.nl",
      "pietersperspectief.nl",
      "povmgmt.com",
      "purplegrape.be",
      "qinformer.ru",
      "qqoffice.ru",
      "qqqoffice.ru",
      "quaakpotatobv.nl",
      "quizthet.nl",
      "raf-infrabouw.nl",
      "rankconsultant.be",
      "realysemarketing.nl",
      "recomfort.nl",
      "redaction-voenmeh.info",
      "rentvacationhousecostablanca.nl",
      "reworn.nl",
      "rijschoolameland.nl",
      "rijschoolbelbas.nl",
      "rubiamoone.nl",
      "rubicom-media.com",
      "sanderskeus.nl",
      "sandersmodelbouw.nl",
      "schildersbedrijfdanielvedder.nl",
      "seniorenorkestamstelland.nl",
      "shinemarketing.nl",
      "skidusoleil.com",
      "skynexaviation.com",
      "smulthuis.nl",
      "snijderstotaalonderhoud.nl",
      "sonnenberg-bpo.nl",
      "sopraan.info",
      "start-rambler.help",
      "stickonthings.be",
      "studiostylez.nl",
      "supersuit.site",
      "teleklantenservice.nl",
      "test2646243.nl",
      "theitnails.nl",
      "thesoos.nl",
      "thomasbruil.nl",
      "timeanddecission.nl",
      "toevallige-ontmoetingen.nl",
      "toffice.site",
      "tofice.space",
      "toomonkeys.com",
      "toothfairyproductions.nl",
      "touchedbytouch.be",
      "tremv.nl",
      "trustedsecondopinions.com",
      "trustedsecondopinions.nl",
      "tuinenvanpost.nl",
      "twinshairstyling.nl",
      "uitzendbureaustartpunt.nl",
      "unifikator.ru",
      "user-mail.ru",
      "user-rembler.ru",
      "users-mail.ru",
      "users-office.ru",
      "users-offices.ru",
      "vanbesienbvba.be",
      "vas-verbeek.eu",
      "vds-a.be",
      "verhuisbedrijfkiezer.online",
      "verhuisgarantkeurmerk.nl",
      "verificationc.nl",
      "verificationc.online",
      "verifikations.ru",
      "villalegrandbleu.nl",
      "visadirect.eu",
      "vitasmovingandcars.nl",
      "vniir-admin.site",
      "vniir-avia.space",
      "vniir-buh.site",
      "vniir-center.space",
      "vniir-info.jm",
      "vniir-info.site",
      "vniir-info.space",
      "vniir-info.website",
      "vniir-kadr.online",
      "vniir-monitor.space",
      "vniir-reception.site",
      "vniir.nl",
      "vniir.space",
      "vrijstelling5b.nl",
      "vshlholding.online",
      "wackogeckogame.store",
      "wattmore.nl",
      "wdagroup.nl",
      "webmade.be",
      "webshopdegroenehoek.nl",
      "werkenbijvanaalsburg.com",
      "wijsopitreis.nl",
      "wijzerinmantelzorgen.nl",
      "wimcollectie.com",
      "windan.be",
      "winformation.ru",
      "woffice.top",
      "woningverhuizers.com",
      "wordpressverhuizen.nl",
      "wpt-diensten.nl",
      "yourecho.be",
      "zaakgeslotenlichtuit.nl",
      "zaeyen.com",
      "zanji.vision",
      "zelfuitvinders.nl",
      "ziggo0189386.nl"
    ],
    "ipv4": [
      "92.63.173.61:587"
    ]
  },
  "last_modified": "2026-06-25T11:12:10+00:00",
  "maltrail_groups": [
    "LIBRARIANGHOULS"
  ],
  "references": [
    "https://app.validin.com/detail?find=89.110.65.154&type=ip4&ref_id=e41544d48ff#tab=resolutions",
    "https://securelist.com/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto/116536/",
    "https://www.kaspersky.ru/blog/librarian-ghouls-cad-formats/38199/",
    "https://www.kaspersky.ru/blog/malicious-mailout-scr-attachment/37823/",
    "https://www.virustotal.com/gui/file/02e49ad0d589b463a5dae39e81ff6c4151b2b9baca366ede566a5c0829a75d84/detection",
    "https://www.virustotal.com/gui/file/26a632f35e4382310044085b7f0e94fb5cd47f30ace588f7fceef9283a26a54a/detection",
    "https://www.virustotal.com/gui/file/2d4943980d751e6551ca04be73d5443359cde2e1ee142ff35ab1c9e84c105f56/detection",
    "https://www.virustotal.com/gui/file/96c7ba19beef1a314a3575f250872dde5b61a82674abdc3508009179292b806f/detection",
    "https://www.virustotal.com/gui/ip-address/109.107.176.232/relations",
    "https://x.com/AUZombie/status/2004528083723047319",
    "https://x.com/PrakkiSathwik/status/2024500406274154503",
    "https://x.com/askardyuss/status/2070084108118556868"
  ],
  "related": [],
  "slug": "LIBRARIANGHOULS",
  "timeline": [
    {
      "counts": {
        "domain": 44
      },
      "first_seen": "2026-06-25",
      "indicators": {
        "domain": [
          "9mmenergy.biz",
          "amaryllisclinic.nl",
          "ardensonlineconsultancyfirm.com",
          "artichi.be",
          "artonlinemarketing.nl",
          "bewustopvoedenenbegeleiden.com",
          "bijbelseexpressie.nl",
          "bulletpointband.com",
          "cc-int.online",
          "degrotewebwinkel.nl",
          "dev-techniek.nl",
          "dorpsplatformlinschoten.nl",
          "eclipsettt.eu",
          "forukrainians.eu",
          "ftfinancial.nl",
          "girell.nl",
          "hcsloop.online",
          "hulpbijzoekmachineoptimalisatie.nl",
          "hvkshop.site",
          "lillyharen.nl",
          "limedesign.eu",
          "lxb-solutions.site",
          "metis-digital.nl",
          "mijnkeur.nl",
          "mkboudoir.nl",
          "nagelsalon-pellegrino.nl",
          "paulineottenhof.nl",
          "paulissenwitgoed.nl",
          "reworn.nl",
          "sanderskeus.nl",
          "sandersmodelbouw.nl",
          "schildersbedrijfdanielvedder.nl",
          "skidusoleil.com",
          "snijderstotaalonderhoud.nl",
          "theitnails.nl",
          "uitzendbureaustartpunt.nl",
          "verhuisbedrijfkiezer.online",
          "vitasmovingandcars.nl",
          "vshlholding.online",
          "webmade.be",
          "wijsopitreis.nl",
          "wijzerinmantelzorgen.nl",
          "woningverhuizers.com",
          "zaeyen.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.kaspersky.ru/blog/malicious-mailout-scr-attachment/37823/",
        "https://www.kaspersky.ru/blog/librarian-ghouls-cad-formats/38199/",
        "https://app.validin.com/detail?find=89.110.65.154&type=ip4&ref_id=e41544d48ff#tab=resolutions",
        "https://www.virustotal.com/gui/file/2d4943980d751e6551ca04be73d5443359cde2e1ee142ff35ab1c9e84c105f56/detection",
        "https://www.virustotal.com/gui/file/02e49ad0d589b463a5dae39e81ff6c4151b2b9baca366ede566a5c0829a75d84/detection",
        "https://www.virustotal.com/gui/file/26a632f35e4382310044085b7f0e94fb5cd47f30ace588f7fceef9283a26a54a/detection"
      ],
      "total": 44
    },
    {
      "counts": {
        "domain": 17
      },
      "first_seen": "2026-06-25",
      "indicators": {
        "domain": [
          "aviatronika.online",
          "fgub-vniir.ph",
          "fgub-vniir.space",
          "flytechaviationgroup.com",
          "nova-stream.site",
          "skynexaviation.com",
          "vniir-admin.site",
          "vniir-avia.space",
          "vniir-buh.site",
          "vniir-center.space",
          "vniir-info.jm",
          "vniir-info.site",
          "vniir-info.space",
          "vniir-info.website",
          "vniir-kadr.online",
          "vniir-monitor.space",
          "vniir-reception.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/askardyuss/status/2070084108118556868"
      ],
      "total": 17
    },
    {
      "counts": {
        "domain": 194
      },
      "first_seen": "2026-02-19",
      "indicators": {
        "domain": [
          "aemiliuszathe.nl",
          "aeternus.be",
          "alcor-as.com",
          "allroundvideomedia.nl",
          "amorapersoneel.nl",
          "autodegroenehoek.nl",
          "autoopkoperbenny.be",
          "barbershopwbd.nl",
          "batwoman-fashion.nl",
          "beeldspraakfotografie.nl",
          "berkelgame.com",
          "bharatsingh-logistics.nl",
          "biesbeauty.nl",
          "blijlekkernij.nl",
          "bloomakay.be",
          "boefjes.nl",
          "boelit-pvlog.be",
          "bouwwerkennoten.be",
          "broodjesboutique.nl",
          "cafestationskoffiehuis.nl",
          "camperbilly.nl",
          "camperreiseuropa.nl",
          "careforhealing.com",
          "choosingchange.nl",
          "cirkelvoordeelshop.nl",
          "climatexperts.be",
          "codevalley.nl",
          "dagboekvaneenoverlever.nl",
          "dakzaken.nl",
          "daniel-stunnenberg.nl",
          "danonnapinuccia.nl",
          "datagiants.be",
          "daydrinkingdisco.com",
          "deboswachteramsterdam.nl",
          "dedienstenpraktijk.nl",
          "dennisbaptist.com",
          "dentaldegroenehoek.nl",
          "denux.nl",
          "derksenadvocatuur.nl",
          "deverstandigeraadgever.nl",
          "digitalbulls.nl",
          "digitalplanit.nl",
          "doacare.nl",
          "doacarethuiszorg.nl",
          "donbosco-wijnegem.be",
          "dooperprojects.nl",
          "drunken-bumble.be",
          "drzabaleta.com",
          "dv-personenvervoer.be",
          "ecoshelter.be",
          "edses.com",
          "eetsmakelijketulp.nl",
          "empiremuziek.nl",
          "etnicom.nl",
          "exz-warehousing.nl",
          "fidelfloris.eu",
          "fidelfloris.nl",
          "fysio-bos.nl",
          "fysiobos.nl",
          "gijsrijbewijs.nl",
          "greensane.nl",
          "groen-atelier.nl",
          "guafbouw.nl",
          "haxaria.com",
          "heemkundekringcranendonck.nl",
          "heerenveenpadel.nl",
          "hekkenwerk.be",
          "helene-schotman.nl",
          "herstelhub.com",
          "hetdigitaalcollectief.nl",
          "hildemetz.be",
          "hondengedragverbeteren.nl",
          "horseteam.nl",
          "hpsysteemplafond.nl",
          "huibertsbodemadvies.nl",
          "hulp-in-huis.be",
          "hverstappen.nl",
          "hyperbolae.studio",
          "infojdl-holding.be",
          "infojdl-holding.com",
          "infojdl-holding.eu",
          "infojdl-investment.be",
          "infojdl-investment.com",
          "infojdl-investment.eu",
          "infojdl-realestate.be",
          "infojdl-realestate.com",
          "infojdl-realestate.eu",
          "ingridtenbrink.nl",
          "internostyling.nl",
          "jaapvermeulen.com",
          "janacle.be",
          "jepevents.nl",
          "jmltermeer.nl",
          "jobbink.nl",
          "jodaniels.photography",
          "johannahuiberts.nl",
          "justicedrinks.nl",
          "jvepatisserie.nl",
          "kermisclub.nl",
          "ketelstechnics.be",
          "kinected.nl",
          "kinected.org",
          "kingkool.nl",
          "kismanstudio.nl",
          "koerdischnieuws.nl",
          "kooldesign.eu",
          "krazychickenz.com",
          "laarbeeksetuinen.nl",
          "lafaimtoujours.be",
          "lafemmefatale.nl",
          "langenhandelsonderneming.nl",
          "leaderfitdevelopment.com",
          "livelozzp.nl",
          "lotseventmanagement.nl",
          "luxzuz.fashion",
          "maartenornstein.com",
          "madelenevanulden.com",
          "matthewbaker.nl",
          "mealprepgemak.nl",
          "michelharmsen.nl",
          "modesocieteit.nl",
          "music4youraalte.nl",
          "my-stepup.be",
          "natuurlijk-sophie.nl",
          "nazaro-catering.nl",
          "nehirvloeren.nl",
          "nericards.nl",
          "neurofeedbackdrenthe.nl",
          "nickyonderwater.com",
          "nieland.eu",
          "nieuw.jodaniels.photography",
          "noordloom.com",
          "nosuhealth.com",
          "onbelast-bijverdienen.be",
          "ont-zien.nl",
          "ontwerpstudiospanjaard.com",
          "pdns-17-04-25.nl",
          "pedicuremolenlanden.nl",
          "pietersperspectief.nl",
          "povmgmt.com",
          "purplegrape.be",
          "quaakpotatobv.nl",
          "quizthet.nl",
          "raf-infrabouw.nl",
          "rankconsultant.be",
          "realysemarketing.nl",
          "recomfort.nl",
          "rentvacationhousecostablanca.nl",
          "rijschoolameland.nl",
          "rijschoolbelbas.nl",
          "rubiamoone.nl",
          "rubicom-media.com",
          "seniorenorkestamstelland.nl",
          "shinemarketing.nl",
          "smulthuis.nl",
          "sonnenberg-bpo.nl",
          "sopraan.info",
          "stickonthings.be",
          "studiostylez.nl",
          "teleklantenservice.nl",
          "test2646243.nl",
          "thesoos.nl",
          "thomasbruil.nl",
          "timeanddecission.nl",
          "toevallige-ontmoetingen.nl",
          "toomonkeys.com",
          "toothfairyproductions.nl",
          "touchedbytouch.be",
          "tremv.nl",
          "trustedsecondopinions.com",
          "trustedsecondopinions.nl",
          "tuinenvanpost.nl",
          "twinshairstyling.nl",
          "vanbesienbvba.be",
          "vas-verbeek.eu",
          "vds-a.be",
          "verhuisgarantkeurmerk.nl",
          "villalegrandbleu.nl",
          "visadirect.eu",
          "vrijstelling5b.nl",
          "wackogeckogame.store",
          "wattmore.nl",
          "wdagroup.nl",
          "webshopdegroenehoek.nl",
          "werkenbijvanaalsburg.com",
          "wimcollectie.com",
          "windan.be",
          "wordpressverhuizen.nl",
          "wpt-diensten.nl",
          "yourecho.be",
          "zaakgeslotenlichtuit.nl",
          "zanji.vision",
          "zelfuitvinders.nl",
          "ziggo0189386.nl"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.kaspersky.ru/blog/malicious-mailout-scr-attachment/37823/",
        "https://www.kaspersky.ru/blog/librarian-ghouls-cad-formats/38199/",
        "https://app.validin.com/detail?find=89.110.65.154&type=ip4&ref_id=e41544d48ff#tab=resolutions",
        "https://www.virustotal.com/gui/file/2d4943980d751e6551ca04be73d5443359cde2e1ee142ff35ab1c9e84c105f56/detection",
        "https://www.virustotal.com/gui/file/02e49ad0d589b463a5dae39e81ff6c4151b2b9baca366ede566a5c0829a75d84/detection",
        "https://www.virustotal.com/gui/file/26a632f35e4382310044085b7f0e94fb5cd47f30ace588f7fceef9283a26a54a/detection"
      ],
      "total": 194
    },
    {
      "counts": {
        "domain": 25
      },
      "first_seen": "2026-02-19",
      "indicators": {
        "domain": [
          "4t-niagara.com",
          "4tniagara.com",
          "almaz-aero.site",
          "aoffices.ru",
          "email-rembler.ru",
          "emailoff.ru",
          "emailoffice.ru",
          "emailon.ru",
          "frontend.fr.po21.net",
          "ip211.ip-94-23-158.eu",
          "mail-rambler.ru",
          "mail-rembler.ru",
          "mofice.store",
          "qinformer.ru",
          "qqoffice.ru",
          "qqqoffice.ru",
          "start-rambler.help",
          "toffice.site",
          "tofice.space",
          "user-mail.ru",
          "user-rembler.ru",
          "users-office.ru",
          "users-offices.ru",
          "winformation.ru",
          "woffice.top"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/PrakkiSathwik/status/2024500406274154503",
        "https://www.virustotal.com/gui/ip-address/109.107.176.232/relations"
      ],
      "total": 25
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-02-19",
      "indicators": {
        "domain": [
          "autotificate.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.kaspersky.ru/blog/malicious-mailout-scr-attachment/37823/",
        "https://www.kaspersky.ru/blog/librarian-ghouls-cad-formats/38199/",
        "https://app.validin.com/detail?find=89.110.65.154&type=ip4&ref_id=e41544d48ff#tab=resolutions",
        "https://www.virustotal.com/gui/file/2d4943980d751e6551ca04be73d5443359cde2e1ee142ff35ab1c9e84c105f56/detection",
        "https://www.virustotal.com/gui/file/02e49ad0d589b463a5dae39e81ff6c4151b2b9baca366ede566a5c0829a75d84/detection",
        "https://www.virustotal.com/gui/file/26a632f35e4382310044085b7f0e94fb5cd47f30ace588f7fceef9283a26a54a/detection",
        "https://x.com/PrakkiSathwik/status/2024500406274154503",
        "https://www.virustotal.com/gui/ip-address/109.107.176.232/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 18
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "acountservices.nl",
          "anyhostings.ru",
          "anyinfos.ru",
          "bmapps.org",
          "center-mail.ru",
          "claud-mail.ru",
          "downdown.ru",
          "dragonfires.ru",
          "email-office.ru",
          "mail-cheker.nl",
          "office-email.ru",
          "outinfo.ru",
          "redaction-voenmeh.info",
          "supersuit.site",
          "unifikator.ru",
          "users-mail.ru",
          "vniir.nl",
          "vniir.space"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://securelist.com/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto/116536/"
      ],
      "total": 18
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mail.vniir.nl"
        ],
        "ipv4": [
          "92.63.173.61:587"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/AUZombie/status/2004528083723047319",
        "https://www.virustotal.com/gui/file/96c7ba19beef1a314a3575f250872dde5b61a82674abdc3508009179292b806f/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2024-12-21",
      "indicators": {
        "domain": [
          "accouts-verification.ru",
          "acountservices.online",
          "deauthorization.online",
          "detectis.ru",
          "email-informer.ru",
          "hostingforme.nl",
          "office-account.ru",
          "verificationc.nl",
          "verificationc.online",
          "verifikations.ru"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.kaspersky.ru/blog/malicious-mailout-scr-attachment/37823/",
        "https://www.kaspersky.ru/blog/librarian-ghouls-cad-formats/38199/",
        "https://app.validin.com/detail?find=89.110.65.154&type=ip4&ref_id=e41544d48ff#tab=resolutions",
        "https://www.virustotal.com/gui/file/2d4943980d751e6551ca04be73d5443359cde2e1ee142ff35ab1c9e84c105f56/detection",
        "https://www.virustotal.com/gui/file/02e49ad0d589b463a5dae39e81ff6c4151b2b9baca366ede566a5c0829a75d84/detection",
        "https://www.virustotal.com/gui/file/26a632f35e4382310044085b7f0e94fb5cd47f30ace588f7fceef9283a26a54a/detection"
      ],
      "total": 10
    }
  ]
}