{
  "aliases": [
    "hydra saiga",
    "shadowsilk"
  ],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 251,
    "ipv4": 23,
    "url": 9,
    "url_path": 1
  },
  "first_seen": {
    "domain": {
      "accessibleneats.com": "2025-01-24",
      "accttechllc.com": "2025-01-24",
      "adm-govuz.com": "2026-01-02",
      "admin.inboxsession.info": "2026-01-02",
      "akcloud.top": "2025-01-24",
      "akersolutoins.com": "2025-01-24",
      "alandyh.com": "2025-01-24",
      "albertinamachinery.com": "2025-01-24",
      "alfhjdumnsulhuehs.com": "2025-01-27",
      "allcloudindex.com": "2026-01-02",
      "allocco-ar.com": "2025-01-24",
      "alpine-hosokawa.net": "2025-01-24",
      "altendorf-de.com": "2025-01-24",
      "annons.info": "2025-01-24",
      "arableaguenews.com": "2025-01-24",
      "arpimportnl.com": "2025-01-24",
      "asdnwakalet.net": "2025-01-24",
      "asmtld.com": "2025-01-24",
      "atomicenergylab.com": "2025-01-24",
      "auth.allcloudindex.com": "2026-01-02",
      "authmailinbox.com": "2025-01-24",
      "ax47tui83.com": "2025-01-24",
      "aydemirtek.com": "2025-01-24",
      "babblnipresses.com": "2025-01-24",
      "bencoconstructionsllc.com": "2025-01-24",
      "bestdomblog.com": "2025-01-24",
      "bestmartsolutions.com": "2025-01-24",
      "bestunif.com": "2025-01-24",
      "bluemoono.com": "2025-01-24",
      "brainytask.tech": "2025-01-24",
      "brandxoffice.com": "2025-01-24",
      "breuing-irco.com": "2025-01-24",
      "brindley-medical.com": "2025-01-24",
      "cae-gruope.com": "2025-01-24",
      "cairo-day-trips.com": "2025-01-24",
      "caprnatic.com": "2025-01-24",
      "catalog-update-update-microsoft.serveftp.com": "2026-01-02",
      "catchthestorms.net": "2025-01-24",
      "check-connection.org": "2025-01-24",
      "checkingsite.org": "2025-01-24",
      "citylinefood.com": "2025-01-24",
      "cm-elevatori.com": "2025-01-24",
      "cmcrushermachine.com": "2025-01-24",
      "colombaogrobg.com": "2025-01-24",
      "consultafacildoc.com": "2025-01-24",
      "consultasfacildoc.com": "2025-01-24",
      "converting-system.com": "2025-01-24",
      "csiwoffshore.com": "2025-01-24",
      "datosdecuit.com": "2025-01-24",
      "dl-keepass.info": "2025-01-24",
      "dmgrnori.com": "2025-01-24",
      "dmsplasts.com": "2025-01-24",
      "document.hometowncity.cloud": "2025-01-24",
      "document.mailboxarea.cloud": "2026-01-02",
      "document.webmailsession.com": "2026-01-02",
      "docworldme.com": "2026-01-02",
      "downloadmailbox.com": "2025-01-24",
      "e-egov.com": "2025-01-24",
      "eaglesxv.com": "2025-01-24",
      "eco-prozestechnik.com": "2025-01-24",
      "eew-groups.com": "2025-01-24",
      "elcomen.com": "2025-01-24",
      "elike-rne.com": "2025-01-24",
      "elinkexpressltd.com": "2025-01-24",
      "elldrissi.com": "2025-01-24",
      "elpisitsinc.com": "2025-01-24",
      "emails-cloud.com": "2026-01-02",
      "emiratom.com": "2025-01-24",
      "emsilgroups.com": "2025-01-24",
      "enigmaaxis.com": "2025-01-24",
      "envolvesearch.com": "2025-01-24",
      "estaterlea.com": "2025-01-24",
      "etori.info": "2025-01-24",
      "etunabilar.com": "2025-01-24",
      "ex.wincorpupdates.com": "2026-01-02",
      "field-tec.org": "2025-01-24",
      "filecenter.online": "2026-03-16",
      "filereader.online": "2026-03-16",
      "filfilter-tr.com": "2025-01-24",
      "filorep.com": "2025-01-24",
      "fob-au.com": "2025-01-24",
      "garmorgan.com": "2025-01-24",
      "gdrr.info": "2025-01-24",
      "geanew.com": "2025-01-24",
      "geniwatit.com": "2025-01-24",
      "genmac-it.com": "2025-01-24",
      "globa-space.com": "2025-01-24",
      "globexgruop.com": "2025-01-24",
      "gmvtest9.ddns.net": "2026-01-02",
      "goodbabiynt.com": "2025-01-24",
      "greeentom.com": "2025-01-24",
      "gsbplataforma.com": "2025-01-24",
      "guidolingiroto.com": "2025-01-24",
      "gvfimpainti.com": "2025-01-24",
      "gynovetylesc.com": "2025-01-24",
      "hamzagill.com": "2025-01-24",
      "harrellc.com": "2025-01-24",
      "henigworldwide.com": "2025-01-24",
      "hgbeerequipment-uk.com": "2025-01-24",
      "hi053.info": "2025-01-24",
      "hidrogarnes.com": "2025-01-24",
      "hometowncity.cloud": "2025-01-24",
      "hpfrugt.com": "2025-01-24",
      "hsb-it.com": "2025-01-24",
      "husmanin-web.com": "2025-01-24",
      "hydrocleariservices.com": "2025-01-24",
      "inbox.docworldme.com": "2026-01-02",
      "inboxoid.com": "2025-01-24",
      "inboxsession.info": "2026-01-02",
      "interger.org": "2025-01-24",
      "investmentsfor.com": "2025-01-24",
      "j-tiec.com": "2025-01-24",
      "jeetu.club": "2025-01-24",
      "jeetu.global": "2025-01-24",
      "jeetu.me": "2025-01-24",
      "jonesproduces.com": "2025-01-24",
      "jskhcdiueslnin.com": "2025-01-24",
      "juargen-escher.com": "2025-01-24",
      "k670.info": "2025-01-24",
      "khu3x.info": "2025-01-24",
      "kingikolok.ignorelist.com": "2026-01-02",
      "kovis-groups.com": "2025-01-24",
      "kss-sap.com": "2025-01-24",
      "kycountynews.com": "2025-01-24",
      "l161.info": "2025-01-24",
      "ledsf.com": "2025-01-24",
      "lnciner8.com": "2025-01-24",
      "lnteracservice.in": "2025-01-24",
      "lnteracservices.com": "2025-01-24",
      "loftinequlp.com": "2025-01-24",
      "lophjgihh.com": "2025-01-24",
      "luada-technology.com": "2025-01-24",
      "lutz-purnpen.com": "2025-01-24",
      "lyndexrceycling.com": "2025-01-24",
      "m339.info": "2025-01-24",
      "magnitudeconsults.com": "2025-01-24",
      "magnumiserviceslp.com": "2025-01-24",
      "mail-sanly.filecenter.online": "2026-03-16",
      "mail-sanly.filereader.online": "2026-03-16",
      "mailboxarea.cloud": "2026-01-02",
      "mailboxdownload.com": "2025-01-24",
      "mailkeyboard.com": "2025-01-24",
      "maill.ddns.net": "2026-01-02",
      "mailruinbox.com": "2025-01-24",
      "mansoorhabibdoost.com": "2025-01-24",
      "maquinadelmal.duckdns.org": "2026-01-02",
      "masonindustries-sg.com": "2025-01-24",
      "matast.com": "2025-01-24",
      "message.mailboxarea.cloud": "2026-01-02",
      "michlot.org": "2025-01-24",
      "miecal.com": "2025-01-24",
      "mininnovationuz.com": "2025-01-24",
      "miyako-securities.com": "2025-01-24",
      "mlutibeias.com": "2025-01-24",
      "mosreg.docworldme.com": "2026-01-02",
      "mozoil-llc.com": "2025-01-24",
      "mprecisionsgrinding.com": "2025-01-24",
      "mqmuk.com": "2025-01-24",
      "mrwallpaper.net": "2025-01-24",
      "multinedia-connect.com": "2025-01-24",
      "mvfglobai.com": "2025-01-24",
      "mxdnxlove.com": "2025-01-24",
      "mypreciousdomainer.net": "2025-01-24",
      "myunistars.com": "2025-01-24",
      "navtechsradar.com": "2025-01-24",
      "ncspares-za.com": "2025-01-24",
      "newscode.net": "2025-01-24",
      "ngmex.org": "2025-01-24",
      "oakcreekapples.com": "2025-01-24",
      "officelabelsonline.com": "2025-01-24",
      "officewithyou.com": "2025-01-24",
      "onlinefinancenews.com": "2025-01-24",
      "onurtektsil.com": "2025-01-24",
      "openpdfllc.com": "2026-01-02",
      "ormac-it.com": "2025-01-24",
      "ozfarmnews.com": "2025-01-24",
      "partincpas.com": "2025-01-24",
      "piasskowanie.net": "2025-01-24",
      "pp731.info": "2025-01-24",
      "productddon.com": "2025-01-24",
      "psbvip.com": "2025-01-24",
      "pweobmxdlboi.com": "2025-01-24",
      "q-10c.com": "2025-01-24",
      "q1q.ddns.net": "2026-01-02",
      "qazmarinefuel.com": "2025-01-24",
      "qswl.org": "2025-01-24",
      "qwadx.com": "2026-01-02",
      "ravemia.com": "2025-01-24",
      "realialebrewing.com": "2025-01-24",
      "reginachian.net": "2025-01-24",
      "registermydomainagain.top": "2025-01-24",
      "releasedatestory.com": "2025-01-24",
      "reynco.co": "2025-01-24",
      "reyncos.com": "2025-01-24",
      "rinbid.com": "2025-01-24",
      "rotomabe.com": "2025-01-24",
      "sasafetty.com": "2025-01-24",
      "sdzgw.org": "2025-01-24",
      "secfatsbily.com": "2025-01-24",
      "segrez.com": "2025-01-24",
      "shuchonafoods.com": "2025-01-24",
      "smartwebgroup.net": "2025-01-24",
      "sobarialty.com": "2025-01-24",
      "solfarmer.net": "2025-01-24",
      "springstonenergyltd.com": "2025-01-24",
      "spsalemarketing.com": "2025-01-27",
      "srsconvayors.com": "2025-01-24",
      "ss.qwadx.com": "2026-01-02",
      "sss.qwadx.com": "2026-01-02",
      "starraqid.com": "2025-01-24",
      "steambolers.com": "2025-01-24",
      "straemer-electric.com": "2025-01-24",
      "suncrb.com": "2025-01-24",
      "swatsconstruction.com": "2025-01-24",
      "teachaways.com": "2025-01-24",
      "terra-worlds.com": "2025-01-24",
      "tfherald.com": "2025-01-24",
      "tigers-coatings.com": "2025-01-24",
      "toampn.com": "2025-01-24",
      "toirbo.com": "2025-01-24",
      "toppciqm.com": "2025-01-24",
      "toptutorialsstore.com": "2025-01-24",
      "tradesworksinc.com": "2025-01-24",
      "travellingwords.com": "2025-01-24",
      "unionlnvest.com": "2025-01-24",
      "updates-check-microsoft.ddns.net": "2026-01-02",
      "uphearth.com": "2025-01-24",
      "ural-info.net": "2025-01-24",
      "usefullhost.info": "2025-01-24",
      "useraccount-assist05u.dynamic-dns.net": "2026-01-02",
      "valkiriya.team": "2025-01-24",
      "vapic.org": "2025-01-24",
      "verification.sdzgw.org": "2025-01-24",
      "vibropowers.com": "2025-01-24",
      "viewpiontsystem.com": "2025-01-24",
      "volgagas.net": "2025-01-24",
      "waikatosinc.com": "2025-01-24",
      "webmailsession.com": "2026-01-02",
      "websubline.com": "2025-01-24",
      "wincorpupdates.com": "2026-01-02",
      "windows-update-catalog.serveftp.com": "2026-01-02",
      "woodrecyclability.com": "2025-01-24",
      "work-dl.org": "2025-01-24",
      "wpowerproduct.com": "2025-01-24",
      "x683.info": "2025-01-24",
      "xnxx-v.com": "2025-01-24",
      "xpanxions.com": "2025-01-24",
      "yanimar.com": "2025-01-24",
      "yushinautomations.com": "2025-01-24",
      "zbtflorida.org": "2025-01-24",
      "zzbanjia0371.net": "2025-01-24"
    },
    "ipv4": {
      "141.98.82.198:443": "2026-02-25",
      "141.98.82.198:9942": "2026-01-02",
      "152.53.20.140:443": "2026-06-22",
      "154.31.217.203:443": "2026-06-22",
      "172.86.75.237:443": "2026-02-25",
      "185.122.171.22:8082": "2025-01-12",
      "185.62.57.219:10443": "2026-03-16",
      "193.124.203.226:9942": "2026-01-02",
      "65.38.120.38:443": "2026-02-25",
      "65.38.121.107:8000": "2026-02-25",
      "72.5.43.100:443": "2026-02-25",
      "72.5.43.178:443": "2026-02-25",
      "81.19.136.241:443": "2026-02-25",
      "81.19.136.241:9942": "2026-01-02",
      "82.115.223.210:9942": "2026-02-25",
      "85.209.128.171:10443": "2026-02-25",
      "85.209.128.171:3306": "2026-01-02",
      "85.209.128.171:8000": "2026-01-02",
      "85.209.128.171:8080": "2026-01-02",
      "85.209.128.171:9000": "2026-01-02",
      "88.214.26.37:443": "2026-02-25",
      "88.214.26.37:9942": "2026-01-02",
      "96.9.125.168:443": "2026-02-25"
    },
    "url": {
      "http://168.100.8.21": "2026-01-02",
      "http://185.106.92.127": "2026-02-25",
      "http://64.7.198.46": "2026-01-02",
      "http://64.7.198.66": "2026-01-02",
      "http://65.38.120.38": "2026-01-02",
      "http://65.38.121.107": "2026-01-02",
      "http://72.5.43.100": "2026-01-02",
      "http://85.209.128.171": "2026-01-02",
      "http://91.212.89.197": "2026-01-02"
    },
    "url_path": {
      "/iufhtyhgyfugj.php": "2025-01-24"
    }
  },
  "first_seen_precision": {
    "domain": {
      "adm-govuz.com": "at-or-before",
      "admin.inboxsession.info": "at-or-before",
      "allcloudindex.com": "at-or-before",
      "auth.allcloudindex.com": "at-or-before",
      "catalog-update-update-microsoft.serveftp.com": "at-or-before",
      "document.mailboxarea.cloud": "at-or-before",
      "document.webmailsession.com": "at-or-before",
      "docworldme.com": "at-or-before",
      "emails-cloud.com": "at-or-before",
      "ex.wincorpupdates.com": "at-or-before",
      "gmvtest9.ddns.net": "at-or-before",
      "inbox.docworldme.com": "at-or-before",
      "inboxsession.info": "at-or-before",
      "kingikolok.ignorelist.com": "at-or-before",
      "mailboxarea.cloud": "at-or-before",
      "maill.ddns.net": "at-or-before",
      "maquinadelmal.duckdns.org": "at-or-before",
      "message.mailboxarea.cloud": "at-or-before",
      "mosreg.docworldme.com": "at-or-before",
      "openpdfllc.com": "at-or-before",
      "q1q.ddns.net": "at-or-before",
      "qwadx.com": "at-or-before",
      "ss.qwadx.com": "at-or-before",
      "sss.qwadx.com": "at-or-before",
      "updates-check-microsoft.ddns.net": "at-or-before",
      "useraccount-assist05u.dynamic-dns.net": "at-or-before",
      "webmailsession.com": "at-or-before",
      "wincorpupdates.com": "at-or-before",
      "windows-update-catalog.serveftp.com": "at-or-before"
    },
    "ipv4": {
      "141.98.82.198:9942": "at-or-before",
      "193.124.203.226:9942": "at-or-before",
      "81.19.136.241:9942": "at-or-before",
      "85.209.128.171:3306": "at-or-before",
      "85.209.128.171:8000": "at-or-before",
      "85.209.128.171:8080": "at-or-before",
      "85.209.128.171:9000": "at-or-before",
      "88.214.26.37:9942": "at-or-before"
    },
    "url": {
      "http://168.100.8.21": "at-or-before",
      "http://64.7.198.46": "at-or-before",
      "http://64.7.198.66": "at-or-before",
      "http://65.38.120.38": "at-or-before",
      "http://65.38.121.107": "at-or-before",
      "http://72.5.43.100": "at-or-before",
      "http://85.209.128.171": "at-or-before",
      "http://91.212.89.197": "at-or-before"
    },
    "url_path": {}
  },
  "first_seen_range": {
    "earliest": "2025-01-12",
    "latest": "2026-06-22"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "accessibleneats.com",
      "accttechllc.com",
      "adm-govuz.com",
      "admin.inboxsession.info",
      "akcloud.top",
      "akersolutoins.com",
      "alandyh.com",
      "albertinamachinery.com",
      "alfhjdumnsulhuehs.com",
      "allcloudindex.com",
      "allocco-ar.com",
      "alpine-hosokawa.net",
      "altendorf-de.com",
      "annons.info",
      "arableaguenews.com",
      "arpimportnl.com",
      "asdnwakalet.net",
      "asmtld.com",
      "atomicenergylab.com",
      "auth.allcloudindex.com",
      "authmailinbox.com",
      "ax47tui83.com",
      "aydemirtek.com",
      "babblnipresses.com",
      "bencoconstructionsllc.com",
      "bestdomblog.com",
      "bestmartsolutions.com",
      "bestunif.com",
      "bluemoono.com",
      "brainytask.tech",
      "brandxoffice.com",
      "breuing-irco.com",
      "brindley-medical.com",
      "cae-gruope.com",
      "cairo-day-trips.com",
      "caprnatic.com",
      "catalog-update-update-microsoft.serveftp.com",
      "catchthestorms.net",
      "check-connection.org",
      "checkingsite.org",
      "citylinefood.com",
      "cm-elevatori.com",
      "cmcrushermachine.com",
      "colombaogrobg.com",
      "consultafacildoc.com",
      "consultasfacildoc.com",
      "converting-system.com",
      "csiwoffshore.com",
      "datosdecuit.com",
      "dl-keepass.info",
      "dmgrnori.com",
      "dmsplasts.com",
      "document.hometowncity.cloud",
      "document.mailboxarea.cloud",
      "document.webmailsession.com",
      "docworldme.com",
      "downloadmailbox.com",
      "e-egov.com",
      "eaglesxv.com",
      "eco-prozestechnik.com",
      "eew-groups.com",
      "elcomen.com",
      "elike-rne.com",
      "elinkexpressltd.com",
      "elldrissi.com",
      "elpisitsinc.com",
      "emails-cloud.com",
      "emiratom.com",
      "emsilgroups.com",
      "enigmaaxis.com",
      "envolvesearch.com",
      "estaterlea.com",
      "etori.info",
      "etunabilar.com",
      "ex.wincorpupdates.com",
      "field-tec.org",
      "filecenter.online",
      "filereader.online",
      "filfilter-tr.com",
      "filorep.com",
      "fob-au.com",
      "garmorgan.com",
      "gdrr.info",
      "geanew.com",
      "geniwatit.com",
      "genmac-it.com",
      "globa-space.com",
      "globexgruop.com",
      "gmvtest9.ddns.net",
      "goodbabiynt.com",
      "greeentom.com",
      "gsbplataforma.com",
      "guidolingiroto.com",
      "gvfimpainti.com",
      "gynovetylesc.com",
      "hamzagill.com",
      "harrellc.com",
      "henigworldwide.com",
      "hgbeerequipment-uk.com",
      "hi053.info",
      "hidrogarnes.com",
      "hometowncity.cloud",
      "hpfrugt.com",
      "hsb-it.com",
      "husmanin-web.com",
      "hydrocleariservices.com",
      "inbox.docworldme.com",
      "inboxoid.com",
      "inboxsession.info",
      "interger.org",
      "investmentsfor.com",
      "j-tiec.com",
      "jeetu.club",
      "jeetu.global",
      "jeetu.me",
      "jonesproduces.com",
      "jskhcdiueslnin.com",
      "juargen-escher.com",
      "k670.info",
      "khu3x.info",
      "kingikolok.ignorelist.com",
      "kovis-groups.com",
      "kss-sap.com",
      "kycountynews.com",
      "l161.info",
      "ledsf.com",
      "lnciner8.com",
      "lnteracservice.in",
      "lnteracservices.com",
      "loftinequlp.com",
      "lophjgihh.com",
      "luada-technology.com",
      "lutz-purnpen.com",
      "lyndexrceycling.com",
      "m339.info",
      "magnitudeconsults.com",
      "magnumiserviceslp.com",
      "mail-sanly.filecenter.online",
      "mail-sanly.filereader.online",
      "mailboxarea.cloud",
      "mailboxdownload.com",
      "mailkeyboard.com",
      "maill.ddns.net",
      "mailruinbox.com",
      "mansoorhabibdoost.com",
      "maquinadelmal.duckdns.org",
      "masonindustries-sg.com",
      "matast.com",
      "message.mailboxarea.cloud",
      "michlot.org",
      "miecal.com",
      "mininnovationuz.com",
      "miyako-securities.com",
      "mlutibeias.com",
      "mosreg.docworldme.com",
      "mozoil-llc.com",
      "mprecisionsgrinding.com",
      "mqmuk.com",
      "mrwallpaper.net",
      "multinedia-connect.com",
      "mvfglobai.com",
      "mxdnxlove.com",
      "mypreciousdomainer.net",
      "myunistars.com",
      "navtechsradar.com",
      "ncspares-za.com",
      "newscode.net",
      "ngmex.org",
      "oakcreekapples.com",
      "officelabelsonline.com",
      "officewithyou.com",
      "onlinefinancenews.com",
      "onurtektsil.com",
      "openpdfllc.com",
      "ormac-it.com",
      "ozfarmnews.com",
      "partincpas.com",
      "piasskowanie.net",
      "pp731.info",
      "productddon.com",
      "psbvip.com",
      "pweobmxdlboi.com",
      "q-10c.com",
      "q1q.ddns.net",
      "qazmarinefuel.com",
      "qswl.org",
      "qwadx.com",
      "ravemia.com",
      "realialebrewing.com",
      "reginachian.net",
      "registermydomainagain.top",
      "releasedatestory.com",
      "reynco.co",
      "reyncos.com",
      "rinbid.com",
      "rotomabe.com",
      "sasafetty.com",
      "sdzgw.org",
      "secfatsbily.com",
      "segrez.com",
      "shuchonafoods.com",
      "smartwebgroup.net",
      "sobarialty.com",
      "solfarmer.net",
      "springstonenergyltd.com",
      "spsalemarketing.com",
      "srsconvayors.com",
      "ss.qwadx.com",
      "sss.qwadx.com",
      "starraqid.com",
      "steambolers.com",
      "straemer-electric.com",
      "suncrb.com",
      "swatsconstruction.com",
      "teachaways.com",
      "terra-worlds.com",
      "tfherald.com",
      "tigers-coatings.com",
      "toampn.com",
      "toirbo.com",
      "toppciqm.com",
      "toptutorialsstore.com",
      "tradesworksinc.com",
      "travellingwords.com",
      "unionlnvest.com",
      "updates-check-microsoft.ddns.net",
      "uphearth.com",
      "ural-info.net",
      "usefullhost.info",
      "useraccount-assist05u.dynamic-dns.net",
      "valkiriya.team",
      "vapic.org",
      "verification.sdzgw.org",
      "vibropowers.com",
      "viewpiontsystem.com",
      "volgagas.net",
      "waikatosinc.com",
      "webmailsession.com",
      "websubline.com",
      "wincorpupdates.com",
      "windows-update-catalog.serveftp.com",
      "woodrecyclability.com",
      "work-dl.org",
      "wpowerproduct.com",
      "x683.info",
      "xnxx-v.com",
      "xpanxions.com",
      "yanimar.com",
      "yushinautomations.com",
      "zbtflorida.org",
      "zzbanjia0371.net"
    ],
    "ipv4": [
      "141.98.82.198:443",
      "141.98.82.198:9942",
      "152.53.20.140:443",
      "154.31.217.203:443",
      "172.86.75.237:443",
      "185.122.171.22:8082",
      "185.62.57.219:10443",
      "193.124.203.226:9942",
      "65.38.120.38:443",
      "65.38.121.107:8000",
      "72.5.43.100:443",
      "72.5.43.178:443",
      "81.19.136.241:443",
      "81.19.136.241:9942",
      "82.115.223.210:9942",
      "85.209.128.171:10443",
      "85.209.128.171:3306",
      "85.209.128.171:8000",
      "85.209.128.171:8080",
      "85.209.128.171:9000",
      "88.214.26.37:443",
      "88.214.26.37:9942",
      "96.9.125.168:443"
    ],
    "url": [
      "http://168.100.8.21",
      "http://185.106.92.127",
      "http://64.7.198.46",
      "http://64.7.198.66",
      "http://65.38.120.38",
      "http://65.38.121.107",
      "http://72.5.43.100",
      "http://85.209.128.171",
      "http://91.212.89.197"
    ],
    "url_path": [
      "/iufhtyhgyfugj.php"
    ]
  },
  "last_modified": "2026-06-22T07:56:34+00:00",
  "maltrail_groups": [
    "SILENTLYNX"
  ],
  "references": [
    "https://app.validin.com/detail?find=64.7.198.66&type=ip4&ref_id=55f2c681bec#tab=resolutions",
    "https://app.validin.com/detail?find=Accessible%20Neats&type=raw&ref_id=ea4a621b30a#tab=host_pairs (# 2025-01-24)",
    "https://www.group-ib.com/blog/shadowsilk/",
    "https://www.seqrite.com/blog/operation-peek-a-baku-silent-lynx-apt-dushanbe-espionage/",
    "https://www.seqrite.com/blog/silent-lynx-apt-targeting-central-asian-entities/",
    "https://www.virustotal.com/gui/file/1b76931775aa4de29df27a9de764b22f17ca117d6e5ae184f4ef617c970fc007/detection",
    "https://www.virustotal.com/gui/file/297d1afa309cdf0c84f04994ffd59ee1e1175377c1a0a561eb25869909812c9c/detection",
    "https://www.virustotal.com/gui/file/3560660162f2268d52b69382c78192667a7eee5796d77418a8609b2f1709f834/detection",
    "https://www.virustotal.com/gui/file/66294c9925ad454d5640f4fe753da9e7d6742f60b093ed97be88fcdd47b04445/detection",
    "https://www.virustotal.com/gui/file/99c6017c8658faf678f1b171c8eb5d5fa7e7d08e0a0901b984a8e3e1fab565cd/detection",
    "https://www.virustotal.com/gui/file/a146e914560229a3389589acaee42cbcd37504731f8c7ba17676678db0547fed/detection",
    "https://www.virustotal.com/gui/file/c045344b23fc245f35a0ff4a6d6fa744d580cde45c8cd0849153dee7dce1d80c/detection",
    "https://www.virustotal.com/gui/file/e6f76a73180b4f2947764f4de57b52d037b482ece1a88dab9d3290e76be8c098/detection",
    "https://www.virustotal.com/gui/file/efb700681713cd50a2addd1fea6b7ee80c084467d3e87668688b9f06642062ba/detection",
    "https://www.vmray.com/hydra-saiga-covert-espionage-and-infiltration-of-critical-utilities/",
    "https://x.com/ElementalX2/status/1985340834217173061",
    "https://x.com/ElementalX2/status/2033593705735852115",
    "https://x.com/SinghSoodeep/status/2033590183929721308",
    "https://x.com/StrikeReadyLabs/status/1877839055716581634",
    "https://x.com/phatomcandle/status/2068755847854072238",
    "https://x.com/skocherhan/status/2068803834403602740",
    "https://x.com/virusbtn/status/1882771331726647421"
  ],
  "related": [],
  "slug": "SILENTLYNX",
  "timeline": [
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2026-06-22",
      "indicators": {
        "ipv4": [
          "152.53.20.140:443",
          "154.31.217.203:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/phatomcandle/status/2068755847854072238",
        "https://x.com/skocherhan/status/2068803834403602740"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 4,
        "ipv4": 1
      },
      "first_seen": "2026-03-16",
      "indicators": {
        "domain": [
          "filecenter.online",
          "filereader.online",
          "mail-sanly.filecenter.online",
          "mail-sanly.filereader.online"
        ],
        "ipv4": [
          "185.62.57.219:10443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/SinghSoodeep/status/2033590183929721308",
        "https://x.com/ElementalX2/status/2033593705735852115",
        "https://www.virustotal.com/gui/file/a146e914560229a3389589acaee42cbcd37504731f8c7ba17676678db0547fed/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "ipv4": 11,
        "url": 1
      },
      "first_seen": "2026-02-25",
      "indicators": {
        "ipv4": [
          "141.98.82.198:443",
          "172.86.75.237:443",
          "65.38.120.38:443",
          "65.38.121.107:8000",
          "72.5.43.100:443",
          "72.5.43.178:443",
          "81.19.136.241:443",
          "82.115.223.210:9942",
          "85.209.128.171:10443",
          "88.214.26.37:443",
          "96.9.125.168:443"
        ],
        "url": [
          "http://185.106.92.127"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.vmray.com/hydra-saiga-covert-espionage-and-infiltration-of-critical-utilities/"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 20,
        "ipv4": 8,
        "url": 8
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "adm-govuz.com",
          "admin.inboxsession.info",
          "allcloudindex.com",
          "auth.allcloudindex.com",
          "document.mailboxarea.cloud",
          "document.webmailsession.com",
          "docworldme.com",
          "emails-cloud.com",
          "ex.wincorpupdates.com",
          "inbox.docworldme.com",
          "inboxsession.info",
          "mailboxarea.cloud",
          "message.mailboxarea.cloud",
          "mosreg.docworldme.com",
          "openpdfllc.com",
          "qwadx.com",
          "ss.qwadx.com",
          "sss.qwadx.com",
          "webmailsession.com",
          "wincorpupdates.com"
        ],
        "ipv4": [
          "141.98.82.198:9942",
          "193.124.203.226:9942",
          "81.19.136.241:9942",
          "85.209.128.171:3306",
          "85.209.128.171:8000",
          "85.209.128.171:8080",
          "85.209.128.171:9000",
          "88.214.26.37:9942"
        ],
        "url": [
          "http://168.100.8.21",
          "http://64.7.198.46",
          "http://64.7.198.66",
          "http://65.38.120.38",
          "http://65.38.121.107",
          "http://72.5.43.100",
          "http://85.209.128.171",
          "http://91.212.89.197"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.group-ib.com/blog/shadowsilk/"
      ],
      "total": 36
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "catalog-update-update-microsoft.serveftp.com",
          "gmvtest9.ddns.net",
          "kingikolok.ignorelist.com",
          "maill.ddns.net",
          "maquinadelmal.duckdns.org",
          "q1q.ddns.net",
          "updates-check-microsoft.ddns.net",
          "useraccount-assist05u.dynamic-dns.net",
          "windows-update-catalog.serveftp.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/ElementalX2/status/1985340834217173061",
        "https://www.seqrite.com/blog/operation-peek-a-baku-silent-lynx-apt-dushanbe-espionage/"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2025-01-27",
      "indicators": {
        "domain": [
          "alfhjdumnsulhuehs.com",
          "spsalemarketing.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=Accessible%20Neats&type=raw&ref_id=ea4a621b30a#tab=host_pairs (# 2025-01-24)"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 211
      },
      "first_seen": "2025-01-24",
      "indicators": {
        "domain": [
          "accttechllc.com",
          "akcloud.top",
          "akersolutoins.com",
          "alandyh.com",
          "albertinamachinery.com",
          "allocco-ar.com",
          "alpine-hosokawa.net",
          "altendorf-de.com",
          "annons.info",
          "arableaguenews.com",
          "arpimportnl.com",
          "asdnwakalet.net",
          "asmtld.com",
          "atomicenergylab.com",
          "authmailinbox.com",
          "ax47tui83.com",
          "aydemirtek.com",
          "babblnipresses.com",
          "bencoconstructionsllc.com",
          "bestdomblog.com",
          "bestmartsolutions.com",
          "bestunif.com",
          "bluemoono.com",
          "brainytask.tech",
          "brandxoffice.com",
          "breuing-irco.com",
          "brindley-medical.com",
          "cae-gruope.com",
          "cairo-day-trips.com",
          "caprnatic.com",
          "catchthestorms.net",
          "check-connection.org",
          "checkingsite.org",
          "citylinefood.com",
          "cm-elevatori.com",
          "cmcrushermachine.com",
          "colombaogrobg.com",
          "consultafacildoc.com",
          "consultasfacildoc.com",
          "converting-system.com",
          "csiwoffshore.com",
          "datosdecuit.com",
          "dl-keepass.info",
          "dmgrnori.com",
          "dmsplasts.com",
          "downloadmailbox.com",
          "e-egov.com",
          "eaglesxv.com",
          "eco-prozestechnik.com",
          "eew-groups.com",
          "elcomen.com",
          "elike-rne.com",
          "elinkexpressltd.com",
          "elldrissi.com",
          "elpisitsinc.com",
          "emiratom.com",
          "emsilgroups.com",
          "enigmaaxis.com",
          "envolvesearch.com",
          "estaterlea.com",
          "etori.info",
          "etunabilar.com",
          "field-tec.org",
          "filfilter-tr.com",
          "filorep.com",
          "fob-au.com",
          "garmorgan.com",
          "gdrr.info",
          "geanew.com",
          "geniwatit.com",
          "genmac-it.com",
          "globa-space.com",
          "globexgruop.com",
          "goodbabiynt.com",
          "greeentom.com",
          "gsbplataforma.com",
          "guidolingiroto.com",
          "gvfimpainti.com",
          "gynovetylesc.com",
          "hamzagill.com",
          "harrellc.com",
          "henigworldwide.com",
          "hgbeerequipment-uk.com",
          "hi053.info",
          "hidrogarnes.com",
          "hpfrugt.com",
          "hsb-it.com",
          "husmanin-web.com",
          "hydrocleariservices.com",
          "inboxoid.com",
          "interger.org",
          "investmentsfor.com",
          "j-tiec.com",
          "jeetu.club",
          "jeetu.global",
          "jeetu.me",
          "jonesproduces.com",
          "jskhcdiueslnin.com",
          "juargen-escher.com",
          "k670.info",
          "khu3x.info",
          "kovis-groups.com",
          "kss-sap.com",
          "kycountynews.com",
          "l161.info",
          "ledsf.com",
          "lnciner8.com",
          "lnteracservice.in",
          "lnteracservices.com",
          "loftinequlp.com",
          "lophjgihh.com",
          "luada-technology.com",
          "lutz-purnpen.com",
          "lyndexrceycling.com",
          "m339.info",
          "magnitudeconsults.com",
          "magnumiserviceslp.com",
          "mailkeyboard.com",
          "mailruinbox.com",
          "mansoorhabibdoost.com",
          "masonindustries-sg.com",
          "matast.com",
          "michlot.org",
          "miecal.com",
          "mininnovationuz.com",
          "miyako-securities.com",
          "mlutibeias.com",
          "mozoil-llc.com",
          "mprecisionsgrinding.com",
          "mqmuk.com",
          "mrwallpaper.net",
          "multinedia-connect.com",
          "mvfglobai.com",
          "mxdnxlove.com",
          "mypreciousdomainer.net",
          "myunistars.com",
          "navtechsradar.com",
          "ncspares-za.com",
          "newscode.net",
          "ngmex.org",
          "oakcreekapples.com",
          "officelabelsonline.com",
          "officewithyou.com",
          "onlinefinancenews.com",
          "onurtektsil.com",
          "ormac-it.com",
          "ozfarmnews.com",
          "partincpas.com",
          "piasskowanie.net",
          "pp731.info",
          "productddon.com",
          "psbvip.com",
          "q-10c.com",
          "qazmarinefuel.com",
          "qswl.org",
          "ravemia.com",
          "realialebrewing.com",
          "reginachian.net",
          "registermydomainagain.top",
          "releasedatestory.com",
          "reynco.co",
          "reyncos.com",
          "rinbid.com",
          "rotomabe.com",
          "sasafetty.com",
          "sdzgw.org",
          "secfatsbily.com",
          "segrez.com",
          "shuchonafoods.com",
          "smartwebgroup.net",
          "sobarialty.com",
          "solfarmer.net",
          "springstonenergyltd.com",
          "srsconvayors.com",
          "starraqid.com",
          "steambolers.com",
          "straemer-electric.com",
          "suncrb.com",
          "swatsconstruction.com",
          "teachaways.com",
          "terra-worlds.com",
          "tfherald.com",
          "tigers-coatings.com",
          "toampn.com",
          "toirbo.com",
          "toppciqm.com",
          "toptutorialsstore.com",
          "tradesworksinc.com",
          "travellingwords.com",
          "unionlnvest.com",
          "uphearth.com",
          "ural-info.net",
          "usefullhost.info",
          "valkiriya.team",
          "vapic.org",
          "verification.sdzgw.org",
          "vibropowers.com",
          "viewpiontsystem.com",
          "volgagas.net",
          "waikatosinc.com",
          "websubline.com",
          "woodrecyclability.com",
          "work-dl.org",
          "wpowerproduct.com",
          "x683.info",
          "xnxx-v.com",
          "xpanxions.com",
          "yanimar.com",
          "yushinautomations.com",
          "zbtflorida.org",
          "zzbanjia0371.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://app.validin.com/detail?find=Accessible%20Neats&type=raw&ref_id=ea4a621b30a#tab=host_pairs (# 2025-01-24)"
      ],
      "total": 211
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2025-01-24",
      "indicators": {
        "domain": [
          "accessibleneats.com",
          "document.hometowncity.cloud",
          "hometowncity.cloud",
          "mailboxdownload.com",
          "pweobmxdlboi.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1877839055716581634",
        "https://x.com/virusbtn/status/1882771331726647421",
        "https://www.seqrite.com/blog/silent-lynx-apt-targeting-central-asian-entities/",
        "https://app.validin.com/detail?find=64.7.198.66&type=ip4&ref_id=55f2c681bec#tab=resolutions",
        "https://www.virustotal.com/gui/file/efb700681713cd50a2addd1fea6b7ee80c084467d3e87668688b9f06642062ba/detection",
        "https://www.virustotal.com/gui/file/e6f76a73180b4f2947764f4de57b52d037b482ece1a88dab9d3290e76be8c098/detection",
        "https://www.virustotal.com/gui/file/3560660162f2268d52b69382c78192667a7eee5796d77418a8609b2f1709f834/detection",
        "https://www.virustotal.com/gui/file/297d1afa309cdf0c84f04994ffd59ee1e1175377c1a0a561eb25869909812c9c/detection",
        "https://www.virustotal.com/gui/file/c045344b23fc245f35a0ff4a6d6fa744d580cde45c8cd0849153dee7dce1d80c/detection",
        "https://www.virustotal.com/gui/file/1b76931775aa4de29df27a9de764b22f17ca117d6e5ae184f4ef617c970fc007/detection",
        "https://www.virustotal.com/gui/file/66294c9925ad454d5640f4fe753da9e7d6742f60b093ed97be88fcdd47b04445/detection",
        "https://www.virustotal.com/gui/file/99c6017c8658faf678f1b171c8eb5d5fa7e7d08e0a0901b984a8e3e1fab565cd/detection"
      ],
      "total": 5
    },
    {
      "counts": {
        "url_path": 1
      },
      "first_seen": "2025-01-24",
      "indicators": {
        "url_path": [
          "/iufhtyhgyfugj.php"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/phatomcandle/status/2068755847854072238",
        "https://x.com/skocherhan/status/2068803834403602740"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2025-01-12",
      "indicators": {
        "ipv4": [
          "185.122.171.22:8082"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1877839055716581634",
        "https://x.com/virusbtn/status/1882771331726647421",
        "https://www.seqrite.com/blog/silent-lynx-apt-targeting-central-asian-entities/",
        "https://app.validin.com/detail?find=64.7.198.66&type=ip4&ref_id=55f2c681bec#tab=resolutions",
        "https://www.virustotal.com/gui/file/efb700681713cd50a2addd1fea6b7ee80c084467d3e87668688b9f06642062ba/detection",
        "https://www.virustotal.com/gui/file/e6f76a73180b4f2947764f4de57b52d037b482ece1a88dab9d3290e76be8c098/detection",
        "https://www.virustotal.com/gui/file/3560660162f2268d52b69382c78192667a7eee5796d77418a8609b2f1709f834/detection",
        "https://www.virustotal.com/gui/file/297d1afa309cdf0c84f04994ffd59ee1e1175377c1a0a561eb25869909812c9c/detection",
        "https://www.virustotal.com/gui/file/c045344b23fc245f35a0ff4a6d6fa744d580cde45c8cd0849153dee7dce1d80c/detection",
        "https://www.virustotal.com/gui/file/1b76931775aa4de29df27a9de764b22f17ca117d6e5ae184f4ef617c970fc007/detection",
        "https://www.virustotal.com/gui/file/66294c9925ad454d5640f4fe753da9e7d6742f60b093ed97be88fcdd47b04445/detection",
        "https://www.virustotal.com/gui/file/99c6017c8658faf678f1b171c8eb5d5fa7e7d08e0a0901b984a8e3e1fab565cd/detection"
      ],
      "total": 1
    }
  ]
}