Indicators of compromise
652 indicators auto-extracted from article text · hashes, IPs, domains, URLs · verify before use
| Type | Indicator | Context | Article | First seen |
|---|---|---|---|---|
| domain | grok.com | : shared, indexable conversations hosted on chatgpt.com and grok.com that can rank for troubleshooting searches. Each of these s | How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface BleepingComputer | · 6d ago |
| domain | domainlify.net | om Sender email address used to send campaign emails Domain domainlify[.]net Newly registered domain used in the Reply-To address Note | Hackers Impersonate CEOs in 1 Million Emails to Trick Employees Into $50,000 Payments Cyber Security News | · 6d ago |
| domain | eemusicclass.co.uk | address used to send campaign emails Email address contact@eemusicclass[.]co[.]uk Sender email address used to send campaign emails Email | Hackers Impersonate CEOs in 1 Million Emails to Trick Employees Into $50,000 Payments Cyber Security News | · 6d ago |
| domain | lifeones.com | ail address used to send campaign emails Email address info@lifeones[.]com Sender email address used to send campaign emails Domain | Hackers Impersonate CEOs in 1 Million Emails to Trick Employees Into $50,000 Payments Cyber Security News | · 6d ago |
| domain | lohnsteuerhilfe-aktuell-verein.de | ail address used to send campaign emails Email address info@lohnsteuerhilfe-aktuell-verein[.]de Sender email address used to send campaign emails Email a | Hackers Impersonate CEOs in 1 Million Emails to Trick Employees Into $50,000 Payments Cyber Security News | · 6d ago |
| domain | lumalisboa.com | address used to send campaign emails Email address no-reply@lumalisboa[.]com Sender email address used to send campaign emails Email a | Hackers Impersonate CEOs in 1 Million Emails to Trick Employees Into $50,000 Payments Cyber Security News | · 6d ago |
| domain | mctci.com | address used to send campaign emails Email address noreply@mctci[.]com Sender email address used to send campaign emails Email a | Hackers Impersonate CEOs in 1 Million Emails to Trick Employees Into $50,000 Payments Cyber Security News | · 6d ago |
| domain | nuf.co.jp | ail address used to send campaign emails Email address info@nuf[.]co[.]jp Sender email address used to send campaign emails Email | Hackers Impersonate CEOs in 1 Million Emails to Trick Employees Into $50,000 Payments Cyber Security News | · 6d ago |
| domain | service-nowinc.com | rs of compromise (IoCs):- Type Indicator Description Domain service-nowinc[.]com Domain impersonating ServiceNow Email address gomez@servi | Hackers Impersonate CEOs in 1 Million Emails to Trick Employees Into $50,000 Payments Cyber Security News | · 6d ago |
| domain | tivityhealth.com | ail address used to send campaign emails Email address info@tivityhealth[.]com Sender email address used to send campaign emails Email a | Hackers Impersonate CEOs in 1 Million Emails to Trick Employees Into $50,000 Payments Cyber Security News | · 6d ago |
| domain | tovimbatista.pt | ail address used to send campaign emails Email address info@tovimbatista[.]pt Sender email address used to send campaign emails Email a | Hackers Impersonate CEOs in 1 Million Emails to Trick Employees Into $50,000 Payments Cyber Security News | · 6d ago |
| domain | uinsure.co.uk | associated with a bank account Email address notifications@uinsure[.]co[.]uk Sender email address used to send campaign emails Email | Hackers Impersonate CEOs in 1 Million Emails to Trick Employees Into $50,000 Payments Cyber Security News | · 6d ago |
| domain | apimantax.otax.fun | bound traffic. Type Indicator Description C2 domain hxxps://apimantax[.]otax[.]fun Active command-and-control domain dynamically retrieved | New Android Ransomware Records Screens, Steals OTPs and Secretly Takes Photos of Victims Cyber Security News | · 6d ago |
| domain | gitclone.org | xploiting CVE-2026-82329 2026-09-02 Not provided hxxp://log.gitclone[.]org:45678/smtp Payload download URL following CVE-2026-42018/ | Hackers Exploit JFrog Artifactory Flaws to Bypass Authentication and Gain Admin Access GBHackers | · 6d ago |
| domain | backup-ubt.s3.us-east-1.amazonaws.com | ws[.]net/dpp1/hostfxr[.]dll SloppyRAT DLL URL URL hxxps[://]backup-ubt[.]s3[.]us-east-1[.]amazonaws[.]com/hostfxr[.]dll SloppyRAT DLL URL Domain stro7121.blo | Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement Cyber Security News | · 6d ago |
| domain | hostfxr.dll | L URL hxxps[://]stro7121[.]blob[.]core[.]windows[.]net/dpp1/hostfxr[.]dll SloppyRAT DLL URL URL hxxps[://]backup-ubt[.]s3[.]us-east | Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement Cyber Security News | · 6d ago |
| domain | linked4x.com | fffa67744812d73ad98eb config.py Python script Domain finger.linked4x[.]com ClickFix script domain Domain skipraid[.]com CastleLoader | Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement Cyber Security News | · 6d ago |
| domain | skipraid.com | Domain finger.linked4x[.]com ClickFix script domain Domain skipraid[.]com CastleLoader domain URL hxxps[://]skipraid[.]com/dsVGmQTr | Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement Cyber Security News | · 6d ago |
| domain | stro7121.blob.core.windows.net | id[.]com/dsVGmQTrzX/default2 CastleLoader URL URL hxxps[://]stro7121[.]blob[.]core[.]windows[.]net/dpp1/config.py Python loader URL URL hxxps[://]stro | Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement Cyber Security News | · 6d ago |
| domain | telephoneip.net | ible; DLLMemLoader/1.0) Python loader User-Agent Domain api.telephoneip[.]net SloppyRAT C2 domain Domain api.truesmart[.]org SloppyRAT | Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement Cyber Security News | · 6d ago |
| domain | truesmart.org | Domain api.telephoneip[.]net SloppyRAT C2 domain Domain api.truesmart[.]org SloppyRAT C2 domain Note: IP addresses and domains are in | Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement Cyber Security News | · 6d ago |
| domain | windows.net | m/hostfxr[.]dll SloppyRAT DLL URL Domain stro7121.blob.core.windows[.]net Python downloader C2 IP address 62.106.66[.]148:443 Slopp | Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement Cyber Security News | · 6d ago |
| domain | gitclone.org | .184.111[.]69 , 64.207.232[.]6:8443 Payload URLs hxxp://log.gitclone[.]org:45678/smtp , hxxp://3.88.162[.]79:36789/smtp File / Hash | JFrog Artifactory Vulnerabilities Actively Exploited in the Wild to Gain Administrative Control Cyber Security News | · 6d ago |
| domain | domainlify.net | t in the fake invoice as a contact address. Another domain, domainlify[.]net, was used in Reply-To fields. The short preparation perio | Hackers Use AI-Assisted CEO Emails to Trick Finance Teams Into Sending $50,000 Payments. GBHackers | · 6d ago |
| domain | eemusicclass.co.uk | uerhilfe-aktuell-verein[.]de info@tovimbatista[.]pt contact@eemusicclass[.]co[.]uk info@lifeones[.]com Email address Sender email address | Hackers Use AI-Assisted CEO Emails to Trick Finance Teams Into Sending $50,000 Payments. GBHackers | · 6d ago |
| domain | lifeones.com | info@tovimbatista[.]pt contact@eemusicclass[.]co[.]uk info@lifeones[.]com Email address Sender email address used to send out email | Hackers Use AI-Assisted CEO Emails to Trick Finance Teams Into Sending $50,000 Payments. GBHackers | · 6d ago |
| domain | lohnsteuerhilfe-aktuell-verein.de | umalisboa[.]com noreply@mctci[.]com info@nuf[.]co[.]jp info@lohnsteuerhilfe-aktuell-verein[.]de info@tovimbatista[.]pt contact@eemusicclass[.]co[.]uk inf | Hackers Use AI-Assisted CEO Emails to Trick Finance Teams Into Sending $50,000 Payments. GBHackers | · 6d ago |
| domain | lumalisboa.com | ications@uinsure[.]co[.]uk info@tivityhealth[.]com no-reply@lumalisboa[.]com noreply@mctci[.]com info@nuf[.]co[.]jp info@lohnsteuerhil | Hackers Use AI-Assisted CEO Emails to Trick Finance Teams Into Sending $50,000 Payments. GBHackers | · 6d ago |
| domain | mctci.com | k info@tivityhealth[.]com no-reply@lumalisboa[.]com noreply@mctci[.]com info@nuf[.]co[.]jp info@lohnsteuerhilfe-aktuell-verein[.] | Hackers Use AI-Assisted CEO Emails to Trick Finance Teams Into Sending $50,000 Payments. GBHackers | · 6d ago |
| domain | nuf.co.jp | th[.]com no-reply@lumalisboa[.]com noreply@mctci[.]com info@nuf[.]co[.]jp info@lohnsteuerhilfe-aktuell-verein[.]de info@tovimbati | Hackers Use AI-Assisted CEO Emails to Trick Finance Teams Into Sending $50,000 Payments. GBHackers | · 6d ago |
| domain | service-nowinc.com | onsumer goods’ and others (Source : Microsoft). One domain, service-nowinc[.]com, was registered on July 31, shortly before the phishing a | Hackers Use AI-Assisted CEO Emails to Trick Finance Teams Into Sending $50,000 Payments. GBHackers | · 6d ago |
| domain | tivityhealth.com | ated with bank account notifications@uinsure[.]co[.]uk info@tivityhealth[.]com no-reply@lumalisboa[.]com noreply@mctci[.]com info@nuf[.] | Hackers Use AI-Assisted CEO Emails to Trick Finance Teams Into Sending $50,000 Payments. GBHackers | · 6d ago |
| domain | tovimbatista.pt | nuf[.]co[.]jp info@lohnsteuerhilfe-aktuell-verein[.]de info@tovimbatista[.]pt contact@eemusicclass[.]co[.]uk info@lifeones[.]com Email | Hackers Use AI-Assisted CEO Emails to Trick Finance Teams Into Sending $50,000 Payments. GBHackers | · 6d ago |
| domain | uinsure.co.uk | ss Email address associated with bank account notifications@uinsure[.]co[.]uk info@tivityhealth[.]com no-reply@lumalisboa[.]com norep | Hackers Use AI-Assisted CEO Emails to Trick Finance Teams Into Sending $50,000 Payments. GBHackers | · 6d ago |
| domain | noht1ng.top | il.uaiubifas[.]top backdoor command server, port 443 Domain noht1ng[.]top hosted the exploit page IP 8.218.50[.]207 staging server, | China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor The Hacker News | · 6d ago |
| domain | uaiubifas.top | hind is GRAYRABBIT. The backdoor reaches its server at mail.uaiubifas[.]top on port 443, and the traffic there is plain TCP scrambled | China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor The Hacker News | · 6d ago |
| domain | apimantax.otax.fun | Mantax OTAX Android Ransomware Zimperium identified hxxps://apimantax[.]otax[.]fun as a C2-related domain in its analysis and published as | Mantax OTAX Android Ransomware Spies on Users, Steals OTPs and Encrypts Files GBHackers | · 6d ago |
| domain | hunt.io | e automated campaigns was effectively less than three days. Hunt.io’s AttackCapture system crawled the attacker’s open director | UK Council Attack Linked to Mass Exploitation of SonicWall Flaw Security Affairs | · 6d ago |
| domain | linked4x.com | irectories. Security teams should also hunt for the domains linked4x[.]com , skipraid[.]com , and the observed Azure Blob Storage pa | Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement GBHackers | · 6d ago |
| domain | skipraid.com | the download of CastleLoader and CastleRAT components from skipraid[.]com , using the distinctive K8VGmQTrzX User-Agent string. Cas | Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement GBHackers | · 6d ago |
| domain | gitclone.org | -2026-42018/CVE-2026-42016 2026-08-28 2026-09-07 hxxp://log.gitclone[.]org:45678/smtp Payload download after CVE-2026-42018/CVE-2026 | Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329 Wiz Blog | · 6d ago |
| domain | domainlify.net | also registered another domain on the same day. The domain domainlify[.]net was used in the Reply-To email. Figure 7. Account informa | Protecting organizations from AI-assisted executive impersonation and invoice fraud Microsoft Security Blog | · 6d ago |
| domain | eemusicclass.co.uk | uerhilfe-aktuell-verein[.]de info@tovimbatista[.]pt contact@eemusicclass[.]co[.]uk info@lifeones[.]com Email address Sender email address | Protecting organizations from AI-assisted executive impersonation and invoice fraud Microsoft Security Blog | · 6d ago |
| domain | lifeones.com | info@tovimbatista[.]pt contact@eemusicclass[.]co[.]uk info@lifeones[.]com Email address Sender email address used to send out email | Protecting organizations from AI-assisted executive impersonation and invoice fraud Microsoft Security Blog | · 6d ago |
| domain | lohnsteuerhilfe-aktuell-verein.de | umalisboa[.]com noreply@mctci[.]com info@nuf[.]co[.]jp info@lohnsteuerhilfe-aktuell-verein[.]de info@tovimbatista[.]pt contact@eemusicclass[.]co[.]uk inf | Protecting organizations from AI-assisted executive impersonation and invoice fraud Microsoft Security Blog | · 6d ago |
| domain | lumalisboa.com | ications@uinsure[.]co[.]uk info@tivityhealth[.]com no-reply@lumalisboa[.]com noreply@mctci[.]com info@nuf[.]co[.]jp info@lohnsteuerhil | Protecting organizations from AI-assisted executive impersonation and invoice fraud Microsoft Security Blog | · 6d ago |
| domain | mctci.com | k info@tivityhealth[.]com no-reply@lumalisboa[.]com noreply@mctci[.]com info@nuf[.]co[.]jp info@lohnsteuerhilfe-aktuell-verein[.] | Protecting organizations from AI-assisted executive impersonation and invoice fraud Microsoft Security Blog | · 6d ago |
| domain | nuf.co.jp | th[.]com no-reply@lumalisboa[.]com noreply@mctci[.]com info@nuf[.]co[.]jp info@lohnsteuerhilfe-aktuell-verein[.]de info@tovimbati | Protecting organizations from AI-assisted executive impersonation and invoice fraud Microsoft Security Blog | · 6d ago |
| domain | service-nowinc.com | registered several domains. A ‘ServiceNow’ lookalike domain service-nowinc[.]com was registered on July 31, shortly before the campaign ac | Protecting organizations from AI-assisted executive impersonation and invoice fraud Microsoft Security Blog | · 6d ago |
| domain | tivityhealth.com | ated with bank account notifications@uinsure[.]co[.]uk info@tivityhealth[.]com no-reply@lumalisboa[.]com noreply@mctci[.]com info@nuf[.] | Protecting organizations from AI-assisted executive impersonation and invoice fraud Microsoft Security Blog | · 6d ago |
| domain | tovimbatista.pt | nuf[.]co[.]jp info@lohnsteuerhilfe-aktuell-verein[.]de info@tovimbatista[.]pt contact@eemusicclass[.]co[.]uk info@lifeones[.]com Email | Protecting organizations from AI-assisted executive impersonation and invoice fraud Microsoft Security Blog | · 6d ago |
| domain | uinsure.co.uk | ss Email address associated with bank account notifications@uinsure[.]co[.]uk info@tivityhealth[.]com no-reply@lumalisboa[.]com norep | Protecting organizations from AI-assisted executive impersonation and invoice fraud Microsoft Security Blog | · 6d ago |
Extraction is regex-based (SHA-256/SHA-1/MD5, public IPv4, defanged hxxp/[.] indicators, and bare domains/emails only from malware, actor, exploit, phishing, ransomware and breach articles with a nearby indicator context word). Treat confidence as low until you verify against the source article.