Indicators of compromise
1,890 indicators auto-extracted from article text · hashes, IPs, domains, URLs · verify before use
| Type | Indicator | Context | Article | First seen |
|---|---|---|---|---|
| domain | hbsanews.com | , an IP address linked to the known Bookworm C2 domain www.hbsanews[.]com . We also found a recent ToneShell sample compiled on Jan | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | i5y3dl.com | m Infrastructure www.fjke5oe[.]com update.fjke5oe[.]com www.i5y3dl[.]com www.hbsanews[.]com www.b8pjmgd6[.]com www.zimbra[.]page w | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | microsoft.com | ate, one of which looks like the following: http://download.microsoft[.]com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab We compa | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | uvfr4ep.com | , the IP address 103.27.202[.]68 resolved to the domain www.uvfr4ep[.]com . This domain hosted the C2 server for a ToneShell sample | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | zimbra.page | www.i5y3dl[.]com www.hbsanews[.]com www.b8pjmgd6[.]com www.zimbra[.]page www.ggrdl4[.]com www.gm4rys[.]com Archives Related to Pub | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | adibas.top | ollowing list shows each domain followed by its IP address. adibas[.]top - 46.173.219.161 footarepu[.]top - 35.165.86.173 guntergo | "Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | astrovoerta.top | iuj[.]top - 46.173.219.161 suzemodels[.]top - 35.163.101.72 astrovoerta[.]top - 185.159.130.89 zofelaseo[.]top - 35.163.101.72 These do | "Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | footarepu.top | n followed by its IP address. adibas[.]top - 46.173.219.161 footarepu[.]top - 35.165.86.173 guntergoner[.]top - 35.163.101.72 gunterg | "Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | guntergoner.top | ibas[.]top - 46.173.219.161 footarepu[.]top - 35.165.86.173 guntergoner[.]top - 35.163.101.72 guntergoner[.]top - 185.159.130.89 ibm-te | "Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | ibm-technoligi.top | er[.]top - 35.163.101.72 guntergoner[.]top - 185.159.130.89 ibm-technoligi[.]top - 35.165.251.24 ibm-technoligi[.]top - 62.109.29.26 polki | "Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | polkiuj.top | i[.]top - 35.165.251.24 ibm-technoligi[.]top - 62.109.29.26 polkiuj[.]top - 35.165.251.241 polkiuj[.]top - 46.173.219.161 suzemodel | "Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | suzemodels.top | lkiuj[.]top - 35.165.251.241 polkiuj[.]top - 46.173.219.161 suzemodels[.]top - 35.163.101.72 astrovoerta[.]top - 185.159.130.89 zofela | "Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | zofelaseo.top | ls[.]top - 35.163.101.72 astrovoerta[.]top - 185.159.130.89 zofelaseo[.]top - 35.163.101.72 These domain names were registered a day | "Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | alita.kz | ugin.zip Examples for start of URLs generated by plugin.js: alita[.]kz/tmp/installation/language/cs-CZ/counter/ avtotur.com/libr | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | anilstone.ir | /woorutu63408454 Links from the emails on Friday, April 14: anilstone[.]ir/libraries/joomla/string/wrapper/counter/1.htm Associated | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | bel.tr | amples of fake Microsoft Microsoft Word Online pages: posof.bel[.]tr/counter/1.htm tramplinonline[.]ru/counter/1.htm mattsfoto | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | boorsemsport.be | om/libraries/fof/utils/ip/counter/ circus-stroy.ru/counter/ boorsemsport[.]be/templates/yoo_aurora/less/uikit/counter/ eurostandard[.]r | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | eurostandard.ro | boorsemsport[.]be/templates/yoo_aurora/less/uikit/counter/ eurostandard[.]ro/pics/size1/counter/ forum-turism.org[.]ro/images/layout/c | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | glochemindia.com | size1/counter/ forum-turism.org[.]ro/images/layout/counter/ glochemindia[.]com/modules/mod_roknavmenu/lib/librokmenu/counter/ sportbelij | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | ideliverys.com | s from the emails on Wednesday, April 12: uspsaeyyuia158140.ideliverys[.]com/ioxoory254772 uspsbhusisoz75.ideliverys[.]com/aagupto83 u | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | maildeliverys.com | s from the emails on Thursday, April 13: aexhnneq102342usps.maildeliverys[.]com/kovcemaw707572 bdguz0371usps.maildeliverys[.]com/usvyneye | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | mattsfotoalbum.de | : 1,537 bytes File description: Contents of plugin.zip from mattsfotoalbum[.]de on April 13th SHA256 hash: 40e8dc147f189baf4660d5db8e0cd1 | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | online.ru | ytes File description: Contents of plugin.zip from tramplin.online[.]ru on April 13th SHA256 hash: a1670db6204f7666ad246cc11736b0 | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | org.ro | counter/ eurostandard[.]ro/pics/size1/counter/ forum-turism.org[.]ro/images/layout/counter/ glochemindia[.]com/modules/mod_rok | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | sportbelijning.be | mindia[.]com/modules/mod_roknavmenu/lib/librokmenu/counter/ sportbelijning[.]be/libraries/joomla/application/web/counter/ | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | tramplinonline.ru | t Microsoft Word Online pages: posof.bel[.]tr/counter/1.htm tramplinonline[.]ru/counter/1.htm mattsfotoalbum[.]de/cache/counter/1.htm ani | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | here.jninmobilaria.com | .101.8.169 Nuclear EK domains: lotos.castrumtelcom.com.br , here.jninmobilaria.com.ar Follow-up malware IP address: 46.148.20.32 Follow-up mal | Locky Ransomware Installed Through Nuclear EK Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | js.cefora.com | malware IP address: 46.148.20.32 Follow-up malware domain: js.cefora.com.ar IP addresses from post-infection traffic caused by Locky | Locky Ransomware Installed Through Nuclear EK Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | lotos.castrumtelcom.com.br | .np Nuclear EK IP address: 46.101.8.169 Nuclear EK domains: lotos.castrumtelcom.com.br , here.jninmobilaria.com.ar Follow-up malware IP address: 4 | Locky Ransomware Installed Through Nuclear EK Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | sed.poudelkamal.com | and 2016-03-16 Gate IP address: 91.195.12.177 Gate domain: sed.poudelkamal.com.np Nuclear EK IP address: 46.101.8.169 Nuclear EK domains: | Locky Ransomware Installed Through Nuclear EK Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | ddns.net | leech pattern was pointing to No-IP.com domains (hopto.org, ddns.net, myftp.biz, serveftp.com, etc). These No-IP domains were ei | Campaign Evolution: Darkleech to Pseudo Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | hopto.org | e same Darkleech pattern was pointing to No-IP.com domains (hopto.org, ddns.net, myftp.biz, serveftp.com, etc). These No-IP domai | Campaign Evolution: Darkleech to Pseudo Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | myftp.biz | ern was pointing to No-IP.com domains (hopto.org, ddns.net, myftp.biz, serveftp.com, etc). These No-IP domains were either gates | Campaign Evolution: Darkleech to Pseudo Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | no-ip.com | . By early 2014, the same Darkleech pattern was pointing to No-IP.com domains (hopto.org, ddns.net, myftp.biz, serveftp.com, etc) | Campaign Evolution: Darkleech to Pseudo Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | serveftp.com | nting to No-IP.com domains (hopto.org, ddns.net, myftp.biz, serveftp.com, etc). These No-IP domains were either gates to an EK, or t | Campaign Evolution: Darkleech to Pseudo Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | aba98.com | 85.93.0[.]33 - mvcvideo[.]tk 2016-03-14: 85.93.0[.]33 - bab.aba98[.]com 2016-03-29: 85.93.0[.]34 - folesd[.]tk When we first noti | How the EITest Campaign's Path to Angler EK Evolved Over Time Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | bobibo.tk | 85.93.0[.]32 - feedero[.]tk 2016-01-25: 85.93.0[.]32 - www.bobibo[.]tk 2016-01-26: 85.93.0[.]32 - en.robertkuzma[.]com 2016-02-0 | How the EITest Campaign's Path to Angler EK Evolved Over Time Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | co.uk | st gate URL 2014-09-22: 148.251.56[.]156 - flv.79highstreet.co[.]uk 2014-10-02: 148.251.56[.]156 - fix-mo[.]tk 2015-06-08: 19 | How the EITest Campaign's Path to Angler EK Evolved Over Time Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | dofned.tk | 2-03: 85.93.0[.]32 - vyetbr[.]tk 2016-02-10: 85.93.0[.]32 - dofned[.]tk 2016-02-15: 85.93.0[.]32 - zeboms[.]tk 2016-02-18: 85.93. | How the EITest Campaign's Path to Angler EK Evolved Over Time Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | feedero.tk | 31.184.192[.]206 - vecexeze[.]tk 2016-01-19: 85.93.0[.]32 - feedero[.]tk 2016-01-25: 85.93.0[.]32 - www.bobibo[.]tk 2016-01-26: 85 | How the EITest Campaign's Path to Angler EK Evolved Over Time Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | fix-mo.tk | 6 - flv.79highstreet.co[.]uk 2014-10-02: 148.251.56[.]156 - fix-mo[.]tk 2015-06-08: 194.15.126[.]7 - joans[.]ga 2015-11-10: 31.18 | How the EITest Campaign's Path to Angler EK Evolved Over Time Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | folesd.tk | : 85.93.0[.]33 - bab.aba98[.]com 2016-03-29: 85.93.0[.]34 - folesd[.]tk When we first noticed the EITest gate in September 2014, | How the EITest Campaign's Path to Angler EK Evolved Over Time Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | joans.ga | 148.251.56[.]156 - fix-mo[.]tk 2015-06-08: 194.15.126[.]7 - joans[.]ga 2015-11-10: 31.184.192[.]206 - ymest[.]ml 2015-12-04: 31. | How the EITest Campaign's Path to Angler EK Evolved Over Time Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | mvcvideo.tk | 3-07: 85.93.0[.]33 - nixsys[.]tk 2016-03-09: 85.93.0[.]33 - mvcvideo[.]tk 2016-03-14: 85.93.0[.]33 - bab.aba98[.]com 2016-03-29: 85 | How the EITest Campaign's Path to Angler EK Evolved Over Time Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | nixsys.tk | 3-04: 85.93.0[.]33 - vovevy[.]tk 2016-03-07: 85.93.0[.]33 - nixsys[.]tk 2016-03-09: 85.93.0[.]33 - mvcvideo[.]tk 2016-03-14: 85.9 | How the EITest Campaign's Path to Angler EK Evolved Over Time Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | robertkuzma.com | 5.93.0[.]32 - www.bobibo[.]tk 2016-01-26: 85.93.0[.]32 - en.robertkuzma[.]com 2016-02-03: 85.93.0[.]32 - vyetbr[.]tk 2016-02-10: 85.93. | How the EITest Campaign's Path to Angler EK Evolved Over Time Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | syte4.com | : 85.93.0[.]32 - zeboms[.]tk 2016-02-18: 85.93.0[.]32 - 14s.syte4[.]com 2016-03-04: 85.93.0[.]33 - vovevy[.]tk 2016-03-07: 85.93. | How the EITest Campaign's Path to Angler EK Evolved Over Time Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | vecexeze.tk | 1.184.192[.]206 - ymest[.]ml 2015-12-04: 31.184.192[.]206 - vecexeze[.]tk 2016-01-19: 85.93.0[.]32 - feedero[.]tk 2016-01-25: 85.93 | How the EITest Campaign's Path to Angler EK Evolved Over Time Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | vovevy.tk | : 85.93.0[.]32 - 14s.syte4[.]com 2016-03-04: 85.93.0[.]33 - vovevy[.]tk 2016-03-07: 85.93.0[.]33 - nixsys[.]tk 2016-03-09: 85.93. | How the EITest Campaign's Path to Angler EK Evolved Over Time Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | vyetbr.tk | 93.0[.]32 - en.robertkuzma[.]com 2016-02-03: 85.93.0[.]32 - vyetbr[.]tk 2016-02-10: 85.93.0[.]32 - dofned[.]tk 2016-02-15: 85.93. | How the EITest Campaign's Path to Angler EK Evolved Over Time Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | ymest.ml | 194.15.126[.]7 - joans[.]ga 2015-11-10: 31.184.192[.]206 - ymest[.]ml 2015-12-04: 31.184.192[.]206 - vecexeze[.]tk 2016-01-19: | How the EITest Campaign's Path to Angler EK Evolved Over Time Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | zeboms.tk | 2-10: 85.93.0[.]32 - dofned[.]tk 2016-02-15: 85.93.0[.]32 - zeboms[.]tk 2016-02-18: 85.93.0[.]32 - 14s.syte4[.]com 2016-03-04: 85 | How the EITest Campaign's Path to Angler EK Evolved Over Time Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | afraid.org | are. This campaign uses gates registered through FreeDNS at afraid.org. We are calling this the Afraidgate campaign. Although we c | Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | allofuslikesforums.com | .11 port 80 - tonthishessici[.]com 207.182.148.92 port 80 - allofuslikesforums[.]com 85.25.79.211 port 80 - oqpwldjc.mjobrkn3[.]eu (using a VM | Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | breastcanceroutreach.com | state[.]com 192.169.190.97 port 80 - frageboegen-plletyksin.breastcanceroutreach[.]com 192.169.190.97 port 80 - reikleivn-azarashi.orlandohomesb | Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | cetinhechinhis.com | .203 port 80 - ranetardinghap[.]com 93.190.141.27 port 80 - cetinhechinhis[.]com 95.211.205.218 port 80 - tedgeroatref[.]com 104.193.252.2 | Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | com.ar | in this campaign: 185.118.164.42 port 80 - host.vivialvarez.com[.]ar - GET /widget.js 185.118.164.42 port 80 - kw.projetoraize | Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | com.br | - GET /widget.js 185.118.164.42 port 80 - kw.projetoraizes.com[.]br - GET /js/script.js 185.118.164.42 port 80 - net.jacquiel | Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | co.uk | hevets[.]org 85.25.160.124 port 80 - mcimaildmz.dinnerplate.co[.]uk 192.169.189.167 port 80 - candidulumbestuurlijk.newlandsi | Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | esteroscreen.com | landohomesbydevito[.]com 209.126.120.8 port 80 - litigators.esteroscreen[.]com Bedep post-infection traffic: 104.193.252.241 port 80 - q | Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | helpthevets.org | ET /js/script.js Angler EK: 85.25.160.124 port 80 - bintiye.helpthevets[.]org 85.25.160.124 port 80 - mcimaildmz.dinnerplate.co[.]uk 19 | Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | mjobrkn3.eu | - allofuslikesforums[.]com 85.25.79.211 port 80 - oqpwldjc.mjobrkn3[.]eu (using a VM) CryptXXX post-infection traffic: 217.23.6.40 | Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | newlandsierrarealestate.com | ate.co[.]uk 192.169.189.167 port 80 - candidulumbestuurlijk.newlandsierrarealestate[.]com 192.169.190.97 port 80 - frageboegen-plletyksin.breastcan | Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | orlandohomesbydevito.com | routreach[.]com 192.169.190.97 port 80 - reikleivn-azarashi.orlandohomesbydevito[.]com 209.126.120.8 port 80 - litigators.esteroscreen[.]com Bed | Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | qrwzoxcjatynejejsz.com | com Bedep post-infection traffic: 104.193.252.241 port 80 - qrwzoxcjatynejejsz[.]com 95.211.205.228 port 80 - yfczmludodohkdqnij[.]com (using | Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | ranetardinghap.com | m (using a VM) Click-fraud traffic: 5.199.141.203 port 80 - ranetardinghap[.]com 93.190.141.27 port 80 - cetinhechinhis[.]com 95.211.205.2 | Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | rerobloketbo.com | .218 port 80 - tedgeroatref[.]com 104.193.252.236 port 80 - rerobloketbo[.]com 162.244.34.11 port 80 - tonthishessici[.]com 207.182.148. | Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | tedgeroatref.com | .27 port 80 - cetinhechinhis[.]com 95.211.205.218 port 80 - tedgeroatref[.]com 104.193.252.236 port 80 - rerobloketbo[.]com 162.244.34.1 | Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | tonthishessici.com | 52.236 port 80 - rerobloketbo[.]com 162.244.34.11 port 80 - tonthishessici[.]com 207.182.148.92 port 80 - allofuslikesforums[.]com 85.25.7 | Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | yfczmludodohkdqnij.com | port 80 - qrwzoxcjatynejejsz[.]com 95.211.205.228 port 80 - yfczmludodohkdqnij[.]com (using a VM) Click-fraud traffic: 5.199.141.203 port 80 - | Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | dyndns.org | nfo - gate pointing to Rig EK 5.61.37[.]139 - kjyrxilohcowy.dyndns[.]org - Rig EK on 2016-06-23 5.61.32[.]163 - smobutdobesy.dyndn | CryptoBit: Another Ransomware Family Gets an Update Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | laoismacau.com | sy.dyndns.org[.]org - Rig EK on 2016-06-24 58.64.142[.]89 - laoismacau[.]com - post-infection traffic from CryptoBit The gate checked | CryptoBit: Another Ransomware Family Gets an Update Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | org.org | - Rig EK on 2016-06-23 5.61.32[.]163 - smobutdobesy.dyndns.org[.]org - Rig EK on 2016-06-24 58.64.142[.]89 - laoismacau[.]com | CryptoBit: Another Ransomware Family Gets an Update Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | realstatistics.info | , this particular campaign used a gate with the domain name realstatistics[.]info that pointed to Rig EK. If a vulnerable Windows host enco | CryptoBit: Another Ransomware Family Gets an Update Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | smobutdobesy.dyndns.org | lohcowy.dyndns[.]org - Rig EK on 2016-06-23 5.61.32[.]163 - smobutdobesy.dyndns.org[.]org - Rig EK on 2016-06-24 58.64.142[.]89 - laoismacau[.] | CryptoBit: Another Ransomware Family Gets an Update Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | activebeliever.com | om - GET /rokmediaqueries.js 188.166.38.125 port 80 - siber.activebeliever[.]com - GET /plugins/fancybox-for-wordpress/js/jquery.easing.1. | Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | afraid.org | n continues to utilize gate domains using name servers from afraid.org. Changing Payloads As early as June 29, 2016 , we saw the A | Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | atchisoncountyrecorder.com | - GET /scripts/jquery.form.js 46.101.26.161 port 80 - motor.atchisoncountyrecorder[.]com - GET /js/blog.js 46.101.26.161 port 80 - motor.atchisonc | Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | blautechnology.com | om[.]br - GET /gantry-totop.js 46.101.26.161 port 80 - snow.blautechnology[.]com - GET /scripts/libs.js 46.101.26.161 port 80 - start.pute | Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | bluechristian.top | rdfngwg.blueelizabeth[.]top 185.140.33.99 port 80 - clfdkbl.bluechristian[.]top 185.140.33.99 port 80 - drhffhveq.greenjessica[.]top 185. | Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | blueelizabeth.top | hxmst.rautumngreen[.]top 185.140.33.99 port 80 - bkhrdfngwg.blueelizabeth[.]top 185.140.33.99 port 80 - clfdkbl.bluechristian[.]top 185.1 | Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | bsuperpink.top | rt 80 - azbepfasz.yintored[.]top 5.2.72.236 port 80 - bkubf.bsuperpink[.]top 5.2.72.114 port 80 - iynwzttqd.hautumngreen[.]top 5.2.72. | Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | com.br | cripts/custom.js 46.101.26.161 port 80 - oskol.migustapizza.com[.]br - GET /gantry-totop.js 46.101.26.161 port 80 - snow.blaut | Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | greenjessica.top | fdkbl.bluechristian[.]top 185.140.33.99 port 80 - drhffhveq.greenjessica[.]top 185.140.33.99 port 80 - rklfdprel.blueelizabeth[.]top Loc | Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | hautumngreen.top | 80 - bkubf.bsuperpink[.]top 5.2.72.114 port 80 - iynwzttqd.hautumngreen[.]top 5.2.72.236 port 80 - mxoug.yintored[.]top 5.2.72.236 port | Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | laderatutors.com | .]com - GET /js/addOnLoad.js 188.166.38.125 port 80 - nepal.laderatutors[.]com - GET /rokmediaqueries.js 188.166.38.125 port 80 - siber. | Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | mafterred.top | egoxmvzpx.bsuperpink[.]top 185.140.33.76 port 80 - erfxsnvj.mafterred[.]top 185.140.33.76 port 80 - hxmst.rautumngreen[.]top 185.140. | Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | oautumnyellow.top | - GET /to_top.js Neutrino EK: 5.2.72.236 port 80 - avukytj.oautumnyellow[.]top 5.2.72.236 port 80 - azbepfasz.yintored[.]top 5.2.72.236 | Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | onion.to | structions: mphtadhci5mrdlju.tor2web[.]org mphtadhci5mrdlju.onion[.]to zjfq4lnfbs7pncr5.tor2web[.]org zjfq4lnfbs7pncr5.onion[.]t | Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | polatoglumimarlik.com | ery.easing.1.3.min.js?ver=1.3 188.166.38.125 port 80 - zine.polatoglumimarlik[.]com - GET /scripts/jquery.sliderkit.1.9.2.pack.js 188.166.38. | Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | puterasyawal.com | [.]com - GET /scripts/libs.js 46.101.26.161 port 80 - start.puterasyawal[.]com - GET /js/addOnLoad.js 188.166.38.125 port 80 - nepal.lad | Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | rautumngreen.top | 80 - erfxsnvj.mafterred[.]top 185.140.33.76 port 80 - hxmst.rautumngreen[.]top 185.140.33.99 port 80 - bkhrdfngwg.blueelizabeth[.]top 18 | Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | stmaryschooldmt.com | he Afraidgate campaign: Gates: 46.101.26.161 port 80 - leon.stmaryschooldmt[.]com - GET /scripts/jquery.form.js 46.101.26.161 port 80 - mot | Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | tor2web.org | Domains from the decryption instructions: mphtadhci5mrdlju.tor2web[.]org mphtadhci5mrdlju.onion[.]to zjfq4lnfbs7pncr5.tor2web[.]or | Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | yintored.top | avukytj.oautumnyellow[.]top 5.2.72.236 port 80 - azbepfasz.yintored[.]top 5.2.72.236 port 80 - bkubf.bsuperpink[.]top 5.2.72.114 po | Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | dropbox.com | buinte[.]com - GET /Contribuinte/Iptu/ HTTPS via port 443 - dropbox[.]com - GET /s/ss6op2vxi3ggnhe/Notificacao%28Iptu-.-2017%29.zip | Malspam Targeting Brazil Continues to Evolve Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | goo.gl | downloaded the malicious zip archive: HTTPS via port 443 – goo[.]gl - GET /htm4qG HTTPS via port 443 - googleapis[.]com - GET | Malspam Targeting Brazil Continues to Evolve Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | googleapis.com | via port 443 – goo[.]gl - GET /htm4qG HTTPS via port 443 - googleapis[.]com - GET /pid/2via.html HTTP via port 80 - gov.br.impostocon | Malspam Targeting Brazil Continues to Evolve Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | impostocontribuinte.com | leapis[.]com - GET /pid/2via.html HTTP via port 80 - gov.br.impostocontribuinte[.]com - GET /Contribuinte/Iptu/ HTTPS via port 443 - dropbox[.] | Malspam Targeting Brazil Continues to Evolve Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | healthymagination.com | . Among the expired domains Sable Squirrel has acquired are healthymagination.com, originally a General Electric health initiative, and rezil | Crooks Are Buying Your Expired Domains and Using Them to Deliver Malware Security Affairs | · Aug 16, 2026 |
Extraction is regex-based (SHA-256/SHA-1/MD5, public IPv4, defanged hxxp/[.] indicators, and bare domains/emails only from malware, actor, exploit, phishing, ransomware and breach articles with a nearby indicator context word). Treat confidence as low until you verify against the source article.