ZeroHour

Indicators of compromise

1,890 indicators auto-extracted from article text · hashes, IPs, domains, URLs · verify before use

TypeIndicatorContextArticleFirst seen
domainhbsanews.com, an IP address linked to the known Bookworm C2 domain www.hbsanews[.]com . We also found a recent ToneShell sample compiled on JanStately Taurus Activity in Southeast Asia Links to Bookworm Malware
Palo Alto Unit 42
· Aug 17, 2026
domaini5y3dl.comm Infrastructure www.fjke5oe[.]com update.fjke5oe[.]com www.i5y3dl[.]com www.hbsanews[.]com www.b8pjmgd6[.]com www.zimbra[.]page wStately Taurus Activity in Southeast Asia Links to Bookworm Malware
Palo Alto Unit 42
· Aug 17, 2026
domainmicrosoft.comate, one of which looks like the following: http://download.microsoft[.]com/v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab We compaStately Taurus Activity in Southeast Asia Links to Bookworm Malware
Palo Alto Unit 42
· Aug 17, 2026
domainuvfr4ep.com, the IP address 103.27.202[.]68 resolved to the domain www.uvfr4ep[.]com . This domain hosted the C2 server for a ToneShell sampleStately Taurus Activity in Southeast Asia Links to Bookworm Malware
Palo Alto Unit 42
· Aug 17, 2026
domainzimbra.pagewww.i5y3dl[.]com www.hbsanews[.]com www.b8pjmgd6[.]com www.zimbra[.]page www.ggrdl4[.]com www.gm4rys[.]com Archives Related to PubStately Taurus Activity in Southeast Asia Links to Bookworm Malware
Palo Alto Unit 42
· Aug 17, 2026
domainadibas.topollowing list shows each domain followed by its IP address. adibas[.]top - 46.173.219.161 footarepu[.]top - 35.165.86.173 guntergo"Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware
Palo Alto Unit 42
· Aug 17, 2026
domainastrovoerta.topiuj[.]top - 46.173.219.161 suzemodels[.]top - 35.163.101.72 astrovoerta[.]top - 185.159.130.89 zofelaseo[.]top - 35.163.101.72 These do"Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware
Palo Alto Unit 42
· Aug 17, 2026
domainfootarepu.topn followed by its IP address. adibas[.]top - 46.173.219.161 footarepu[.]top - 35.165.86.173 guntergoner[.]top - 35.163.101.72 gunterg"Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware
Palo Alto Unit 42
· Aug 17, 2026
domainguntergoner.topibas[.]top - 46.173.219.161 footarepu[.]top - 35.165.86.173 guntergoner[.]top - 35.163.101.72 guntergoner[.]top - 185.159.130.89 ibm-te"Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware
Palo Alto Unit 42
· Aug 17, 2026
domainibm-technoligi.toper[.]top - 35.163.101.72 guntergoner[.]top - 185.159.130.89 ibm-technoligi[.]top - 35.165.251.24 ibm-technoligi[.]top - 62.109.29.26 polki"Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware
Palo Alto Unit 42
· Aug 17, 2026
domainpolkiuj.topi[.]top - 35.165.251.24 ibm-technoligi[.]top - 62.109.29.26 polkiuj[.]top - 35.165.251.241 polkiuj[.]top - 46.173.219.161 suzemodel"Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware
Palo Alto Unit 42
· Aug 17, 2026
domainsuzemodels.toplkiuj[.]top - 35.165.251.241 polkiuj[.]top - 46.173.219.161 suzemodels[.]top - 35.163.101.72 astrovoerta[.]top - 185.159.130.89 zofela"Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware
Palo Alto Unit 42
· Aug 17, 2026
domainzofelaseo.topls[.]top - 35.163.101.72 astrovoerta[.]top - 185.159.130.89 zofelaseo[.]top - 35.163.101.72 These domain names were registered a day"Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware
Palo Alto Unit 42
· Aug 17, 2026
domainalita.kzugin.zip Examples for start of URLs generated by plugin.js: alita[.]kz/tmp/installation/language/cs-CZ/counter/ avtotur.com/librMole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics
Palo Alto Unit 42
· Aug 17, 2026
domainanilstone.ir/woorutu63408454 Links from the emails on Friday, April 14: anilstone[.]ir/libraries/joomla/string/wrapper/counter/1.htm AssociatedMole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics
Palo Alto Unit 42
· Aug 17, 2026
domainbel.tramples of fake Microsoft Microsoft Word Online pages: posof.bel[.]tr/counter/1.htm tramplinonline[.]ru/counter/1.htm mattsfotoMole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics
Palo Alto Unit 42
· Aug 17, 2026
domainboorsemsport.beom/libraries/fof/utils/ip/counter/ circus-stroy.ru/counter/ boorsemsport[.]be/templates/yoo_aurora/less/uikit/counter/ eurostandard[.]rMole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics
Palo Alto Unit 42
· Aug 17, 2026
domaineurostandard.roboorsemsport[.]be/templates/yoo_aurora/less/uikit/counter/ eurostandard[.]ro/pics/size1/counter/ forum-turism.org[.]ro/images/layout/cMole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics
Palo Alto Unit 42
· Aug 17, 2026
domainglochemindia.comsize1/counter/ forum-turism.org[.]ro/images/layout/counter/ glochemindia[.]com/modules/mod_roknavmenu/lib/librokmenu/counter/ sportbelijMole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics
Palo Alto Unit 42
· Aug 17, 2026
domainideliverys.coms from the emails on Wednesday, April 12: uspsaeyyuia158140.ideliverys[.]com/ioxoory254772 uspsbhusisoz75.ideliverys[.]com/aagupto83 uMole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics
Palo Alto Unit 42
· Aug 17, 2026
domainmaildeliverys.coms from the emails on Thursday, April 13: aexhnneq102342usps.maildeliverys[.]com/kovcemaw707572 bdguz0371usps.maildeliverys[.]com/usvyneyeMole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics
Palo Alto Unit 42
· Aug 17, 2026
domainmattsfotoalbum.de: 1,537 bytes File description: Contents of plugin.zip from mattsfotoalbum[.]de on April 13th SHA256 hash: 40e8dc147f189baf4660d5db8e0cd1Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics
Palo Alto Unit 42
· Aug 17, 2026
domainonline.ruytes File description: Contents of plugin.zip from tramplin.online[.]ru on April 13th SHA256 hash: a1670db6204f7666ad246cc11736b0Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics
Palo Alto Unit 42
· Aug 17, 2026
domainorg.rocounter/ eurostandard[.]ro/pics/size1/counter/ forum-turism.org[.]ro/images/layout/counter/ glochemindia[.]com/modules/mod_rokMole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics
Palo Alto Unit 42
· Aug 17, 2026
domainsportbelijning.bemindia[.]com/modules/mod_roknavmenu/lib/librokmenu/counter/ sportbelijning[.]be/libraries/joomla/application/web/counter/Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics
Palo Alto Unit 42
· Aug 17, 2026
domaintramplinonline.rut Microsoft Word Online pages: posof.bel[.]tr/counter/1.htm tramplinonline[.]ru/counter/1.htm mattsfotoalbum[.]de/cache/counter/1.htm aniMole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics
Palo Alto Unit 42
· Aug 17, 2026
domainhere.jninmobilaria.com.101.8.169 Nuclear EK domains: lotos.castrumtelcom.com.br , here.jninmobilaria.com.ar Follow-up malware IP address: 46.148.20.32 Follow-up malLocky Ransomware Installed Through Nuclear EK
Palo Alto Unit 42
· Aug 17, 2026
domainjs.cefora.commalware IP address: 46.148.20.32 Follow-up malware domain: js.cefora.com.ar IP addresses from post-infection traffic caused by LockyLocky Ransomware Installed Through Nuclear EK
Palo Alto Unit 42
· Aug 17, 2026
domainlotos.castrumtelcom.com.br.np Nuclear EK IP address: 46.101.8.169 Nuclear EK domains: lotos.castrumtelcom.com.br , here.jninmobilaria.com.ar Follow-up malware IP address: 4Locky Ransomware Installed Through Nuclear EK
Palo Alto Unit 42
· Aug 17, 2026
domainsed.poudelkamal.comand 2016-03-16 Gate IP address: 91.195.12.177 Gate domain: sed.poudelkamal.com.np Nuclear EK IP address: 46.101.8.169 Nuclear EK domains:Locky Ransomware Installed Through Nuclear EK
Palo Alto Unit 42
· Aug 17, 2026
domainddns.netleech pattern was pointing to No-IP.com domains (hopto.org, ddns.net, myftp.biz, serveftp.com, etc). These No-IP domains were eiCampaign Evolution: Darkleech to Pseudo
Palo Alto Unit 42
· Aug 17, 2026
domainhopto.orge same Darkleech pattern was pointing to No-IP.com domains (hopto.org, ddns.net, myftp.biz, serveftp.com, etc). These No-IP domaiCampaign Evolution: Darkleech to Pseudo
Palo Alto Unit 42
· Aug 17, 2026
domainmyftp.bizern was pointing to No-IP.com domains (hopto.org, ddns.net, myftp.biz, serveftp.com, etc). These No-IP domains were either gatesCampaign Evolution: Darkleech to Pseudo
Palo Alto Unit 42
· Aug 17, 2026
domainno-ip.com. By early 2014, the same Darkleech pattern was pointing to No-IP.com domains (hopto.org, ddns.net, myftp.biz, serveftp.com, etc)Campaign Evolution: Darkleech to Pseudo
Palo Alto Unit 42
· Aug 17, 2026
domainserveftp.comnting to No-IP.com domains (hopto.org, ddns.net, myftp.biz, serveftp.com, etc). These No-IP domains were either gates to an EK, or tCampaign Evolution: Darkleech to Pseudo
Palo Alto Unit 42
· Aug 17, 2026
domainaba98.com85.93.0[.]33 - mvcvideo[.]tk 2016-03-14: 85.93.0[.]33 - bab.aba98[.]com 2016-03-29: 85.93.0[.]34 - folesd[.]tk When we first notiHow the EITest Campaign's Path to Angler EK Evolved Over Time
Palo Alto Unit 42
· Aug 17, 2026
domainbobibo.tk85.93.0[.]32 - feedero[.]tk 2016-01-25: 85.93.0[.]32 - www.bobibo[.]tk 2016-01-26: 85.93.0[.]32 - en.robertkuzma[.]com 2016-02-0How the EITest Campaign's Path to Angler EK Evolved Over Time
Palo Alto Unit 42
· Aug 17, 2026
domainco.ukst gate URL 2014-09-22: 148.251.56[.]156 - flv.79highstreet.co[.]uk 2014-10-02: 148.251.56[.]156 - fix-mo[.]tk 2015-06-08: 19How the EITest Campaign's Path to Angler EK Evolved Over Time
Palo Alto Unit 42
· Aug 17, 2026
domaindofned.tk2-03: 85.93.0[.]32 - vyetbr[.]tk 2016-02-10: 85.93.0[.]32 - dofned[.]tk 2016-02-15: 85.93.0[.]32 - zeboms[.]tk 2016-02-18: 85.93.How the EITest Campaign's Path to Angler EK Evolved Over Time
Palo Alto Unit 42
· Aug 17, 2026
domainfeedero.tk31.184.192[.]206 - vecexeze[.]tk 2016-01-19: 85.93.0[.]32 - feedero[.]tk 2016-01-25: 85.93.0[.]32 - www.bobibo[.]tk 2016-01-26: 85How the EITest Campaign's Path to Angler EK Evolved Over Time
Palo Alto Unit 42
· Aug 17, 2026
domainfix-mo.tk6 - flv.79highstreet.co[.]uk 2014-10-02: 148.251.56[.]156 - fix-mo[.]tk 2015-06-08: 194.15.126[.]7 - joans[.]ga 2015-11-10: 31.18How the EITest Campaign's Path to Angler EK Evolved Over Time
Palo Alto Unit 42
· Aug 17, 2026
domainfolesd.tk: 85.93.0[.]33 - bab.aba98[.]com 2016-03-29: 85.93.0[.]34 - folesd[.]tk When we first noticed the EITest gate in September 2014,How the EITest Campaign's Path to Angler EK Evolved Over Time
Palo Alto Unit 42
· Aug 17, 2026
domainjoans.ga148.251.56[.]156 - fix-mo[.]tk 2015-06-08: 194.15.126[.]7 - joans[.]ga 2015-11-10: 31.184.192[.]206 - ymest[.]ml 2015-12-04: 31.How the EITest Campaign's Path to Angler EK Evolved Over Time
Palo Alto Unit 42
· Aug 17, 2026
domainmvcvideo.tk3-07: 85.93.0[.]33 - nixsys[.]tk 2016-03-09: 85.93.0[.]33 - mvcvideo[.]tk 2016-03-14: 85.93.0[.]33 - bab.aba98[.]com 2016-03-29: 85How the EITest Campaign's Path to Angler EK Evolved Over Time
Palo Alto Unit 42
· Aug 17, 2026
domainnixsys.tk3-04: 85.93.0[.]33 - vovevy[.]tk 2016-03-07: 85.93.0[.]33 - nixsys[.]tk 2016-03-09: 85.93.0[.]33 - mvcvideo[.]tk 2016-03-14: 85.9How the EITest Campaign's Path to Angler EK Evolved Over Time
Palo Alto Unit 42
· Aug 17, 2026
domainrobertkuzma.com5.93.0[.]32 - www.bobibo[.]tk 2016-01-26: 85.93.0[.]32 - en.robertkuzma[.]com 2016-02-03: 85.93.0[.]32 - vyetbr[.]tk 2016-02-10: 85.93.How the EITest Campaign's Path to Angler EK Evolved Over Time
Palo Alto Unit 42
· Aug 17, 2026
domainsyte4.com: 85.93.0[.]32 - zeboms[.]tk 2016-02-18: 85.93.0[.]32 - 14s.syte4[.]com 2016-03-04: 85.93.0[.]33 - vovevy[.]tk 2016-03-07: 85.93.How the EITest Campaign's Path to Angler EK Evolved Over Time
Palo Alto Unit 42
· Aug 17, 2026
domainvecexeze.tk1.184.192[.]206 - ymest[.]ml 2015-12-04: 31.184.192[.]206 - vecexeze[.]tk 2016-01-19: 85.93.0[.]32 - feedero[.]tk 2016-01-25: 85.93How the EITest Campaign's Path to Angler EK Evolved Over Time
Palo Alto Unit 42
· Aug 17, 2026
domainvovevy.tk: 85.93.0[.]32 - 14s.syte4[.]com 2016-03-04: 85.93.0[.]33 - vovevy[.]tk 2016-03-07: 85.93.0[.]33 - nixsys[.]tk 2016-03-09: 85.93.How the EITest Campaign's Path to Angler EK Evolved Over Time
Palo Alto Unit 42
· Aug 17, 2026
domainvyetbr.tk93.0[.]32 - en.robertkuzma[.]com 2016-02-03: 85.93.0[.]32 - vyetbr[.]tk 2016-02-10: 85.93.0[.]32 - dofned[.]tk 2016-02-15: 85.93.How the EITest Campaign's Path to Angler EK Evolved Over Time
Palo Alto Unit 42
· Aug 17, 2026
domainymest.ml194.15.126[.]7 - joans[.]ga 2015-11-10: 31.184.192[.]206 - ymest[.]ml 2015-12-04: 31.184.192[.]206 - vecexeze[.]tk 2016-01-19:How the EITest Campaign's Path to Angler EK Evolved Over Time
Palo Alto Unit 42
· Aug 17, 2026
domainzeboms.tk2-10: 85.93.0[.]32 - dofned[.]tk 2016-02-15: 85.93.0[.]32 - zeboms[.]tk 2016-02-18: 85.93.0[.]32 - 14s.syte4[.]com 2016-03-04: 85How the EITest Campaign's Path to Angler EK Evolved Over Time
Palo Alto Unit 42
· Aug 17, 2026
domainafraid.orgare. This campaign uses gates registered through FreeDNS at afraid.org. We are calling this the Afraidgate campaign. Although we cAfraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Palo Alto Unit 42
· Aug 17, 2026
domainallofuslikesforums.com.11 port 80 - tonthishessici[.]com 207.182.148.92 port 80 - allofuslikesforums[.]com 85.25.79.211 port 80 - oqpwldjc.mjobrkn3[.]eu (using a VMAfraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Palo Alto Unit 42
· Aug 17, 2026
domainbreastcanceroutreach.comstate[.]com 192.169.190.97 port 80 - frageboegen-plletyksin.breastcanceroutreach[.]com 192.169.190.97 port 80 - reikleivn-azarashi.orlandohomesbAfraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Palo Alto Unit 42
· Aug 17, 2026
domaincetinhechinhis.com.203 port 80 - ranetardinghap[.]com 93.190.141.27 port 80 - cetinhechinhis[.]com 95.211.205.218 port 80 - tedgeroatref[.]com 104.193.252.2Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Palo Alto Unit 42
· Aug 17, 2026
domaincom.arin this campaign: 185.118.164.42 port 80 - host.vivialvarez.com[.]ar - GET /widget.js 185.118.164.42 port 80 - kw.projetoraizeAfraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Palo Alto Unit 42
· Aug 17, 2026
domaincom.br- GET /widget.js 185.118.164.42 port 80 - kw.projetoraizes.com[.]br - GET /js/script.js 185.118.164.42 port 80 - net.jacquielAfraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Palo Alto Unit 42
· Aug 17, 2026
domainco.ukhevets[.]org 85.25.160.124 port 80 - mcimaildmz.dinnerplate.co[.]uk 192.169.189.167 port 80 - candidulumbestuurlijk.newlandsiAfraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Palo Alto Unit 42
· Aug 17, 2026
domainesteroscreen.comlandohomesbydevito[.]com 209.126.120.8 port 80 - litigators.esteroscreen[.]com Bedep post-infection traffic: 104.193.252.241 port 80 - qAfraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Palo Alto Unit 42
· Aug 17, 2026
domainhelpthevets.orgET /js/script.js Angler EK: 85.25.160.124 port 80 - bintiye.helpthevets[.]org 85.25.160.124 port 80 - mcimaildmz.dinnerplate.co[.]uk 19Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Palo Alto Unit 42
· Aug 17, 2026
domainmjobrkn3.eu- allofuslikesforums[.]com 85.25.79.211 port 80 - oqpwldjc.mjobrkn3[.]eu (using a VM) CryptXXX post-infection traffic: 217.23.6.40Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Palo Alto Unit 42
· Aug 17, 2026
domainnewlandsierrarealestate.comate.co[.]uk 192.169.189.167 port 80 - candidulumbestuurlijk.newlandsierrarealestate[.]com 192.169.190.97 port 80 - frageboegen-plletyksin.breastcanAfraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Palo Alto Unit 42
· Aug 17, 2026
domainorlandohomesbydevito.comroutreach[.]com 192.169.190.97 port 80 - reikleivn-azarashi.orlandohomesbydevito[.]com 209.126.120.8 port 80 - litigators.esteroscreen[.]com BedAfraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Palo Alto Unit 42
· Aug 17, 2026
domainqrwzoxcjatynejejsz.comcom Bedep post-infection traffic: 104.193.252.241 port 80 - qrwzoxcjatynejejsz[.]com 95.211.205.228 port 80 - yfczmludodohkdqnij[.]com (usingAfraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Palo Alto Unit 42
· Aug 17, 2026
domainranetardinghap.comm (using a VM) Click-fraud traffic: 5.199.141.203 port 80 - ranetardinghap[.]com 93.190.141.27 port 80 - cetinhechinhis[.]com 95.211.205.2Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Palo Alto Unit 42
· Aug 17, 2026
domainrerobloketbo.com.218 port 80 - tedgeroatref[.]com 104.193.252.236 port 80 - rerobloketbo[.]com 162.244.34.11 port 80 - tonthishessici[.]com 207.182.148.Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Palo Alto Unit 42
· Aug 17, 2026
domaintedgeroatref.com.27 port 80 - cetinhechinhis[.]com 95.211.205.218 port 80 - tedgeroatref[.]com 104.193.252.236 port 80 - rerobloketbo[.]com 162.244.34.1Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Palo Alto Unit 42
· Aug 17, 2026
domaintonthishessici.com52.236 port 80 - rerobloketbo[.]com 162.244.34.11 port 80 - tonthishessici[.]com 207.182.148.92 port 80 - allofuslikesforums[.]com 85.25.7Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Palo Alto Unit 42
· Aug 17, 2026
domainyfczmludodohkdqnij.comport 80 - qrwzoxcjatynejejsz[.]com 95.211.205.228 port 80 - yfczmludodohkdqnij[.]com (using a VM) Click-fraud traffic: 5.199.141.203 port 80 -Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Palo Alto Unit 42
· Aug 17, 2026
domaindyndns.orgnfo - gate pointing to Rig EK 5.61.37[.]139 - kjyrxilohcowy.dyndns[.]org - Rig EK on 2016-06-23 5.61.32[.]163 - smobutdobesy.dyndnCryptoBit: Another Ransomware Family Gets an Update
Palo Alto Unit 42
· Aug 17, 2026
domainlaoismacau.comsy.dyndns.org[.]org - Rig EK on 2016-06-24 58.64.142[.]89 - laoismacau[.]com - post-infection traffic from CryptoBit The gate checkedCryptoBit: Another Ransomware Family Gets an Update
Palo Alto Unit 42
· Aug 17, 2026
domainorg.org- Rig EK on 2016-06-23 5.61.32[.]163 - smobutdobesy.dyndns.org[.]org - Rig EK on 2016-06-24 58.64.142[.]89 - laoismacau[.]comCryptoBit: Another Ransomware Family Gets an Update
Palo Alto Unit 42
· Aug 17, 2026
domainrealstatistics.info, this particular campaign used a gate with the domain name realstatistics[.]info that pointed to Rig EK. If a vulnerable Windows host encoCryptoBit: Another Ransomware Family Gets an Update
Palo Alto Unit 42
· Aug 17, 2026
domainsmobutdobesy.dyndns.orglohcowy.dyndns[.]org - Rig EK on 2016-06-23 5.61.32[.]163 - smobutdobesy.dyndns.org[.]org - Rig EK on 2016-06-24 58.64.142[.]89 - laoismacau[.]CryptoBit: Another Ransomware Family Gets an Update
Palo Alto Unit 42
· Aug 17, 2026
domainactivebeliever.comom - GET /rokmediaqueries.js 188.166.38.125 port 80 - siber.activebeliever[.]com - GET /plugins/fancybox-for-wordpress/js/jquery.easing.1.Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Palo Alto Unit 42
· Aug 17, 2026
domainafraid.orgn continues to utilize gate domains using name servers from afraid.org. Changing Payloads As early as June 29, 2016 , we saw the AAfraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Palo Alto Unit 42
· Aug 17, 2026
domainatchisoncountyrecorder.com- GET /scripts/jquery.form.js 46.101.26.161 port 80 - motor.atchisoncountyrecorder[.]com - GET /js/blog.js 46.101.26.161 port 80 - motor.atchisoncAfraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Palo Alto Unit 42
· Aug 17, 2026
domainblautechnology.comom[.]br - GET /gantry-totop.js 46.101.26.161 port 80 - snow.blautechnology[.]com - GET /scripts/libs.js 46.101.26.161 port 80 - start.puteAfraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Palo Alto Unit 42
· Aug 17, 2026
domainbluechristian.toprdfngwg.blueelizabeth[.]top 185.140.33.99 port 80 - clfdkbl.bluechristian[.]top 185.140.33.99 port 80 - drhffhveq.greenjessica[.]top 185.Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Palo Alto Unit 42
· Aug 17, 2026
domainblueelizabeth.tophxmst.rautumngreen[.]top 185.140.33.99 port 80 - bkhrdfngwg.blueelizabeth[.]top 185.140.33.99 port 80 - clfdkbl.bluechristian[.]top 185.1Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Palo Alto Unit 42
· Aug 17, 2026
domainbsuperpink.toprt 80 - azbepfasz.yintored[.]top 5.2.72.236 port 80 - bkubf.bsuperpink[.]top 5.2.72.114 port 80 - iynwzttqd.hautumngreen[.]top 5.2.72.Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Palo Alto Unit 42
· Aug 17, 2026
domaincom.brcripts/custom.js 46.101.26.161 port 80 - oskol.migustapizza.com[.]br - GET /gantry-totop.js 46.101.26.161 port 80 - snow.blautAfraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Palo Alto Unit 42
· Aug 17, 2026
domaingreenjessica.topfdkbl.bluechristian[.]top 185.140.33.99 port 80 - drhffhveq.greenjessica[.]top 185.140.33.99 port 80 - rklfdprel.blueelizabeth[.]top LocAfraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Palo Alto Unit 42
· Aug 17, 2026
domainhautumngreen.top80 - bkubf.bsuperpink[.]top 5.2.72.114 port 80 - iynwzttqd.hautumngreen[.]top 5.2.72.236 port 80 - mxoug.yintored[.]top 5.2.72.236 portAfraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Palo Alto Unit 42
· Aug 17, 2026
domainladeratutors.com.]com - GET /js/addOnLoad.js 188.166.38.125 port 80 - nepal.laderatutors[.]com - GET /rokmediaqueries.js 188.166.38.125 port 80 - siber.Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Palo Alto Unit 42
· Aug 17, 2026
domainmafterred.topegoxmvzpx.bsuperpink[.]top 185.140.33.76 port 80 - erfxsnvj.mafterred[.]top 185.140.33.76 port 80 - hxmst.rautumngreen[.]top 185.140.Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Palo Alto Unit 42
· Aug 17, 2026
domainoautumnyellow.top- GET /to_top.js Neutrino EK: 5.2.72.236 port 80 - avukytj.oautumnyellow[.]top 5.2.72.236 port 80 - azbepfasz.yintored[.]top 5.2.72.236Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Palo Alto Unit 42
· Aug 17, 2026
domainonion.tostructions: mphtadhci5mrdlju.tor2web[.]org mphtadhci5mrdlju.onion[.]to zjfq4lnfbs7pncr5.tor2web[.]org zjfq4lnfbs7pncr5.onion[.]tAfraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Palo Alto Unit 42
· Aug 17, 2026
domainpolatoglumimarlik.comery.easing.1.3.min.js?ver=1.3 188.166.38.125 port 80 - zine.polatoglumimarlik[.]com - GET /scripts/jquery.sliderkit.1.9.2.pack.js 188.166.38.Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Palo Alto Unit 42
· Aug 17, 2026
domainputerasyawal.com[.]com - GET /scripts/libs.js 46.101.26.161 port 80 - start.puterasyawal[.]com - GET /js/addOnLoad.js 188.166.38.125 port 80 - nepal.ladAfraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Palo Alto Unit 42
· Aug 17, 2026
domainrautumngreen.top80 - erfxsnvj.mafterred[.]top 185.140.33.76 port 80 - hxmst.rautumngreen[.]top 185.140.33.99 port 80 - bkhrdfngwg.blueelizabeth[.]top 18Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Palo Alto Unit 42
· Aug 17, 2026
domainstmaryschooldmt.comhe Afraidgate campaign: Gates: 46.101.26.161 port 80 - leon.stmaryschooldmt[.]com - GET /scripts/jquery.form.js 46.101.26.161 port 80 - motAfraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Palo Alto Unit 42
· Aug 17, 2026
domaintor2web.orgDomains from the decryption instructions: mphtadhci5mrdlju.tor2web[.]org mphtadhci5mrdlju.onion[.]to zjfq4lnfbs7pncr5.tor2web[.]orAfraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Palo Alto Unit 42
· Aug 17, 2026
domainyintored.topavukytj.oautumnyellow[.]top 5.2.72.236 port 80 - azbepfasz.yintored[.]top 5.2.72.236 port 80 - bkubf.bsuperpink[.]top 5.2.72.114 poAfraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Palo Alto Unit 42
· Aug 17, 2026
domaindropbox.combuinte[.]com - GET /Contribuinte/Iptu/ HTTPS via port 443 - dropbox[.]com - GET /s/ss6op2vxi3ggnhe/Notificacao%28Iptu-.-2017%29.zipMalspam Targeting Brazil Continues to Evolve
Palo Alto Unit 42
· Aug 17, 2026
domaingoo.gldownloaded the malicious zip archive: HTTPS via port 443 – goo[.]gl - GET /htm4qG HTTPS via port 443 - googleapis[.]com - GETMalspam Targeting Brazil Continues to Evolve
Palo Alto Unit 42
· Aug 17, 2026
domaingoogleapis.comvia port 443 – goo[.]gl - GET /htm4qG HTTPS via port 443 - googleapis[.]com - GET /pid/2via.html HTTP via port 80 - gov.br.impostoconMalspam Targeting Brazil Continues to Evolve
Palo Alto Unit 42
· Aug 17, 2026
domainimpostocontribuinte.comleapis[.]com - GET /pid/2via.html HTTP via port 80 - gov.br.impostocontribuinte[.]com - GET /Contribuinte/Iptu/ HTTPS via port 443 - dropbox[.]Malspam Targeting Brazil Continues to Evolve
Palo Alto Unit 42
· Aug 17, 2026
domainhealthymagination.com. Among the expired domains Sable Squirrel has acquired are healthymagination.com, originally a General Electric health initiative, and rezilCrooks Are Buying Your Expired Domains and Using Them to Deliver Malware
Security Affairs
· Aug 16, 2026

Extraction is regex-based (SHA-256/SHA-1/MD5, public IPv4, defanged hxxp/[.] indicators, and bare domains/emails only from malware, actor, exploit, phishing, ransomware and breach articles with a nearby indicator context word). Treat confidence as low until you verify against the source article.