Indicators of Compromise

Domain

TLP:CLEAR

coincidentbitter.com

ThreatFox: Unknown malware

85% confidence

Added

2026-08-11

Filename

TLP:CLEAR

msuitl.exe

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

msuitl.tar

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

173.254.204.72

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

warsanservices.com

50% confidence

Added

2026-08-09

SHA-256 Hash

TLP:CLEAR

55f75724386dbe740c0b868da913af2c8b280335da4fde64e2300c776b79d4e8

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

RdxFactory.exe

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

urocakpmpanel.com

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

95.169.180.122

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

jacknwoods.com

50% confidence

Added

2026-08-09

URL

TLP:CLEAR

http:///vbgf.php?mo=%computername%--%username%

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

levarisnetqlsvc.net

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

function.The

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

olmajhnservice.com

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

woodstocktutors.com

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

jbc.php

50% confidence

Added

2026-08-09

URL

TLP:CLEAR

http:///svch.php?li=%computername%..%username%

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

blucollinsoutien.com

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

sdf.php

50% confidence

Added

2026-08-09

URL

TLP:CLEAR

http:///svupfl.php?oi=%computername%_%username%

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

abc1.pdf

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

princecleanit.com

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

dune64.bin

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

utizviewstation.com

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

shh.exe

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

cayote.log

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

helpdesk.autodefragapp.com

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

autodefragapp.com

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

46.229.55.63

50% confidence

Added

2026-08-09

URL

TLP:CLEAR

https://bitter-limit-a1c1.dazesdsxcxmlcxcxcc.workers.dev/

PhishTank: https://bitter-limit-a1c1.dazesdsxcxmlcxcxcc.workers.dev/

90% confidence

Added

2026-08-07

Domain

TLP:CLEAR

bittertafel.ergonshopusa.com

75% confidence

Added

2026-07-26

Domain

TLP:CLEAR

bittertafel.ergonshopusa.com

75% confidence

Added

2026-07-26

Domain

TLP:CLEAR

gebitterde-durfdaad.higginsrestoration.net

75% confidence

Added

2026-07-26

Domain

TLP:CLEAR

gebitterde-durfdaad.higginsrestoration.net

75% confidence

Added

2026-07-26

Domain

TLP:CLEAR

bittersweetkennel.com

ThreatFox: ClearFake

85% confidence

Added

2026-07-19

Domain

TLP:CLEAR

ystr.bittersweetkennel.com

ThreatFox: ClearFake

85% confidence

Added

2026-07-19

Domain

TLP:CLEAR

bitter-salty.digital

ThreatFox: ClearFake

85% confidence

Added

2026-07-04

SHA-1 Hash

TLP:CLEAR

fa64ee115ff67e796d41f639ad4eba87de800f4b

SSLBL Cert: Bitter C&C

85% confidence

Added

2026-05-26

Domain

TLP:CLEAR

1y9a9xkq.bitter-salty.digital

ThreatFox: ClearFake

85% confidence

Added

2026-05-14

Domain

TLP:CLEAR

p4l3fctz.bitter-salty.digital

ThreatFox: ClearFake

85% confidence

Added

2026-05-14

URL

TLP:CLEAR

https://bitter-glitter-3cd5.epd5tuee.workers.dev/cd5490f6-dbf0-4f93-bb21-f8abb4af035f

MISP: https://bitter-glitter-3cd5.epd5tuee.workers.dev/cd5490f6-dbf0-4f93-bb21-f8abb4af035f

50% confidence

Added

2026-05-06

URL

TLP:CLEAR

https://bitter-glitter-3cd5.epd5tuee.workers.dev/87ea057f-c531-4c7e-82f6-0db77e23877f

MISP: https://bitter-glitter-3cd5.epd5tuee.workers.dev/87ea057f-c531-4c7e-82f6-0db77e23877f

50% confidence

Added

2026-05-06

URL

TLP:CLEAR

https://bitter-glitter-3cd5.epd5tuee.workers.dev/61ad5154-b481-4697-875a-0c6535039f60

MISP: https://bitter-glitter-3cd5.epd5tuee.workers.dev/61ad5154-b481-4697-875a-0c6535039f60

50% confidence

Added

2026-05-06

URL

TLP:CLEAR

https://bitter-glitter-3cd5.epd5tuee.workers.dev/7da54e1f-29d2-413b-b640-23e3c1541d68

MISP: https://bitter-glitter-3cd5.epd5tuee.workers.dev/7da54e1f-29d2-413b-b640-23e3c1541d68

50% confidence

Added

2026-05-06

URL

TLP:CLEAR

https://bitter-glitter-3cd5.epd5tuee.workers.dev/56f8a48a-f721-439e-938a-2da2bef8b674

MISP: https://bitter-glitter-3cd5.epd5tuee.workers.dev/56f8a48a-f721-439e-938a-2da2bef8b674

50% confidence

Added

2026-05-06

URL

TLP:CLEAR

https://bitter-glitter-3cd5.epd5tuee.workers.dev/ad6f4118-9a49-4966-8892-b3fb6fe081ef

MISP: https://bitter-glitter-3cd5.epd5tuee.workers.dev/ad6f4118-9a49-4966-8892-b3fb6fe081ef

50% confidence

Added

2026-05-06

URL

TLP:CLEAR

https://bitter-glitter-3cd5.epd5tuee.workers.dev/71cd08cb-f1a6-4732-a8d4-ae949ab53ecb

MISP: https://bitter-glitter-3cd5.epd5tuee.workers.dev/71cd08cb-f1a6-4732-a8d4-ae949ab53ecb

50% confidence

Added

2026-05-06

URL

TLP:CLEAR

https://bitter-glitter-3cd5.epd5tuee.workers.dev/cb9e210f-255e-4b9f-86e9-19e269526666

MISP: https://bitter-glitter-3cd5.epd5tuee.workers.dev/cb9e210f-255e-4b9f-86e9-19e269526666

50% confidence

Added

2026-05-06

URL

TLP:CLEAR

https://bitter-glitter-3cd5.epd5tuee.workers.dev/4937a868-6e64-494f-ac3f-c58ee6966ff7

MISP: https://bitter-glitter-3cd5.epd5tuee.workers.dev/4937a868-6e64-494f-ac3f-c58ee6966ff7

50% confidence

Added

2026-05-06

URL

TLP:CLEAR

https://bitter-glitter-3cd5.epd5tuee.workers.dev/d7e5a9e9-d8a4-496b-9f9b-cfab53738b1c

MISP: https://bitter-glitter-3cd5.epd5tuee.workers.dev/d7e5a9e9-d8a4-496b-9f9b-cfab53738b1c

50% confidence

Added

2026-05-06