Indicators of Compromise

Domain

TLP:CLEAR

GhostSec.Wkr

50% confidence

Added

2026-08-09

URL

TLP:CLEAR

hxxp://94.103.91.246/addInfection

Ransomware.live IOC (Ghostsec): hxxp://94.103.91.246/addInfection

75% confidence

Added

2026-05-05

URL

TLP:CLEAR

hxxp://94.103.91.246/victimchat?id=[EncryptionID]

Ransomware.live IOC (Ghostsec): hxxp://94.103.91.246/victimchat?id=[EncryptionID]

75% confidence

Added

2026-05-05

URL

TLP:CLEAR

hxxp://94.103.91.246/login?next=

Ransomware.live IOC (Ghostsec): hxxp://94.103.91.246/login?next=

75% confidence

Added

2026-05-05

URL

TLP:CLEAR

hxxp://94.103.91.246/upload

Ransomware.live IOC (Ghostsec): hxxp://94.103.91.246/upload

75% confidence

Added

2026-05-05

IPv4 Address

TLP:CLEAR

94.103.91.246

Ransomware.live IOC (Ghostsec): 94.103.91.246

75% confidence

Added

2026-05-05

SHA-256 Hash

TLP:CLEAR

a1b468e9550f9960c5e60f7c52ca3c058de19d42eafa760b9d5282eb24b7c55f

Ransomware.live IOC (Ghostsec): a1b468e9550f9960c5e60f7c52ca3c058de19d42eafa760b9d5282eb24b7c55f

75% confidence

Added

2026-05-05

URL

TLP:CLEAR

hxxp://94.103.91.246/incrementLaunch

Ransomware.live IOC (Ghostsec): hxxp://94.103.91.246/incrementLaunch

75% confidence

Added

2026-05-05

SHA-256 Hash

TLP:CLEAR

8b758ccdfbfa5ff3a0b67b2063c2397531cf0f7b3d278298da76528f443779e9

Ransomware.live IOC (Ghostsec): 8b758ccdfbfa5ff3a0b67b2063c2397531cf0f7b3d278298da76528f443779e9

75% confidence

Added

2026-05-05

SHA-256 Hash

TLP:CLEAR

36760e9bbfaf5a28ec7f85d13c7e8078a4ee4e5168b672639e97037d66eb1d17

Ransomware.live IOC (Ghostsec): 36760e9bbfaf5a28ec7f85d13c7e8078a4ee4e5168b672639e97037d66eb1d17

75% confidence

Added

2026-05-05

SHA-256 Hash

TLP:CLEAR

8fa28795e4cd95e6c78c4a1308ea80674102669f9980b2006599d82eff6237b3

Ransomware.live IOC (Ghostsec): 8fa28795e4cd95e6c78c4a1308ea80674102669f9980b2006599d82eff6237b3

75% confidence

Added

2026-05-05