Indicators of Compromise

Domain

TLP:CLEAR

earth-baxia-spear-phishing-and-geoserver-exploit.html

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

dl.wel1.ru

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

75% confidence

Added

2026-08-10

Domain

TLP:CLEAR

2.sdk.dl.wel1.ru

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

75% confidence

Added

2026-08-10

Domain

TLP:CLEAR

1.sdk.dl.wel1.ru

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

75% confidence

Added

2026-08-10

Domain

TLP:CLEAR

0.sdk.dl.wel1.ru

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

75% confidence

Added

2026-08-10

SHA-256 Hash

TLP:CLEAR

e2650e9aa2f924433ba422857b22ee7c5996b5ad306f3f903283f6a13e248935

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

75% confidence

Added

2026-08-10

SHA-256 Hash

TLP:CLEAR

c214746c74cae8ece8bdaf69aa05da4db6ce013f9e77452d1eed1a002fd9ba00

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

75% confidence

Added

2026-08-10

SHA-256 Hash

TLP:CLEAR

b74c5675725911c62091bdf40714df760cc2af7a88360d21065f4e1c878aa8f0

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

75% confidence

Added

2026-08-10

SHA-256 Hash

TLP:CLEAR

a3e2ffb440b779d30da3ff282affd649731088e8570df7b1aa72742d995b782c

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

75% confidence

Added

2026-08-10

SHA-256 Hash

TLP:CLEAR

94ef6b1c4a9d31f78f446d053048bcef34fd88f4376a1a46f7f777a9e9c83a29

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

75% confidence

Added

2026-08-10

SHA-256 Hash

TLP:CLEAR

7e486657f30594afda379b97030252a09a19fe8055e25c9e371544f59bd8e9e3

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

75% confidence

Added

2026-08-10

SHA-256 Hash

TLP:CLEAR

0fc30f82e1fa5e51a6c0c43f3ed7f13592ea731cb331e43a4d085df60a4db8b6

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

75% confidence

Added

2026-08-10

SHA-1 Hash

TLP:CLEAR

bc3ae1e11c283e9e3d57c02abf24870f4e8cfaa1

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

75% confidence

Added

2026-08-10

MD5 Hash

TLP:CLEAR

d382fdae4e2675b94419fdb115dbd397

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

75% confidence

Added

2026-08-10

Domain

TLP:CLEAR

net.dl.wel1.ru

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

75% confidence

Added

2026-08-10

Domain

TLP:CLEAR

pkg.dl.wel1.ru

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

75% confidence

Added

2026-08-10

Domain

TLP:CLEAR

ext.dl.wel1.ru

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

75% confidence

Added

2026-08-10

Domain

TLP:CLEAR

sdk.dl.wel1.ru

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

75% confidence

Added

2026-08-10

Domain

TLP:CLEAR

wel1.ru

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

75% confidence

Added

2026-08-10

Domain

TLP:CLEAR

hopto.org

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

zapto.org

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

serveblog.net

50% confidence

Added

2026-08-10

Filename

TLP:CLEAR

scrcons.exe

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

redirectme.net

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

3utilities.com

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

onthewifi.com

50% confidence

Added

2026-08-10

Filename

TLP:CLEAR

pgodb100.dll

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

security.evtx

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

Compliance.rdp

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

Verification.rdp

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

Test.rdp

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

Start.rdp

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

swpartners.com.au

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

cewalton.com

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

totalconstruction.com.au

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

townoflakelure.com

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

Check.rdp

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

Configuration.rdp

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

sellar.co.uk

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

Access.rdp

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

ghazacast.com

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

ikhwancast.com

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

Venezuela.zip

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

fr24cast.com

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

koramate.fun

Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases

75% confidence

Added

2026-08-06

Domain

TLP:CLEAR

grace2019.teamernst.net

Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases

75% confidence

Added

2026-08-06

Domain

TLP:CLEAR

hesenorm.info

Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases

75% confidence

Added

2026-08-06

Domain

TLP:CLEAR

desk-azureft.info

Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases

75% confidence

Added

2026-08-06

Domain

TLP:CLEAR

cristiantirira.com

Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases

75% confidence

Added

2026-08-06

Domain

TLP:CLEAR

casinolegit.fun

Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases

75% confidence

Added

2026-08-06