Skip to content
THE HUNTER’S LEDGER
IOC Feed
Multi-Actor AI-Agent Framework Abuse (8 Operators)
99 indicators extracted from this investigation's feed. Filter by type, then copy or download exactly what is on screen.
Raw JSON feedFull reportDetection rules
99 shown
TypeIndicatorConfidenceActionFP risk
ipv4 139.59.239.112HIGHBLOCK
ipv4 158.178.214.94LOWMONITORConfirmed legitimate developer (elyasbetter@gmail.com owns alumni platform); NOT a threat actor
ipv4 165.227.175.161DEFINITEBLOCKUnderlying VPS host belongs to GetYourGroup GmbH legitimate tourism platform - notify victim before blocking
ipv4 173.249.2.23LOWMONITORConfirmed false positive per Phase 11 review (979 source files, 226 grep hits all FP); NOT a threat actor - notify Anthropic on exposed credentials only
ipv4 188.166.194.243HIGHMONITOR
ipv4 209.38.205.158DEFINITEBLOCK
ipv4 213.165.51.115DEFINITEBLOCK
ipv4 221.150.15.104DEFINITEBLOCK
ipv4 34.34.57.141HIGHBLOCK
ipv4 34.34.81.129MODERATEBLOCK
ipv4 35.192.41.201HIGHBLOCK
ipv4 47.110.83.41LOWMONITORConfirmed legitimate Chinese AI developer; port 666 is symbolic choice, not malicious; NOT a threat actor
ipv4 5.230.201.54DEFINITEBLOCK
ipv4 66.94.120.32LOWMONITORConfirmed false positive per Phase 11 review (213 triage reports, 0 real offensive hits); NOT a threat actor - notify HF + Anthropic + OpenAI + Google T&S on exposed credentials only
ipv4 68.183.92.28HIGHBLOCK
ipv4 77.110.125.145DEFINITEBLOCK
ipv4 77.110.96.200DEFINITEBLOCK
ipv4 80.211.111.10DEFINITEBLOCK
ipv4 80.211.94.16DEFINITEBLOCK
ipv4 85.17.70.56HIGHBLOCK
ipv4 87.106.143.220DEFINITEBLOCK
ipv4 87.106.54.213HIGHBLOCK
ipv4 95.211.175.167HIGHBLOCK
domain antipublic.oneHIGHMONITOR
domain arpa-autolearn.serviceDEFINITE
domain arpa-daemon.serviceDEFINITE
domain arpa-instana-api.serviceDEFINITE
domain arpa-parallel.serviceDEFINITE
domain auto.c3pool.orgHIGHMONITOR
domain bot.shDEFINITEBLOCK
domain c2.tralalarkefe.comHIGHBLOCK
domain catchall1.tralalarkefe.comHIGHBLOCK
domain cfx-asia1.nanopool.orgHIGHMONITOR
domain cfx.kryptex.networkHIGHMONITOR
domain docs.openclaw.aiHIGHMONITOR
domain duty-free.ccHIGHMONITOR
domain etc.kryptex.networkHIGHMONITOR
domain hermes-agent.nousresearch.comMODERATEMONITORLegitimate NousResearch endpoint; presence alone is not malicious
domain lightmake.siteHIGHMONITOR
domain openclaw.aiHIGHMONITOR
domain pandora.shDEFINITEBLOCK
domain payloads.tralalarkefe.comHIGHBLOCK
domain skillhub-1388575217.cos.ap-guangzhou.myqcloud.comHIGHMONITOR
domain soul.mdMODERATEMONITORLegitimate Hermes/OpenClaw installations carry this file by default; only malicious when combined with offensive tooling
domain tenant-upcoming-great-descending.trycloudflare.comHIGHBLOCK
domain tralalarkefe.comDEFINITEBLOCK
url http://209.38.205.158:8096/api/ingest/instanaDEFINITEBLOCK
url http://5.230.201.54/api/v/keylogDEFINITEBLOCK
url http://5.230.201.54:8080/decryption_key.txtDEFINITEBLOCK
url http://5.230.201.54:8080/encrypted_v2.b64DEFINITEBLOCK
url http://77.110.96.200/libpam_cache.cDEFINITEBLOCK
url http://77.110.96.200/libpam_cache.soDEFINITEBLOCK
url http://77.110.96.200:3301DEFINITEBLOCK
url https://openclaw.ai/install.shHIGHMONITOR
sha256 0c748b9e8bc6b5b4fe989df67655f3301d28ef81617b9cbe8e0f6a19d4f9b657DEFINITEBLOCK
sha256 23c3719c7f949d6074fd3505928116df52de0e95e18a0a9e8c966b276b08e4eeDEFINITEBLOCK
sha256 2e07f091d401c1f2267537a2f7c2cb5f68a1c1d994abfc87270dcdf38e8f84bbDEFINITEBLOCK
sha256 2fd960f0ce8b9eb86b37d7389599df080bc831b397f3aaaf212b85278039c2ecDEFINITEBLOCK
sha256 3a10ce135b52753beda81368712decc49a83715d527e00660c19f69d1b4879daMODERATEMONITORLegitimate Hermes/OpenClaw installations carry this file by default; only malicious when combined with offensive tooling
sha256 518e957c198aceb3b99e8863e311f48aa52a552c195a71822bd601810f337068DEFINITEBLOCK
sha256 5305c7fc5dbae5c7630984ea0a00568594e4fbb84eca68ab6a05aef97c2e9e03DEFINITEBLOCK
sha256 58ef3f244dab408fac7117606843a3dbcfb0754b2032a5950e977bc1811c0313DEFINITEBLOCK
sha256 5de806617a6d7949a547076d4eb304e6f695cfcac3860bf4c1d5838026ac871fDEFINITEMONITOR
sha256 64afc3b3a02706ffcf4255bda4519f8c1c66daaaf937a2641fd14a551a34e383DEFINITEBLOCK
sha256 7033c45472d358e48e333839e680509ee42d9349bc389d747a424ba74315939eDEFINITEBLOCK
sha256 7112cd222d1c90fa18fc4f5520800a44891ad5770bdda71772d471377d66b1eeDEFINITEBLOCK
sha256 a24f5b066c6b2e1d4b64d8e2ae863f579281489fcd990d46fb4ece3c2fb397f0MODERATEMONITORLegitimate NousResearch Hermes installations may carry this file
sha256 bc5846c28aca370144d9fbb240a8ab913d3ba98d2a397a5e658435a67d8436e6DEFINITEDETECT
sha256 d3fd9994b16dc9b14c29f7faf7b5f6c84f44b06fccf82f0031a0871ce5e20e17DEFINITEBLOCK
sha256 d55e488cb7af11ab252cfacbfeb2c9d30289d371d9b54af85466e8814f25ca02DEFINITEBLOCK
sha256 eaaa10c840de23335abae1a9ead0a6a7fb7be5187cd19ad05137feab12bb7301DEFINITEBLOCK
sha256 edafde0d33ff1a169c0c4eeaeec12d1759818c7cf4950fcee91c687e811e6cffDEFINITEBLOCK
sha256 f09aaa0fe090b5d0d43dc1724bf6e4167e1593b91bd249d7a58efc8a08c41e94MODERATEMONITORDefault Hermes bundle; only malicious when combined with offensive tooling
sha256 f3c7cde94261f6664891357b399198a73b9741a7a435527807dca5b3bb86e5f0DEFINITEBLOCK
md5 296a800564111b0bad9fe63faf4e63baDEFINITEBLOCK
email elyasbetter@gmail.comLOWConfirmed legitimate; do NOT block
path %TEMP%\svchost_upd.exeDEFINITE
path /etc/cron.d/.cache_updateDEFINITE
path /etc/init.d/sysupdateDEFINITE
path /etc/ld.so.preloadHIGH
path /etc/systemd/system/arpa-autolearn.serviceDEFINITE
path /etc/systemd/system/arpa-continuous.serviceDEFINITE
path /etc/systemd/system/arpa-daemon.serviceDEFINITE
path /etc/systemd/system/arpa-instana-api.serviceDEFINITE
path /etc/systemd/system/arpa-parallel.serviceDEFINITE
path /etc/systemd/system/system-update.serviceDEFINITE
path /lib/security/libpam_cache.soHIGH
path /root/arsenal/c2_server.logDEFINITE
path /root/arsenal/c2_server_10101.logDEFINITE
path /root/arsenal/c2_server_8081.logDEFINITE
path /root/matrix/DEFINITE
path /tmp/.hy2_*HIGH
filename keylogger.ps1DEFINITEBLOCK
filename launcher_combined.ps1DEFINITEBLOCK
filename loader_v29.ps1DEFINITEBLOCK
filename naku.armDEFINITEBLOCK
filename ncrypt_load.ps1DEFINITEBLOCK
filename screencap_v11.ps1DEFINITEBLOCK
filename stealth.ps1DEFINITEBLOCK

288 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Do not block

These values came out of this investigation, but blocking them would break something legitimate, whether a shared service, a bystander's infrastructure, or the victim's own equipment. They are listed here because they still matter for hunting, and they are deliberately excluded from the copy and download buttons above.

TypeIndicatorWhy it stays off a blocklist
ipv4 31.223.97.87 Turkish ARPA operator residential IP via TurkNet ASN 12735 (operator-from-own-ISP, late-evening Turkish working hours, observed 2026-05-20 21:22-21:30 UTC)
domain arpa-continuous.service Turkish ARPA operator systemd unit - continuous collection daemon for victim-side observability harvest
domain system-update.service Rovodev/Pandora victim-side systemd unit using legitimate-name camouflage; part of 5-vector persistence sequence on compromised hosts

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.