IOC Feed
Gotenberg CVE-2026-42589 Mass Exploitation and Cryptomining
9 indicators extracted from this
investigation's feed. Filter by type, then copy or download exactly what is on screen.
9 shown
| Type | Indicator | Confidence | Action | FP risk |
|---|---|---|---|---|
| ipv4 | 107.175.69.137 | DEFINITE | BLOCK | low |
| domain | nanachiapproved.cfd | |||
| domain | systemd-polkitd.service | DEFINITE | HUNT | low |
| domain | systemd-vconsole-setup.service | DEFINITE | HUNT | medium |
| url | https://the-hunters-ledger.com/reports/gotenberg-rce-cryptomining-107-175-69-137/ | HIGH | ||
| sha256 | b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49 | DEFINITE | ALERT | low |
| path | /home/gotenberg/.local/share/watchdog.sh | DEFINITE | HUNT | low |
| path | /tmp/polkitd/ | DEFINITE | HUNT | low |
| path | /usr/bin/polkitd.d/ | DEFINITE | HUNT | low |
38 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.
Do not block
These values came out of this investigation, but blocking them would break something legitimate, whether a shared service, a bystander's infrastructure, or the victim's own equipment. They are listed here because they still matter for hunting, and they are deliberately excluded from the copy and download buttons above.
| Type | Indicator | Why it stays off a blocklist |
|---|---|---|
| domain | dohwawazs.pro |
Part of the same shared cryptojacking-kit drop layer as vibecoders.vip: it carries this campaign's exact miner hash in its VirusTotal downloaded_files, but the serving check*.sh installer family has multiple independent unrelated submitters. Graded LOW under the Supplier Test: shared, not operator-exclusive, and shared is not the same as paid. |
| domain | vibecoders.vip |
Carries this campaign's exact miner hash in its VirusTotal downloaded_files, but the serving check*.sh installer family has multiple independent unrelated submitters. Graded LOW under the Supplier Test: shared, not operator-exclusive, and shared is not the same as paid. |
| endpoint | ca.moneroocean.stream:10032 |
The second MoneroOcean pool endpoint, carrying the same judgment as gulf.moneroocean.stream:10032: a public mining pool used by unrelated operators and by legitimate miners, graded Class E shared ecosystem infrastructure and INSUFFICIENT alone for attribution. Both endpoints appear only in the dropped config, never in the binary. Hunt for them; do not blocklist them as operator infrastructure. |
| endpoint | gulf.moneroocean.stream:10032 |
MoneroOcean is a public mining pool used by unrelated operators and by legitimate miners. Graded Class E shared ecosystem infrastructure, INSUFFICIENT alone for attribution, and corroborated in unrelated published campaigns back to 2024. Hunt for it; do not blocklist it as operator infrastructure. |
Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.