Skip to content
THE HUNTER’S LEDGER
IOC Feed
Carrier Credential Harvesting Through a Customer's Router
129 indicators extracted from this investigation's feed. Filter by type, then copy or download exactly what is on screen.
Raw JSON feedFull reportDetection rules
129 shown
TypeIndicatorConfidenceAction
ipv4 13.140.145.210DEFINITEBLOCK
ipv4 95.214.114.37HIGHMONITOR
domain c.pemDEFINITE
domain decrypt3des.pyDEFINITE
domain exploit21182.javaDEFINITE
domain genbypass.javaDEFINITE
domain i786.shDEFINITE
domain k.pemDEFINITE
domain poc21839.pyDEFINITE
domain radius-sync.comHIGHBLOCK
domain so.shDEFINITE
domain ssrft3.javaDEFINITE
domain vmi3432966.contaboserver.netDEFINITEBLOCK
domain xds.javaDEFINITE
domain xscan.javaDEFINITE
url http://13.140.145.210/DEFINITEBLOCK
url http://13.140.145.210:4445/DEFINITEBLOCK
url http://13.140.145.210:8888/DEFINITEBLOCK
sha256 04dbe46cf060c2de75ff04a13b0f2b48253c1b03a638a2afdae3cccdeeae500cDEFINITE
sha256 08ae961db6b2564e26ba55ebe8aaf31920dc418b55010b0a2401ed995552c347DEFINITE
sha256 0a76c28f5452dbbc146752d0b4e28b10779a337091f59650b94f5e938545572cDEFINITE
sha256 1079a2f628fd6a33dae90515ecebecabf66eb3952c39635fd495dd3718173f64DEFINITE
sha256 10ff5a12a4380e7e3209cd2c1cab14c1329160fb88d0ede2e4450e8ade6f4b79DEFINITE
sha256 1351c03f626745cacd97f957419559da442264c0e0c4b100f496199dbd6301ccDEFINITE
sha256 1766fd750011ad5d3b4f98357acb418f8ee07587c558c7fbe5169b7f3d8285c0DEFINITE
sha256 19957b57916b3133fd69ca925304b1260c92d1f3b6857bcb9b48606b583a6455DEFINITE
sha256 1f135e2ede4d2389e481d51d046e533ac485d15dc83396818d41bb81c7e84045DEFINITE
sha256 25e713913758006835da0c0aa3aa621c37e21498114dadc8c4a8c00d6997d99bDEFINITE
sha256 35792ca59beddfc9905c06c1a22b35b367d4f39083a0e59aea3a197f33af36e0DEFINITE
sha256 3797dddabdef5e9607c9c0bde108922467adf15d5e29cd6c6319df91b334a0c9DEFINITE
sha256 395d83618e1ad08a61a70405f9c41f38202ad273ec2f748017a934c5a5020a32DEFINITE
sha256 3fbfafab2e467055e22cf88719f081770fda732c278ad7244c938308f6b28c96DEFINITE
sha256 403aad5736161e9b36c4f2c9a4451d0146b870c76627cc0afb28f2c038ab9af2DEFINITE
sha256 4430563acc3e61903969f077fa2f868cc75158ec6719abb4031c115aa7e895abDEFINITE
sha256 45534cd8555fb79ebae27aaea8a6fbaec70d41ef5d9bc0a9415ed72e7ad23b00DEFINITE
sha256 4bb64940f1f08d23a5b0733369a40f349dce28a8e677577e44dbf0d61ceb6fafDEFINITE
sha256 4d53fc510a54cc1d3f9f6e8c14cb62bb784267ebcf15b6fc4126901fd81c32ccDEFINITE
sha256 4e722db95bf034806bf181f11065c6cb28578074b9fa613fd5018d1370db7ba2DEFINITE
sha256 5182ec0b8959cc554c8f3e06e8fad7a94b71f11de29d7c9c462fb500ef9d33bbDEFINITE
sha256 53517fdc0d386c7dfd4546e9e83150f85dab0662dbcaf9bf0f9dd82fab3a07e9DEFINITE
sha256 57808e07ba7745a2d598f630db9c6a671fe5cca005c6dbf4239b8ad794277143DEFINITE
sha256 58475dcbda931c31e45a83884e366a28b34aaa9099bab8b2e38590824e3b61b3DEFINITE
sha256 5a8aa26793cc031314eba327f40e384e2e0d009a7183e344e5db11f2cd3b185fDEFINITE
sha256 5ce9cdc2d2d5f5fd053ef7438626a9c98bc92ecc1eb2960fc6cffdc94e0ab550DEFINITE
sha256 5f2efa79f548b648a318e6c6f3512581574002b79fab97cfec10b77feba177b8DEFINITE
sha256 610ff467df7cf2ea672762f4fd63c9a817b7d5f18f290efe8bdf239ddc8031f7DEFINITE
sha256 626856f44bba5e61c878c2e2be54f3aa12a2fdee602634706917bc77aaaa4ef5DEFINITE
sha256 628e3af996c506671d978026496c28e2ec0b4bc3a91302257d3b508d1ebd61f6DEFINITE
sha256 6457ff57de0ee5b12abf6e3c8291e69718ea6ded741af51807259c692e7071c5DEFINITE
sha256 65bd20aa232157ee4015e1d5b8939e953db0dd69a3c86a7387a33aedd2288b85DEFINITE
sha256 676437728db9710c645d509d7ccc517864a263914f9a152c1d49cad3106df900DEFINITE
sha256 6ce28a27af3bf7732952461c6d6003c53ee0c367563f941b8dd481aefa2e7454DEFINITE
sha256 72c6383477bbcb93811fd837a9e4721cfddea0cd238eebe3012acc0e6a31c40eDEFINITE
sha256 7477eea61182c26fdd26e688bcc4f6ae87347e9a9290b81aae21b2fd71db0984DEFINITE
sha256 75f99724611c680400f2ba567b71522a63122b0510ea7ef35c2696dd61666ecfDEFINITE
sha256 7b699b24025e3d71fd83dd766c7b842579cf28527f22a8fd5c9097ceaa7a013dDEFINITE
sha256 80b9a4c5cde7f1793b4123662b2dddc2b3801e09fdc7ed8c295e10bad3397b9bDEFINITE
sha256 885cfb5bfd041b8efd885860add9661eeab6086d2eb91997fffc420738e42adeDEFINITE
sha256 891c4bb6b5c94b28867535c1ec71561be75b30da47554fbf6d55ae7f0d86be8bDEFINITE
sha256 9251373f585c91b6bf7c407aa1a989e7cc596c4afc79a8573a18f858df9f014dDEFINITE
sha256 953b668e95e033b34de0373af354cfd1d5557edf8cdfa49887cabf2b44d67b65DEFINITE
sha256 9bebcc8ccfb9207b8265c85a4896760b8adee5deea0c2f57e6b08fc56a29e2ecDEFINITE
sha256 9e683ccc4baa5efdf4b643ade417cf56b729c5da1d351495d4317272b15f925fDEFINITE
sha256 9f2302cd9698895ac3d83e44fc0b3c99767cc1561bb18de6a2fb31acb5c15febDEFINITE
sha256 a133809a768c7c6b958d72ff6857677b14ed6bf284b99dc81a121442dfe04f90DEFINITE
sha256 a652e3ae426e614844a5970154cb2a2e1465ab6fe73bbd3df47abeb6bdf859ebDEFINITE
sha256 a71223b4b7d092f5a0cbcece6df94f907572f090c5db6bb68bcaaeb077c744d7DEFINITE
sha256 a93d8af6748c9c8ff1dbdffeed317cf81fe7777f25daf5c8feb44aa64d600463DEFINITE
sha256 abcb8e8bd371549af056f973b95cceae9156b5b96e80facbc19db009347b2924DEFINITE
sha256 bfb79c2d47b7bbd0cfc17782014eb7a57b73834ab93d49d7dd1e6942693ac8f2DEFINITE
sha256 c17736b8535359e385fdc3e242d2a36c3b921469229c256947695a4716ad0e4dDEFINITE
sha256 ce2bb74025dc77d4d5c506b990633f526f4f3f4ca849db7c0025d42d10a8529aDEFINITE
sha256 d2ba9a1859464c4f08c47643d2e157400a94b31b429d4415acb4389944ee016aDEFINITE
sha256 daee2d57566c88374b5de65ecc04e1321da4d5dc35b84a0eb98893afad9e2664DEFINITE
sha256 dbbdffa94caf45a4c1f9132fa7c5bfc6a4c20ee104440ba964cc99ea9850facbDEFINITE
sha256 dcd739dfe08285c08200be926905155576bedc4e5633b5f02561ec7f80d512f1DEFINITE
sha256 e447cbfbb5e82bd6b924cd6d9265d022a9ab576898c34ee6b854b9269ff9e870DEFINITE
sha256 e5621ffe4879f0ec39ed40f688db9399c2d43054d41ef14472fa335c4693b915DEFINITE
sha256 e74276ce204476787aaa65c0f0604707c918a06b724ceaa98eb57f2105c65157DEFINITE
sha256 e788774dfe961c999953ef72a208f198c58c47f14d4b7777d50abee835d75fffDEFINITE
sha256 e788f829b1a0141a488afb5f82b94f13035623609ca3b83f0c6985919cd9e83bDEFINITE
sha256 ee2d150a2f73a561983088a6b1a6a2b1c452777aaf03181387708c6907ac6dcdDEFINITE
sha256 f03e4111413befd8e44035c7fa56abf48fb12a0d03a6eda5662de33ffe47e2e7DEFINITE
sha256 fa433bbbc82c572c838ac6a9f0bdde3634c8fbae4178d3660bf0dcb1a958e262DEFINITE
sha256 fa434d13bee84e9a4ccfffbd8df2852d9d1238f8222bf806506b108d21924557DEFINITE
sha256 fa930afe099b266006f22fe75245f4d52b52a11de7280b6c2cff8e3a4e4b3e06DEFINITE
sha256 fae8fe13ac0e717d99f992fba9186aa37fb706058fe7762993717366f653d14aDEFINITE
sha256 fd628df5bf58c7abaebfca3ecfe504511080872bf1687ec2dd39d1d4cd3f0aabDEFINITE
sha1 373b099212237996e4394bdf8dd5a27715dccf13DEFINITE
sha1 aab136e06c94e5616832afa34af096bd6b77151cDEFINITE
path /opt/aaa/bin/radstatdHIGH
path /root/.ssh/sysgad_keyHIGH
path /tmp/CVE-2023-21839/DEFINITE
path /tmp/andinet.shHIGH
path /tmp/prtg_devices.jsonDEFINITE
path /usr/local/bin/pollRadiusLog.phpHIGH
path /usr/local/bin/safe_pollRadiusLog.shHIGH
path C:\wamp64\www\.s.bakHIGH
path C:\wamp64\www\.y.bakHIGH
path C:\wamp64\www\h.phpHIGH
path C:\wamp64\www\x.phpHIGH
filename chisel443.logDEFINITE
filename chisel80.logDEFINITE
filename chisel_new.logDEFINITE
filename chisel_server.logDEFINITE
filename chisel_win.exeDEFINITE
filename combined_wordlist.txtDEFINITE
filename docker_output.txtDEFINITE
filename exfil_capture.logDEFINITE
filename exfil_cores_batch.logDEFINITE
filename http80.logDEFINITE
filename hybrid_wordlist.txtDEFINITE
filename iiop_resp.binDEFINITE
filename jndi_cb.txtDEFINITE
filename jndiexploit.jarDEFINITE
filename lua_source.txtDEFINITE
filename movistar_wordlist.txtDEFINITE
filename pkg_names.txtDEFINITE
filename plink.exeDEFINITE
filename proxychains_catastro.confDEFINITE
filename proxychains_chisel.confDEFINITE
filename r.batDEFINITE
filename serve_http.logDEFINITE
filename sph_cve.txtDEFINITE
filename ssrf_results.txtDEFINITE
filename string_payload.binDEFINITE
filename t35.txtDEFINITE
filename wl_resp.txtDEFINITE
filename wl_t3.txtDEFINITE

88 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Do not block

These values came out of this investigation, but blocking them would break something legitimate, whether a shared service, a bystander's infrastructure, or the victim's own equipment. They are listed here because they still matter for hunting, and they are deliberately excluded from the copy and download buttons above.

TypeIndicatorWhy it stays off a blocklist
ipv4 104.21.41.159 Cloudflare proxy A record for radius-sync.com
ipv4 127.0.0.1 Operator custom multi-session C2 console bound to localhost on the VPS. Verbs sessions and use . The server (console.py) was never archived
ipv4 140.99.223.46 Independent intruder on the same Cisco router, 2026-05-12, using the generic public CVE-2023-20198 URI POST /webui/logoutconfirm.html?logon_hash=1. Limestone Networks, US
ipv4 146.70.52.222 Browsed the same router's WebUI three times on 2026-07-07 with AAA failures. M247, VT-tagged vpn
ipv4 147.124.203.51 Independent intruder on the same router, 2026-07-07, same generic URI. Tier.Net Technologies, US
ipv4 172.67.148.55 Cloudflare proxy A record for radius-sync.com
ipv4 2.57.91.91 RETRACTED as an operator IP. radius-sync.com pointed here for approximately fifteen seconds at registration before being repointed. Hostinger shared parking infrastructure, AS47583, approximately 4.2 million domains. Its VT 9/91 is mass-hosting noise
ipv4 47.130.108.237 Failed TLS handshake against the same router on 2026-07-07. AWS Singapore, probably scanner noise
ipv4 62.133.46.18 Browsed the same router's WebUI 2026-07-07 and 07-24 with AAA failures. M247, VT-tagged vpn
domain paloma.ns.cloudflare.com Operator-owned domain
domain peyton.ns.cloudflare.com Operator-owned domain

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.