THE HUNTER’S LEDGER
IOC Feed
Carrier Credential Harvesting Through a Customer's Router
137 indicators extracted from this investigation's feed. Filter by type, then copy or download exactly what is on screen.
Raw JSON feedFull reportDetection rules
137 shown
TypeIndicator
ipv4 104.21.41.159
ipv4 13.140.145.210
ipv4 140.99.223.46
ipv4 146.70.52.222
ipv4 147.124.203.51
ipv4 172.67.148.55
ipv4 2.57.91.91
ipv4 47.130.108.237
ipv4 62.133.46.18
ipv4 95.214.114.37
domain c.pem
domain decrypt3des.py
domain exploit21182.java
domain genbypass.java
domain i786.sh
domain k.pem
domain poc21839.py
domain radius-sync.com
domain so.sh
domain ssrft3.java
domain vmi3432966.contaboserver.net
domain xds.java
domain xscan.java
url http://13.140.145.210/
url http://13.140.145.210:4445/
url http://13.140.145.210:8888/
sha256 04dbe46cf060c2de75ff04a13b0f2b48253c1b03a638a2afdae3cccdeeae500c
sha256 08ae961db6b2564e26ba55ebe8aaf31920dc418b55010b0a2401ed995552c347
sha256 0a76c28f5452dbbc146752d0b4e28b10779a337091f59650b94f5e938545572c
sha256 1079a2f628fd6a33dae90515ecebecabf66eb3952c39635fd495dd3718173f64
sha256 10ff5a12a4380e7e3209cd2c1cab14c1329160fb88d0ede2e4450e8ade6f4b79
sha256 1351c03f626745cacd97f957419559da442264c0e0c4b100f496199dbd6301cc
sha256 1766fd750011ad5d3b4f98357acb418f8ee07587c558c7fbe5169b7f3d8285c0
sha256 19957b57916b3133fd69ca925304b1260c92d1f3b6857bcb9b48606b583a6455
sha256 1f135e2ede4d2389e481d51d046e533ac485d15dc83396818d41bb81c7e84045
sha256 25e713913758006835da0c0aa3aa621c37e21498114dadc8c4a8c00d6997d99b
sha256 35792ca59beddfc9905c06c1a22b35b367d4f39083a0e59aea3a197f33af36e0
sha256 3797dddabdef5e9607c9c0bde108922467adf15d5e29cd6c6319df91b334a0c9
sha256 395d83618e1ad08a61a70405f9c41f38202ad273ec2f748017a934c5a5020a32
sha256 3fbfafab2e467055e22cf88719f081770fda732c278ad7244c938308f6b28c96
sha256 403aad5736161e9b36c4f2c9a4451d0146b870c76627cc0afb28f2c038ab9af2
sha256 4430563acc3e61903969f077fa2f868cc75158ec6719abb4031c115aa7e895ab
sha256 45534cd8555fb79ebae27aaea8a6fbaec70d41ef5d9bc0a9415ed72e7ad23b00
sha256 4bb64940f1f08d23a5b0733369a40f349dce28a8e677577e44dbf0d61ceb6faf
sha256 4d53fc510a54cc1d3f9f6e8c14cb62bb784267ebcf15b6fc4126901fd81c32cc
sha256 4e722db95bf034806bf181f11065c6cb28578074b9fa613fd5018d1370db7ba2
sha256 5182ec0b8959cc554c8f3e06e8fad7a94b71f11de29d7c9c462fb500ef9d33bb
sha256 53517fdc0d386c7dfd4546e9e83150f85dab0662dbcaf9bf0f9dd82fab3a07e9
sha256 57808e07ba7745a2d598f630db9c6a671fe5cca005c6dbf4239b8ad794277143
sha256 58475dcbda931c31e45a83884e366a28b34aaa9099bab8b2e38590824e3b61b3
sha256 5a8aa26793cc031314eba327f40e384e2e0d009a7183e344e5db11f2cd3b185f
sha256 5ce9cdc2d2d5f5fd053ef7438626a9c98bc92ecc1eb2960fc6cffdc94e0ab550
sha256 5f2efa79f548b648a318e6c6f3512581574002b79fab97cfec10b77feba177b8
sha256 610ff467df7cf2ea672762f4fd63c9a817b7d5f18f290efe8bdf239ddc8031f7
sha256 626856f44bba5e61c878c2e2be54f3aa12a2fdee602634706917bc77aaaa4ef5
sha256 628e3af996c506671d978026496c28e2ec0b4bc3a91302257d3b508d1ebd61f6
sha256 6457ff57de0ee5b12abf6e3c8291e69718ea6ded741af51807259c692e7071c5
sha256 65bd20aa232157ee4015e1d5b8939e953db0dd69a3c86a7387a33aedd2288b85
sha256 676437728db9710c645d509d7ccc517864a263914f9a152c1d49cad3106df900
sha256 6ce28a27af3bf7732952461c6d6003c53ee0c367563f941b8dd481aefa2e7454
sha256 72c6383477bbcb93811fd837a9e4721cfddea0cd238eebe3012acc0e6a31c40e
sha256 7477eea61182c26fdd26e688bcc4f6ae87347e9a9290b81aae21b2fd71db0984
sha256 75f99724611c680400f2ba567b71522a63122b0510ea7ef35c2696dd61666ecf
sha256 7b699b24025e3d71fd83dd766c7b842579cf28527f22a8fd5c9097ceaa7a013d
sha256 80b9a4c5cde7f1793b4123662b2dddc2b3801e09fdc7ed8c295e10bad3397b9b
sha256 885cfb5bfd041b8efd885860add9661eeab6086d2eb91997fffc420738e42ade
sha256 891c4bb6b5c94b28867535c1ec71561be75b30da47554fbf6d55ae7f0d86be8b
sha256 9251373f585c91b6bf7c407aa1a989e7cc596c4afc79a8573a18f858df9f014d
sha256 953b668e95e033b34de0373af354cfd1d5557edf8cdfa49887cabf2b44d67b65
sha256 9bebcc8ccfb9207b8265c85a4896760b8adee5deea0c2f57e6b08fc56a29e2ec
sha256 9e683ccc4baa5efdf4b643ade417cf56b729c5da1d351495d4317272b15f925f
sha256 9f2302cd9698895ac3d83e44fc0b3c99767cc1561bb18de6a2fb31acb5c15feb
sha256 a133809a768c7c6b958d72ff6857677b14ed6bf284b99dc81a121442dfe04f90
sha256 a652e3ae426e614844a5970154cb2a2e1465ab6fe73bbd3df47abeb6bdf859eb
sha256 a71223b4b7d092f5a0cbcece6df94f907572f090c5db6bb68bcaaeb077c744d7
sha256 a93d8af6748c9c8ff1dbdffeed317cf81fe7777f25daf5c8feb44aa64d600463
sha256 abcb8e8bd371549af056f973b95cceae9156b5b96e80facbc19db009347b2924
sha256 bfb79c2d47b7bbd0cfc17782014eb7a57b73834ab93d49d7dd1e6942693ac8f2
sha256 c17736b8535359e385fdc3e242d2a36c3b921469229c256947695a4716ad0e4d
sha256 ce2bb74025dc77d4d5c506b990633f526f4f3f4ca849db7c0025d42d10a8529a
sha256 d2ba9a1859464c4f08c47643d2e157400a94b31b429d4415acb4389944ee016a
sha256 daee2d57566c88374b5de65ecc04e1321da4d5dc35b84a0eb98893afad9e2664
sha256 dbbdffa94caf45a4c1f9132fa7c5bfc6a4c20ee104440ba964cc99ea9850facb
sha256 dcd739dfe08285c08200be926905155576bedc4e5633b5f02561ec7f80d512f1
sha256 e447cbfbb5e82bd6b924cd6d9265d022a9ab576898c34ee6b854b9269ff9e870
sha256 e5621ffe4879f0ec39ed40f688db9399c2d43054d41ef14472fa335c4693b915
sha256 e74276ce204476787aaa65c0f0604707c918a06b724ceaa98eb57f2105c65157
sha256 e788774dfe961c999953ef72a208f198c58c47f14d4b7777d50abee835d75fff
sha256 e788f829b1a0141a488afb5f82b94f13035623609ca3b83f0c6985919cd9e83b
sha256 ee2d150a2f73a561983088a6b1a6a2b1c452777aaf03181387708c6907ac6dcd
sha256 f03e4111413befd8e44035c7fa56abf48fb12a0d03a6eda5662de33ffe47e2e7
sha256 fa433bbbc82c572c838ac6a9f0bdde3634c8fbae4178d3660bf0dcb1a958e262
sha256 fa434d13bee84e9a4ccfffbd8df2852d9d1238f8222bf806506b108d21924557
sha256 fa930afe099b266006f22fe75245f4d52b52a11de7280b6c2cff8e3a4e4b3e06
sha256 fae8fe13ac0e717d99f992fba9186aa37fb706058fe7762993717366f653d14a
sha256 fd628df5bf58c7abaebfca3ecfe504511080872bf1687ec2dd39d1d4cd3f0aab
sha1 373b099212237996e4394bdf8dd5a27715dccf13
sha1 aab136e06c94e5616832afa34af096bd6b77151c
path /opt/aaa/bin/radstatd
path /root/.ssh/sysgad_key
path /tmp/CVE-2023-21839/
path /tmp/andinet.sh
path /tmp/prtg_devices.json
path /usr/local/bin/pollRadiusLog.php
path /usr/local/bin/safe_pollRadiusLog.sh
path C:\wamp64\www\.s.bak
path C:\wamp64\www\.y.bak
path C:\wamp64\www\h.php
path C:\wamp64\www\x.php
filename chisel443.log
filename chisel80.log
filename chisel_new.log
filename chisel_server.log
filename chisel_win.exe
filename combined_wordlist.txt
filename docker_output.txt
filename exfil_capture.log
filename exfil_cores_batch.log
filename http80.log
filename hybrid_wordlist.txt
filename iiop_resp.bin
filename jndi_cb.txt
filename jndiexploit.jar
filename lua_source.txt
filename movistar_wordlist.txt
filename pkg_names.txt
filename plink.exe
filename proxychains_catastro.conf
filename proxychains_chisel.conf
filename r.bat
filename serve_http.log
filename sph_cve.txt
filename ssrf_results.txt
filename string_payload.bin
filename t35.txt
filename wl_resp.txt
filename wl_t3.txt

88 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.