Skip to content
THE HUNTER’S LEDGER
IOC Feed
CVE-2026-41940 cPanel Harvester Toolkit (216.126.227.49)
109 indicators extracted from this investigation's feed. Filter by type, then copy or download exactly what is on screen.
Raw JSON feedFull reportDetection rules
109 shown
TypeIndicatorConfidenceActionFP risk
ipv4 144.172.103.253HIGHBLOCK
ipv4 144.172.105.176MODERATEMONITOR
ipv4 144.172.116.74HIGHBLOCK
ipv4 144.172.122.226MODERATEMONITOR
ipv4 144.172.97.151MODERATEMONITOR
ipv4 172.234.24.120MODERATEMONITORHIGH - shared Parklogic infrastructure
ipv4 216.126.224.181HIGHMONITOR
ipv4 216.126.227.148HIGHBLOCK
ipv4 216.126.227.49HIGHBLOCK
ipv4 38.143.66.193HIGHBLOCK
ipv4 45.61.128.128MODERATEMONITOR
domain adorarama.comHIGHBLOCK
domain beast-dashboard.pyHIGHHUNT
domain beast-notify.pyHIGHHUNT
domain checkwithsec.onlineHIGHBLOCK
domain coinbase-co.ccHIGHBLOCK
domain cpanel-scan.shHIGHHUNT
domain eps-soltec.cloudHIGHBLOCK
domain fast-scan.pyHIGHHUNT
domain gen-beast-page.pyHIGHHUNT
domain gen-logins-instant.pyHIGHHUNT
domain gen-sessions.pyHIGHHUNT
domain gocomper.comHIGHBLOCK
domain groundsstudio.comMODERATEMONITOR
domain harvest-v3.pyHIGHHUNT
domain kucoinsgem.xyzHIGHBLOCK
domain kwpbby.inHIGHBLOCK
domain live-dashboard-v10.pyHIGHHUNT
domain ltamaeropromoweb-ecuador-travel.shopHIGHBLOCK
domain mail.hcjs2.jlengineering.seHIGHBLOCK
domain mailmanagement.cfdHIGHHUNT
domain masscan-boost.shHIGHHUNT
domain megahunt-fast.shHIGHHUNT
domain mmnsdvrt8.eps-soltec.cloudHIGHBLOCK
domain mrrbno.shopHIGHBLOCK
domain mx.plingest.comHIGHBLOCK
domain officebyt.e56sutx.eps-soltec.cloudHIGHBLOCK
domain pernex.onlineHIGHBLOCK
domain pipeline-41940.shHIGHHUNT
domain plingest.comHIGHBLOCK
domain poc-fixed.pyHIGHHUNT
domain promo-de-natal-livelo.comMODERATEMONITOR
domain quick-barber.comHIGHBLOCK
domain receita-federal.comHIGHBLOCK
domain runwaylander.comHIGHBLOCK
domain runwaylanderhome.comHIGHBLOCK
domain runwaylanderlights.comHIGHBLOCK
domain runwaylanderplace.comHIGHBLOCK
domain runwaylanderspot.comHIGHBLOCK
domain runwaylanderstreet.comHIGHBLOCK
domain runwayparking.comHIGHBLOCK
domain supportsite.infoHIGHHUNT
domain tesaco.sbsHIGHBLOCK
domain trace.pyHIGHHUNT
domain trace2.pyHIGHHUNT
domain whm-hunter.pyHIGHHUNT
domain yahoohelp.comMODERATEMONITOR
url http://216.126.224.181/22/evc/goodpeopleswellmeans.htaMODERATEBLOCK
url http://216.126.224.181/23/goodpersonforbetterthings.htaMODERATEBLOCK
url http://216.126.224.181/wem/img_191738.pngMODERATEMONITOR
url https://216.126.224.181/24/mkaingbestchoiceforme.htaMODERATEBLOCK
url https://mgcountyks.invoicerequests.net/MODERATEMONITOR
url https://officebyt.e56sutx.eps-soltec.cloud/f/d6aba322369cHIGHBLOCK
sha256 0330a32ad6cce29a15e238ae1382dc590ff7b2675eef4bdb5b2844c7228bc684HIGHHUNT
sha256 0442691db9f9aa7cfdc8f04036f74b4b042dce0101325dd30f5ef4d27aa99d2eHIGHHUNT
sha256 0e566c38bf4046a92dbbec97e27711ec8691006362869fe6aa3c875e3f5b86c4HIGHHUNT
sha256 16855dfbb2a8ec40ffa98c5777e598f353e84c4793a0691fa2cb26384e2c23d8HIGHHUNT
sha256 1bede88ae4cddbaa413b4940485604863cb2bb72ece110d9c9394ad377e96622HIGHHUNT
sha256 217236a47ac38db476671b42382fe022d11665e07f42160df0f38cbb9b7e54a5HIGHHUNT
sha256 27316a2efb0fa2be4e1ba965f948a8816df75acfe0f30b53b0aaf8624694e098HIGHHUNT
sha256 29cfacedeec7112df7ac4796484afdd0507536d4377233d5580234b065f75b56HIGHHUNT
sha256 2c92c6d466f33204278d586bcbb4d341bd58362f2c5c904e3164aadf63a236c2HIGHHUNT
sha256 2f0eafed073d01a909006f18136e46af5b7fb688814cbbed1dad024968d426faHIGHHUNT
sha256 32b9b9a82913dae5e40842f68791cc639fe690603ccc1d85fe1ae2e99b7bf26bHIGHHUNT
sha256 38f10f41e22192c4f342632f7997e18006eead2610af94712cba3e4220f6bd36HIGHHUNT
sha256 47e095505fefdcd5268575186a8355bdeb8846787b95c11148aaa27c35d47dacHIGHHUNT
sha256 4829505f75518154d01ad16d658e4f95be4446d35f10497937197714cb471e1fHIGHHUNT
sha256 4b054892b4a5d7811f57562552d1ea0e8ea5bfbf705ceb71e91126482b650a47HIGHHUNT
sha256 51ca6ee17451cd860ddf2f32ef5de86f178d15f479bfe75d256ca92c1ba0d217HIGHHUNT
sha256 526bd8c749afe3d281da4e65ec38c96e55748227ed8193e9a20e458381c68278LOWMONITOR
sha256 57abe6de4ecf88da092f22966d0caeda8266dc97d8c64cfaa157d301d917e95fHIGHHUNT
sha256 664022b84b1ec4bd0bda55fc277bdc232e627be090c37c0266e2505386a5b179HIGHHUNT
sha256 6a43ae28b6e6298b7b8f3a7a2afabfc260af20563591a416ab5a04865b5799c5LOWMONITOR
sha256 6bf4e5e3f377c4ba6efabe2cb003479369e7347bf15d7de139b40bb259ad69ffHIGHHUNT
sha256 8132130bb306fc933d5ac92d6cf45024df92c4d9ee424e6a9774fbac9432cfb4HIGHHUNT
sha256 8360ffe84d85ebce7082e69b05fca351796256de77430e90cd02c89487d33120HIGHHUNT
sha256 94eb05de232d361bd8fd13a2f27b14602e1b47252ca1e67d4e8a8ac4bd6b113fHIGHHUNT
sha256 96babe4f65d33dafcdb2425039012d5b2cf8c01b04d0680c5551482ccea27b64HIGHHUNT
sha256 972f5025f2675c20824d395271121205ce2b6e1054887845b9c28d62b989a3b6HIGHHUNT
sha256 97cd91ad5e65c72e5a92be26477eb55e28fc89ecd8540ca62855effea34feefcHIGHHUNT
sha256 99087c222ba3f8122fe122be1241f0aecbddfb8ecd783fd76cca99df33af4a8bHIGHHUNT
sha256 9df3c0792e2a460825619999f87c0c19d34a74ca6bc4a7dfd80a64e94c68cc76HIGHHUNT
sha256 9df8d0da0dce17d061a870024f65f066c668c49c3b468727d6badbdd776a5880HIGHHUNT
sha256 9f4a96af8c27371bbae17a4f270e29fc4c1b852c83b5625607d123fc0b59802aLOWMONITOR
sha256 a892d7ea50d09f209c8a31439d4c6309143d465cd88ffcf23fb557f22dac5ec6HIGHHUNT
sha256 b08d31df351d1249adcae302db3bd5aea1f5e44255d40c2203ef0a2dd37e2f65LOWMONITOR
sha256 c0323da18895064aa7b5097885d2e71457e5928bc4ae00f367a28bd40859a7f0LOWMONITOR
sha256 c635f3d808953584614e5128e9039f7644ad51cd903e32015f1cfdbaafea122dHIGHHUNT
sha256 c8fe86a54d7fffc0ec89afd9b0988d69bf5b2177f23ddb5ac8940f364c03d766HIGHHUNT
sha256 d0c714b71006ebb87ad3948cbe8b8d8713b7265651c7a64e619c19f5049bdf79HIGHHUNT
sha256 dea988c96b02dbbcb36ed3edd096d9c7cf50b28feff461e16c9651fe0dd7c474LOWMONITOR
sha256 e58ba18209f8fdbfb2a04f283dc2111cbc45fd1534068f2da20fb56c3e0313f4HIGHHUNT
sha256 e7e5da0cdbeea894ea00db07d72da8ab2954b84867acf4a79ee612a57e8bdd49HIGHHUNT
sha256 f06598ef96511ee4e478759241d2902c1233ff46f4dca59ece6ce4f22e9be865HIGHHUNT
sha256 f1d3ac3c111c7684868a2e95b70630221b8287c6db68776b13867bd57b495106HIGHHUNT
sha256 f6972b49f717274862cbef73bd91554726f1e0cae61ed72c5b6acda43c8aa128HIGHHUNT
md5 6e3644a97f844763a34565b865d35310HIGH
filename goodpeopleswellmeans.htaLOWMONITOR
filename lgt81941.xlsLOWMONITOR

70 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Do not block

These values came out of this investigation, but blocking them would break something legitimate, whether a shared service, a bystander's infrastructure, or the victim's own equipment. They are listed here because they still matter for hunting, and they are deliberately excluded from the copy and download buttons above.

TypeIndicatorWhy it stays off a blocklist
ipv4 172.237.149.231 Parklogic shared TDS landing infrastructure - operator parks 11 TDS landing domains here via customer account pkAId=2143526812. Shared by all Parklogic customers, so do not blocklist the IP without context
domain rebel.com Yahoo support spoof (HIGH-MONETIZED, ownership ambiguous - full operator infra pattern but Rebel org-hash differs)

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.