IOC Feed
The Middle Tier: A Non-APT Operator's Reach Into Four Southeast Asian Governments
32 indicators extracted from this
investigation's feed. Filter by type, then copy or download exactly what is on screen.
32 shown
| Type | Indicator | Confidence | Action |
|---|---|---|---|
| ipv4 | 144.172.106.236 | DEFINITE | MONITOR |
| domain | cat.sh | HIGH | BLOCK |
| sha256 | 23560e13d06d8153e0e7566d153ffe9eec79e08eb1ed18f8cd1417728e7dbdd6 | HIGH | HUNT |
| sha256 | 8a7d387663d7f32730ed8b996f1dab7c2eed4b829b71fd48c608f51569dc4d69 | HIGH | BLOCK |
| sha256 | c600f8e4ee5ece27ce777fe4f69c18c6611768ee7192c74e4e66f9e236e19b1e | HIGH | HUNT |
| sha256 | e788f829b1a0141a488afb5f82b94f13035623609ca3b83f0c6985919cd9e83b | LOW | HUNT |
| sha1 | 71760ce87e12cb881c2316034be0d016617f7628 | BLOCK | |
| sha1 | 886504ea793ae05bb8206f383a3140e8d7bddd45 | HUNT | |
| sha1 | c640fed8c76802f2bea562ff08a0643d8f033771 | HUNT | |
| sha1 | c787636df481e1075db49c96d696de8dc6198e26 | HUNT | |
| md5 | 0d72d798449356ed66410f7e84c4a37a | BLOCK | |
| md5 | 157ff784cd1736f401e54cd2aa3cde38 | HUNT | |
| md5 | d96d4e7bc25704e48576ee7667d424aa | HUNT | |
| md5 | f26c3cd4209492b699131d29b76d941a | HUNT | |
security-monitor@tni.mil.id | HIGH | MONITOR | |
| path | /home/nast/authd | HIGH | HUNT |
| path | /home/nast/bootcfg | HIGH | HUNT |
| path | /home/nast/netd | HIGH | HUNT |
| path | /home/nast/udevd-sync | HIGH | HUNT |
| path | /opt/zimbra/jetty-distribution-9.4.46.v20220331/webapps/zimbra/public/shell.jsp | HIGH | HUNT |
| path | /opt/zimbra/jetty/webapps/zimbra/public/shell.jsp | HIGH | HUNT |
| path | /opt/zimbra/jetty/webapps/zimbra/shell.jsp | HIGH | HUNT |
| path | /opt/zimbra/jetty_base/webapps/zimbra/public/shell.jsp | HIGH | HUNT |
| path | /opt/zimbra/jetty_base/webapps/zimbra/shell.jsp | HIGH | HUNT |
| path | /opt/zimbra/mailboxd/webapps/zimbra/public/shell.jsp | HIGH | HUNT |
| path | /opt/zimbra/mailboxd/webapps/zimbra/shell.jsp | HIGH | HUNT |
| path | /tmp/creds_result.txt | HIGH | HUNT |
| path | /tmp/exploit.cpio | HIGH | HUNT |
| path | /tmp/proxylogon-loop | HIGH | HUNT |
| path | /tmp/sipede_docs/ | HIGH | HUNT |
| path | /tmp/vpn_cookies.txt | HIGH | HUNT |
| filename | chisel.exe | LOW | HUNT |
39 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.
Do not block
These values came out of this investigation, but blocking them would break something legitimate, whether a shared service, a bystander's infrastructure, or the victim's own equipment. They are listed here because they still matter for hunting, and they are deliberately excluded from the copy and download buttons above.
| Type | Indicator | Why it stays off a blocklist |
|---|---|---|
| ipv4 | 128.199.246.46 |
Public VPNJantit free-VPN exit node the operator connected THROUGH (usable only as a source IP, never operator-owned) |
| ipv4 | 140.99.255.48 |
bootyreader.com's host |
| ipv4 | 146.56.180.42 |
Shared Hysteria2 circumvention proxy the operator used upstream (not operator-owned) |
| ipv4 | 43.208.251.115 |
AWS-Thailand SOCKS5 'Thai VPS' candidate, ownership INSUFFICIENT; operator could not even connect |
| ipv4 | 87.106.101.131 |
GSRN public relay node (gs18.thc.org), seen embedded in the second-actor cat.sh loader |
| domain | api.telegram.org |
Shared public infrastructure with vast legitimate use. Presence of a GSocket relay connection FROM a server-class host with no interactive user is the signal. The domains themselves are not. NEVER place these on a block list or ship as campaign IOCs. Second-actor (GSocket/THC kit) context only. |
| domain | bootyreader.com |
Unrelated Moroccan spam co-tenant of the recycled IP |
| domain | cdn.gsocket.io |
Shared public infrastructure with vast legitimate use. Presence of a GSocket relay connection FROM a server-class host with no interactive user is the signal. The domains themselves are not. NEVER place these on a block list or ship as campaign IOCs. Second-actor (GSocket/THC kit) context only. |
| domain | discord.com |
Shared public infrastructure with vast legitimate use. Presence of a GSocket relay connection FROM a server-class host with no interactive user is the signal. The domains themselves are not. NEVER place these on a block list or ship as campaign IOCs. Second-actor (GSocket/THC kit) context only. |
| domain | g.gs.thc.org |
Shared public infrastructure with vast legitimate use. Presence of a GSocket relay connection FROM a server-class host with no interactive user is the signal. The domains themselves are not. NEVER place these on a block list or ship as campaign IOCs. Second-actor (GSocket/THC kit) context only. |
| domain | github.com |
Shared public infrastructure with vast legitimate use. Presence of a GSocket relay connection FROM a server-class host with no interactive user is the signal. The domains themselves are not. NEVER place these on a block list or ship as campaign IOCs. Second-actor (GSocket/THC kit) context only. |
| domain | gsocket.io |
Shared public infrastructure with vast legitimate use. Presence of a GSocket relay connection FROM a server-class host with no interactive user is the signal. The domains themselves are not. NEVER place these on a block list or ship as campaign IOCs. Second-actor (GSocket/THC kit) context only. |
| domain | localroot.sbs |
Second-actor loader / staging domain |
| domain | master.gs.thc.org |
Shared public infrastructure with vast legitimate use. Presence of a GSocket relay connection FROM a server-class host with no interactive user is the signal. The domains themselves are not. NEVER place these on a block list or ship as campaign IOCs. Second-actor (GSocket/THC kit) context only. |
| domain | p.gs.thc.org |
Shared public infrastructure with vast legitimate use. Presence of a GSocket relay connection FROM a server-class host with no interactive user is the signal. The domains themselves are not. NEVER place these on a block list or ship as campaign IOCs. Second-actor (GSocket/THC kit) context only. |
| domain | raw.githubusercontent.com |
Shared public infrastructure with vast legitimate use. Presence of a GSocket relay connection FROM a server-class host with no interactive user is the signal. The domains themselves are not. NEVER place these on a block list or ship as campaign IOCs. Second-actor (GSocket/THC kit) context only. |
| domain | serveo.net |
A free, no-signup SSH reverse-tunnel relay the operator connected through, alongside a VPNJantit exit node and a shared Hysteria2 proxy, to anonymize its single dedicated box; none of the three is operator-owned. Blocking it would hit the relay's unrelated legitimate users rather than the operator, whose own infrastructure is the single box behind these hops. |
| domain | utah01-maas.cloudzy.com |
Resolves to 144.172.106.236 itself (288 self-lookups in the operator's localhost DNS log). Cloudzy provider infrastructure hostname, not a C2 domain, context/hunt only, do not block. |
| domain | webhook.site |
Shared public infrastructure with vast legitimate use. Presence of a GSocket relay connection FROM a server-class host with no interactive user is the signal. The domains themselves are not. NEVER place these on a block list or ship as campaign IOCs. Second-actor (GSocket/THC kit) context only. |
| domain | z.gs.thc.org |
Shared public infrastructure with vast legitimate use. Presence of a GSocket relay connection FROM a server-class host with no interactive user is the signal. The domains themselves are not. NEVER place these on a block list or ship as campaign IOCs. Second-actor (GSocket/THC kit) context only. |
| sha256 | c739f55d53b632bddc229a332a5165d006ae14cdabe6740a9048619394ac3b93 |
VPNJantit's PUBLIC VPN-node certificate would flag every VPNJantit user worldwide (Censys returns 1 host) |
Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.