IOC Feed
ShinyHunters Data Leak Site (91.215.85.22)
25 indicators extracted from this
investigation's feed. Filter by type, then copy or download exactly what is on screen.
25 shown
| Type | Indicator | Confidence | FP risk |
|---|---|---|---|
| ipv4 | 91.215.43.200 | DEFINITE | |
| ipv4 | 91.215.85.22 | DEFINITE | |
| domain | europa.zip | HIGH | |
| domain | pro-spero.ru | DEFINITE | |
| domain | shinyhunte.rs | DEFINITE | |
| domain | shinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onion | HIGH | |
| domain | shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd.onion | HIGH | |
| domain | toolatedhs5dtr2pv6h5kdraneak5gs3sxrecqhoufc5e45edior7mqd.onion | HIGH | |
| url | http://91.215.85.22/pay_or_leak/ | DEFINITE | |
| url | http://91.215.85.22/pay_or_leak/INFORMATION.txt | DEFINITE | |
| url | http://web.archive.org/web/20260322033123/https://shinyhunte.rs/ | DEFINITE | |
| url | http://web.archive.org/web/20260322033217/https://shinyhunte.rs/newpgp | DEFINITE | |
| url | https://pastebin.com/raw/sb7aB9eU | HIGH | pastebin.com is a shared-service domain; block only this specific raw-paste URL, not pastebin.com wholesale |
| url | https://shinyhunte.rs/ | DEFINITE | |
| url | https://shinyhunte.rs/newpgp | HIGH | |
| url | https://t.me/wokawoka10 | LOW | |
| url | https://web.archive.org/web/20251012013224/https://shinyhunte.rs/ | HIGH | |
| url | https://web.archive.org/web/20251217231546/https://shinyhunte.rs/ | HIGH | |
| sha1 | 1fc4d0b1dee914bb05b57fabf1f1b98a51c989b3 | DEFINITE | |
| sha1 | 828537c15f43f135a8317153cd16a1660cc7ce51 | DEFINITE | |
| sha1 | e80c1308a09ec1adc418c3f02578988f69bca3fc | MODERATE | |
| sha1 | f4953411767de71bedcdabcb76f4e26f7a20978a | HIGH | |
abuse@ddos-guard.net | DEFINITE | ||
abuse@pro-spero.ru | DEFINITE | ||
| filename | information.txt | DEFINITE |
95 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.
Do not block
These values came out of this investigation, but blocking them would break something legitimate, whether a shared service, a bystander's infrastructure, or the victim's own equipment. They are listed here because they still matter for hunting, and they are deliberately excluded from the copy and download buttons above.
| Type | Indicator | Why it stays off a blocklist |
|---|---|---|
| domain | ns1.ddos-guard.net |
DDoS-Guard authoritative NS for shinyhunte.rs |
| domain | ns2.ddos-guard.net |
DDoS-Guard authoritative NS for shinyhunte.rs |
Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.