Actor Profile

🏹 Domains/URLs — Threat Actor / Malware

Classification

Threat Actor / Malware

Leak-site victims

Ransomware.live

Associated IoCs

200
local intel

MITRE techniques

ATT&CK

Tracked

Local

Associated Indicators (200)

IndicatorTypeThreat
https://dewatabalirental.com/4.exe url profile
http://185.215.113.16/off/def.exe url profile
https://newvideo.link/temp/xnsjjxja.exe url profile
https://github.com/Abdulah345/pizdaporc/ url profile
https://github.com/clipaCHEAT/chaaa/raw/ url profile
http://59.99.215.146:49697/Mozi.m url profile
https://aquafusion.com.co/ngbx/ngown.exe url profile
http://66.63.187.150/file/build.exe url profile
http://66.63.187.150/file/build2.exe url profile
http://66.63.187.150/file/build3.exe url profile
http://66.63.187.231/657/caspol.exe url profile
https://durraactive.com.my/wp-content/im url profile
http://83.217.208.37/app/upd.exe url profile
https://nasa.r2cloudhikepoo2.shop/NHFMUB url profile
https://mapimwp.org/wp-content/images/pi url profile
http://185.7.78.88/bot.arm url profile
http://45.131.135.227/Captcha.exe url profile
http://74.50.95.117/files/Hkrrl.exe url profile
http://74.50.95.117/files/Pkaffth.exe url profile
http://185.215.113.16/inc/Dynpvoy.exe url profile
http://185.81.68.147/vvv.exe url profile
http://185.81.68.147/fcxcx.exe url profile
http://185.81.68.147/AsyncClient.exe url profile
http://185.81.68.147/ctx.exe url profile
http://185.81.68.147/gfx.exe url profile
http://176.113.115.37/ScreenUpdateSync.e url profile
http://80.82.65.70/dl?name=mixthree.exe^ url profile
http://zakazbuketov.kz/audiodf.exe url profile
https://dominikatracy.com/audidg.exe url profile
https://kiltone.top/stelin/Gosjeufon.cpl url profile
http://185.81.68.147/Update.exe url profile
http://185.81.68.147/ssg.exe url profile
http://185.81.68.147/zx.exe url profile
http://185.81.68.147/Build.exe url profile
http://194.37.81.64/Aqua.x86_64 url profile
https://github.com/BalletsPistol/d9fb74g url profile
http://filter.trueddns.com:18066/x/encod url profile
https://github.com/temperloin/piponis/ra url profile
https://github.com/temperloin/piponis/ra url profile
https://github.com/temperloin/piponis/ra url profile
http://185.232.205.104/bins/g4za.arm7 url profile
http://37.44.238.88/spim url profile
http://37.44.238.88/l7vmra url profile
http://hybridemails.ae/esign-app.exe url profile
http://176.65.134.62/bins/morte.x86 url profile
http://176.65.134.5/arm url profile
https://recursoscompartidos.xyz/pora/csc url profile
http://62.60.226.112/file/590_9883.exe url profile
https://raw.githubusercontent.com/Xeroxz url profile
https://github.com/deripascod/coderoom/r url profile
http://196.251.115.212/x86_64 url profile
http://103.175.16.117/mips url profile
http://185.39.207.117/ppc url profile
http://213.209.150.48/arm7 url profile
http://94.154.34.240:8000/linux.exe url profile
http://94.154.34.240:8000/atrix.exe url profile
http://94.154.34.240:8000/Manya.exe url profile
http://94.154.34.240:8000/Muzul.exe url profile
http://185.238.191.89:5554/beba.exe url profile
http://178.16.55.189/files/7968590541/T7 url profile
http://108.181.161.143:1911/build.exe url profile
http://162.0.225.149/XjeelShZ/build.exe url profile
http://144.172.107.244/frost.x86_64 url profile
http://178.16.55.189/files/5917492177/Mw url profile
http://178.16.55.189/files/6331503294/nG url profile
http://176.46.152.62:5858/7526e77af84e4d url profile
https://i-slept-with-ur.mom/Stb/Retev.ph url profile
http://62.60.226.16:5553/dva.exe url profile
https://hody-musique.com/modules/blog/oc url profile
https://bdddda.cfd/ddq1.exe url profile
http://172.86.123.179/inihiddenngentod/z url profile
http://216.126.239.11/alfa.exe url profile
http://178.16.55.189/files/8233900432/o7 url profile
http://178.16.55.189/files/mr/random.exe url profile
http://178.16.55.189/modka/duna.exe url profile
http://178.16.55.189/files/unique2/rando url profile
http://178.16.55.189/amka/random.exe url profile
http://86.54.24.29/Renewable.exe url profile
https://raw.githubusercontent.com/lenkon url profile
https://raw.githubusercontent.com/lenkon url profile
http://176.97.210.242/bins/skid.x86 url profile
http://190.198.218.210:1171/i url profile
https://marsalek.cy/static/Pjibf2.exe url profile
https://marsalek.cy/static/abcfg.exe url profile
http://45.133.74.103/x86 url profile
https://cloudaxis.cc/gsmft/yueu/fkvqld/t url profile
http://77.110.126.212/5r3fqt67ew531has42 url profile
http://62.60.226.159/Amadey.x64.exe url profile
http://95.85.251.201/Imperial.exe url profile
http://95.85.251.201/ourrat.exe url profile
http://85.215.159.4:11029/stub.txt url profile
https://vcc-library.uk/Stb/Retev.php?bl= url profile
http://5.252.155.72/load/os1/uRgOy.exe url profile
http://140.233.190.47/terrabot/023782ple url profile
http://151.242.30.51/bins/arm url profile
http://94.156.152.234/mipsel url profile
https://github.com/muhammadzidane632/Hop url profile
http://www.botvrij.eu url profile
loader.plg domain profile
test.txt domain profile
payload.txt domain profile
payload.res domain profile
payload.enc domain profile
Domain.txt domain profile
Doc1.dotm domain profile
Doc1.dot domain profile
Form.dotm domain profile
bypassvalue.txt domain profile
Bypass1.txt domain profile
BypassAV.txt domain profile
1232435467897654.txt domain profile
ioool.txt domain profile
ioooll.txt domain profile
iooolll.txt domain profile
iooollll.txt domain profile
iooolllll.txt domain profile
iooollllll.txt domain profile
iooolllllll.txt domain profile
iooollllllll.txt domain profile
iooolllllllll.txt domain profile
iooollllllllll.txt domain profile
iooolllllllllll.txt domain profile
bypass.txt domain profile
avbypass.txt domain profile
shellcode.txt domain profile
w.wiz domain profile
ns1.bg-scammers.com domain profile
safxcer.com domain profile
bg-scammers.com domain profile
http://158.94.209.17 url profile
https://x.com/Huntio/status/208432737630 url profile
continuously-protected-kiss-bread.tryclo domain profile
https://x.com/smica83/status/20827913403 url profile
privacy-grain-hypothesis-cities.trycloud domain profile
https://x.com/smica83/status/20822223832 url profile
concert-selected-exploring-writes.tryclo domain profile
https://x.com/smica83/status/20806391100 url profile
visits-fool-judicial-outer.trycloudflare domain profile
https://x.com/smica83/status/20799838599 url profile
eye-cardiovascular-biological-fruit.tryc domain profile
https://x.com/smica83/status/20799888371 url profile
hash-relationship-vaccine-blair.trycloud domain profile
https://x.com/smica83/status/20770024249 url profile
sequences-williams-analytical-graduate.t domain profile
https://x.com/smica83/status/20769658295 url profile
rome-johnson-mesh-consider.trycloudflare domain profile
https://x.com/smica83/status/20769662041 url profile
sporting-delhi-cork-pursuit.trycloudflar domain profile
https://x.com/smica83/status/20769637364 url profile
usb-enough-stock-citation.trycloudflare. domain profile
https://x.com/smica83/status/20755567335 url profile
devon-camel-bring-enquiry.trycloudflare. domain profile
https://x.com/smica83/status/20755476662 url profile
bible-uncle-turkish-elderly.trycloudflar domain profile
https://x.com/smica83/status/20751297696 url profile
ministries-forecast-house-publish.tryclo domain profile
https://x.com/malwrhunterteam/status/207 url profile
priced-broadway-reform-gene.trycloudflar domain profile
https://x.com/malwrhunterteam/status/207 url profile
dollar-jury-outsourcing-vocational.trycl domain profile
https://x.com/smica83/status/20731344513 url profile
http://85.11.161.22 url profile
https://x.com/smica83/status/20720219275 url profile
enjoy-rachel-rider-ireland.trycloudflare domain profile
https://x.com/malwrhunterteam/status/207 url profile
surgical-contacted-processor-raid.tryclo domain profile
https://x.com/smica83/status/20701218772 url profile
montgomery-reflection-faqs-lee.trycloudf domain profile
https://x.com/smica83/status/20701208867 url profile
complicated-damaged-latitude-practice.tr domain profile
https://x.com/smica83/status/20697410801 url profile
linye666.pw domain profile
101.201.62.40 ip profile
http://101.201.62.40 url profile
https://x.com/cyberthint/status/20690304 url profile
pace-authors-productive-foreign.trycloud domain profile
https://x.com/smica83/status/20675335852 url profile
drive-eligibility-selecting-billing.tryc domain profile
https://x.com/smica83/status/20672062552 url profile
merger-requests-generate-editorial.trycl domain profile
https://x.com/smica83/status/20676770000 url profile
sunny-dynamic-clocks-sessions.trycloudfl domain profile
https://x.com/smica83/status/20675339207 url profile
stand-how-aqua-adjustable.trycloudflare. domain profile
https://x.com/smica83/status/20672065178 url profile
flirtationless.s3.ap-east-1.amazonaws.co domain profile
https://x.com/smica83/status/20654199401 url profile
inspector-agreed-labels-cells.trycloudfl domain profile
https://x.com/smica83/status/20654205405 url profile
considerable-arizona-institutes-duties.t domain profile
https://x.com/smica83/status/20654202395 url profile
excellence-analyze-experiment-installing domain profile
https://x.com/smica83/status/20650306552 url profile
premiere-sunday-citizens-afford.trycloud domain profile
https://x.com/smica83/status/20650310234 url profile
costumes-met-zum-refinance.trycloudflare domain profile
https://x.com/smica83/status/20650303679 url profile
http://2.27.160.147 url profile
https://x.com/smica83/status/20633505526 url profile
45.225.135.54 ip profile

🧭 Intelligence disciplines

CYBINT →OSINT →HUMINT →GEOINT →
Live group profile & victims via Ransomware.live; ATT&CK technique hints are a static reference for well-known groups. All network calls cached & offline-safe.
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

🔍 Lookup & Enrich

💡 Recommendations

⚙ Automation

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php