Skip to content

Public IOC feed / Data exfiltration

Data exfiltration

Infrastructure that receives stolen data.

29 high-confidence indicators from the last 30 days of security reporting. Free, refreshed hourly, no login, CC-BY.

Files

With an API key: /api/public/v1/iocs/feed?category=exfiltration. API reference

Newest indicators

Showing 29 of 29.

  • ad.starx-net.com domain, 4 Nov

    Exfiltration endpoint for data collected by AndroSnitch malware Source

  • 142.111.194.73 ipv4, 4 Nov

    Listed as BeautyStealer exfiltration server Source

  • goodnfortunes.com domain, 2 Nov

    Domain used for data exfiltration in attack chain Source

  • 13.163.205.35 ipv4, 29 Oct

    IP address where stolen data was left open on the internet Source

  • coinbase.bonto.io domain, 27 Oct

    Subdomain used for exfiltration by malicious Firefox extensions Source

  • carte-avantage.com domain, 7 Oct

    Used as an exfiltration endpoint by attackers Source

  • 45.139.104.115 ipv4, 19 Oct

    IP address used as an exfiltration endpoint in the attack campaign, indicating attacker control. Source

  • wikileaks2.site domain, 28 Oct

    Domain used for publishing stolen data Source

  • 1x0.is domain, 27 Oct

    Domain used to exfiltrate card details from compromised checkouts, indicating attacker control. Source

  • anl.is domain, 27 Oct

    Listed as an exfiltration endpoint used by the attackers, indicating attacker control. Source

  • snf.is domain, 27 Oct

    Listed as an exfiltration endpoint used by the attackers, indicating attacker control. Source

  • litellm.dev domain, 21 Oct

    Listed as an exfiltration endpoint and attacker-controlled domain Source

  • szzqwggurg.hbmc.net domain, 23 Oct

    Domain used as a C2 server by the threat actor Source

  • 4398063cd50c77b8d28f15c35b5948165b356f33dd7c4504eeac0c328fe97487 sha256, 23 Oct

    Hash of a malicious file uploaded to VirusTotal Source

  • ae2005c3fe8ab3b96ab712c5543651431c25fa4f42f828e22bf3ae414cf663c1 sha256, 23 Oct

    Hash of a malicious file uploaded to VirusTotal Source

  • 193.32.204.199 ipv4, 7 Oct

    Listed as an exfiltration endpoint used by attackers. Source

  • www.litellm.dev domain, 21 Oct

    Listed as an exfiltration endpoint and attacker-controlled domain Source

  • 56b74573eed6e4aafe4b50603dbe7853e0345f188c8e44a09f1098caf1f4bcdf sha256, 21 Oct

    SHA-256 hash of a malicious file in the compromised package Source

  • 34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa sha256, 21 Oct

    SHA-256 hash of a malicious file in the compromised package Source

  • 9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25 sha256, 21 Oct

    SHA-256 hash of a malicious file in the compromised package Source

  • homelygrill.com domain, 21 Oct

    Used for exfiltration after initial check-in Source

  • thegrilljournal.com domain, 21 Oct

    Used for exfiltration in malware communication Source

  • my-gitlab.com domain, 19 Oct

    Registered by the threat actor for phishing and data exfiltration. Source

  • nucleflowers.xyz domain, 16 Oct

    Used for data exfiltration in a malicious campaign Source

  • sys-tools.cfd domain, 16 Oct

    Used for data exfiltration in malicious campaigns. Source

  • dns.studiocloud.xyz domain, 8 Oct

    Attributed to attacker infrastructure by FBI Source

  • dnshook.site domain, 8 Oct

    Configured as an authoritative nameserver for data exfiltration via DNS tunneling Source

  • my-secret.dnshook.site domain, 8 Oct

    Subdomain used for data exfiltration via DNS tunneling Source

  • 193.178.158.61 ipv4, 7 Oct

    IP address hosts a panel on the same network as the exfiltration server Source

Think one of these is wrong? Email [email protected].

Other categories