| domain | backgroundformat[.]online | 1 | 2026-05-14 |
| domain | background-off[.]com | 1 | 2026-05-14 |
| domain | background-ready[.]online | 1 | 2026-05-14 |
| domain | bg-go[.]online | 1 | 2026-05-14 |
| domain | bg-ready[.]online | 1 | 2026-05-14 |
| domain | bg-removerok[.]online | 1 | 2026-05-14 |
| domain | bg-transparency[.]online | 1 | 2026-05-14 |
| domain | brionter[.]com | 1 | 2026-05-14 |
| domain | cheeshomireciple[.]com | 1 | 2026-05-14 |
| domain | giovettiadv[.]com | 1 | 2026-05-14 |
| url | hxxps://brionter[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/net40[.]bin | 1 | 2026-05-14 |
| url | hxxps://obelnamevalf[.]org/OaTS7yE9zd/default | 1 | 2026-05-14 |
| url | hxxps://trindastal[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/loc8 | 1 | 2026-05-14 |
| url | hxxps://trindastal[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/v8 | 1 | 2026-05-14 |
| url | hxxps://trindastal[.]com/8250d149-9bf8-566d-9d7d-ea925eae0a4c/ | 1 | 2026-05-14 |
| domain | mail[.]bg-go[.]online | 1 | 2026-05-14 |
| domain | obelnamevalf[.]org | 1 | 2026-05-14 |
| domain | poronto[.]com | 1 | 2026-05-14 |
| domain | trindastal[.]com | 1 | 2026-05-14 |
| url | snippet[.]host/efguhk/raw | 1 | 2026-05-14 |
| url | pastebin[.]com/raw/mcwWi1Ue | 1 | 2026-05-14 |
| domain | rti[[.]]cargomanbd[[.]]com | 1 | 2026-05-14 |
| url | hxxps://github[[.]]com/leaked-claude-code/leaked-claude-code | 1 | 2026-05-14 |
| url | hxxps[:]//github[.]com/leaked-claude-code/leaked-claude-code/releases/download/leaked-claude-code/Claude_code_x64[.]7z | 1 | 2026-05-14 |
| domain | bad[.]xyz | 1 | 2026-05-14 |
| domain | reseqrch-test-uihksd89w4[.]cloudfront[.]net | 1 | 2026-05-14 |
| filename | .mcp.json | 1 | 2026-05-14 |
| url | hxxp://attacker-server[.]com | 1 | 2026-05-14 |
| url | hxxp://attacker-server[.]com/payload.sh | 1 | 2026-05-14 |
| filename | .claude/settings.json | 1 | 2026-05-14 |
| filename | ~/.local/share/pgmon/service.py | 1 | 2026-05-14 |
| filename | ~/.config/systemd/user/pgmon.service | 1 | 2026-05-14 |
| filename | /tmp/pglog | 1 | 2026-05-14 |
| url | hxxps://tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io/ | 1 | 2026-05-14 |
| domain | tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io | 1 | 2026-05-14 |
| url | hxxps://storage[.]googleapis[.]com/storage/v1/b/xdr-analytics-exfil/iam | 1 | 2026-05-14 |
| email | [email protected] | 1 | 2026-05-14 |
| domain | acceptable-use-policy-calendly[.]de | 1 | 2026-05-14 |
| domain | cocinternal[.]com | 1 | 2026-05-14 |
| domain | compliance-protectionoutlook[.]de | 1 | 2026-05-14 |
| domain | gadellinet[.]com | 1 | 2026-05-14 |
| domain | harteprn[.]com | 1 | 2026-05-14 |
| url | hxxps://login[.]managedservice365[.]blueprivacer[.]com/qnDaNmPM | 1 | 2026-05-14 |
| url | hxxps://login[.]managedservices365[.]assumetrend[.]org/yvFYpxLL | 1 | 2026-05-14 |
| domain | login[.]managedservice365[.]blueprivacer[.]com | 1 | 2026-05-14 |
| domain | login[.]managedservices365[.]assumetrend[.]org | 1 | 2026-05-14 |
| domain | na[.]businesshellosign[.]de | 1 | 2026-05-14 |
| url | hxxps://ftpbd[.]net/wp-content/plugins/cgi-/trade/trade//res.php | 1 | 2026-05-14 |
| url | hxxps://hnint[.]net/cgi-bin/peacemind//res.php | 1 | 2026-05-14 |
| url | hxxps://mtl-logistics[.]com/blb/blob.html | 1 | 2026-05-14 |
