IOCs

Indicators extracted from posts. Substring search; click any indicator to see every post that mentioned it.

Indicators are leads, not verdicts — verify against the originating post before acting. Extraction coverage is still expanding. Pull these via the IOC feed →

Type	Value (defanged)	Posts	Last seen
url	hxxps://dry[.]za[.]com/if1/	1	2026-05-13
url	hxxp://t[.]ly/KwKzQ	1	2026-05-13
email	[email protected]	1	2026-05-13
domain	1[.]9[.]5[.]0[.]9[.]1[.]0[.]0[.]0[.]7[.]4[.]0[.]1[.]0[.]0[.]2[.]ip6[.]arpa	1	2026-05-13
domain	5[.]2[.]1[.]6[.]3[.]0[.]0[.]0[.]7[.]4[.]0[.]1[.]0[.]0[.]2[.]ip6[.]arpa	1	2026-05-13
domain	8[.]1[.]9[.]5[.]0[.]9[.]1[.]0[.]0[.]0[.]7[.]4[.]0[.]1[.]0[.]0[.]2[.]ip6[.]arpa	1	2026-05-13
domain	9[.]a[.]d[.]0[.]6[.]3[.]0[.]0[.]0[.]7[.]4[.]0[.]1[.]0[.]0[.]2[.]ip6[.]arpa	1	2026-05-13
domain	d[.]d[.]e[.]0[.]6[.]3[.]0[.]0[.]0[.]7[.]4[.]0[.]1[.]0[.]0[.]2[.]ip6[.]arpa	1	2026-05-13
url	hxxp://lemurinfo[.]com/content/fragments/combine.html?fragmentOneContents=	1	2026-05-13
url	hxxp://lemurinfo[.]com/content.html	1	2026-05-13
domain	lemurinfo[.]com	1	2026-05-13
domain	aopmbxeqax[[.]]click	1	2026-05-13
domain	fgynfgi[[.]]buzz	1	2026-05-13
domain	googlenames[.]top	1	2026-05-13
domain	safesecurea[[.]]sbs	1	2026-05-13
domain	youtubefind[[.]]top	1	2026-05-13
sha256	911cccd238fbfdb4babafc8d2582e80dcfa76469fa1ee27bbc5f4324d5fca539	1	2026-05-13
sha256	c9128d72de407eede1dd741772b5edfd437e006a161eecfffdf27b2483b33fc7	1	2026-05-13
domain	dorareco[[.]]net	1	2026-05-13
sha256	e53bc08e60af1a1672a18b242f714486ead62164dda66f32c64ddc11ffe3f0df	1	2026-05-13
domain	racineupci[[.]]org	1	2026-05-13
registry_key	Software\Microsoft\Windows\CurrentVersion\Run\CanonPrinter	1	2026-05-13