Infrastructure of Interest: Medium Confidence Command And Control

Aug. 8, 2025, 7:46 a.m.

Description

These indicators of compromise (IOCs) were identified through LevelBlue Labs' proprietary collection and threat hunting processes, leveraging AI-driven heuristics to detect anomalous patterns, behavioral analysis of malicious activity, and cross-referenced intelligence from endpoint telemetry and external sources. The IOCs included in this pulse are associated with command and control (C2) infrastructure, facilitating malware communication, data exfiltration, and persistent threat actor operations. Use this data to enhance detection rules, block malicious infrastructure, or correlate with existing incident investigations.

Tags

Date

  • Created: Aug. 7, 2025, 7:29 a.m.
  • Published: Aug. 7, 2025, 7:29 a.m.
  • Modified: Aug. 8, 2025, 7:46 a.m.

Indicators

  • www.rhadamanthys.de
  • www.vividsense.org
  • www.fastcloud17.sbs
  • www.farorsps.com
  • www.ex9.cc
  • www.diskrifinder.de
  • www.crm.tifim.com.br
  • www.bunkeranlagen.de
  • www.xcb.one
  • www.kkguu.com
  • www.hetrxio.online
  • www.dfhuw.cn
  • www.bg.parts
  • ysqwsa7a5bd9474c.top
  • your-bigprofit.top
  • xrrxbb3601042986.top
  • wsmtv.xyz
  • webcoderscdn.eu
  • websitedown.xyz
  • worlopollox.top
  • uuqwac911437455c.top
  • vipxgo.xyz
  • vindalexw.xyz
  • tplmv9fc788ed799.top
  • top5.work
  • topkee.top
  • tapcoins.xyz
  • streammain.top
  • sterndrive.cc
  • simplifi.work
  • sigmacontrol.eu
  • showrunner.xyz
  • scouts.nz
  • schallers.xyz
  • readyevents.eu
  • re-captha-version-3-25.top
  • re-captha-version-3-275.buzz
  • quintinquartermaster.work
  • qusoc.click
  • quix.work
  • qualityservice.top
  • qaxno1.ml
  • pxoit5a1da562f02.top
  • pxoit5a1da562f02.net
  • przedszkolestrzelce.eu
  • preview-web.xyz
  • pohutukawagallery.nz
  • picoapps.xyz
  • pctel.biz
  • os1515.work
  • nxouz9de87780a5d.top
  • ncquickpassmx.top
  • newso2.xyz
  • mxdm.xyz
  • msqiv3ad02794605.top
  • misspompadour.xyz
  • manga18.xyz
  • m3ulist.xyz
  • luckyblock.top
  • ljdki897cc184833.top
  • ljsex7a7a878dfc4.top
  • lennyngetich.xyz
  • leads.work
  • kclfve16378fbe09.top
  • krfastbox704.top
  • int3ew.xyz
  • irpass.cc
  • jabus.xyz
  • imbeaf798f024fd9.top
  • icjai7080f7b5238.top
  • i2pd.xyz
  • getmusic.cc
  • hbkjc1b8fdc04e64.top
  • givemeredditstream.cc
  • ftcia06bb2600555.top
  • gagtac2d844c0eec.top
  • freshpanels.xyz
  • fradlb0bcaf8040c.top
  • fhapp.xyz
  • fbawk8099b9f4e3b.top
  • fastht.ml
  • fbcqrbaa07bc0fee.top
  • fastlink.xyz
  • f4fcdn.eu
  • coloring.top
  • ellearcher.nz
  • ddfet0eeb5a6b934.top
  • duniyakibaru.ml
  • cooawbi.top
  • consciencewer.xyz
  • commonsupport.xyz
  • captchawizard.top
  • capturethebug.xyz
  • 476666.xyz
  • 52iiansi.xyz
  • bestcache.top
  • booksc.xyz
  • 100peaks.nz
  • 909-services.xyz
  • 187187.xyz
  • 30duzhes.top
  • 94-130-203-181.top
  • 94-130-167-220.top
  • asportsplus.xyz
  • asstr.xyz
  • 5bqyp.top
  • arslanrocky.xyz
  • apartbin.top
  • 158-69-126-44.xyz
  • 4funbox.xyz
  • 94-130-130-242.top
  • 142-132-200-46.top
  • birdseeds.xyz
  • 144-76-107-211.top
  • 148-251-75-109.top
  • blackfriday.cam
  • bhom.xyz
  • 2303.xyz
  • 138-201-193-61.top
  • 2bot.top
  • zhaofenghotel.net
  • youdaopllvow.icu
  • x-xx-x.ydns.eu
  • wormoni.lms-austria.com
  • wss.as.vip
  • wsip-98-184-14-107.mc.at.cox.net
  • ws.kelimator.app
  • win2325.webredirect.org
  • web.moodculture.com
  • web.signingflow.com
  • web-center.org
  • wealthytradesbanks.duckdns.org
  • ward-16-b2-v4wan-166537-cust928.vm18.cable.virginm.net
  • wealthyblessed.minhaempresa.tv
  • wap.linuxdownloadrpm.com
  • vwpjzo4zy.localto.net
  • vps.tuxy.lol
  • vps.nextfilms.net
  • vmi2687021.contaboserver.net
  • vmi2322439.contaboserver.net
  • vmi1505556.contaboserver.net
  • vibrant-wozniak.176-123-1-62.plesk.page
  • vigorous-napier.45-80-158-242.plesk.page
  • vibrant-almeida.196-251-70-227.plesk.page
  • v2202504174830327536.megasrv.de
  • vbjhb.linkpc.net
  • uvzbhscuy.lat
  • uut.de
  • update.read-books.org
  • update.exitprojectmanagement.com
  • unsung.cc
  • ukrpossea.top
  • ty.softlinko.com
  • tryfancify.com
  • tristan-aldebert.com
  • traefik.skytechmotorsport.co.uk
  • transitx.in
  • track.postal.timiki.org
  • tong123.top
  • telo2158.duckdns.org
  • tefalhizla.it.com
  • td.ldxwpedf.cn
  • syss.offsys.nl
  • suezax50.ddns.net
  • subastasgalileo.es
  • state.archarabia.com
  • spidra.diverto.hr
  • sophiahouston.com
  • ssn24.ink
  • sooassa.sells-it.net
  • sk.vgpt.eu
  • shuzigfxz.com
  • shogun-dark.duckdns.org
  • sharefiles.webredirect.org
  • shareaz.allianz-courtage.co
  • seller.telegram-market.ru
  • sdpms.com
  • sctr1.localtonet.com
  • sazwebapiprod.allianz-courtage.co
  • saratrufefufel.com
  • s.p6.fit
  • rsmtp-004.fmcity.com
  • rsmtp-003.fmcity.com
  • rootsel.com
  • romofashion.com
  • riderbit.com
  • reverent-jepsen.213-209-143-43.plesk.page
  • resoglobalx.com
  • qwerty1223.ddns.net
  • qaazjz06a73rdkempzdjw7cce8e.useushippinginc.com
  • px.drwps.com
  • private.cechire.com
  • prakashjadhav74738.ddns.net
  • postcardnews.com
  • pqtejl5dd.localto.net
  • porten.top
  • pingservice.is-a-teacher.com
  • pokupi.com
  • parfenov.rtu-tc.ru
  • pepinaza.duckdns.org
  • panel2.ssagnryvento.com
  • ovancorpdev.123websitedev.com
  • outlook.secureboxdoc.org
  • oqjdvcieh.linkpc.net
  • office.verifiedaccesssecure.icu
  • nyreon.net
  • ns3.powwwerworkgroup.com
  • ns3.cafei.com
  • ns2.uptimesinstitute.com
  • ns2.pl-profil.com
  • ns2.novatronica.com
  • ns2.metorlogs.com
  • ns2.agorab2b.com
  • ns1.localtonet.com
  • ns1.downunderbidets.com
  • ns1.ddnss.de
  • ns1.boulevards.com
  • nott-21-b2-v4wan-161959-cust144.vm15.cable.virginm.net
  • noon1.nqbaccessible.de.com
  • nominanuevo.duckdns.org
  • nid.linkdeposits.o-r.kr
  • ngumbitertiary0012.duckdns.org
  • ngaddis2.publish.ngaddis2.antares-test.windows-int.net
  • nexsa111.sells-it.net
  • next2.xftth.com
  • netflix-abonnement.help
  • nbr.elbracht.net
  • myebooker.eu5.org
  • mx2.psbcltd.cn
  • movies.floatymonkys.org
  • mis47.de
  • migs.localto.net
  • mis36.de
  • miner888.cfd
  • microsoft84.casacam.net
  • metavm.mysynology.net
  • mayankservers.eu.org
  • manoooo101.ddns.net
  • mail.vestcast.co
  • mail.useushippinginc.com
  • mail.uptimesinstitute.com
  • mail.orcashipping.ro
  • mail.mailware.org
  • mail.h123.xyz
  • mail.dgteoes-sede.cfd
  • magellan.krdumvd.ru
  • ma5d2jf.localto.net
  • m26943.contaboserver.net
  • m179.creativeworldsmedia.com
  • m.geyian.com
  • khalil3131.ddns.net
  • lkitp0fjosazdfcir8zvmgdr7d.ohyeahh.cc
  • lk7799.duckdns.org
  • lishiming07.top
  • laohupojie.com
  • landownerdozenguard.com
  • lamaite17.warkloom31.coastview-luxury.com
  • kvservervpn.duckdns.org
  • kr100m012v1.imadministrator.com
  • knoeyyrt.com
  • kltapp1.petusound.com
  • keyauth.ddns.net
  • kalel1234.ddnsgeek.com
  • jsodi.pallldnx.jjkksjdncm.club
  • jsjfhdj.bzjckvk.mnxbcbxbx.club
  • job3.yjctllgcq.cn
  • invoice.myonlinedoc.kro.kr
  • intelligent-galois.45-138-16-131.plesk.page
  • immersiverealms.us
  • images.seansolovev.ru
  • i0834.cn
  • hopeful-aryabhata.194-105-5-249.plesk.page
  • homecookupmagic.site
  • hj8917.top
  • hj7796.top
  • helpmicrosoft.ddnsfree.com
  • hcpanel.hackcrack.io
  • gtahub.club
  • graf-pre-prod.shestakovyachtsales.com
  • googeapicdn.online
  • goldenclear.top
  • glgkorea.com
  • git.antharris.top
  • g633.com
  • g.iambatman.top
  • furbodo.xyz
  • fttuvgt.ddnsfree.com
  • frosted-family.xyz
  • fp6fd98d46.ap.nuro.jp
  • forum.azmatel.org
  • francaisabarcelone.com
  • fishwoapi.chat.xsnight.cn
  • file1-h1.filedo.net
  • fikom.esaunggul.ac.id.stbvip.vipop.biz.id
  • fdaasdfklnsahaszzzxfseraa.pro
  • fa.alokn.cn
  • evarosa.vn
  • evoquantumwave.xyz
  • euland.freevar.com
  • emv1.zrc-rubber.com
  • esteesnuevo2025.duckdns.org
  • emv1.vestcast.co
  • emv1.uptimesinstitute.com
  • emv1.novatronica.com
  • emv1.nglocalhost.com
  • emv1.dfhuw.cn
  • eloquent-kalam.198-251-84-224.plesk.page
  • elastic-ptolemy.137-184-46-150.plesk.page
  • edifice.direct.quickconnect.to
  • edge-chat.allianz-courtage.co
  • ecosistema.ivaras.cl
  • ec2-3-122-235-189.eu-central-1.compute.amazonaws.com
  • ec2-157-175-176-40.me-south-1.compute.amazonaws.com
  • ec2-54-233-24-103.sa-east-1.compute.amazonaws.com
  • e-commerce666.com
  • ec2-15-157-72-7.ca-central-1.compute.amazonaws.com
  • e-commerce555.com
  • dwqmwrfqlf.click
  • dragones2.dynuddns.com
  • doshstreamingar.bazaito.com
  • download.vasgard.rocks
  • dollarman101.hopto.org
  • docaccesshub.top
  • dl.gewangcn.cn
  • dia6969.duckdns.org
  • dgtsees-sede.cfd
  • dev.adenz.top
  • demo.etlworks.com
  • deguo1.silkhers.com
  • deepseadon.dad
  • darko-met.duckdns.org
  • d.0vs.org
  • cwma-10-b2-v4wan-167603-cust250.vm2.cable.virginm.net
  • cuzwedid.xyz
  • cs.h123.xyz
  • crazy-colden.212-224-86-146.plesk.page
  • coxverification.con-ip.com
  • connectionsunlimited.tempurl.host
  • confy9.mywire.org
  • confident-shockley.176-123-1-62.plesk.page
  • condescending-engelbart.176-123-1-62.plesk.page
  • cmprecisiontech.tempurl.host
  • cloud.antharris.top
  • client.cryptoveche.xyz
  • cipqa.com
  • chevtchenko.com
  • chernuha.vps.webdock.cloud
  • cheng-hong.asia
  • cdn.tqb.app
  • cdl-lb-1356093980.us-east-1.elb.amazonaws.com
  • cctvfilsham.bht.org.uk
  • cbevil.merseine.com
  • catevil.com
  • caisleans.com
  • bunkeranlagen.de
  • braendli.vpbx.iway.ch
  • br.securetunnels.net
  • boty.theworkpc.com
  • bpzxjty7k.localto.net
  • botnetszx.duckdns.org
  • bnaalkher.etpcon.net
  • bmwrus.com
  • blogdosartistas.org
  • bkp.payoopoint.net
  • bine.newpowergroup.com
  • bilheteriaonline.org
  • beta.payoopoint.net
  • bebelokomozoomix.xyz
  • bc0c40.ddnsking.com
  • beautiful-shaw.45-144-214-106.plesk.page
  • bakrie.ac.id.stbvip.vipop.biz.id
  • autoconfig.steel-opora.ru
  • b3kylyu7z.localto.net
  • backup001.webredirect.org
  • autodiscover.proteinrg.com
  • autodiscover.caef11.top
  • autodiscover.oboron-komplekt.ru
  • auth.byluoyulin.com
  • austin.xozv.top
  • app.yizu.tv
  • aka.alokn.cn
  • 1b2ef735fd691beeb6b5bda93f5fc142.org
  • 1.www.richinimpianti.cloud
  • 103-172-26-247.cprapid.com
  • 164-92-127-11.cprapid.com
  • 167-172-79-24.cprapid.com
  • a.zyzh.space
  • 196-251-88-248.cprapid.com
  • 3osch20.duckdns.org
  • adoring-clarke.92-205-165-168.plesk.page
  • 208-85-19-80.cprapid.com
  • 8wsy.com
  • 7yamy.com
  • 8320.cn
  • 123wa.com
  • xtudy.xyz
  • propertyinstitute.nz
  • zilcore.giize.com
  • xvic8.publicvm.com
  • x.ojbk.zip
  • wqo9.firewall-gateway.de
  • windows10-11.ddnsfree.com
  • wa64-029.cafe24.com
  • v2202502253868315544.hotsrv.de
  • uqvn1ek6t.localto.net
  • ttttppplllbk.duckdns.org
  • travel.bumbleshrimp.com
  • sybyqpj.com
  • surcultural.info
  • shadow.steelpanman.com
  • scbr2.localtonet.com
  • salan1.webredirect.org
  • reverent-northcutt.149-102-147-106.plesk.page
  • rar.ydns.eu
  • putaoshu.top
  • netframework.ydns.eu
  • mywinsupdate64.com
  • market-lumma.ru
  • m.66qo.cn
  • longlife.theworkpc.com
  • lishiming02.top
  • hj6686.top
  • gkfcr.fun
  • git.adventurelife-rp.de
  • gasworld.duckdns.org
  • frankohacker.strangled.net
  • etcs.ydzh.ltd
  • data01.asadal.com
  • dapaoj.xyz
  • dailycookupmagic.site
  • d-y21.com
  • corina2contractebk.duckdns.org
  • cloedjw.duckdns.org
  • brutico2025aprende.kozow.com
  • ambassador-boost.ru
  • annadirovichblogs.com
  • allianz-courtage.co
  • bcgdd.cfd
  • bolotadoida.duckdns.org
  • kyleeandco.nz
  • sys.offsys.nl
  • hcm-foxconn.com
  • youdaopllvot.icu
  • newlegendrpg.com
  • france.bloodvpns.online
  • gaoqiqiang.xyz
  • usulbuyukisyan.xyz
  • echojoy.xyz

Attack Patterns

Additional Informations

  • rpc-p1.bajun.network
  • books.xn--7ov.co
  • test-pages.digital