cloud.g-drive[.]camDomain
Reported by 1 independent source · first reported by Palo Alto Unit 42 · last reported
Last reported 18 days ago
What the reports say
1 report, newest first · the exact sentence from each-
Blinder Tunnel Campaign Targets Iraqi Infrastructure“On May 16, 2026, a VirusTotal submitter from Israel submitted a phishing URL hosted on this IP address: hxxps://cloud.g-drive[.]cam/drive/file/d/[generated id]/view”
Indicators reported together
named in the same reports- hxxps://api.github[.]com/repos/peakyblinders-tm/myLic/contents/in 1 report
- 91.107.156[.]29in 1 report
- 6e7d9b33f1e72ea1…de9ecd1fd239in 1 report
- f5b12772db6817f7…4a372a410fc9in 1 report
- 53f35e49eb9b271f…be0363daa402in 1 report
- 3fd810a3aa003999…0887cdd3ed13in 1 report
- 76273382e4252c1f…891762c0682ein 1 report
- d3561bd4aad003dc…08ab1d4e8260in 1 report
- 65.109.214[.]145in 1 report
- f5ba1645694c62f5…37e72803b4bdin 1 report
- 87.248.129[.]239in 1 report
- 7cc571aca6d8715d…7c5d00a1f875in 1 report
- 38.180.136[.]127in 1 report
- googeldrive[.]camin 1 report
- drivegoogel[.]camin 1 report
- googelmeet[.]onlinein 1 report
- meetonline[.]camin 1 report
- asdfafadafg[.]onlinein 1 report
Copy these 18 indicators · defanged
Also named with it: CVE-2026-88771, CVE-2026-88772
Thanks — we review every report.