hunt[.]ioDomain
Reported by 4 independent sources · first reported by Huntress · last reported
Last reported yesterday
What the reports say
8 reports, newest first · the exact sentence from each-
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge“Hunt[.]io attributed the PHP2Shell traffic it observed to an established Mirai-style botnet, active since at least May 2026, that recently added the flaws to the methods it uses to spread.”
-
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware“The same exploitation server ("206.188.197.105") has also been flagged by Hunt[.]io, which said the threat actor behind the operation has targeted 123 servers across cloud, shared-hosting and ISP networks.”
-
Security Affairs newsletter Round 599 by Pierluigi Paganini – INTERNATIONAL EDITION“Hunt[.]io Finds New Infrastructure Of BraZetsu Access Broker Months Before Disclosure”
-
ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories“Hunt[.]io, in a new analysis of the network indicators, said "the command hostname reported on 31 August, c2.installscenter.com, was already serving TLS on a second VPS (80.78.27.252) on port 2083 from 4 April 2026, almost five months before the disclosure.”
-
Hunt.io Finds New Infrastructure Of BraZetsu Access Broker Months Before Disclosure“Hunt[.]io Finds New Infrastructure Of BraZetsu Access Broker Months Before Disclosure”
-
Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent“That same month, Hunt[.]io also highlighted another operation in which attackers used Hermes Agent in unattended "YOLO" mode to target Thailand's Ministry of Finance (MOF), ultimately breaching multiple systems within the network.”
-
Unmasking an Attack Chain of MuddyWater“On March 4, 2026, Hunt[.]io published a blog regarding Iranian-linked APT infrastructure indicators.”
-
ClickFix Attack: Variants, Detection & How It Works“hxxps://hunt[.]io/blog/macos-clickfix-applescript-terminal-phishing”
Indicators reported together
named in the same reports- c2.installscenter[.]comin 2 reports
- painel.installscenter[.]comin 2 reports
- 80.78.27[.]252in 2 reports
- 107.189.14[.]87in 1 report
- 157.20.182[.]49in 1 report
- 173.16.10[.]1in 1 report
- 162.0.230[.]185in 1 report
- e25892603c42e34b…04d6281b743bin 1 report
- 589ecb0bb31adc61…8e613a7740b6in 1 report
- hxxps://redteamer[.]tips/bring-your-own-fixin 1 report
- redteamer[.]tipsin 1 report
- hxxps://mrd0x[.]com/filefix-clickfix-alternative/in 1 report
- mrd0x[.]comin 1 report
- hxxps://mrd0x[.]com/filefix-part-2/in 1 report
- hxxps://www.cloudsek[.]com/blog/threat-actors-lure-victims-into-downloading-hta-files-using-clickfix-to-spread-epsilon-red-ransomwarein 1 report
- hxxps://hunt[.]io/blog/macos-clickfix-applescript-terminal-phishingin 1 report
- hxxp://clickfix[.]wiki/in 1 report
- clickfix[.]wikiin 1 report
Copy these 18 indicators · defanged
Also named with it: CVE-2026-109618, CVE-2026-109619
Thanks — we review every report.