netml[.]shopDomain
Reported by 1 independent source · first reported by The DFIR Report · last reported
Last reported 3 months ago
What the reports say
1 report, newest first · the exact sentence from each-
From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira“Infrastructure Overlap: Passive DNS analysis confirms that the Ivanti gateways (netml[.]shop, shopping5.shop) utilized the same Hostinger staging IP (84.32.84.32) as the Wave 1 gateway, soft-server.online.”
Indicators reported together
named in the same reports- opmanager[.]proin 1 report
- zenmap[.]proin 1 report
- download-server[.]onlinein 1 report
- soft-server[.]onlinein 1 report
- soft-hub[.]proin 1 report
- hxxps://tria[.]ge/250530-ttmjhayzhwin 1 report
- tria[.]gein 1 report
- hxxps://tria[.]ge/250812-zw4tfszpy4in 1 report
- shopping5[.]shopin 1 report
- 84.32.84[.]32in 1 report
- 4.239.95[.]1in 1 report
- ip-scanner[.]orgin 1 report
- certgraveyard[.]orgin 1 report
- 170.130.55[.]223in 1 report
- delete[.]mein 1 report
- 188.40.187[.]145in 1 report
- 109.205.195[.]211in 1 report
- ev2sirbd269o5j[.]orgin 1 report
- 2rxyt9urhq0bgj[.]orgin 1 report
- 171.22.183[.]43in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.