sam[.]hivDomain
Reported by 1 independent source · first reported by GreyNoise · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation“$sam = reg save HKLM\SAM C:\Windows\Temp\sam[.]hiv /y 2>&1”
Indicators reported together
named in the same reports- com[.]twin 1 report
- httpbin[.]orgin 1 report
- re[.]searchin 1 report
- resp[.]readin 1 report
- hxxp://74.48.66[.]73:9860/sshin 1 report
- 74.48.66[.]73in 1 report
- 2ff2945b13a4cd0e…bf9f8a4000b1in 1 report
- p3.981666[.]xyzin 1 report
Copy these 8 indicators · defanged
Also named with it: CVE-2026-60004, CVE-2022-0847, CVE-2026-60137, CVE-2026-63030, CVE-2023-54391, CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-7273, CVE-2026-56271, CVE-2026-79756, CVE-2026-54569
Thanks — we review every report.