windows.n1tro[.]cyouDomain

Reported by 1 independent source · first reported 11 Jun 2026 by Sekoia.io · last reported 11 Jun 2026

Last reported 4 months ago

What the reports say

1 report, newest first · the exact sentence from each

“One of the IOCs associated with the Mimus ransomware, reportedly used by Mimo IS and documented by AhnLab, is windows.n1tro[.]cyou.”

Sekoia.ioVendor11 Jun 2026
The Sharp Taste of Mimo'lette: Mimo Targets Craft CMS

Indicators reported together

named in the same reports

85.106.113[.]168in 1 report
n1tr0[.]onlinein 1 report
1aa4d88a38f5a27a…9abc29ea671ein 1 report
3a71680ffb4264e0…2125a98b94aain 1 report
fc04f1ef05847607…252c18dd7a62in 1 report
7868cb82440632cc…daf1d108ee9ain 1 report
2e46816450ad1b4b…b6c36bbb3fd5in 1 report
hxxp://15.188.246[.]198/alamdar.x86_64in 1 report
15.188.246[.]198in 1 report
hxxp://15.188.246[.]198/4l4md4r.shin 1 report
hxxp://15.188.246[.]198/hezb.x86_64in 1 report

Copy these 11 indicators · defanged

11 indicators, defanged, one per line

85.106.113[.]168
n1tr0[.]online
1aa4d88a38f5a27a60cfc6d6995f065da074ee340789ed00ddc29abc29ea671e
3a71680ffb4264e07da4aaca16a3f8831b9a30d444215268e82b2125a98b94aa
fc04f1ef05847607bce3b0ac3710c80c5ae238dcc7fd842cd15e252c18dd7a62
7868cb82440632cc4fd7a451a351c137a39e1495c84172a17894daf1d108ee9a
2e46816450ad1b4baa85e2a279031f37608657be93e1095238e2b6c36bbb3fd5
hxxp://15.188.246[.]198/alamdar.x86_64
15.188.246[.]198
hxxp://15.188.246[.]198/4l4md4r.sh
hxxp://15.188.246[.]198/hezb.x86_64

Also named with it: CVE-2025-32432, CVE-2024-46483

Thanks — we review every report.

Report a wrong value