109.205.195[.]211IP address
Reported by 1 independent source · first reported by The DFIR Report · last reported
Last reported 3 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira“While several failed to resolve, successful connections were established with 188.40.187.145:443 and 109.205.195[.]211:443 using the domains ev2sirbd269o5j.org and 2rxyt9urhq0bgj.org respectively.”
-
Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira“The Bumblebee malware established command and control (C2) with 109.205.195[.]211:443 and 188.40.187.145:443 using DGA domains.”
Indicators reported together
named in the same reports- opmanager[.]proin 2 reports
- ip-scanner[.]orgin 2 reports
- 170.130.55[.]223in 2 reports
- 188.40.187[.]145in 2 reports
- ev2sirbd269o5j[.]orgin 2 reports
- 2rxyt9urhq0bgj[.]orgin 2 reports
- 172.96.137[.]160in 2 reports
- 193.242.184[.]150in 2 reports
- 185.174.100[.]203in 2 reports
- 186b26df63df3b73…c1936f0aa5dain 2 reports
- a6df0b49a5ef9ffd…eb1914945331in 2 reports
- de730d969854c369…9fff6edce19din 2 reports
- zenmap[.]proin 1 report
- download-server[.]onlinein 1 report
- soft-server[.]onlinein 1 report
- soft-hub[.]proin 1 report
- hxxps://tria[.]ge/250530-ttmjhayzhwin 1 report
- tria[.]gein 1 report
- hxxps://tria[.]ge/250812-zw4tfszpy4in 1 report
- netml[.]shopin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.