172.81.60[.]97IP address
Reported by 1 independent source · first reported by Zscaler ThreatLabz · last reported
Last reported 7 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Middle East Conflict Fuels Opportunistic Cyber Attacks“…antial code overlap between kugou.dll and the LOTUSLITE backdoor documented in January 2026, including use of the same C2 IP address: 172.81.60[.]97.”
Indicators reported together
named in the same reports- hxxps://www.360printsol[.]com/2026/alfadhalah/thumbnail?img=index.pngin 1 report
- www.360printsol[.]comin 1 report
- www.e-kflower[.]comin 1 report
- goldman-iran-krieg.pages[.]devin 1 report
- cfgomma[.]comin 1 report
- 017.65c.mytemp[.]websitein 1 report
- irandonation[.]orgin 1 report
- nowarwithiran[.]storein 1 report
- khameneisol[.]xyzin 1 report
- 098bc0dd6a02a777fabb1b7d6f2da505in 1 report
- 80.97.160[.]190in 1 report
- media.hyperfilevault2[.]momin 1 report
- arch2.maxdatahost1[.]cyouin 1 report
- arch.megadatahost1[.]lolin 1 report
- media.megafilehost2[.]sbsin 1 report
- media.megadatahost1[.]lolin 1 report
- arch2.megadatahost1[.]lolin 1 report
- media.maxdatahost1[.]cyouin 1 report
- flourishingscreencousin[.]comin 1 report
- holidayslettucecircumvent[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.