Indicators of Compromise
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
| value | context | campaigns | Copy |
|---|---|---|---|
| domainbyte-io.us | Network indicator from blog post | 1 | |
| domainapi.ipify.org | Network indicator from blog post | 1 | |
| domainipinfo.io | Legitimate service abused by Epsilon Stealer for victim geolocation (GET /json). Also used for sandbox IP blacklist check. | 1 | |
| ipv489.36.224.5 | IP address indicator from blog post | 1 | |
| ipv4208.115.220.17 | IP address indicator from blog post | 1 | |
| sha2560a8ab3d16b12d3a453ee5a3208fe04744ad54514ef8ea27bb8fe32679efad270 | SHA-256 hash from blog post | 1 | |
| sha2560b028b781950641818800fee2b4bf68e4ef2bcee53fe71a21755275ba108783d | SHA-256 hash from blog post | 1 | |
| sha1dfd224461edb06c556ee0d5677bd78ddda80b910 | SHA-1/commit-like hash from blog post | 1 | |
| domainprod.universitecentrale.net | Network indicator from blog post | 1 | |
| domainurlvoelpilswwxkiosey.supabase.co | Network indicator from blog post | 1 | |
| domainchat.universitecentrale.net | Network indicator from blog post | 1 | |
| ipv4146.0.0.0 | IP address indicator from blog post | 1 | |
| sha1333e5b7c412736685b3c296a58663a7763744949 | SHA-1/commit-like hash from blog post | 1 | |
| sha14c385d4376314b24793b6b4e3526783f72383667 | SHA-1/commit-like hash from blog post | 1 | |
| sha12a6e3839766d215e40785f6b277dc2a34d4e2f71 | SHA-1/commit-like hash from blog post | 1 | |
| sha1442158353951337678587c236567276e767a3d39 | SHA-1/commit-like hash from blog post | 1 | |
| sha13f3922326c646a2d2f78703073224a3e4a366761 | SHA-1/commit-like hash from blog post | 1 | |
| sha13c335f732e6f5c3b48665745325c572b25724a60 | SHA-1/commit-like hash from blog post | 1 | |
| sha12968623b3a4c275d544149674522663559617b74 | SHA-1/commit-like hash from blog post | 1 | |
| sha15551307d753c3c5a59333c25525f2f446d2a213e | SHA-1/commit-like hash from blog post | 0 | |
| sha13d69675671616a6426515e7cc2a32e4ac2a32c33 | SHA-1/commit-like hash from blog post | 0 | |
| sha1c2a32a743329604e5633767d4e7e567a48246476 | SHA-1/commit-like hash from blog post | 0 | |
| domainadmondtamang.com.np | Network indicator from blog post | 1 | |
| domaingist.github.com | Network indicator from blog post | 1 | |
| domaingist.githubusercontent.com | Network indicator from blog post | 1 | |
| sha25640aa5d412a50db79a814ac5ad65237745727cb4777843d66a760f64285a5a3e6 | SHA-256 hash from blog post | 1 | |
| sha11c5d51c2002f452a4dd58a1a73a9dd90a7fe0297 | SHA-1/commit-like hash from blog post | 1 | |
| md5814132e794e5d007e9b8ebd223a9494f | MD5 hash from blog post | 1 | |
| md50c0fc7a0c23cdb5e1c8f66b208053ed6 | MD5 hash from blog post | 1 | |
| ipv4144.31.107.231 | IP address indicator from blog post | 1 | |
| emailw1gtd@sharebot.net | Email indicator from blog post | 1 | |
| domainjsonkeeper.com | Public JSON paste service used as dead-drop C2. Shared TTP-family with express-session-js (DPRK Contagious Interview / Famous Chollima) — technique-level link, not hard attribution. | 2 | |
| domain216.126.237.71 | Network indicator from blog post | 1 | |
| ipv4216.126.237.71 | IP address indicator from blog post | 2 | |
| ipv4216.126.229.166 | IP address indicator from blog post | 1 | |
| ipv4216.126.227.239 | IP address indicator from blog post | 1 | |
| sha256b5cca27ca1d792bd8c46b83fccfa4e5ba38916eb78877a19cbb39392ce98cc39 | SHA-256 hash from blog post | 1 | |
| md5a36adbc35e69b22acbf9f834a0deb286 | MD5 hash from blog post | 1 | |
| domainsfrclak.com | Network indicator from blog post | 1 | |
| ipv4142.11.206.73 | IP address indicator from blog post | 1 | |
| sha2565bb67e88846096f1f8d42a0f0350c9c46260591567612ff9af46f98d1b7571cd | SHA-256 hash from blog post | 1 | |
| sha25659336a964f110c25c112bcc5adca7090296b54ab33fa95c0744b94f8a0d80c0f | SHA-256 hash from blog post | 1 | |
| sha256fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf | SHA-256 hash from blog post | 1 | |
| sha256e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09 | SHA-256 hash from blog post | 1 | |
| emailifstap@proton.me | Email indicator from blog post | 1 | |
| emailnrwise@proton.me | Email indicator from blog post | 1 | |
| domain83.142.209.203 | Network indicator from blog post | 1 | |
| ipv483.142.209.203 | IP address indicator from blog post | 1 | |
| sha2567321caa303fe96ded0492c747d2f353c4f7d17185656fe292ab0a59e2bd0b8d9 | SHA-256 hash from blog post | 1 | |
| sha256cd08115806662469bbedec4b03f8427b97c8a4b3bc1442dc18b72b4e19395fe3 | SHA-256 hash from blog post | 1 |