# Copyright (c) 2014-2026 Maltrail developers (https://github.com/stamparm/maltrail/)
# See the file 'LICENSE' for copying permission

# Aliases: scavenger, ghostaction

# Reference: https://research.checkpoint.com/2022/cloudguard-spectral-detects-several-malicious-packages-on-pypi-the-official-software-repository-for-python-developers/
# Reference: https://securelist.com/two-more-malicious-python-packages-in-the-pypi/107218/

65.1.221.11:1337
utilities.tk
zerotwo-best-waifu.online

# Reference: https://www.reversinglabs.com/blog/sentinelsneak-malicious-pypi-module-poses-as-security-sdk

http://54.254.189.27
54.254.189.27:443

# Reference: https://blog.cyble.com/2023/05/03/new-kekw-malware-variant-identified-in-pypi-package-distribution/

blackcap.ru
kekwltd.ru

# Reference: https://www.reversinglabs.com/blog/vmconnect-malicious-pypi-packages-imitate-popular-open-source-modules
# Reference: https://otx.alienvault.com/pulse/64d26652e33287d2d5ca7fe7

deliworkshopexpress.xyz
ethertestnet.pro

# Reference: https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/malicious-packages-deepseeek-and-deepseekai-published-in-python-package-index

eoyyiyqubj7mquj.m.pipedream.net

# Reference: https://x.com/bzvr_/status/1927334283762430183
# Reference: https://x.com/bzvr_/status/1927337812539449744

196.251.81.229:6969

# Reference: https://jfrog.com/blog/chimera-sandbox-extensions-malware-threatens-pypi-users/

chimerasandbox.workers.dev
0l3qvp0sl3r5rgtl.chimerasandbox.workers.dev
4hhmng1s9zobe8gk.chimerasandbox.workers.dev
au6ewri21q4jcokh.chimerasandbox.workers.dev
bmehxcvbijyfpdg7.chimerasandbox.workers.dev
covnn2rvaagchcq1.chimerasandbox.workers.dev
qn2q3zr7js6ubls6.chimerasandbox.workers.dev
tnt69eqbib53nbj3.chimerasandbox.workers.dev
tpur5v4nwlv62e7f.chimerasandbox.workers.dev
twdtsgc8iuryd0iu.chimerasandbox.workers.dev
x403y4difmiagvoo.chimerasandbox.workers.dev

# Reference: https://x.com/johnk3r/status/1949862337340461528
# Reference: https://invokere.com/posts/2025/07/scavenger-malware-distributed-via-num2words-pypi-supply-chain-compromise/
# Reference: https://github.com/Invoke-RE/community-malware-research/blob/main/Research/Loaders/Scavenger/num2words_IOCs.md
# Reference: https://www.virustotal.com/gui/file/c36ebf96573afcb36bb31590d56e8af49502fb159e00fd4a59336f8a450bec8b/detection

ifyouseethisyouareultragay.com
pokerainteasy.su

# Reference: https://blog.gitguardian.com/ghostaction-campaign-3-325-secrets-stolen/

bold-dhawan.45-139-104-115.plesk.page

# Reference: https://x.com/cod3nym/status/1995851000251646237
# Reference: https://www.virustotal.com/gui/file/79cc98d0831e7b6a191000ec997ebc1853b1f6cc1190dbb855b97d7bf418c287/detection

212.80.7.213:20578

# Reference: https://x.com/malwrhunterteam/status/2040124590127554805
# Reference: https://x.com/BreakGlassIntel/status/2040130861291471272
# Reference: https://urlscan.io/result/019d5a40-561d-7779-bdd1-f3d21a5a0931/
# Reference: https://urlscan.io/result/019d5a42-60d8-73c8-adcc-626288505c35/
# Reference: https://www.virustotal.com/gui/file/063ac0149148ea4d7d8816b782b67c53c7d1f3f1e0d756d3477a2aa7a0754c7e/detection
# Reference: https://www.virustotal.com/gui/file/1b8c15f17fca23fd9e47be3b07bd34ccc352bc6c3dbbbf940b7652d44fe5ae06/detection
# Reference: https://www.virustotal.com/gui/file/ae36c0036d4125f41092d1b532257f4628d7205c4f9a0260c7a76e6e569920c3/detection
# Reference: https://www.virustotal.com/gui/file/98f74f3be68ea5ec3c4a86aeaf1577440a9d4c981c7ebe3dd55dfd84b622d609/detection
# Reference: https://www.virustotal.com/gui/file/f7ddba605e3d04e06d2f7b0fc4a38027ae58ca65a69d800dd2f43c8e94ca8396/detection
# BANNER_0_HASH-HOST=91963e65b02c1b191a294acba78fc4ae
# CLASS_0_HASH-HOST=7f51f08c8f99dcda98e0585b692925f5

beboss34.ru
bossbeyburda.xyz
caribb.ru
catatkerja.my.id
databreach.space
fanonlyatn.xyz
dash.databreach.space
data.catatkerja.my.id

# Reference: https://research.jfrog.com/post/hermes-px-pypi/

egenlabs.com
urlvoelpilswwxkiosey.supabase.co
/EGenLabs/hermes/

# Generic

/dsc_injection
/wap/dsc_injection
/wap/enner/injector
/wap/shatlegay/stealer
/wap/shatlegay/stealer123365
/shatlegay/stealer
/shatlegay/stealer123365
