GEO THREAT INTEL
LIVEGeolocated, MITRE-ATT&CK-attributed indicators of compromise — classified malicious / suspicious / clean. Sourced from the estate threat-intel pipeline; enriched, never re-scanned.
Indicators
40
geolocated IOCs
Origin countries
8
distinct sources
Attributed actors
8
MITRE intrusion sets
Classification
MALICIOUS
dominant verdict
GLOBAL IOC MAP
malicious
suspicious
clean
equirectangular · hover a node for detail
ORIGIN COUNTRIES
US13
CA13
NL4
JP3
DE3
RO1
CH1
GE1
TOP ATTRIBUTED ACTORS
Earth Lusca
G1006
Turla
G0010
Sandworm Team
G0034
Contagious Interview
G1052
Scattered Spider
G1015
Rocke
G0106
Mustang Panda
G0129
RedEcho
G1042
ATTRIBUTION GRAPH · ACTOR ↔ INDICATOR
MITRE-ATTRIBUTED INDICATORS
◆ actors (MITRE intrusion sets) · ● indicators (colored by classification) · lines = attribution
INDICATOR REGISTRY
40 geolocated IOCs
INDICATORS
| INDICATOR | CLASS | GEO | NETWORK | SOURCE | ATTRIBUTION |
|---|---|---|---|---|---|
| 85.137.53.71 | malicious | NL | AS43641 SOLLUTIUM EU Sp z.o.o. | msrc | — |
| 76.76.21.21 | malicious | US | AS16509 Amazon.com, Inc. | unit42 | — |
| 104.20.24.117 | malicious | CA | AS13335 Cloudflare, Inc. | unit42 | — |
| 172.66.150.162 | malicious | CA | AS13335 Cloudflare, Inc. | unit42 | — |
| 209.182.237.133 | malicious | JP | AS29802 HIVELOCITY, Inc. | unit42 | — |
| 185.10.68.127 | malicious | RO | AS200651 FlokiNET ehf | unit42 | — |
| 209.94.90.1 | malicious | US | AS40680 Protocol Labs | hackernews | Scattered Spider |
| 172.66.0.227 | malicious | CA | AS13335 Cloudflare, Inc. | bleeping | Play, Scattered Spider |
| 45.131.66.106 | malicious | DE | AS213250 Dominic Scholz... | hackernews | — |
| 64.20.53.230 | malicious | US | AS19318 Interserver, Inc | hackernews | — |
| 185.70.42.45 | malicious | CH | AS62371 Proton AG | hackernews | — |
| 91.132.163.78 | malicious | DE | AS213520 Senko Digital LLC | hackernews | Lazarus Group |
| 142.251.186.191 | malicious | US | AS15169 Google LLC | hackernews | — |
| 18.160.156.19 | malicious | US | AS16509 Amazon.com, Inc. | darkreading | — |
| 18.160.156.24 | malicious | US | AS16509 Amazon.com, Inc. | darkreading | — |
| 18.160.156.28 | malicious | US | AS16509 Amazon.com, Inc. | darkreading | — |
| 18.160.156.44 | malicious | US | AS16509 Amazon.com, Inc. | darkreading | — |
| 176.65.139.204 | malicious | NL | AS214472 Offshore LC | hackernews | — |
| 3.96.91.14 | malicious | CA | AS16509 Amazon.com, Inc. | hackernews | — |
| 83.142.209.214 | malicious | DE | AS205759 Ghosty Networks LLC | hackernews | Rocke |
| 34.117.59.81 | malicious | US | AS396982 Google LLC | hackernews | Rocke |
| 178.236.252.133 | malicious | NL | AS205775 NEON CORE NETWORK LLC | hackernews | Earth Lusca |
| 77.91.123.187 | malicious | GE | — | hackernews | Earth Lusca |
| 96.126.130.126 | malicious | JP | AS149440 Evoxt Sdn. Bhd. | hackernews | Sandworm Team |
| 188.208.141.177 | malicious | IN | AS132335 LEAPSWITCH NETWORKS... | hackernews | Mustang Panda, RedEcho |
| 194.5.97.169 | malicious | NL | AS149020 WebHorizon Internet Services | hackernews | Mustang Panda, RedEcho |
| 104.20.44.100 | malicious | CA | AS13335 Cloudflare, Inc. | bleeping | Sandworm Team |
| 172.66.169.62 | malicious | CA | AS13335 Cloudflare, Inc. | bleeping | Sandworm Team |
| 137.220.156.33 | malicious | JP | AS4907 IENS TECHNOLOGY PTE. LTD | hackernews | — |
| 104.26.3.16 | malicious | CA | AS13335 Cloudflare, Inc. | hackernews | Turla |
| 104.26.2.16 | malicious | CA | AS13335 Cloudflare, Inc. | hackernews | Turla |
| 172.67.75.40 | malicious | CA | AS13335 Cloudflare, Inc. | hackernews | Turla |
| 174.138.125.138 | malicious | US | AS14061 DigitalOcean, LLC | hackernews | Turla |
| 172.67.183.105 | malicious | CA | AS13335 Cloudflare, Inc. | hackernews | Earth Lusca |
| 104.21.18.221 | malicious | CA | AS13335 Cloudflare, Inc. | hackernews | Earth Lusca |
| 76.76.21.98 | malicious | US | AS16509 Amazon.com, Inc. | hackernews | Earth Lusca, Contagious Interview |
| 76.76.21.22 | malicious | US | AS16509 Amazon.com, Inc. | hackernews | Earth Lusca, Contagious Interview |
| 140.82.113.3 | malicious | US | AS36459 GitHub, Inc. | hackernews | Earth Lusca, Contagious Interview |
| 172.66.135.165 | malicious | CA | AS13335 Cloudflare, Inc. | bleeping | — |
| 172.66.139.132 | malicious | CA | AS13335 Cloudflare, Inc. | bleeping | — |