IP address 62.149.128.157 (mxd8.aruba.it)
No activities identified yet
IOC - Indicator of Compromise (13)
These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.
| ID | IP address | Hostname | Actor | Campaigns | Type | Confidence |
|---|---|---|---|---|---|---|
| 1 | 62.149.128.42 | imaps.aruba.it | Emotet | verified | High | |
| 2 | 62.149.128.45 | redirect.aruba.it | Lokibot | verified | High | |
| 3 | 62.149.128.72 | mxd4.aruba.it | Unknown | verified | High | |
| 4 | XX.XXX.XXX.XX | xxxx.xxxxx.xx | Xxxxx | verified | High | |
| 5 | XX.XXX.XXX.XXX | xxxx.xxxxx.xx | Xxxxx | verified | High | |
| 6 | XX.XXX.XXX.XXX | xxxx.xxxxx.xx | Xxxxxxx | verified | High | |
| 7 | XX.XXX.XXX.XXX | xxxx.xxxxx.xx | Xxxxx | verified | High | |
| 8 | XX.XXX.XXX.XXX | xxxx.xxxxx.xx | Xxxxx | verified | High | |
| 9 | XX.XXX.XXX.XXX | xxxx.xxxxx.xx | Xxxxx | verified | High | |
| 10 | XX.XXX.XXX.XXX | xxxx.xxxxx.xx | Xxxxx | verified | High | |
| 11 | XX.XXX.XXX.XXX | xxxxx.xxxxx.xx | Xxxxxx | verified | High | |
| 12 | XX.XXX.XXX.XXX | xxxxx.xxxxx.xx | Xxxxxx | verified | High | |
| 13 | XX.XXX.XXX.XXX | xxxxxx.xxxxx.xx | Xxxxxx | verified | High |
References (7)
The following list contains external sources which discuss the actor and the associated activities:
- https://blog.talosintelligence.com/2019/09/threat-roundup-0920-0927.html
- https://blog.talosintelligence.com/2019/10/threat-roundup-1004-1011.html
- https://blog.talosintelligence.com/2019/10/threat-roundup-1011-1018.html
- https://blog.talosintelligence.com/2019/11/threat-roundup-1025-1101.html
- https://blog.talosintelligence.com/2021/07/threat-roundup-0702-0709.html
- https://github.com/firehol/blocklist-ipsets/blob/master/bambenek_simda.ipset
- https://isc.sans.edu/forums/diary/Searching+for+malspam/21145/