Welcome to the Threat Trends Digest, a monthly view of real-world threat patterns.
This report compiles data from the previous month using Malware Patrol’s global telemetry and live attack observations to surface key stats on malware, phishing, ransomware, C2s, and domain generation algorithms (DGAs). You’ll find insights into the most exploited TLDs, frequently seen malware hashes and IPs, and other critical indicators. Use this digest to keep a close pulse on attacker behavior, uncover shifting patterns, and better align your defenses with the latest threat activity.
For more articles, check out our #onpatrol4malware blog.
IOCs
Top Malicious IPs
106.41.200.151
140.82.116.4
140.82.116.3
185.199.111.133
185.199.110.133
185.199.108.133
185.199.109.133
173.205.127.152
23.226.124.131
69.61.56.164
5.189.185.23
104.18.43.151
172.64.144.105
104.37.191.164
37.153.93.10
104.21.16.89
172.67.210.124
74.115.51.8
74.115.51.9
103.11.153.134
Top Attacking IPs
176.65.128.158
103.161.34.10
103.161.34.44
80.75.212.112
80.75.212.67
130.12.183.13
103.161.35.72
146.19.191.54
198.7.114.164
173.249.209.193
85.208.102.58
92.38.176.252
142.171.174.45
31.131.22.122
192.227.178.250
213.199.49.172
161.97.91.253
38.242.150.240
213.199.48.198
188.130.232.75
Top Malware Hashes
| Hash | VirusTotal Detections | VirusTotal Label |
| 31549917cdc6e3f9d40a48ea5998493f | 56/70 | adware.qjwmonkey |
| 8bdd2cdd39b2ad7b679faa50f629ce2b | 28/64 | trojan.pdf.phishing.btq |
| 59ce0baba11893f90527fc951ac69912 | 46/63 | trojan.mirai/mozi |
| eec5c6c219535fba3a0492ea8118b397 | 52/63 | trojan.mirai/mozi |
| 3849f30b51a5c49e8d1546960cc206c7 | 48/62 | trojan.mirai/mozi |
| a73ddd6ec22462db955439f665cad4e6 | 47/61 | trojan.mirai/mozi |
| 796c596185e63803a4ec4003aa60f425 | 57/71 | adware.qjwmonkey/bundler |
| 96dd80012c33291e1621b66f5bd66967 | 63/71 | adware.qjwmonkey/bundler |
| c0fd19c0e4a252efb1864b267fb154ae | 54/71 | adware.ababsoftware/downloadasist |
| fbe51695e97a45dc61967dc3241a37dc | 47/62 | trojan.mirai/mozi |
| 9b6c3518a91d23ed77504b5416bfb5b3 | 50/65 | trojan.hajime/mirai |
| 5dfc3eefe1c51312d0020910020c4025 | 61/72 | adware.qjwmonkey/nezchi |
| c4374912473cd42cfe4e1abab51af40e | 14/60 | trojan.qwexlafiba |
| 64eb7ad3aaf9b6639ccc5c0b30b6e59f | 51/70 | trojan.msil/powershell |
| d8f9a2adeaf9ba290ef88dfaf52c5e12 | 32/71 | pua.drivernavigator/sobrab |
| 5377e8f2ebdb280216c37a6195da9d6c | 46/64 | trojan.hajime/mirai |
| a53485b5394ccb5197543e018eda64c0 | 33/65 | trojan.mirai/avyg |
| dc631d0b479e7f00b54c87ff3d3fba4d | 32/67 | trojan. |
| dbc520ea1518748fec9fcfcf29755c30 | 44/62 | trojan.mirai/mozi |
| 3a9349af006440c7e0da677724551239 | 26/61 | trojan.generik |
To learn more about how we collect, analyze, and deliver actionable threat intelligence, explore our Threat Intelligence Services. If you’re interested in running your own queries – whether for threat actors, CVEs, infrastructure, or emerging activity – see how our MCP Server helps turn intelligence into practical security insight. Both are designed to support real-world analysis, investigation, and decision-making.