Welcome to the Threat Trends Digest, a monthly view of real-world threat patterns.
This report compiles data from the previous month using Malware Patrol’s global telemetry and live attack observations to surface key stats on malware, phishing, ransomware, C2s, and domain generation algorithms (DGAs). You’ll find insights into the most exploited TLDs, frequently seen malware hashes and IPs, and other critical indicators. Use this digest to keep a close pulse on attacker behavior, uncover shifting patterns, and better align your defenses with the latest threat activity.
For more articles, check out our #onpatrol4malware blog.
IOCs
Malicious IPs
| IP | Source (ISP) | Country |
| 213.186.33.87 | OVH SAS | FR |
| 43.242.37.17 | YOTTA NETWORK SERVICES PRIVATE LIMITED | IN |
| 188.241.222.214 | Awesome Projects S.R.L. | RO |
| 96.125.172.210 | Network Solutions, LLC | US |
| 109.234.166.59 | O2SWITCH SAS | FR |
| 70.40.210.164 | Unified Layer | US |
| 64.37.63.18 | HostDime.com, Inc. | US |
| 154.0.169.106 | AFRIHOST SP (PTY) LTD | ZA |
| 185.118.115.89 | Dream Fusion – IT Services, Lda | PT |
| 213.186.33.19 | OVH SAS | FR |
| 213.186.33.4 | OVH SAS | FR |
| 104.21.89.111 | Cloudflare, Inc. | US |
| 74.115.51.9 | Weebly, Inc. | US |
| 77.65.212.167 | PROGRESO.PL SP Z O.O | PL |
| 64.40.13.26 | GLOBALHOSTINGSOLUTIONS INC | US |
| 106.41.200.151 | CHINANET HUNAN PROVINCE NETWORK | CN |
| 185.199.110.133 | GitHub, Inc. | US |
| 185.199.109.133 | GitHub, Inc. | US |
| 185.199.108.133 | GitHub, Inc. | US |
| 185.199.111.133 | GitHub, Inc. | US |
Attacking IPs
| IP | Source (ISP/ASN) | Country |
| 213.199.50.203 | Contabo GmbH | FR |
| 167.86.103.106 | Contabo GmbH | FR |
| 78.41.139.200 | HOSTSHIELD LTD | NL |
| 167.86.95.106 | Contabo GmbH | FR |
| 207.180.236.132 | Contabo GmbH | FR |
| 38.242.151.30 | Contabo GmbH | FR |
| 213.199.49.171 | Contabo GmbH | FR |
| 161.97.91.253 | Contabo GmbH | FR |
| 213.199.49.105 | Contabo GmbH | FR |
| 173.212.226.152 | Contabo GmbH | FR |
| 161.97.92.64 | Contabo GmbH | FR |
| 161.97.91.150 | Contabo GmbH | FR |
| 84.247.184.190 | Contabo GmbH | FR |
| 84.247.185.83 | Contabo GmbH | FR |
| 80.75.212.112 | Ferdinand Zink trading as Tube-Hosting | DE |
| 103.161.34.44 | GSJZ(CHINA)TECHNOLOGY CO.,LIMITED t/a Guosheng IDC lease | NL |
| 176.65.131.19 | ZeXoTeK IT-Services GmbH | NL |
| 130.12.183.13 | Netiface LLC | DE |
| 176.65.131.18 | ZeXoTeK IT-Services GmbH | NL |
| 103.161.34.10 | GSJZ(CHINA)TECHNOLOGY CO.,LIMITED t/a Guosheng IDC lease | NL |
Malware Hashes
| Hash | VirusTotal Detections | VirusTotal Label | |
| 31549917cdc6e3f9d40a48ea5998493f | 56/67 | adware.qjwmonkey/dangeroussig | |
| 8bdd2cdd39b2ad7b679faa50f629ce2b | 29/62 | phishing.akgpp/malurl | |
| 59ce0baba11893f90527fc951ac69912 | 42/61 | trojan.mirai/mozi | |
| 3849f30b51a5c49e8d1546960cc206c7 | 50/62 | trojan.mirai/mozi | |
| eec5c6c219535fba3a0492ea8118b397 | 53/63 | trojan.mirai/mozi | |
| a73ddd6ec22462db955439f665cad4e6 | 49/62 | trojan.mirai/mozi | |
| 796c596185e63803a4ec4003aa60f425 | 54/68 | adware.qjwmonkey/bundler | |
| c0fd19c0e4a252efb1864b267fb154ae | 53/70 | adware.ababsoftware/downloadasist | |
| 96dd80012c33291e1621b66f5bd66967 | 61/69 | adware.qjwmonkey/bundler | |
| fbe51695e97a45dc61967dc3241a37dc | 47/62 | trojan.mirai/mozi | |
| 724f25e7f93eae0ae54a80142e11b7ef | 38/62 | trojan.sshdoor/abtrojan | |
| 4cbfce17e2733c3926997aab98c20b8f | 27/60 | trojan.grhe/msil | |
| 5377e8f2ebdb280216c37a6195da9d6c | 47/62 | trojan.hajime/mirai | |
| cb7569803c981f18d9e0756f0032b81d | 11/60 | trojan.agentb/remcos | |
| 936b35bfee8232f437bf6b46e88401dd | 39/61 | trojan.sshdoor/sshdkit | |
| c3f53808a624b526d51356430923f9c6 | 4/61 | trojan.encodedpe/packed2 | |
| dbc520ea1518748fec9fcfcf29755c30 | 45/62 | trojan.mirai/ddos | |
| f7459bc26baf2db287c39770f6a1e19c | 35/63 | trojan.mirai/awtg | |
| 9b6c3518a91d23ed77504b5416bfb5b3 | 49/63 | trojan.hajime/mirai | |
| b5b87f87c084115b7a57898dc54a6888 | 20/60 | trojan.grhd/msil | |
To learn more about how we collect, analyze, and deliver actionable threat intelligence, explore our Threat Intelligence Services. If you’re interested in running your own queries – whether for threat actors, CVEs, infrastructure, or emerging activity – see how our MCP Server helps turn intelligence into practical security insight. Both are designed to support real-world analysis, investigation, and decision-making.