Welcome to the Threat Trends Digest, a monthly view of real-world threat patterns.
This report compiles data from the previous month using Malware Patrol’s global telemetry and live attack observations to surface key stats on malware, phishing, ransomware, C2s, and domain generation algorithms (DGAs). You’ll find insights into the most exploited TLDs, frequently seen malware hashes and IPs, and other critical indicators. Use this digest to keep a close pulse on attacker behavior, uncover shifting patterns, and better align your defenses with the latest threat activity.
For more articles, check out our #onpatrol4malware blog.
IOCs
Malicious IPs
| IP | Source (ISP/ASN) | Country |
| 46.151.182.200 | Ghosty Networks LLC | LU |
| 188.165.53.185 | OVH SAS | FR |
| 74.115.51.9 | Weebly, Inc. | US |
| 213.186.33.87 | OVH SAS | FR |
| 74.115.51.8 | Weebly, Inc. | US |
| 5.223.56.39 | Hetzner Online GmbH | SG |
| 213.186.33.19 | OVH SAS | FR |
| 64.89.163.215 | Meowcore Softworks LLC | DE |
| 192.162.199.149 | FEMO IT SOLUTIONS LIMITED | DE |
| 213.186.33.4 | OVH SAS | FR |
| 163.44.198.41 | GMO INTERNET PTE. LTD. | TH |
| 64.37.63.18 | HostDime.com, Inc. | US |
| 106.41.200.151 | CHINANET HUNAN PROVINCE NETWORK | CN |
| 77.65.212.167 | PROGRESO.PL SP Z O.O | PL |
| 206.72.194.50 | Interserver, Inc | US |
| 173.205.127.152 | Web Hosting Hub, Inc | US |
| 188.241.222.214 | Awesome Projects S.R.L. | RO |
| 64.40.13.26 | GLOBALHOSTINGSOLUTIONS INC | US |
| 109.234.166.59 | O2SWITCH SAS | FR |
| 81.91.85.141 | Web4U s.r.o. | CZ |
| 172.67.140.248 | Cloudflare, Inc. | US |
Attacking IPs
| IP | Source (ISP/ASN) | Country |
| 103.161.34.10 | GSJZ(CHINA)TECHNOLOGY CO.,LIMITED t/a Guosheng IDC lease | NL |
| 176.65.131.18 | ZeXoTeK IT-Services GmbH | NL |
| 176.65.131.19 | ZeXoTeK IT-Services GmbH | NL |
| 103.161.34.44 | GSJZ(CHINA)TECHNOLOGY CO.,LIMITED t/a Guosheng IDC lease | NL |
| 103.161.35.72 | GSJZ(CHINA)TECHNOLOGY CO.,LIMITED t/a Guosheng IDC lease | NL |
| 95.174.113.63 | Consumer Internet Cooperative PG-19 | RU |
| 204.76.203.84 | Intelligence Hosting LLC | NL |
| 204.76.203.2 | Intelligence Hosting LLC | NL |
| 78.41.139.200 | HOSTSHIELD LTD | NL |
| 45.156.87.223 | TechTies Inc. | NL |
| 20.198.176.220 | Microsoft Corporation | SG |
| 45.153.34.104 | TechTies Inc. | NL |
| 45.153.34.106 | TechTies Inc. | NL |
| 162.251.238.24 | VegasNAP, LLC | US |
| 38.45.71.191 | Cogent Communications, LLC | US |
| 192.129.220.186 | RackNerd LLC | US |
| 181.214.99.234 | Unesty Company | DE |
| 162.248.102.46 | GALAXYGATE, LLC | US |
| 15.204.132.78 | OVH SAS | US |
| 192.210.181.100 | RackNerd LLC | US |
Malware Hashes
| Hash | VT Detections | Classification |
| dedb672b0cd94b68c4d232f3ecb90d79 | 10/60 | trojan.agentb/remcos |
| 309e9e9ec97d8c92d8b32fe4418d7ff0 | 25/55 | trojan.mirai/ddos |
| 8bdd2cdd39b2ad7b679faa50f629ce2b | 29/62 | phishing.akgpp/malurl |
| 3d7bc4241b59780559d21e6433bf9672 | 29/60 | trojan.mirai/miraidlod |
| 5294f25631d20b68ebf3a9acd4cc1f5d | 33/64 | trojan.malpack/rootkit |
| d4f0c4ab122e0a7f27ba5864934a4ca8 | 35/64 | trojan.sagnt/r002c0db526 |
| 9314f0fa42caebcbbe5261bdd2795f7d | 39/61 | trojan.tsunami/kaiten |
| a3d10d1a5be5daa9a42973e54d6c8d0e | 39/62 | trojan.mirai/usblh926 |
| 4ce6a00b6110069929311e18e32973ad | 39/63 | trojan.tsunami/kaiten |
| 895a8e146f5e855018cb3ce5f85f0e45 | 41/62 | trojan.tsunami/kaiten |
| e27fb7c5558474234b8a0f884a909ccf | 41/63 | trojan.mirai/gafgyt |
| 59ce0baba11893f90527fc951ac69912 | 42/61 | trojan.mirai/mozi |
| cc262c7d2c4f7c23182f33b0b7c38e5a | 42/63 | trojan.mirai/usblh926 |
| 7b61351b598bf22ab0cf7b09a6f89227 | 44/63 | trojan.mirai/gafgyt |
| dbc520ea1518748fec9fcfcf29755c30 | 45/62 | trojan.mirai/ddos |
| 7822cdf1cf8e30d9997c9743f8897f33 | 45/64 | trojan.tsunami/kaiten |
| e0c0873263eb23d5092363f938ea9ca2 | 46/63 | trojan.tsunami/kaiten |
| fbe51695e97a45dc61967dc3241a37dc | 47/62 | trojan.mirai/mozi |
| a73ddd6ec22462db955439f665cad4e6 | 49/62 | trojan.mirai/mozi |
| 3849f30b51a5c49e8d1546960cc206c7 | 50/62 | trojan.mirai/mozi |
To learn more about how we collect, analyze, and deliver actionable threat intelligence, explore our Threat Intelligence Services. If you’re interested in running your own queries – whether for threat actors, CVEs, infrastructure, or emerging activity – see how our MCP Server helps turn intelligence into practical security insight. Both are designed to support real-world analysis, investigation, and decision-making.