Welcome to the October Threat Trends Digest, a monthly view of real-world threat patterns.
This report compiles data from the previous month using Malware Patrol’s global telemetry and live attack observations to surface key stats on malware, phishing, ransomware, C2s, and domain generation algorithms (DGAs). You’ll find insights into the most exploited TLDs, frequently seen malware hashes and IPs, and other critical indicators. Use this digest to keep a close pulse on attacker behavior, uncover shifting patterns, and better align your defenses with the latest threat activity.
For more articles, check out our #onpatrol4malware blog.
IOCs
Malicious IPs
| IP | Source (ISP/ASN) | Country |
| 185.199.111.133 | GitHub, Inc. | US |
| 74.115.51.8 | Weebly, Inc. | US |
| 213.186.33.3 | OVH SAS | FR |
| 51.91.236.255 | OVH SAS | FR |
| 213.186.33.16 | OVH SAS | FR |
| 74.115.51.9 | Weebly, Inc. | US |
| 106.41.200.151 | CHINANET HUNAN PROVINCE NETWORK | CN |
| 198.84.119.122 | NCH Software | US |
| 54.149.5.211 | Amazon Technologies Inc. | US |
| 66.39.83.155 | pair Networks | US |
| 64.37.63.18 | HostDime.com, Inc. | US |
| 210.245.95.158 | FPT Telecom Company | VN |
| 5.223.56.39 | Hetzner Online GmbH | SG |
| 77.65.212.167 | PROGRESO.PL SP Z O.O | PL |
| 173.205.127.152 | Web Hosting Hub, Inc | US |
| 120.138.9.38 | VK Marketing Services | IN |
| 185.183.33.232 | WorldStream B.V. | NL |
| 185.177.127.234 | WorldStream B.V. | NL |
| 64.40.13.26 | GLOBALHOSTINGSOLUTIONS INC | US |
| 178.63.47.101 | Hetzner Online GmbH | DE |
Attacking IPs
| IP | Source (ISP/ASN) | Country |
| 92.205.109.198 | Host Europe GmbH | FR |
| 103.154.233.221 | Netclues Technologies Private Limited | IN |
| 51.254.44.49 | OVH SAS | FR |
| 139.28.232.128 | LVNET LTD | US |
| 31.7.61.148 | Private Layer INC | CH |
| 198.23.254.92 | RackNerd LLC | US |
| 45.117.156.209 | Cloudone Technology Company Limited | VN |
| 23.94.202.190 | RackNerd LLC | US |
| 185.119.16.30 | Realtox-Media | DE |
| 108.181.134.101 | Psychz Networks | US |
| 192.227.229.38 | HostPapa | US |
| 145.239.200.78 | OVH SAS | GB |
| 185.217.0.192 | w1n ltd | SE |
| 45.82.244.64 | LVNET LTD | US |
| 185.118.134.189 | Virtual Machine Solutions, LLC | US |
| 23.238.82.163 | RackNerd LLC | US |
| 192.119.75.194 | RackNerd LLC | US |
| 216.152.147.202 | GTHost | CA |
| 108.181.69.13 | Psychz Networks | BR |
| 23.94.179.95 | HostPapa | US |
Malware Hashes
| Hash (MD5) | VT Detections | Classification |
| 96dd80012c33291e1621b66f5bd66967 | 61/69 | adware.qjwmonkey/bundler |
| 3c4161be295e9e9d019ce68dae82d60a | 60/71 | trojan.lummastealer/lazy |
| eec5c6c219535fba3a0492ea8118b397 | 53/63 | trojan.mirai/mozi |
| 64eb7ad3aaf9b6639ccc5c0b30b6e59f | 59/71 | trojan.powershell/msil |
| b6ffc5ab3d9c3d132b0cdb490ed800d2 | 59/71 | trojan.msil/lumma |
| 31549917cdc6e3f9d40a48ea5998493f | 56/67 | adware.qjwmonkey/dangeroussig |
| d6432b42f7a52976277bb00b29e761b9 | 57/71 | trojan.msil/vidar |
| 3849f30b51a5c49e8d1546960cc206c7 | 50/62 | trojan.mirai/mozi |
| a73ddd6ec22462db955439f665cad4e6 | 49/62 | trojan.mirai/mozi |
| 40da9a875dde6adc4c25c1df5247b590 | 48/68 | trojan.lazy/usblhe26 |
| 0d65a1bb78ada0f0822c7b64c637a92c | 46/65 | trojan.lummastealer/reflo |
| e3bccdc6f05ab0f1c29914cdf0dd233f | 47/68 | trojan.lummastealer/lummac |
| a758c8cf0a5845d4d3c71ed9d910c4bc | 46/66 | trojan.lummastealer/tedy |
| 59ce0baba11893f90527fc951ac69912 | 42/61 | trojan.mirai/mozi |
| dbeac4d387d1ca868d2b07c286804324 | 46/68 | trojan.lummastealer/jbns |
| 368979b1e71f5b2f167d7c9eb2724122 | 41/68 | trojan.stealc/malgent |
| 35c993d49e8a4de8c2853ceb5f1e0835 | 40/68 | trojan.lummastealer/misc |
| 0c9fd44bfc0d9a3a1fa04275ea9a542f | 37/66 | trojan.stealc/malgent |
| 3595a43418463e5570f675fb47452362 | 37/65 | trojan.lummastealer |
| 21531ec596b58777f61e51079852bf8c | 36/64 | trojan.dacic/salat |
To learn more about how we collect, analyze, and deliver actionable threat intelligence, explore our Threat Intelligence Services. If you’re interested in running your own queries – whether for threat actors, CVEs, infrastructure, or emerging activity – see how our MCP Server helps turn intelligence into practical security insight. Both are designed to support real-world analysis, investigation, and decision-making.