Welcome to the Threat Trends Digest, a monthly view of real-world threat patterns.
This report compiles data from the previous month using Malware Patrol’s global telemetry and live attack observations to surface key stats on malware, phishing, ransomware, C2s, and domain generation algorithms (DGAs). You’ll find insights into the most exploited TLDs, frequently seen malware hashes and IPs, and other critical indicators. Use this digest to keep a close pulse on attacker behavior, uncover shifting patterns, and better align your defenses with the latest threat activity.
For more articles, check out our #onpatrol4malware blog.
IOCs
Malicious IPs
| IP | Source (ISP/ASN) | Country |
| 106.41.200.151 | CHINANET HUNAN PROVINCE NETWORK | CN |
| 89.111.158.16 | JSC RU-CENTER | RU |
| 173.205.127.152 | Web Hosting Hub, Inc | US |
| 74.115.51.9 | Weebly, Inc. | US |
| 74.115.51.8 | Weebly, Inc. | US |
| 185.143.233.238 | AbrArvan BGP Anycast | IR |
| 185.143.234.238 | AbrArvan BGP Anycast | IR |
| 43.231.112.25 | Apartment # 34, 2nd khoroo | MN |
| 162.241.24.119 | Unified Layer | US |
| 64.40.13.26 | GLOBALHOSTINGSOLUTIONS INC | US |
| 212.99.45.180 | Completel SAS | FR |
| 77.65.212.167 | PROGRESO.PL SP Z O.O | PL |
| 64.37.63.18 | HostDime.com, Inc. | US |
| 178.48.185.211 | 2Connect Telecommunications Infrastructure & Network Services Ltd. | HU |
| 203.162.31.118 | VietNam Data Communication Company | VN |
| 213.186.33.19 | OVH SAS | FR |
| 67.227.189.236 | Liquid Web, L.L.C | US |
| 213.186.33.4 | OVH SAS | FR |
| 154.0.169.106 | AFRIHOST SP (PTY) LTD | ZA |
| 210.245.95.158 | FPT Telecom Company | VN |
Attacking IPs
| IP | Source (ISP/ASN) | Country |
| 193.111.248.174 | Ferdinand Zink trading as Tube-Hosting | DE |
| 103.161.34.10 | GSJZ(CHINA)TECHNOLOGY CO.,LIMITED t/a Guosheng IDC lease | DE |
| 176.65.131.18 | ZeXoTeK IT-Services GmbH | DE |
| 103.161.35.72 | GSJZ(CHINA)TECHNOLOGY CO.,LIMITED t/a Guosheng IDC lease | DE |
| 193.111.248.216 | Ferdinand Zink trading as Tube-Hosting | DE |
| 216.152.147.202 | GTHost | CA |
| 84.247.184.254 | Contabo GmbH | FR |
| 213.199.50.203 | Contabo GmbH | FR |
| 192.227.173.60 | HostPapa | US |
| 103.154.233.221 | Netclues Technologies Private Limited | IN |
| 213.199.50.230 | Contabo GmbH | FR |
| 213.199.50.178 | Contabo GmbH | FR |
| 95.174.113.63 | Consumer Internet Cooperative PG-19 | RU |
| 104.168.65.101 | HostPapa | US |
| 45.153.34.104 | TechTies Inc. | NL |
| 45.153.34.106 | TechTies Inc. | NL |
| 198.23.197.71 | HostPapa | US |
| 23.238.92.11 | RackNerd LLC | US |
| 45.134.226.143 | Contabo GmbH | FR |
| 146.70.87.165 | M247 LTD Los Angeles Infrastructure | US |
Malware Hashes
| Hash | VT Detections | Classification |
| eec5c6c219535fba3a0492ea8118b397 | 53/63 | trojan.mirai/mozi |
| 59ce0baba11893f90527fc951ac69912 | 42/61 | trojan.mirai/mozi |
| 31549917cdc6e3f9d40a48ea5998493f | 56/67 | adware.qjwmonkey/dangeroussig |
| 8bdd2cdd39b2ad7b679faa50f629ce2b | 29/62 | phishing.akgpp/malurl |
| 3849f30b51a5c49e8d1546960cc206c7 | 50/62 | trojan.mirai/mozi |
| a73ddd6ec22462db955439f665cad4e6 | 49/62 | trojan.mirai/mozi |
| 796c596185e63803a4ec4003aa60f425 | 54/68 | adware.qjwmonkey/bundler |
| d4f0c4ab122e0a7f27ba5864934a4ca8 | 35/64 | trojan.sagnt/r002c0db526 |
| dbc520ea1518748fec9fcfcf29755c30 | 45/62 | trojan.mirai/ddos |
| fbe51695e97a45dc61967dc3241a37dc | 47/62 | trojan.mirai/mozi |
| c0fd19c0e4a252efb1864b267fb154ae | 53/70 | adware.ababsoftware/downloadasist |
| cbcb58ffe45c202c11bcf2070496aed6 | 56/67 | trojan.cugn/nsis |
| 96dd80012c33291e1621b66f5bd66967 | 61/69 | adware.qjwmonkey/bundler |
| 5116812ebf7d518f7776a1500a26296c | 40/64 | trojan.mirai/gafgyt |
| 5294f25631d20b68ebf3a9acd4cc1f5d | 33/64 | trojan.malpack/rootkit |
| 595486a5108206c8bc47b92592b83e28 | 37/63 | trojan.mirai/dirtyfrag |
| 5dfc3eefe1c51312d0020910020c4025 | 55/67 | adware.qjwmonkey/nezchi |
| 0c00a35e30cf2583d06c3a795ee1f0f3 | 43/71 | trojan.webwatcher/occamy |
| cc354e0cd2cfde3c80a17ead892ea48e | 38/63 | trojan.mirai/usbli326 |
| afbefb79120fd5d265e6a727825919e8 | 37/63 | trojan.mirai/dirtyfrag |
To learn more about how we collect, analyze, and deliver actionable threat intelligence, explore our Threat Intelligence Services. If you’re interested in running your own queries – whether for threat actors, CVEs, infrastructure, or emerging activity – see how our MCP Server helps turn intelligence into practical security insight. Both are designed to support real-world analysis, investigation, and decision-making.