Threat Trends Digest – May 2026
Welcome to the Threat Trends Digest, a monthly view of real-world threat patterns.
This report compiles data from the previous month using Malware Patrol’s global telemetry and live attack observations to surface key stats on malware, phishing, ransomware, C2s, and domain generation algorithms (DGAs). You’ll find insights into the most exploited TLDs, frequently seen malware hashes and IPs, and other critical indicators. Use this digest to keep a close pulse on attacker behavior, uncover shifting patterns, and better align your defenses with the latest threat activity.
For more articles, check out our #onpatrol4malware blog.
IOCs
Top Malicious IPs
IP |
Source (ISP/ASN) |
| 106.41.200.151 | ChinaNet Hunan Province Network / AS4134 |
| 140.82.116.4 | Github IP |
| 185.199.111.133 | Github IP |
| 185.199.109.133 | Github IP |
| 70.40.210.164 | VPN/Data Center IP |
| 206.72.194.50 | VPN/Data Center IP |
| 74.115.51.8 | Weebly Inc. / AS27647 |
| 74.115.51.9 | Weebly Inc. / AS27647 |
| 64.40.13.26 | GlobalHostingSolutions Inc / AS395512 |
| 77.65.212.167 | Progreso.pl SP Z O.O / AS210379 |
| 87.98.239.3 | VPN/Data Center IP |
| 162.214.80.24 | VPN/Data Center IP |
| 64.37.63.18 | VPN/Data Center IP |
| 104.18.43.151 | Cloudflare IP Range |
| 213.186.33.19 | VPN/Data Center IP |
| 160.22.122.114 | Ionsite Software One Member Co Ltd / AS135918 |
| 217.182.30.109 | VPN/Data Center IP |
| 5.223.56.39 | VPN/Data Center IP |
| 188.241.222.214 | Awesome Projects S.R.L. / AS5606 |
| 43.231.112.25 | Apartment # 34, 2nd khoroo / AS63962 |
Summary
- Malicious infrastructure is heavily concentrated in hosting, cloud, VPN, and proxy networks, with approximately 40–45% of the IPs originating from VPN/data center providers. This is consistent with infrastructure commonly used to host:
- Malware payloads / Ransomware staging servers / Phishing kits / C2 systems / Cryptomining operations / DGA-related infrastructure
- Several IPs originate from major cloud and developer platforms, including GitHub and Cloudflare, highlighting a common adversary tactic of abusing trusted services to distribute malware, host malicious content, or conceal attacker infrastructure behind reputable providers.
- Overall, the dataset reinforces a common modern threat trend: attackers increasingly rely on cloud services, VPS providers, VPN networks, and short-lived rented infrastructure to host and rotate malware, phishing, ransomware, and C2 operations while blending into legitimate internet traffic.
Top Attacking IPs
IP |
Source (ISP/ASN) |
| 103.161.34.10 | Guosheng IDC Lease / AS198584 |
| 103.161.35.72 | Guosheng IDC Lease / AS198584 |
| 80.75.212.112 | Tube Hosting / AS49581 |
| 176.65.131.18 | Zexotek IT-Services GmbH / AS198584 |
| 80.75.212.67 | Tube Hosting / AS49581 |
| 130.12.183.13 | Netiface LLC / AS51396 |
| 45.153.34.104 | VMHeaven.io / AS51396 |
| 172.245.75.28 | VPN/Data Center IP |
| 103.157.26.137 | PT Linkgo Metro Teknologi / AS141107 |
| 172.245.75.11 | VPN/Data Center IP |
| 162.248.101.69 | Galaxygate, LLC / AS397031 |
| 51.75.104.160 | VPN/Data Center IP |
| 185.119.90.69 | United Internet Ltd. / AS207604 |
| 173.249.209.8 | VPN/Data Center IP |
| 135.148.160.225 | VPN/Data Center IP |
| 94.46.187.205 | VPN/Data Center IP |
| 185.103.255.38 | IP Market – FZCO / AS200740 |
| 80.75.212.28 | Tube Hosting / AS49581 |
| 185.214.10.121 | 365 Group LLC / AS202602 |
| 161.97.91.164 | VPN/Data Center IP |
Summary
- ~35–40% of the IPs are identifiable VPN or data center addresses, a pattern commonly associated with:
- Credential stuffing campaigns / SSH brute-force / Automated exploit frameworks / Anonymized attack infrastructure
- The concentration of hosting-provider IPs strongly suggests largely automated activity, including:
- Internet-wide scanning / Bot-driven reconnaissance / Credential harvesting attempts / Proxy/VPN-based attacks / Security research scanning / Commodity malware operations
- Overall, the data reflects opportunistic internet “background noise” and automated threat activity, highlighting the continued prevalence of large-scale reconnaissance and brute-force operations targeting exposed services.
Top Malware Hashes
Hash |
VirusTotal Detections |
VirusTotal Label |
| 31549917cdc6e3f9d40a48ea5998493f | 61/75 | adware.qjwmonkey/dangeroussig |
| 59ce0baba11893f90527fc951ac69912 | 51/75 | trojan.mirai/mozi |
| 8bdd2cdd39b2ad7b679faa50f629ce2b | 28/75 | phishing.akgpp/malurl |
| 3849f30b51a5c49e8d1546960cc206c7 | 51/75 | trojan.mirai/mozi |
| eec5c6c219535fba3a0492ea8118b397 | 54/75 | trojan.mirai/mozi |
| a73ddd6ec22462db955439f665cad4e6 | 51/75 | trojan.mirai/mozi |
| 796c596185e63803a4ec4003aa60f425 | 56/75 | adware.qjwmonkey/bundler |
| c0fd19c0e4a252efb1864b267fb154ae | 53/75 | adware.ababsoftware/downloadasist |
| 96dd80012c33291e1621b66f5bd66967 | 62/75 | adware.qjwmonkey/bundler |
| a9438d893c19d866cf720a581c9476bc | 65/75 | virus.tenga/remoteexec |
| 64eb7ad3aaf9b6639ccc5c0b30b6e59f | 58/75 | trojan.msil/powershell |
| fbe51695e97a45dc61967dc3241a37dc | 50/75 | trojan.mirai/mozi |
| 5dfc3eefe1c51312d0020910020c4025 | 56/75 | adware.qjwmonkey/nezchi |
| 9b6c3518a91d23ed77504b5416bfb5b3 | 51/75 | trojan.hajime/mirai |
| 724f25e7f93eae0ae54a80142e11b7ef | 39/75 | trojan.sshdoor/abtrojan |
| 5377e8f2ebdb280216c37a6195da9d6c | 47/75 | trojan.hajime/mirai |
| 9f35fd3bcbc01b097602dbd85d6ecfbb | 21/75 | trojan.msil/powershell |
| 936b35bfee8232f437bf6b46e88401dd | 41/75 | trojan.sshdoor/sshdkit |
| e4f0fc29322640a13934b97c788dd4d5 | 40/74 | trojan.lazy/misc |
| f7459bc26baf2db287c39770f6a1e19c | 34/75 | trojan.mirai/awtg |
To learn more about how we collect, analyze, and deliver actionable threat intelligence, explore our Threat Intelligence Services. If you’re interested in running your own queries – whether for threat actors, CVEs, infrastructure, or emerging activity – see how our MCP Server helps turn intelligence into practical security insight. Both are designed to support real-world analysis, investigation, and decision-making.
