## Enhancement idea - [x] June 2026 Firewall definitions - [ ] Tor Domains - [ ] Domains - [ ] Ip Addresses - [x] Rest ## Description n/a ### Screenshots <img width="724" height="350" alt="Image" src="https://github.com/user-attachments/assets/f26e49a2-8b44-44e7-98cd-3c2d333c4077" /> <img width="740" height="801" alt="Image" src="https://github.com/user-attachments/assets/0e4874dc-2cca-43d6-8d1d-dd0d647c8615" /> <img width="740" height="801" alt="Image" src="https://github.com/user-attachments/assets/dddf6569-dc78-4886-a04e-3d393631b6b9" /> <img width="740" height="265" alt="Image" src="https://github.com/user-attachments/assets/8b55542b-e522-42e4-af12-f4e79a8b0c69" /> ## Links https://www.sentinelone.com/blog/shub-reaper-macos-stealer-spoofs-apple-google-and-microsoft-in-a-single-attack-chain/ https://www.sentinelone.com/blog/katz-stealer-powerful-maas-on-the-prowl-for-credentials-and-crypto-assets/ https://www.ox.security/blog/new-actors-deploy-shai-hulud-clones-teampcp-copycats-are-here/ https://www.ox.security/blog/openclaw-github-phishing-crypto-wallet-attack/ https://socket.dev/blog/antv-packages-compromised https://news.drweb.com/show/?i=15253&lng=en&c=5 https://github.com/DoctorWebLtd/malware-iocs/blob/master/Mac.PWS.JobStealer.1/README.adoc https://www.sentinelone.com/labs/cloud-worm-evicts-teampcp-and-steals-credentials-at-scale/ https://moonlock.com/notorious-hacker-returns-notnullosx-stealer https://www.hiddenlayer.com/research/malware-found-in-trending-hugging-face-repository-open-oss-privacy-filter https://unit42.paloaltonetworks.com/gremlin-stealer-evolution/ https://darkatlas.io/blog/salat-stealer-analysis-go-based-rat-c2-resilience-and-info-stealing-capabilities https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/red-lamassu-open-season.html https://www.stepsecurity.io/blog/laravel-lang-supply-chain-attack https://socket.dev/blog/laravel-lang-compromise https://www.aikido.dev/blog/supply-chain-attack-targets-laravel-lang-packages-with-credential-stealer https://www.microsoft.com/en-us/security/blog/2026/05/26/poisoned-search-results-gpu-mining-cryptojacking-campaign-abusing-screenconnect-microsoft-net-utilities/ https://www.crowdstrike.com/en-us/blog/inside-crowdstrike-takedown-of-a-developer-targeting-botnet/ https://cyble.com/blog/btmob-rat-newly-discovered-android-malware/ https://www.welivesecurity.com/en/malware/btmob-stealthy-rat-burrowing-deep-android-devices/ https://arcticwolf.com/resources/blog/forticlient-ems-exploited-via-cve-2026-35616-to-deliver-ekz-infostealer-disguised-as-a-fortinet-patch/ https://pushsecurity.com/blog/llmshare-malvertising-campaign https://www.virustotal.com/gui/file/641526a22667a527290aac8c2c0358265d85c83318a7caca7cff28cecc2dbc16 https://www.malwarebytes.com/blog/detections/gcdn-co https://unit42.paloaltonetworks.com/apateweb-scareware-pup-delivery-campaign/ https://cybernews.com/security/openai-codex-tool-malware-token-theft/ https://www.europol.europa.eu/media-press/newsroom/news/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering-pipeline https://ioctl.fail/preliminary-analysis-of-aur-malware/ https://www.sygnia.co/wp-content/uploads/2026/06/Appendix_Indicators-of-Compromise.pdf https://securelist.com/dozens-of-malicious-wallpapers-found-on-steam-workshop/120186/ https://securelist.com/video-books-pirates-miners-rat/119943/ https://www.microsoft.com/en-us/security/blog/2026/06/17/crypto-clipper-uses-tor-worm-like-propagation-for-persistence-control/ https://zimperium.com/blog/rokarolla-android-banker-with-complete-device-takeover-capabilities https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/ https://securelist.com/fakewallet-cryptostealer-ios-app-store/119474/ https://securelist.com/janelarat-financial-threat-in-latin-america/119332/ https://www.zscaler.com/blogs/security-research/payouts-king-ransomware-initial-access-broker-deploys-new-edgecution https://securelist.com/whatsapp-vbs-rmm-campaign/120290/ https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion ## IOC ### I2P websites n/a ### IPFS websites n/a ### Tor2web websites n/a ### TOR websites ``` 7goms4byw26kkbaanz5a5u5234gusot7rp5imzc3ozh66wwcvmcudjid.onion cgky6bn6ux5wvlybtmm3z255igt52ljml2ngnc5qp3cnw5jlglamisad.onion facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion gfoqsewps57xcyxoedle2gd53o6jne6y5nq5eh25muksqwzutzq7b3ad.onion he5vnov645txpcv57el2theky2elesn24ebvgwfoewlpftksxp4fnxad.onion ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion j3bv7g27oramhbxxuv6gl3dcyfmf44qnvju3offdyrap7hurfprq74qd.onion lyhizqy2js2eh6ufngkbzntouiikdek5zsdj3qwa22b4z6knpqorgiad.onion olrh4mibs62l6kkuvvjyc5lrercqg5tz543r4lsw3o6mh5qb7g7sneid.onion shinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onion wt26llpl5k6gok3vnaxmucwgzv2wk3l7nuibbh25clghrtus3p5ctsid.onion ``` ### URL's n/a ### Folders n/a ### Sub-Domains ``` gs.thc.org ``` Above: Add to `thc-org` code section. ``` pub-ce02802067934e0eb072f69bf6427bf6.r2.dev ``` Above: Add to `r2-dev` code section. ``` baoyuw2s.s3.ap-southeast-1.amazonaws.com hksha3.s3.ap-southeast-1.amazonaws.com sjdkjj23.s3.ap-southeast-1.amazonaws.com spm-cdn-assets-dist-2026.s3.us-east-2.amazonaws.com xijkwm2.s3.ap-southeast-1.amazonaws.com yifubafu.s3.ap-southeast-1.amazonaws.com ``` Above: Add to `amazonaws-com` code section. ``` baolongwes.oss-ap-southeast-1.aliyuncs.com sdcwww.oss-ap-southeast-1.aliyuncs.com ``` Above: Add to `aliyuncs-com` code section. ``` caiwuascw.s3.us-east-005.backblazeb2.com facaia.s3.us-east-005.backblazeb2.com ``` Above: Add to `backblazeb2-com` code section. ``` mactest-6b2ab-default-rtdb.firebaseio.com ``` Above: Add to `firebaseio-com` code section. ``` cl-9168a3cc.gcdn.co cl-glcb907925.gcdn.co ``` Above: Add to `gcdn-co` code section. ``` infocontablidades.it.com ``` Above: Add to `it-com` code section. ``` d1jp293q9tvi92.cloudfront.net d23l50n6ubud7p.cloudfront.net d2g6dl71gua1qa.cloudfront.net d3nh8sl98s2554.cloudfront.net ``` Above: Add to `cloudfront-net` code section. ### HIGH-RISK / MAY BREAK LEGITIMATE SITES `.lhr.life` is a dynamic domain suffix generated by localhost.run, a free service that allows developers to securely expose their local development servers (e.g., localhost) to the public internet via reverse SSH tunneling. However, because these tunnel URLs are easily generated and randomized, the domain is frequently flagged and blocked by security services. ``` lhr.life ``` ### Domains ``` 1fichier.com 5d14vnfb.space abiorime.cfd ad-blocking24.net ahroar.com allureoutlayterrific.com anyclaw.store apps-store.im appstoreios.com arbsniper.com artificius.com baoxis.cc baskwms.top beralisvc.info blestorians.cfd brightly.to carolla.app ciderurginsx.com cloudfront-js.com cloudproxy.link crypto-stroe.cc cumm.info dc1637.xyz deliverlett.com deliverly.top designli.pictures directdownload.icu eth-fastscan.org experttrafficmonitor.com featuresscanner.com flipboxstudio.info flowcomm.click giize.com gleeze.com gxzhrc.cn hebsbsbzjsjshduxbs.xyz helllo2025.com hightrafficcounter.com hoanoola.net inboxally.agency inboxly.top iosfc.com jeaw520i.space jhxrpbgq.com jpadsnow.com katz-panel.com katz-stealer.com katzstealer.com kkkhhhnnn.com kristina.quest lahuafa.com lastpass-login-help.com lett.email lettermail.eu m-kosche.com m4yuri.online mailora.eu maskasd.com meetix.app meetlab.io mlcrosoft.co.com mlroweb.com morevoms.cfd msopsa.top Myqenad24.com namefuture.site newsprojects.online nmu8n.com notegpt.io npoint.io onweblive.org openew.app oukwww.com performancerefill.com pheontx.eu postfast.eu postify.email postino.click professionalswebcheck.com proftrafficcounter.com qdmagva5.space qq-0732gwh22.com qube.black quix.express r7mvjl67.space recargapopular.com salat.cn salator.es sefy.com shaaslong.one shoppes.help siyangoil.com smplfy.in sumato-soft.org sxsfcc.com technobrains.dev token-claw.xyz tracker-tds.info trayo.app tvipguncelpro.com twist2katz.com ulbcl.com urgpt.dev urush1bar4.online wallpapermacos.com wallspaceapp.com watery-compost.today websalat.top welovechinatown.info wrat.in xcent.online yaarsa.com yjzhengruol.com zgj1tam9.space zmx6f.com ``` ### Package Names NPM: ``` @deadcode09284814/axios-util @friuns/codex-web-local @friuns/codexapp @friuns/codexui axois-utils chalk-tempalte codex-web-ui codexapp codexui-android color-style-utils ``` HuggingFace: ``` anthfu/Bonsai-8B-gguf anthfu/DeepSeek-V4-Pro anthfu/Qwen3.6-35B-A3B-APEX-GGUF anthfu/Qwen3.6-35B-A3B-Claude-4.6-Opus-Reasoning-Distilled-GGUF anthfu/Qwopus-GLM-18B-Merged-GGUF anthfu/supergemma4-26b-uncensored-gguf-v2 Open-OSS/privacy-filter ``` PHP: ``` laravel-lang/lang laravel-lang/http-statuses laravel-lang/attributes ``` ### IP's ``` 104.21.64.137 107.172.212.235 111.90.149.111 120.48.156.17 135.125.107.221 139.180.139.209 139.180.223.193 142.251.183.138 15.197.240.20 152.32.159.11 161.97.129.25 161.97.135.154 161.97.163.87 161.97.186.175 161.97.187.42 164.92.88.210 166.88.11.196 166.88.99.32 169.254.169.254 172.233.218.87 172.67.146.103 173.194.193.138 173.194.194.94 173.194.206.106 173.233.137.36 173.233.137.44 173.233.137.52 173.233.137.60 173.233.139.164 178.156.177.192 185.107.74.40 191.101.131.250 191.96.224.87 191.96.225.241 191.96.78.172 191.96.78.28 191.96.79.133 191.96.79.179 191.96.79.41 192.145.44.201 192.178.209.95 192.243.59.12 192.243.59.13 192.243.59.20 192.243.61.225 192.243.61.227 193.124.93.153 193.187.129.143 193.42.11.108 194.58.112.174 194.87.92.109 195.160.221.203 195.182.25.71 195.86.120.2 198.23.185.238 2.59.132.106 200.9.155.153 202.144.192.29 202.61.160.137 202.61.160.160 202.61.160.201 202.61.160.202 202.61.160.208 207.90.205.55 213.136.80.73 23.239.3.135 23.254.164.123 23.254.164.92 23.27.201.115 23.27.201.160 31.177.109.39 38.242.204.245 38.242.237.196 38.242.245.147 38.55.151.63 45.131.66.106 45.76.157.243 50.63.202.59 64.20.53.230 64.227.128.21 66.42.49.27 74.125.132.95 74.125.202.103 78.135.93.123 79.133.57.141 80.200.28.28 80.64.18.219 83.138.53.110 83.171.249.231 83.217.209.88 89.124.93.110 91.195.240.117 93.115.10.35 ``` ### ASN's n/a ### Emails ``` e78393397@proton.me tylerwisdom.dev@gmail.com ``` ### Wallet addresses Ethereum: ``` 0x069c4c579671f8c120b1327a73217D01Ea2EC5ea 0x0bd48f6B86a26D3a217d0Fa6FfE2B491B956A7a2 0x0Ec68c5B10F21EFFb74f2A5C61DFe6b08C0Db6Cb 0x113cB99283AF242Da0A0C54347667edF531Aa7d6 0x153CAB79f4767E2ff862C94aa49573294B13D169 0x1876EA7702C0ad0C6A2ae6036DE7733edfBca519 0x19A6d1E9034596196295CF148509796978343c5D 0x1a0ad011913A150f69f6A19DF447A0CfD9551054 0x2658723Bf70c7667De6B25F99fcce13A16D25d08 0x26dB93F8b8b4f7016240af62F7730979d353f9A7 0x2F12d621a16e2d3285929C9996f478508951dFe4 0x3154Cf16ccdb4C6d922629664174b904d80F2C35 0x34C0bD5877A5Ee7099D0f5688D65F4bB9158BDE2 0x36cb65c1967A0Fb0EEE11569C51C2f2aA1Ca6f6D 0x3aA974fb3f8C1E02796048BDCdeD79e9D53a6965 0x3e2Ea9B92B7E48A52296fD261dc26fd995284631 0x4317ba146D4933D889518a3e5E11Fe7a53199b04 0x43edB88C4B80fDD2AdFF2412A7BebF9dF42cB40e 0x470458C91978D2d929704489Ad730DC3E3001113 0x49048044D57e1C92A77f79988d21Fa8fAF74E97e 0x50130b669B28C339991d8676FA73CF122a121267 0x512a3d2c7a43bd9261d2b8e8c9c70d4bd4d503c0 0x56315b90c40730925ec5485cf004d835058518A0 0x5b22280886a2f5e09a49bea7e320eab0e5320e28 0x5dc881dda4e4a8d312be3544ad13118d1a04cb17 0x5f4867441d2416cA88B1b3fd38f21811680CD2C8 0x66CC916Ed5C6C2FA97014f7D1cD141528Ae171e4 0x68a8609a60a008EFA633dfdec592c03B030cC508 0x697402166Fbf2F22E970df8a6486Ef171dbfc524 0x735aDBbE72226BD52e818E7181953f42E3b0FF21 0x81014F44b0a345033bB2b3B21C7a1A308B35fEeA 0x826D1B0D4111Ad9146Eb8941D7Ca2B6a44215c76 0x864Bf681ADD6052395188A89101A1B37d3B4C961 0x88e529a6ccd302c948689cd5156c83d4614fae92 0x8AdeE124447435fE03e3CD24dF3f4cAE32E65a3E 0x8B34b14c7c7123459Cf3076b8Cb929BE097d0C07 0x99C9fc46f92E8a1c0deC1b1747d010903E884bE1 0x9E6204F750cD866b299594e2aC9eA824E2e5f95c 0xA9d71E1dd7ca26F26e656E66d6AA81ed7f745bf0 0xbEb5Fc579115071764c7423A4f12eDde41f106Ed 0xce01f8eee7E479C928F8919abD53E553a36CeF67 0xd5ec14a83B7d95BE1E2Ac12523e2dEE12Cbeea6C 0xdDa53E23f8a32640b04D7256e651C1db98dB11C1 0xddfb18888a9466688235887dec2a10c4f5effee9 0xdfe97868233d1aa22e815a266982f2cf17685a27 0xe5965Ab5962eDc7477C8520243A95517CD252fA9 0xeb9bf100225c214efc3e7c651ebbadcf85177607 0xF05F0e4362859c3331Cb9395CBC201E3Fa6757Ea 0xf8ac4BEB2F75d2cFFb588c63251347fdD629B92c 0xF9cda624FBC7e059355ce98a31693d299FACd963 ``` Bitcoin: ``` 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy ``` ### Blockchain Transactions n/a ### Mining pool addresses n/a