Inside Water Barghest’s Rapid Exploit-to-Market Strategy for IoT Devices - Indicators of Compromise DOMAINS Domain name Description 45.61.141.192 Scanner / Malware hosting 67.220.85.145 Scanner / Malware hosting 77.83.199.142 Scanner / Malware hosting 79.141.162.154 Scanner / Malware hosting 95.169.180.227 Scanner / Malware hosting 104.234.240.65 Scanner / Malware hosting 107.175.229.142 Scanner / Malware hosting 144.172.76.24 Scanner / Malware hosting 144.172.111.24 Scanner / Malware hosting 154.7.253.113 Scanner / Malware hosting 167.88.166.112 Scanner / Malware hosting 167.88.168.2 Scanner / Malware hosting 172.86.96.114 Scanner / Malware hosting 173.211.70.205 Scanner / Malware hosting 185.45.195.140 Scanner / Malware hosting 207.189.164.106 Scanner / Malware hosting 216.107.139.52 Scanner / Malware hosting dnslookip.com Residential proxy marketplace domain name used to determine nameservers of router bots ipscoredns.com Residential proxy marketplace domain name used to determine nameservers of router bots nslookups.com Residential proxy marketplace domain name used to determine nameservers of router bots asdns.pp.ua Historical residential proxy marketplace domain asdns2.pp.ua Historical residential proxy marketplace domain ipwebinfo.net Historical residential proxy marketplace domain ipinfocheck.com whosedns.pp.ua Historical Residential proxy marketplace domain antigutation.info C&C antihicipate.com C&C disimunous.com C&C emelenalike.com C&C enidecikive.net C&C exagenafy.com C&C inoluvary.com C&C interocakate.com C&C macrofocafify.org C&C minixetepate.biz C&C misukumotist.info C&C monobimefist.com C&C prekudinish.com C&C prenurevaty.info C&C promexucate.com C&C recepatission.info C&C remalexation.name C&C semiridinution-postepudency.com C&C subonuker.name C&C ultradomafy.net C&C underuvukent.com C&C monobimefist.com prenurevaty.info 23.105.170.30 Second-stage C&C / Residential proxy marketplace entry node 23.105.170.32 Second-stage C&C / Residential proxy marketplace entry node 23.105.170.33 Second-stage C&C / Residential proxy marketplace entry node 23.105.170.34 Second-stage C&C / Residential proxy marketplace entry node 23.105.170.35 Second-stage C&C / Residential proxy marketplace entry node 37.59.213.49 Second-stage C&C / Residential proxy marketplace entry node 38.91.106.214 Second-stage C&C / Residential proxy marketplace entry node 38.91.106.252 Second-stage C&C / Residential proxy marketplace entry node 38.91.107.2 Second-stage C&C / Residential proxy marketplace entry node 38.91.107.220 Second-stage C&C / Residential proxy marketplace entry node 38.91.107.224 Second-stage C&C / Residential proxy marketplace entry node 38.91.107.229 Second-stage C&C / Residential proxy marketplace entry node 46.105.44.29 Second-stage C&C / Residential proxy marketplace entry node 51.254.149.59 Second-stage C&C / Residential proxy marketplace entry node 51.254.167.45 Second-stage C&C / Residential proxy marketplace entry node 51.68.244.19 Second-stage C&C / Residential proxy marketplace entry node 51.83.116.2 Second-stage C&C / Residential proxy marketplace entry node 51.83.116.3 Second-stage C&C / Residential proxy marketplace entry node 51.83.116.5 Second-stage C&C / Residential proxy marketplace entry node 51.83.116.6 Second-stage C&C / Residential proxy marketplace entry node 51.83.116.7 Second-stage C&C / Residential proxy marketplace entry node 66.23.233.210 Second-stage C&C / Residential proxy marketplace entry node 66.29.128.241 Second-stage C&C / Residential proxy marketplace entry node 66.29.128.242 Second-stage C&C / Residential proxy marketplace entry node 66.29.128.243 Second-stage C&C / Residential proxy marketplace entry node 66.29.128.244 Second-stage C&C / Residential proxy marketplace entry node 66.29.128.245 Second-stage C&C / Residential proxy marketplace entry node 66.29.128.246 Second-stage C&C / Residential proxy marketplace entry node 66.29.129.52 Second-stage C&C / Residential proxy marketplace entry node 66.29.129.53 Second-stage C&C / Residential proxy marketplace entry node 66.29.129.54 Second-stage C&C / Residential proxy marketplace entry node 66.29.129.56 Second-stage C&C / Residential proxy marketplace entry node 67.213.210.115 Second-stage C&C / Residential proxy marketplace entry node 67.213.210.118 Second-stage C&C / Residential proxy marketplace entry node 67.213.210.167 Second-stage C&C / Residential proxy marketplace entry node 67.213.210.168 Second-stage C&C / Residential proxy marketplace entry node 67.213.210.175 Second-stage C&C / Residential proxy marketplace entry node 67.213.210.60 Second-stage C&C / Residential proxy marketplace entry node 67.213.210.61 Second-stage C&C / Residential proxy marketplace entry node 67.213.210.62 Second-stage C&C / Residential proxy marketplace entry node 67.213.212.36 Second-stage C&C / Residential proxy marketplace entry node 67.213.212.38 Second-stage C&C / Residential proxy marketplace entry node 67.213.212.39 Second-stage C&C / Residential proxy marketplace entry node 67.213.212.40 Second-stage C&C / Residential proxy marketplace entry node 67.213.212.47 Second-stage C&C / Residential proxy marketplace entry node 67.213.212.48 Second-stage C&C / Residential proxy marketplace entry node 67.213.212.49 Second-stage C&C / Residential proxy marketplace entry node 67.213.212.50 Second-stage C&C / Residential proxy marketplace entry node 67.213.212.51 Second-stage C&C / Residential proxy marketplace entry node 67.213.212.52 Second-stage C&C / Residential proxy marketplace entry node 67.213.212.53 Second-stage C&C / Residential proxy marketplace entry node 67.213.212.54 Second-stage C&C / Residential proxy marketplace entry node 67.213.212.55 Second-stage C&C / Residential proxy marketplace entry node 67.213.212.56 Second-stage C&C / Residential proxy marketplace entry node 67.213.212.57 Second-stage C&C / Residential proxy marketplace entry node 67.213.212.58 Second-stage C&C / Residential proxy marketplace entry node 108.181.132.115 Second-stage C&C / Residential proxy marketplace entry node 108.181.132.116 Second-stage C&C / Residential proxy marketplace entry node 108.181.132.117 Second-stage C&C / Residential proxy marketplace entry node 108.181.132.118 Second-stage C&C / Residential proxy marketplace entry node 108.181.133.58 Second-stage C&C / Residential proxy marketplace entry node 108.181.133.59 Second-stage C&C / Residential proxy marketplace entry node 138.201.21.218 Second-stage C&C / Residential proxy marketplace entry node 138.201.21.227 Second-stage C&C / Residential proxy marketplace entry node 138.201.21.228 Second-stage C&C / Residential proxy marketplace entry node 138.201.21.232 Second-stage C&C / Residential proxy marketplace entry node 138.201.21.233 Second-stage C&C / Residential proxy marketplace entry node 138.201.21.238 Second-stage C&C / Residential proxy marketplace entry node 141.94.238.246 Second-stage C&C / Residential proxy marketplace entry node 144.76.167.18 Second-stage C&C / Residential proxy marketplace entry node 144.76.167.23 Second-stage C&C / Residential proxy marketplace entry node 144.76.167.25 Second-stage C&C / Residential proxy marketplace entry node 144.76.167.26 Second-stage C&C / Residential proxy marketplace entry node 144.76.167.34 Second-stage C&C / Residential proxy marketplace entry node 144.76.167.37 Second-stage C&C / Residential proxy marketplace entry node 162.0.220.161 Second-stage C&C / Residential proxy marketplace entry node 162.0.220.214 Second-stage C&C / Residential proxy marketplace entry node 162.0.220.215 Second-stage C&C / Residential proxy marketplace entry node 162.0.220.216 Second-stage C&C / Residential proxy marketplace entry node 162.0.220.217 Second-stage C&C / Residential proxy marketplace entry node 162.0.220.218 Second-stage C&C / Residential proxy marketplace entry node 162.0.220.219 Second-stage C&C / Residential proxy marketplace entry node 162.0.220.220 Second-stage C&C / Residential proxy marketplace entry node 162.19.7.46 Second-stage C&C / Residential proxy marketplace entry node 162.19.7.47 Second-stage C&C / Residential proxy marketplace entry node 162.19.7.48 Second-stage C&C / Residential proxy marketplace entry node 162.19.7.49 Second-stage C&C / Residential proxy marketplace entry node 162.19.7.50 Second-stage C&C / Residential proxy marketplace entry node 162.19.7.53 Second-stage C&C / Residential proxy marketplace entry node 162.19.7.56 Second-stage C&C / Residential proxy marketplace entry node 162.19.7.57 Second-stage C&C / Residential proxy marketplace entry node 162.19.7.58 Second-stage C&C / Residential proxy marketplace entry node 162.19.7.59 Second-stage C&C / Residential proxy marketplace entry node 162.19.7.60 Second-stage C&C / Residential proxy marketplace entry node 162.19.7.61 Second-stage C&C / Residential proxy marketplace entry node 162.210.192.135 Second-stage C&C / Residential proxy marketplace entry node 162.210.192.136 Second-stage C&C / Residential proxy marketplace entry node 162.210.192.171 Second-stage C&C / Residential proxy marketplace entry node 162.210.197.69 Second-stage C&C / Residential proxy marketplace entry node 162.210.197.91 Second-stage C&C / Residential proxy marketplace entry node 174.138.176.74 Second-stage C&C / Residential proxy marketplace entry node 174.138.176.76 Second-stage C&C / Residential proxy marketplace entry node 174.138.176.77 Second-stage C&C / Residential proxy marketplace entry node 174.138.176.78 Second-stage C&C / Residential proxy marketplace entry node 195.154.43.182 Second-stage C&C / Residential proxy marketplace entry node 195.154.43.184 Second-stage C&C / Residential proxy marketplace entry node 195.154.43.189 Second-stage C&C / Residential proxy marketplace entry node 195.154.43.198 Second-stage C&C / Residential proxy marketplace entry node 195.154.43.221 Second-stage C&C / Residential proxy marketplace entry node 195.154.43.86 Second-stage C&C / Residential proxy marketplace entry node 198.7.56.71 Second-stage C&C / Residential proxy marketplace entry node 198.7.56.72 Second-stage C&C / Residential proxy marketplace entry node 198.7.56.73 Second-stage C&C / Residential proxy marketplace entry node 198.7.56.74 Second-stage C&C / Residential proxy marketplace entry node 198.7.61.67 Second-stage C&C / Residential proxy marketplace entry node 198.7.61.72 Second-stage C&C / Residential proxy marketplace entry node 209.159.153.19 Second-stage C&C / Residential proxy marketplace entry node 209.159.153.20 Second-stage C&C / Residential proxy marketplace entry node 209.159.153.21 Second-stage C&C / Residential proxy marketplace entry node 209.159.153.22 Second-stage C&C / Residential proxy marketplace entry node 212.83.137.142 Second-stage C&C / Residential proxy marketplace entry node 212.83.137.150 Second-stage C&C / Residential proxy marketplace entry node 212.83.137.165 Second-stage C&C / Residential proxy marketplace entry node 212.83.137.239 Second-stage C&C / Residential proxy marketplace entry node 212.83.137.30 Second-stage C&C / Residential proxy marketplace entry node 212.83.137.94 Second-stage C&C / Residential proxy marketplace entry node 212.83.138.132 Second-stage C&C / Residential proxy marketplace entry node 212.83.138.172 Second-stage C&C / Residential proxy marketplace entry node 212.83.138.186 Second-stage C&C / Residential proxy marketplace entry node 212.83.138.192 Second-stage C&C / Residential proxy marketplace entry node 212.83.138.245 Second-stage C&C / Residential proxy marketplace entry node 212.83.138.60 Second-stage C&C / Residential proxy marketplace entry node 212.83.142.100 Second-stage C&C / Residential proxy marketplace entry node 212.83.142.114 Second-stage C&C / Residential proxy marketplace entry node 212.83.142.131 Second-stage C&C / Residential proxy marketplace entry node 212.83.142.145 Second-stage C&C / Residential proxy marketplace entry node 212.83.142.149 Second-stage C&C / Residential proxy marketplace entry node 212.83.142.158 Second-stage C&C / Residential proxy marketplace entry node 212.83.143.103 Second-stage C&C / Residential proxy marketplace entry node 212.83.143.118 Second-stage C&C / Residential proxy marketplace entry node 212.83.143.147 Second-stage C&C / Residential proxy marketplace entry node 212.83.143.151 Second-stage C&C / Residential proxy marketplace entry node 212.83.143.159 Second-stage C&C / Residential proxy marketplace entry node 212.83.143.191 Second-stage C&C / Residential proxy marketplace entry node 212.83.143.204 Second-stage C&C / Residential proxy marketplace entry node 212.83.143.211 Second-stage C&C / Residential proxy marketplace entry node 212.83.143.223 Second-stage C&C / Residential proxy marketplace entry node 212.83.143.60 Second-stage C&C / Residential proxy marketplace entry node 212.83.143.97 Second-stage C&C / Residential proxy marketplace entry node FILES SHA-256 C&C URL path sv 83cf89428e07a1a10b22958dca25f50a8a151bccfa01ee9bcce870303a4f9861 /metric 42ea 7bddb716c233211fa7332586e7d3e859814ec508108fa1024c4fb99aab843cdf /metric 271a 6a3288b1d326290778544769ea7c1ed80af763ea47fee5131afef209a0e2d301 /metric 271a e0cdaaba90f061d31cfe0211fe207cb3971970a141d9d72f95c8a55c8d565cb1 /metric 271a e2423e93b84284890a27e3796491049a22f6496b3830e20e808dff1c77560e3d /metric 271a 1748978997d9630c568f6c06ff0767ed8b0cfbf5c93612daf600adefecfba2e1 /metric 271a a79ff2cd7f47b11d9176c40f0e82ba9b378c463ff9dd6e3e907df9480c7a1547 /metric 271a 743f7c495048d8983bbedc3d52ea00c914fe008b06ef01c1be2a78cd5c1375f3 /metric 271a 892eb161254733cf5923313544e923fface375c27b3dcf8f66e79da84c93cf65 /metric 271a 129693d8c474a8de8f91e1d16e0129732aba20bea9ac24e7c68b345b7b05ad6f /metric 271a a8f7eaf999eb6cc8461f785fad13da30315da80b534cae047c5811bbea3351e3 /metric 271a 78a1b5bea50034e7a03e6ed5c0f4f80f1fbc770555891a73790e1b59a2fba608 /metric 271a 5353228926aa96b546b33de4418f15e347441d16d292f4946beca6a0d314e635 /metric 271a 600c56a175f3661f434d1fe3418fb4cca96cdf6f880bd74a389e0d16d85ca501 /metric 271a a3317844f3d6b5b2440be896b84fd6aa4ee77a0f9b656b784b235e077b69715d /metric 271a bfab45d715e0e090ea18849661ed3ed58bdd7310c54c4a14a607eee4cc742e33 /metric 271a 2bf2c10332f1d31e1b87e62ca2d7afc70f073c55474d7f03ff6c37caec28df4a /metric 271a e3344c598a984dc5dc8dc1d971da8dd9b7058c48288dc5ad063548fff61543a1 /metric 271a 35f95fbb1b439a89cbd6e825188fb64fde44aef9829d549b4f547850552e095c /metric 271a 9fead901a3012825841cb6091f52e0a914944fbb1460c3ddb9d07213fbb7e30e /metric 271a 9f1fcfb2fcc66f4e534d3348b8d01eef0be1b153bc022ae7601ed3a0817aae88 /metric 271a 4af537b29c54f976801ee7688c4db78d4b4e7b9947769226afc108e4645cf20f /metric 271a f6d70464165e00de26127464a84919f20521aa4efbecfae41e75688f74436489 /metric 271a 05cd00f975bd2522d943e836ef5a1cb00806c6d684987274da850be348b2b1f4 /piwik.js 271a b8385ce60ca6c69b7ea67fa93c7d5908809658e7d8a4fb9e003890b820979f53 /piwik.js 271a 9fda16ad1d32f34c221d0e074a4ef13217eded63b5ff507452c4e2bbb57df3a4 /piwik.js 271a 869965781d96a06741c2a28c54bb8e3233bc10fcb92455e6cb9ab0c9fc2c54d4 /piwik.js 271a b9360f1434ce7ff45b3ca49ff7269293188a339747b03bcd395b71b1d179700f /piwik.js 271a be285b77211d1a33b7ae1665623a9526f58219e20a685b6548bc2d8e857b6b44 /piwik.js 271a 9cb6c49173e4cb5a0b3c2f6d69a5bdc0bc67138329f00afaf38d678f2c0e00a6 /piwik.js 271a 56657300f250fa9df77d6bc393bfc01d585d00bfb5302bf34314368fb13cbe26 /piwik.js 271a 4e8a36f467f1dab1b4768f67efd3712562699603839e38d93525c90989a4cf26 /piwik.js 271a 2e940e3bd88226cfbbfb7a2eefbdd675173fd2950847a9131e11c1682353e286 /piwik.js 271a 1fe1cece08fef19448a32a746f5c8f77521db757c2b345103834a5f617101f15 /piwik.js 271a a8497257d78ea15088e0b9c68319a2c0ae8c651ed36780e9424effe97f440c0c /piwik.js 271a f95342caa61e77174fe7653eea60909b9db0102c27a0641e25cdc053689110ab /piwik.js 271a 9fb33a16762dce934e7a48946e396ad672ab16d42a060021238f2ddf6a9f0514 /piwik.js 271a 97cadc2eba1eaa7a4115ea7cc82a6955bc69d8e2913b0b46f493f9cc84ec07de /piwik.js 271a 74f4d77bf367063bccece2fb3796e6bd7a1f51528f58ed3f1450b7de6c29b5f4 /piwik.js 271a 5d89b09dfb7c09a3a42345a136293b469a71ef7a1f599102ad67c09dc4fc53bf /piwik.js 271a 710e0317de732f1bce32ed96d33468cb2b55e513106393b11bf7800081f1e681 /jquery.js 271a eddd909b49f2fef023a7b6188b2ae70bbf1e25e85f5e4c84c19cc25641f17175 /jquery.js 271a c267e0bf3f1a0448e66427d5863d762af7cd6cc7ff812e6addcd4e54d9a46ac9 /jquery.js 271a