type,indicator,campaign,source,notes
ipv4,103.216.220.92,PHP2Shell (CVE-2026-109618/109619),AWS · 17 Oct,"Shared anonymisation/cloud address — investigate, don't blanket-block"
ipv4,31.223.184.166,PHP2Shell (CVE-2026-109618/109619),AWS · 21 Oct,"Shared anonymisation/cloud address — investigate, don't blanket-block"
ipv4,37.19.200.5,PHP2Shell (CVE-2026-109618/109619),AWS · 21 Oct,"Shared anonymisation/cloud address — investigate, don't blanket-block"
ipv4,134.209.159.64,PHP2Shell (CVE-2026-109618/109619),AWS · 21 Oct,"Shared anonymisation/cloud address — investigate, don't blanket-block"
ipv4,103.114.163.188,PHP2Shell (CVE-2026-109618/109619),AWS · 21 Oct,"Shared anonymisation/cloud address — investigate, don't blanket-block"
ipv4,95.217.98.37,PHP2Shell (CVE-2026-109618/109619),AWS · 21 Oct,"Shared anonymisation/cloud address — investigate, don't blanket-block"
ipv4,45.198.224.169,PHP2Shell (CVE-2026-109618/109619),Telekom honeypot,"Shared anonymisation/cloud address — investigate, don't blanket-block"
ipv4,64.176.35.212,PHP2Shell (CVE-2026-109618/109619),Telekom honeypot,"Shared anonymisation/cloud address — investigate, don't blanket-block"
domain,litellm.dev,LiteLLM 1.107.0 stealer,LiteLLM,"Exfil domain, registered 13 Oct 2026"
domain,www.litellm.dev,LiteLLM 1.107.0 stealer,LiteLLM,Exfil host
url,http://www.litellm.dev/healthcheck,LiteLLM 1.107.0 stealer,LiteLLM,Beacon URL
url,https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt,LiteLLM 1.107.0 stealer,LiteLLM,C2 domain list
http-header,X-Token: XWiA8gZNa7NcX2XRoAEb,LiteLLM 1.107.0 stealer,LiteLLM,Fake MSIE 7.0 User-Agent
host-artifact,site-packages/cook.pth,LiteLLM 1.107.0 stealer,LiteLLM,
host-artifact,cook.py,LiteLLM 1.107.0 stealer,LiteLLM,
host-artifact,sitecustomize.py (unexpected),LiteLLM 1.107.0 stealer,LiteLLM,
host-artifact,litellm-1.107.0.dist-info,LiteLLM 1.107.0 stealer,LiteLLM,
host-artifact,/tmp/.pc_once_72129118c59f5636c0bb,LiteLLM 1.107.0 stealer,LiteLLM,
host-artifact,/tmp/remote_code_loader.lock,LiteLLM 1.107.0 stealer,LiteLLM,
host-artifact,/tmp/.pc_sq_*,LiteLLM 1.107.0 stealer,LiteLLM,
host-artifact,/tmp/.pc_e_*,LiteLLM 1.107.0 stealer,LiteLLM,
host-artifact,env PRIVCOLLECT_ACTIVE=1,LiteLLM 1.107.0 stealer,LiteLLM,
git-commit,20535d8fa11f786a6c24df7488a0e449ed5f09ad,LiteLLM 1.107.0 stealer,LiteLLM,github.com/Berri-AI/litellm (lookalike)
git-commit,9cf97e935aeaf791b9c8db224a2bb3ee156134ce,LiteLLM 1.107.0 stealer,LiteLLM,workflow
ipv4,69.48.229.143,LiteLLM 1.107.0 stealer,LiteLLM,C2 / exfiltration infrastructure
ipv4,199.91.221.39,LiteLLM 1.107.0 stealer,LiteLLM,C2 / exfiltration infrastructure
ipv4,168.100.8.57,LiteLLM 1.107.0 stealer,Wiz,C2 / exfiltration infrastructure
ipv4,165.227.201.8,LiteLLM 1.107.0 stealer,Wiz,C2 / exfiltration infrastructure
sha256,7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb,LiteLLM 1.107.0 stealer,Linux/macOS,cook.pth
sha256,9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25,LiteLLM 1.107.0 stealer,Linux/macOS,cook.py
sha256,34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa,LiteLLM 1.107.0 stealer,Linux/macOS,sitecustomize.py
sha256,84dc8c82c0a4a4a62552ef826b49fcc86d1a5c4a5d0f2c06665723f93d129d7d,LiteLLM 1.107.0 stealer,Windows,cook.pth
sha256,03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea,LiteLLM 1.107.0 stealer,Windows,cook.py
sha256,b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465,LiteLLM 1.107.0 stealer,Windows,sitecustomize.py
image digests,litellm index sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e · litellm-database amd64 sha256:24581ddc30767f16ecb69d2b0517556f2cd7dea56971adb42a3d1beb97d69523 · arm64 sha256:827dd893c74cf621a860a66a3a447a5c732533f087589ce905573e285c0a239c · litellm-non_root amd64 sha256:645a67d810628252d63df85dcc8824c58bcc77cf8383f4d3e6321f0ccc3ce9e4 · arm64 sha256:f75c8edae59b72b1ebfd617295833f465c85bb2fab9c1d60f21b496db86cb8da,LiteLLM 1.107.0 stealer,LiteLLM,
spki-sha256,EBED6475C2C2D80FCB199F3FE8DD6E6B3CE60B77EB15D4E42C3DEC0C6F5B5105,eMudhra weak-key intermediates,Mozilla / Google root programs,EM DV TLS CA - G3B (TLS) — distrusted
spki-sha256,43BFFA19D6EF651451F6841E019931E96F6F2EAEFF28AB4B6F1CE4576DE2717B,eMudhra weak-key intermediates,Mozilla / Google root programs,EM OV TLS CA - G3B (TLS) — distrusted
spki-sha256,E0254C7FCDC265E2F0F8A428DABB75AB4AE039B4872D62F5EE57F0877D5A8A41,eMudhra weak-key intermediates,Mozilla / Google root programs,EM EV TLS CA - G3B (TLS) — distrusted
spki-sha256,49DD353DC2B919A3770645117D0E60C16115E7D1BC259EEFE734B00EA434FE5F,eMudhra weak-key intermediates,Mozilla / Google root programs,EM DV TLS CA - G3C (TLS) — distrusted
spki-sha256,63ECEFEE431D49523BC1136C4E72D0206A477086CAF606CD5CF025686C109CF8,eMudhra weak-key intermediates,Mozilla / Google root programs,EM OV TLS CA - G3C (TLS) — distrusted
spki-sha256,5C0660A2B164910D8FF589C18E14552E9E0EC237DCEFE2CB736D41A4811F81A0,eMudhra weak-key intermediates,Mozilla / Google root programs,EM EV TLS CA - G3C (TLS) — distrusted
spki-sha256,EC4FFA1AD0AC88081314B7AAFFEF6A91F97CD57291BB5BA686C5415F5EB4F6B6,eMudhra weak-key intermediates,Mozilla / Google root programs,EM OV CS CA - G3B (Code signing) — distrusted
spki-sha256,92C063D67E8F14DB71D288E11266FFDAF69CBF115F7BAB14F3BC2F68D25E0E30,eMudhra weak-key intermediates,Mozilla / Google root programs,EM OV CS CA - G3C (Code signing) — distrusted