IOC Radar
IPMediumSignal 0/100

151.101.193.91

Location
United StatesUnited States
Montreal, Quebec
ASN
AS54113
Fastly, Inc.
First Seen
Mar 27, 2025
Last Seen
May 30, 2026
Mar 27
First Seen
442d ago
May 30
Last Seen
13d ago
6
Reports
source reports
0%
Confidence
medium
Found in 6 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
0%
Signal Score
0 / 100
IDS Rule
No
Threat Context
Tags

Network Information

CountryUSUnited States
RegionMontreal, Quebec
ASNAS54113
OrganizationFastly, Inc.

Feed Intelligence Summary

6 reports0% confidence
6
Source reports
0%
Confidence score
Category tags
indicatornetworkresearched

Activity Timeline

1 total obs
May 30May 30

Threat Activity Heatmap

· Peak: 2026-05-30
Less
More
Mon
Wed
Fri
Jun
·
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
24h
0
Dormant
7d
0
Dormant
30d
1
Minimal
3mo
1
Minimal
Threat ScoreLow Risk
0
SIGNAL
Signal Score
0%
Confidence
6
Reports
First seenMar 27, 2025
Last seenMay 30, 2026
GeolocationUS
CountryUnited States
LocationMontreal, Quebec
ASNAS54113
OrgFastly, Inc.
Coords37.7757, -122.3952

VirusTotal

Not checked

WHOIS

description
TTB-Chained executes a systemic collapse of the cryptographic chain of trust. Exploiting DNSSEC-unsigned protocols and .net edge nodes, it injects C++ payloads into the resolution chain prior to verification. Remediating via certificate expiration is ineffective; the architecture leverages systemic flaws in DMARC/SPF/DKIM and cryptographic handshake protocols to lock "Hollow Library" assets into the environment pre-enforcement, ensuring total detection evasion. The conduit utilizes a multi-umbrella transit strategy: Lumen (AS3356) + RIPE (37.97.254.27) + Fastly (151.101.130.159). These 63.16 KB "hollowed" assets masquerade as signed updates for total penetration. TTB-chained executes high-speed wipers targeting firmware/boot sectors, triggering complete corruption of hardware beyond restore. Once the root hosted in IP {53.xxx] is compromised and the pre-verified environment is saturated, the hardware is physically neutralized. -msudosos. See Belasco Chain for more.
raw
NetRange: 151.101.0.0 - 151.101.255.255 CIDR: 151.101.0.0/16 NetName: SKYCA-3 NetHandle: NET-151-101-0-0-1 Parent: RIPE-ERX-151 (NET-151-0-0-0-0) NetType: Direct Allocation OriginAS: Organization: Fastly, Inc. (SKYCA-3) RegDate: 2016-02-01 Updated: 2021-12-14 Ref: https://rdap.arin.net/registry/ip/151.101.0.0 OrgName: Fastly, Inc. OrgId: SKYCA-3 Address: PO Box 78266 City: San Francisco StateProv: CA PostalCode: 94107 Country: US RegDate: 2011-09-16 Updated: 2025-03-25 Ref: https://rdap.arin.net/registry/entity/SKYCA-3 OrgNOCHandle: FNO19-ARIN OrgNOCName: Fastly Network Operations OrgNOCPhone: +1-415-404-9374 OrgNOCEmail: [email protected] OrgNOCRef: https://rdap.arin.net/registry/entity/FNO19-ARIN OrgAbuseHandle: ABUSE4771-ARIN OrgAbuseName: Abuse Account OrgAbusePhone: +1-415-496-9353 OrgAbuseEmail: [email protected] OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE4771-ARIN OrgTechHandle: FRA19-ARIN OrgTechName: Fastly RIR Administrator OrgTechPhone: +1-415-518-9103 OrgTechEmail: [email protected] OrgTechRef: https://rdap.arin.net/registry/entity/FRA19-ARIN
references
https://www.virustotal.com/gui/collection/7b031642a30f1ee179e901d885a09c9e285273ad8a0605f08b84e81b4f715ea3, https://www.virustotal.com/graph/embed/gd8e70aa0638046c8af997e3e7fe529f1cfe2a121f5ca473880544f95a17eb56e?theme=dark, https://www.virustotal.com/gui/collection/7b031642a30f1ee179e901d885a09c9e285273ad8a0605f08b84e81b4f715ea3/iocs, https://tria.ge/240930-t6zdtsvfmk, https://mwdb.cert.pl/file/382eccd545c69bcf07e9b7b73701bd2bea707c58452cb108f99d3f541545b86b, https://jaffacakes118.dev/analysis/382eccd545c69bcf07e9b7b73701bd2bea707c58452cb108f99d3f541545b86b, https://tip.neiki.dev/file/382eccd545c69bcf07e9b7b73701bd2bea707c58452cb108f99d3f541545b86b, pop-os_files_md5s.csv, https://www.virustotal.com/graph/embed/g532ea94109c54d96ba1bde62201fb4439ef00ab8d0af4a2f99ee42846ad158df?theme=dark, SCANID: S-yIBIO4Ib0l4, SCANID: S-9uT7vEdHwHk, SCANID: S-4FSYbAVw6TA, SCANID: S-4jjwyMrjTU0, SCANID: S-jZUP9vdJp8E, https://www.virustotal.com/gui/collection/d8bbd97abe2ea808a02db46380171df0803a43a379ed3795a316cb1f947939de/iocs, SCANID: S-CadvV0Kd35c, SCANID: S-0LxiGnOve0Q, SCANID: S-YV38dG9guZE, https://www.virustotal.com/gui/collection/f890b10e639770c7e6ef3eeb804ee9e7391360557aedca7b1daaee02da0f7682/iocs, https://www.virustotal.com/gui/collection/f890b10e639770c7e6ef3eeb804ee9e7391360557aedca7b1daaee02da0f7682/summary, https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcnV0QllCYlB1, https://mwdb.cert.pl/file/efb45096e24a61b488eb809bd8edf874d15bb498dd75ced8b888b020c87e5c6c, https://n0paste.eu/UH6n5pD/, https://www.virustotal.com/graph/embed/g9e26667333d9418897f0ed8ce09560a6f8c68666f388427fb984306cf72b0125?theme=dark, https://www.virustotal.com/graph/embed/ga6f4f3cb5f1143dba3a0c5c4de4b4253709421851a914925a1512678f1034e9a?theme=dark, https://www.virustotal.com/gui/collection/0c323ad7f87df817719f1709edb03022c6b7fa4d27907b90eef0d5c863c1624a, https://www.virustotal.com/gui/collection/0c323ad7f87df817719f1709edb03022c6b7fa4d27907b90eef0d5c863c1624a/iocs, https://www.virustotal.com/gui/collection/0c323ad7f87df817719f1709edb03022c6b7fa4d27907b90eef0d5c863c1624a/graph, https://www.virustotal.com/gui/collection/ee0928d5289165511398be0144460ff4c8663292be0a99a05ac955de2728a078/iocs, https://www.virustotal.com/graph/embed/g0844b0f8d48c4bfab3ae40a376456055e267e54952fe40e0a79f63cc17550863?theme=dark, https://viz.greynoise.io/analysis/02a64dd4-d7e0-451c-8384-13cf23298551

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 1 year ago · Last seen 13 days ago
Appeared in 6 threat reports