IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
espionageIRIranThreat Actor
Active Threat

MuddyWater

104
IOCs Tracked
14
Intel Reports
Associated IOCs50 total
Domain1
t2.net
2026-07-24High
URL48
http://facebook-photo5.blogspot.com/
2026-09-15High
http://sp25ct7-zervax-biz-kersen-famdok.pages.dev/appeals/submit-appeal-form/return
2026-07-24High
http://www.saskaccessaccountservicedeskuser202.vercel.app/
2026-07-24High
http://zwurd-bfrnk-skrunt-0rw71c-vznk-prentz.pages.dev/appeals/submit-appeal-form/return
2026-07-24High
http://sp3ct-vornak-biz8-seltri-qovan.pages.dev/appeals/submit-appeal-form/return
2026-07-24High
https://www.trust-ledger-login-patch-gateway.vercel.app/
2026-07-24High
https://yhnuj0fdran-xjnshlpw-0a3b6c-xj811a.pages.dev/
2026-07-24High
http://sp29ct-fervik-biz-kantor-hazsel.pages.dev/appeals/submit-appeal-form/return
2026-07-24High
http://duishalik.blogspot.com/
2026-07-24High
http://sp3ct-lodvek-biz8-karsin-zumel.pages.dev/appeals/submit-appeal-form/return
2026-07-24High
https://2farobux.com/redeem/ctbSex5crcuN
2026-07-24High
http://saabeqoon.com/js/vendor/update
2026-07-24High
https://www.instagramloginpage111.blogspot.com/
2026-07-24High
http://www.netflixfree2024.blogspot.com/
2026-07-24High
https://ipfs.io/ipfs/bafybeifkilhlranv7rj63emeaaz3gye5rigd72s2cpuo4chpfvwqqp3sie
2026-07-24High
https://ledger-wallets-auth-graphical.vercel.app/ledger%20form/index.html/
2026-07-24High
http://sp29ct-vaztor-biz-hemqik-forsel.pages.dev/appeals/submit-appeal-form/return
2026-07-24High
https://www.meta-maskluginxgic.godaddysites.com/
2026-07-24High
https://net-ledger-wallet-data-script.vercel.app/ledger%20form/index.html/
2026-07-24High
http://thecourierdelivery2.netlify.app/
2026-07-24High
http://leboncoin1.github.io/leboncoin
2026-07-24High
https://maisixx.us.cc/5g
2026-07-24High
http://ui-clone-by-naman.netlify.app/
2026-07-24High
http://twxpl54lkwg-bgrnd65spli-2ce31c-zby5k.pages.dev/appeals/submit-appeal-form/return
2026-07-24High
https://facebooklogincomin.blogspot.com/?m=1
2026-07-24High
http://sp29ct-hemtor-biz-zanrik-vaskel.pages.dev/appeals/submit-appeal-form/return
2026-07-24High
http://sp25ct7-qorvok-biz-hemlor-fansik.pages.dev/appeals/submit-appeal-form/return
2026-07-24High
http://sp3ct-voslar-biz8-tenvik-qurem.pages.dev/appeals/submit-appeal-form/return
2026-07-24High
https://www.net-ledger-wallet-data-ios.vercel.app/
2026-07-24High
http://sp25ct7-vernax-biz-kalsor-femlin.pages.dev/appeals/submit-appeal-form/return
2026-07-24High
http://sp3ct-drenix-biz8-solvek-tranu.pages.dev/appeals/submit-appeal-form/return
2026-07-24High
http://imountsecurity.co.nz/hansonagy/
2026-07-24High
http://sp29ct-meltor-biz-zovrik-kansel.pages.dev/appeals/submit-appeal-form/return
2026-07-24High
http://sp3ct-baslor-biz8-qurvik-fonel.pages.dev/appeals/submit-appeal-form/return
2026-07-24High
http://sp29ct-pralvik-biz-komtor-zefsel.pages.dev/appeals/submit-appeal-form/return
2026-07-24High
http://zwurd-vlypx-skrunt-0rw71c-zplv-prentz.pages.dev/appeals/submit-appeal-form/return
2026-07-24High
http://fracturdevisdokd.duckdns.org/
2026-07-24High
http://sp3ct-wesnar-biz8-polvik-damel.pages.dev/appeals/submit-appeal-form/return
2026-07-24High
https://www.trust-ledger-login-patch-testing.vercel.app/
2026-07-24High
http://sp29ct-horlen-biz-pravok-kemvik.pages.dev/appeals/submit-appeal-form/return
2026-07-24High
https://www.netflix-clone-nextjs.vercel.app/
2026-07-24High
https://www.wallet-trezor-login-trust-website.vercel.app/
2026-07-24High
http://ksaservicesarl.com/visionrealtymgt/
2026-07-24High
https://135461223.site/1781/565c2b3b-b892-4792-8858-fe75524f363a/750431
2026-07-24High
http://sp25ct7-forvex-biz-kamlor-felsik.pages.dev/appeals/submit-appeal-form/return
2026-07-24High
http://www.bankofamerica-mi.vercel.app/
2026-07-24High
http://lh.gecnnrl.com/NeemaHospitalityManagement/
2026-07-24High
https://www.acreditar.webcindario.com/
2026-07-24High
CVE1
CVE-2026-33017
2026-08-22High
Related Reports14 total
SimpleHarm: Tracking MuddyWater’s infrastructure
Group-IB
Tracking MuddyWater in Action: Infrastructure, Malware and Operations during 2025
Group-IB
Unmasking MuddyWater’s New Malware Toolkit Driving International Espionage
Group-IB
Operation Olalampo: Inside MuddyWater’s Latest Campaign
Group-IB
Catching fish in muddy waters
Group-IB
MuddyWater-Linked Dindoor Backdoor Abuses Legitimate Deno Runtime to Evade Detection
Cyber PressAug 26, 2026
Cyber Conflict Briefing Q2 2026
DCSO CyTec BlogAug 3, 2026
OpenPhish (300 entries)
OpenPhish
299 IOC
Weekly Threat Landscape Digest – Week 28
HawkEyeJul 10, 2026
40 IOC
May 2026 Threat Trend Report on APT Groups
AhnLabJun 15, 2026
Critical Langflow Vulnerability Exploited for Malicious Code Execution
Cyber PressJun 11, 2026
5 IOC
When Your AI Agent’s Memory Becomes a Security Liability
Check Point BlogJun 11, 2026
Exposing Fox Tempest: A malware-signing service operation
Microsoft Threat IntelligenceMay 19, 2026
8 IOC
NSFOCUS Monthly APT Insights – March 2026
NSFOCUS Security LabsMay 28, 2026
1 IOC
Threat Profile
Motivationespionage
OriginIRIran
Last seenSep 2026
IOCs tracked104