Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

TLP:WHITE126 IOCs

Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

Check Point Research

Published September 2, 2026Original Report

Threat Actors

Malware Families

Diamond Model

Adversary(1)

Infrastructure(6)

Capability(3)

Victim

Indicators of Compromise

Indicators of Compromise126

Type	Indicator	Confidence	Score	First Seen
SHA256	b88a7f3288bdf4b97d75dad4e47e5cb3d4e0962b12674a08e32e5f96e762e877 active scanalphaagentapache modules	Medium	58	Sep 2, 26
IP	16.162.255.92 indicatorintel-blogmalware	Low	31	Sep 2, 26
SHA256	94aa88ff6222583b2a5b791ddd655837787e31f59483ed91f860857d3399b84a file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	cff25a9c84c893e32a9a75c1dae385934cf917f709efa11172a53ea2337fa109 file-hashintel-blogmalware	Medium	53	Oct 9, 26
Domain	microsoft-azure-loadbalance.com intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	297c53d935c501864e15fe7abcfdafed83df9aafdf241094604ae405529c5eb7 active scanalphaagentapache modules	Medium	42	Sep 2, 26
SHA256	0611c153bf8b8561ef53f2a5ba1413115bdc0e4554e0c22cf9641bd8845db03e active scanalphaagentapache modules	Medium	42	Sep 2, 26
IP	54.207.196.189 indicatorintel-blogmalware	Low	31	Sep 2, 26
Domain	js.ai-jquery.com intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	c3c6ab58514cd13638cf049332186ef6d4ec7b256913edb1cd66a19437608882 active scanalphaagentapache modules	Medium	58	Sep 2, 26
IP	165.22.101.200 intel-blogmalwarenetwork	High	58	Oct 9, 26
IP	204.16.172.106 active scanactive scanningalphaagent	Low	38	Feb 20, 24
SHA256	2de964314a8aacc40897140f6fe21d268e24503a69f9821177e31bca7b1e4035 active scanalphaagentapache modules	Medium	42	Sep 2, 26
IP	202.146.222.18 alphaagentasiabitbridge	Medium	45	Jul 5, 26
SHA256	0d4a28d5cf7b99f11ffe972abd0284d9e35b6858eeb288532a55633b3e29f9c7 active scanalphaagentapache modules	Medium	63	Sep 2, 26
SHA256	ab7d531d298f0d77bc7bbbdc36f4f8a1732ceca90ff60e3f225a99b9b10f334e file-hashintel-blogmalware	Medium	53	Oct 9, 26
IP	172.80.8.202 alphaagentchuserearth berberoka	Medium	64	Sep 2, 26
Domain	github.wiki botnetc2command and control	High	68	May 4, 22
SHA256	154c977a113ff4d94ff2f29f7b93a8d0bd6ad8e67a820c09505117f5d386fd40 file-hashintel-blogmalware	Medium	53	Oct 9, 26
Domain	dnslog.kernel-lib.com alphaagentchuserearth berberoka	High	67	Sep 2, 26
IP	154.84.62.145 alphaagentchuserearth berberoka	Medium	62	Sep 2, 26
SHA256	9d513a419bf129a42017b29eb7d084451a4f34be0828f6871439ec79f7f9b5fb file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	114824bccfafcbb42040f119fdcd3ec48f54eb154ffee6676d06986cba2b0af0 active scanalphaagentapache modules	Medium	42	Sep 2, 26
SHA256	52863d36a216a86b2f90914db2d9229cba7ea317ab5ee9a678cb229087f04611 active scanalphaagentapache modules	Low	33	Sep 2, 26
IP	43.198.30.170 indicatorintel-blogmalware	Low	31	Sep 2, 26
IP	15.228.251.82 indicatorintel-blogmalware	Low	31	Sep 2, 26
Domain	gitlab.bet c2intel-blogmalware	High	58	Oct 9, 26
SHA256	1829efbf7946e1a958779a3e7f1e50ca63fe61c6a2ddc177c14a7b0c5e10020a active scanalphaagentapache modules	Medium	42	Sep 2, 26
SHA256	c4d2efa57eef0c5defc4ca708ebe35832f8b543cf764beebef56fef6d36d4f69 active scanalphaagentapache modules	Medium	58	Sep 2, 26
IP	56.124.49.89 indicatorintel-blogmalware	Low	31	Sep 2, 26
SHA256	0e7c96a22e3612c68866a8693cc583df95972d3444978ce163c024a45682133a file-hashintel-blogmalware	Medium	53	Oct 9, 26
IP	104.206.37.134 alphaagentchuserearth berberoka	Medium	64	Sep 2, 26
SHA256	f025520d648c7799ca5bed4a9be5bee14ac33be1f1e9b20c090c8c6319404fcf active scanalphaagentapache modules	Medium	63	Sep 2, 26
IP	18.229.255.14 indicatorintel-blogmalware	Low	31	Sep 2, 26
Domain	80.443.team intel-blogmalwarenetwork	High	58	Oct 9, 26
IP	13.203.9.172 indicatorintel-blogmalware	Low	31	Sep 2, 26
SHA256	d138d5f4fbc77650bc3be1cbf8fbd0ee292aa30eed5feec1ea7ba02e57da932b active scanalphaagentapache modules	Medium	63	Sep 2, 26
SHA256	090e886e5605255ad5708e1f27aecc54319de835abd28853e54182981410707e active scanalphaagentapache modules	Medium	42	Sep 2, 26
SHA256	749784fb7846bb3b52dd8c2f660b53d95d5df30387b87b65b584ef9cc781ae52 active scanalphaagentapache modules	Low	33	Sep 2, 26
SHA256	44373953431d7570d9585c91377dbe8b6527ccc00662d249f383b003b68b459f active scanalphaagentapache modules	High	67	Sep 2, 26
Domain	api.onlinevrgame.com intel-blogmalwarenetwork	High	58	Oct 9, 26
IP	108.187.28.158 abuseaccess controlactive scan	Medium	42	Oct 22, 25
SHA256	85b5e95cbb5103202abebf8f84b91a286994e61b33ddef53355ab0df2a2b6d9a file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	12af9d95c44e20a375148c25f8a2978a62ee95489134654c3537ccfb2d42120d active scanalphaagentapache modules	Medium	63	Sep 2, 26
SHA256	612fe3a3ace706725aa5415a1cd1cf18548627b4b40636c5443cb770def30b4c active scanalphaagentapache modules	Medium	58	Sep 2, 26
Domain	devops.aliyuntsl.com alphaagentchuserearth berberoka	High	67	Sep 2, 26
SHA256	e8bc706b0b007d6a122c6b19e87451e550baee793540774db13b9a08803ed76a file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	1eb40363a64e0cad15e340af476d106ccf57ebb6662c1389da1347429ee68c9c active scanalphaagentapache modules	Medium	58	Sep 2, 26
SHA256	232ef6be134c2b7c14648aa193daf7e23e987477b8a40150dd77883947fdf017 active scanalphaagentapache modules	Medium	42	Sep 2, 26
Domain	file.ijjjst23m.com alphaagentchuserdga	High	67	Sep 2, 26
SHA256	2949f0b16b83b35dc8a3dfa11815b9516403e3997e13100e7b86f3bb81f6c283 file-hashintel-blogmalware	Medium	53	Oct 9, 26
IP	43.199.133.195 indicatorintel-blogmalware	Low	31	Sep 2, 26
IP	154.84.62.128 alphaagentchuserearth berberoka	Medium	64	Sep 2, 26
SHA256	5af1bec4635e52da4909bf744ea4b7e4483ec944241218855212f4a9e3d48611 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	c59ebe5cf45935c7b5f91b5936fe2c8a5feb7ca161e40ca4e3fb93e447373fa6 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	88544d36beb6dc621c9376806836d0ad109ece64b589605d5674e0c86313d1c0 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	fa7d8c44a0ecb5ec40832d0d2cfe22c47879317177eae88d178e156f1c8d61a3 active scanalphaagentapache modules	Low	33	Sep 2, 26
IP	43.198.248.193 indicatorintel-blogmalware	Low	31	Sep 2, 26
SHA256	c3c09fe219e10808f053e580628aeb87b1f00fc683c810aa828905fe03cda98f active scanalphaagentapache modules	High	67	Sep 2, 26
Domain	bageyi.kernel-lib.com intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	ac99754357bd4a69c1de576977e0ee19c7354f29f7f52a9893b7a60f9c2f5248 file-hashintel-blogmalware	Medium	53	Oct 9, 26
IP	56.125.218.234 indicatorintel-blogmalware	Low	31	Sep 2, 26
Domain	playfootball.info intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	e8bb763bd10e727228ca9a8e3e6cf10bf4de4639b6be680a3abfb181a0adc052 active scanalphaagentapache modules	Medium	58	Sep 2, 26
SHA256	3537bfeaf2c18feafeaf773700a88118fd50979d97f2c42c7e34ba6c9aa62820 active scanalphaagentapache modules	Medium	42	Sep 2, 26
IP	18.164.116.24 indicatorintel-blogmalware	Low	28	Sep 2, 26
IP	18.228.136.28 indicatorintel-blogmalware	Low	31	Sep 2, 26
SHA256	7d9f5eb3f704607e6f63681842f48071cc58f2f2e63b16b64a49440cb4b9e6e3 active scanalphaagentapache modules	Low	33	Sep 2, 26
Domain	rb.aliyuntsl.com intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	2305ae23ea350e31b05b9f071d315ee60c5a88e96ce11be8ff9db16314a6197c active scanalphaagentapache modules	Medium	58	Sep 2, 26
SHA256	088d0742a667f1acfc83edb94671a10b951f6745badec6d5c754ef594dddf815 active scanalphaagentapache modules	Medium	42	Sep 2, 26
IP	18.166.208.57 indicatorintel-blogmalware	Low	31	Sep 2, 26
SHA256	02f5e07dd4c97a3de48cc886f46dad35443f1c221a352630e2c7787806ee21b6 active scanalphaagentapache modules	High	67	Sep 2, 26
Domain	data.mirrors-inc.com intel-blogmalwarenetwork	High	58	Oct 9, 26
IP	13.250.18.158 indicatorintel-blogmalware	Low	31	Sep 2, 26
Domain	hwlocal.team-hw.com intel-blogmalwarenetwork	High	58	Oct 9, 26
IP	18.163.182.231 indicatorintel-blogmalware	Low	31	Sep 2, 26
SHA256	45b9382d7e91a4178b47c908b9b5f6884de7c5a1ef849fbf01d6c23d06d81b88 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	96488c59287889fcd3b9952ec78b78914fabb901c8b61a7354552439170ed148 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	5a11ed7931fb6358846e0f3c8d69921f43f8ccade5937fc41e5c262cc49f82e8 active scanalphaagentapache modules	Low	33	Sep 2, 26
SHA256	bcd7e5964630c34f06a43e48d696d99d7abae6b679509ad839ffa5179a972838 active scanalphaagentapache modules	Low	33	Sep 2, 26
Domain	team-hw.com alphaagentchuserearth berberoka	High	69	Sep 2, 26
SHA256	d948b486c740b66642a5ae29dc1cb80da703ad40296bcda34a1b27216b63a5cd file-hashintel-blogmalware	Medium	53	Oct 9, 26
Domain	update.aliyun.la intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	adbee84e9a43949b0a816f052ffb3c0b7855e078b985fea95532158c3b9389bc file-hashintel-blogmalware	Medium	53	Oct 9, 26
Domain	data.windows-update-cdn.com intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	16d35a725819142d2bd5bc0949dc518d344d6f63626a517e67fcba7322eb3844 active scanalphaagentapache modules	High	67	Sep 2, 26
IP	154.84.62.160 alphaagentchuserearth berberoka	Medium	64	Sep 2, 26
Domain	8yiu.kernel-lib.com alphaagentchuserearth berberoka	High	67	Sep 2, 26
Domain	404.443.team intel-blogmalwarenetwork	High	58	Oct 9, 26
Domain	br.team-hw.com intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	263c14e84398339b25cd3e59da7e108340306fdbb8112bbe7dc0f07a71eb8a31 file-hashintel-blogmalware	Medium	53	Oct 9, 26
IP	18.228.195.216 indicatorintel-blogmalware	Low	31	Sep 2, 26
SHA256	3a8f464f1f2b5c38173e2a96f95a690af327d85c13c04d37cf0a91893d487bdb file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	582ecca146a6aef478706e4b2774d6115a9220a18d1db8f92ee54a5118ecebd9 active scanalphaagentapache modules	Medium	58	Sep 2, 26
SHA256	9d3085eac9a59a94f0473db5ec0173def8777d2f794da281fb1749389ae33cdb active scanalphaagentapache modules	Low	33	Sep 2, 26
SHA256	2567d6b42dac97a391217ad22ee375f504d541940d3fbb9436a3f5e9bb23ab91 active scanalphaagentapache modules	Medium	58	Sep 2, 26
SHA256	24f7296ac5ce844678c5f7470eaf64b28e870108ca06851c8f66a27a52003f12 active scanalphaagentapache modules	Medium	42	Sep 2, 26
SHA256	3ad35ea116b2c0855c13459a04699318b3944762385e8a47144f1d03b48f0bb1 active scanalphaagentapache modules	Medium	42	Sep 2, 26
Domain	kerneltty.com intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	fa7fc029ac13af2f3880151e9c408e9afadeba7b2cff01659806fb7c3c83288d file-hashintel-blogmalware	Medium	53	Oct 9, 26
Domain	github.la active scanalphaagentapache modules	High	69	Sep 2, 26
SHA256	98e17fe36ff77106bbbb9a04f3e00004bf872b88aab22438076966913ea83322 active scanalphaagentapache modules	Low	33	Sep 2, 26
SHA256	67ccc12c0a17dc31388a8c851d076edaaf1213e80398b01d46f5a29b8c7b8b9b file-hashintel-blogmalware	Medium	53	Oct 9, 26
Domain	update.opentls2.com intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	0963c0034a5e0665729d686d50c5375948c4a684c56770adb13d24ff5df8013d active scanalphaagentapache modules	Medium	42	Sep 2, 26
Domain	br.team-c2.com intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	0f26e1ba39ddd1f0a7e6f72bd8c4e02a5f0140de72eeda9fe5ab56402821e31e file-hashintel-blogmalware	Medium	53	Oct 9, 26
Domain	update.team-c2.com intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	8a64d368ce14c5a1f5e775714bcc02f080d0541360743bb4235e0d640f1787b1 file-hashindicatorintel-blog	Medium	43	Sep 3, 26
SHA256	f32dfbe4a2c11a975d735297bf76f6497ce9f5789ab8eaaef3fdd182c2f1f7b1 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	99b5404df81992cad104dd242bc736d75fd6c58af34dc1a75a8ee3c5e1784fa4 file-hashintel-blogmalware	Medium	53	Oct 9, 26
IP	56.124.87.60 indicatorintel-blogmalware	Low	31	Sep 2, 26
SHA256	f4aceaf5c0740093f8040f5e0f29c7582a1bd7ab2bca628d162fb45c29045063 active scanalphaagentapache modules	Medium	58	Sep 2, 26
SHA256	5f6d112637545a2e8c1a9f260c39698852c7a22e83db5ccfc99b99d9f6274710 active scanalphaagentapache modules	Medium	58	Sep 2, 26
IP	154.84.62.149 active scanalphaagentapache modules	Medium	62	Sep 2, 26
IP	18.162.210.53 indicatorintel-blogmalware	Low	31	Sep 2, 26
SHA256	fc789397742aee60b01292b071f79b4165981c31aa431eb1577a47c5911381c3 file-hashintel-blogmalware	Medium	53	Oct 9, 26
Domain	api.gitlab.bet alphaagentchuserearth berberoka	Medium	47	Sep 2, 26
IP	192.253.229.23 alphaagentasiabotnet	High	86	Sep 2, 26
SHA256	36cf87fe2e29cc8b0fd84fce91d70e62a4c4d2fc5f9650dc37440d629ae61b8f active scanalphaagentapache modules	Medium	42	Sep 2, 26
IP	18.166.243.179 indicatorintel-blogmalware	Low	28	Sep 2, 26
Domain	up.443.team intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	d478f867512e18d839180ceafc980c8fb26c3aa7d1c9e96d054819c81afef6f4 active scanalphaagentapache modules	Medium	58	Sep 2, 26
SHA256	a71498bfffae8ac694356b3f2436820b396946c9e71c8915e282c1b2fdba4162 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	8495598b1fec814d72caf76f1460b132071bb7305335331fed3bac9876c6e40c alphaagentchuserearth berberoka	Low	33	Sep 2, 26

IOC Relationship Graph

IOC Relationship Graph126 total IOCs

SHA256IPDomain

scroll to zoom · drag to pan · click IOC to open