Latest Research on INC and The Gentlemen Ransomware: Exposed AI Infrastructure
IOCs Feed
Hashes, IPs, domains, URLs from active ransomware campaigns
Indicators of compromise (IOCs) are file hashes, IP addresses, domains, and URLs observed in real ransomware attacks — security teams use them to detect, block, and hunt for the same infrastructure and malware across their own environment. This feed lists IOCs collected from active ransomware campaigns, attributed to the group and leak site that used them where known.
Total Indicators
54,006
hashes, IPs, domains, URLs
Ransomware Groups
303
with IOCs
IOC Types
4
hash, IP, domain, etc.
IOC charts
IOCs by Type
Share of indicators by type (hash, IP, domain, etc.).
37.2%
hostname
hostname
Share 37.2%hash
Share 35.9%ip
Share 22.1%url
Share 4.8%Data may be capped by source.
Ransomware Incidents by Month
Victim counts by month (attack/discovery date). Last 12 months.
54,006 total
| Ransomware group | Type | Value | Copy |
|---|---|---|---|
| chort | hostname | hgxyonufefcglpekxma55fttev3lcfucrf7jvep2c3j6447cjroadead.onion | |
| frag | hash | 7eec7d07587112777016e5742c0d002d7e64a3e1fe7bde82fed8f65e3663456a | |
| frag | hash | e1c371c7c39c16d208bcbaa5b5d0714df696e6ef68b95a880673a904527c8b96 | |
| frag | hostname | ravand.com | |
| frag | hostname | www.prival.com | |
| frag | hostname | chirurgiemaxillo.com | |
| frag | hostname | www.pomerandboccia.com | |
| frag | hostname | norpak.com | |
| frag | hash | e06520c65bf27d9110d68ecc0de0e0824c3a99be080ead1a5b5be8fd2a26d12d | |
| frag | hostname | dasmeshschool.com | |
| frag | hostname | uwock.ca | |
| frag | hostname | conwest.com | |
| frag | hostname | compactmould.com | |
| frag | hostname | centaurproducts.com | |
| frag | hostname | carranza.on.ca | |
| frag | hostname | cccm.bc.ca | |
| frag | hostname | briwaycarriers.com | |
| frag | hostname | brebeuf.org | |
| frag | hostname | whiskijackresorts.com | |
| frag | hostname | sensiblesolutions.ca | |
| frag | hostname | technikel.ca | |
| frag | hostname | strategicobjectives.com | |
| frag | hostname | sabre.ca | |
| frag | hostname | smtlawyers.ca | |
| frag | hostname | ripobec.com | |
| frag | hostname | phoenixlabs.com | |
| frag | hostname | modtech.ca | |
| frag | hostname | mattandsteve.com | |
| frag | hostname | lemonastere.ca | |
| frag | hostname | idealwelders.com | |
| frag | hostname | hitechpiping.ca | |
| frag | hostname | groupepiche.ca | |
| frag | hostname | groupecho.com | |
| frag | hostname | excavationtourigny.ca | |
| frag | hostname | eastplats.com | |
| frag | hostname | alliancemercantile.com | |
| Eraleign | hostname | eraleignews.com | |
| Eraleign | hostname | ns1.eraleignews.com | |
| Eraleign | hostname | ns2.eraleignews.com | |
| Eraleign | hostname | ns3.eraleignews.com | |
| Eraleign | hostname | ns4.eraleignews.com | |
| Eraleign | hostname | bashe4aec32kr6zbifwd5x6xgjsmhg4tbowrbx4pneqhc5mqooyifpid.onion | |
| Eraleign | hostname | basheqtvzqwz4vp6ks5lm2ocq7i6tozqgf6vjcasj4ezmsy4bkpshhyd.onion | |
| Eraleign | hostname | qcgv5tfer4f46ns6ohh72zeyyh5uavoiybypzpt3lmwk5ecyqykptgqd.onion | |
| Eraleign | hostname | wn6vonooq6fggjdgyocp7bioykmfjket7sbp47cwhgubvowwd7ws5pyd.onion | |
| Eraleign | hostname | fleqwmg7xnanypt5km2m75l72q7nlcvlp2m4sdmgjxorsn6tb3zyp3qd.onion | |
| Eraleign | hostname | basherq53eniermxovo3bkduw5qqq5bkqcml3qictfmamgvmzovykyqd.onion | |
| payload | hash | dfcd1769d4963d87a5ca77f17e03a2d1d8a15c5150070d6055047a9c83f28a62 | |
| payload | ip | 141.147.89.33 | |
| payload | url | http://13.140.176.180:7866/tadashi.x64 |
Showing 1–50 of 54,006
Page 1 of 1081