REDSHARK

Cyber Threat Intelligence Platform

2026-09-27 08:16:07 (GMT+8)Live Intel

Risk Posture

Elevated

Live Feed

CRITICALCVE-2026-85102cveOTX—

CRITICALhttp://192.162.199.149/uploads/d0f13ab7f8f848caa7df8c464d67912e.exeurlThreatFox—

CRITICALCVE-2026-85103cveOTX—

CRITICALhttp://62.197.62.195:60001/sshdurlThreatFox—

CRITICALCVE-2026-84869cveOTX—

CRITICALhttps://magistvapk.com.ar/file/magis-celular_vlatest_2.apkurlThreatFox—

CRITICALCVE-2026-76461cveOTX—

HIGHhttp://quiunch.click:6271/profilesurlThreatFox—

CRITICAL107.175.82.242ipOTXUnited States

CRITICAL39.96.203.222ipThreatFoxChina

CRITICAL193.178.159.128ipOTXFrance

CRITICAL45.131.3.38ipThreatFoxTurkey

CRITICAL06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90hashOTX—

CRITICAL64.188.59.224ipThreatFoxThe Netherlands

CRITICAL38e90affe37342ee36917cdc535fe9bf04589afa8430eb8d1ba1016adcfc1878hashOTX—

CRITICALhttp://107.161.168.217/?h=107.161.168.217&p=80&t=tcp&a=w32&stage=trueurlThreatFox—

MEDIUMbsc-dataseed1.ninicoin.iodomainOTX—

HIGHhttps://randombrosdatamines.pages.dev/Random.Project.exeurlThreatFox—

MEDIUMbsc-dataseed4.ninicoin.iodomainOTX—

CRITICAL7f2877c0400dcaf354e7de2848461abd959ad5d56f86d0e69fa7644ffa1287dahashThreatFox—

MEDIUMbsc-dataseed3.defibit.iodomainOTX—

CRITICALc458e443759ea633cde8929b4337726136675141d82251158f973f54008e20achashThreatFox—

MEDIUMbsc-dataseed4.defibit.iodomainOTX—

CRITICAL8630ccb0f78e12c7f7a283d49a34ff465c44ec994c874219d5c03bc7caf71abehashThreatFox—

MEDIUMbsc-dataseed3.ninicoin.iodomainOTX—

CRITICALa1d2d5253ae69788c0ab3ec33ca2cb49fac28a40dcb3526d5ee494877520ce10hashThreatFox—

MEDIUMbsc-dataseed2.ninicoin.iodomainOTX—

CRITICAL4b56b9f267d6dec2aeeb1b93af1acad6332e2fe3a484965bffce5b1fdc8b208ehashThreatFox—

MEDIUMbsc-dataseed2.defibit.iodomainOTX—

CRITICAL42b709ef46d6a65ebc390a70db367d3958652a519496d07b62eed461ecf22e69hashThreatFox—

CRITICALCVE-2026-85102cveOTX—

CRITICALhttp://192.162.199.149/uploads/d0f13ab7f8f848caa7df8c464d67912e.exeurlThreatFox—

CRITICALCVE-2026-85103cveOTX—

CRITICALhttp://62.197.62.195:60001/sshdurlThreatFox—

CRITICALCVE-2026-84869cveOTX—

CRITICALhttps://magistvapk.com.ar/file/magis-celular_vlatest_2.apkurlThreatFox—

CRITICALCVE-2026-76461cveOTX—

HIGHhttp://quiunch.click:6271/profilesurlThreatFox—

CRITICAL107.175.82.242ipOTXUnited States

CRITICAL39.96.203.222ipThreatFoxChina

CRITICAL193.178.159.128ipOTXFrance

CRITICAL45.131.3.38ipThreatFoxTurkey

CRITICAL06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90hashOTX—

CRITICAL64.188.59.224ipThreatFoxThe Netherlands

CRITICAL38e90affe37342ee36917cdc535fe9bf04589afa8430eb8d1ba1016adcfc1878hashOTX—

CRITICALhttp://107.161.168.217/?h=107.161.168.217&p=80&t=tcp&a=w32&stage=trueurlThreatFox—

MEDIUMbsc-dataseed1.ninicoin.iodomainOTX—

HIGHhttps://randombrosdatamines.pages.dev/Random.Project.exeurlThreatFox—

MEDIUMbsc-dataseed4.ninicoin.iodomainOTX—

CRITICAL7f2877c0400dcaf354e7de2848461abd959ad5d56f86d0e69fa7644ffa1287dahashThreatFox—

MEDIUMbsc-dataseed3.defibit.iodomainOTX—

CRITICALc458e443759ea633cde8929b4337726136675141d82251158f973f54008e20achashThreatFox—

MEDIUMbsc-dataseed4.defibit.iodomainOTX—

CRITICAL8630ccb0f78e12c7f7a283d49a34ff465c44ec994c874219d5c03bc7caf71abehashThreatFox—

MEDIUMbsc-dataseed3.ninicoin.iodomainOTX—

CRITICALa1d2d5253ae69788c0ab3ec33ca2cb49fac28a40dcb3526d5ee494877520ce10hashThreatFox—

MEDIUMbsc-dataseed2.ninicoin.iodomainOTX—

CRITICAL4b56b9f267d6dec2aeeb1b93af1acad6332e2fe3a484965bffce5b1fdc8b208ehashThreatFox—

MEDIUMbsc-dataseed2.defibit.iodomainOTX—

CRITICAL42b709ef46d6a65ebc390a70db367d3958652a519496d07b62eed461ecf22e69hashThreatFox—

Critical

High

Medium

Low

Total Active IOCs

191

Geospatial Threat Map

Global·Live

24H Incident Timeline

06131925

11:37

13:37

15:37

17:37

19:37

21:37

23:37

01:37

03:37

05:37

07:37

09:37

low

medium

high

critical

Executive AI Briefing

10:37

Malaysia Threat Posture — live indicators across the feed

RedShark aggregates indicators of compromise from multiple threat-intelligence feeds. The dominant attack vector observed is T1498 Network Denial of Service, with concentrated targeting of Kuala Lumpur and surrounding regions. Real attack severity and timing are mapped onto Malaysian ASN ranges to provide a localised SOC view; the most common indicator types observed are HASH, IP and DOMAIN.

Key Highlights

Top vector: T1498 Network Denial of Service
Most targeted region: Kuala Lumpur
Top sources: multiple threat-intelligence feeds
Hash + IP + Domain dominate the indicator mix

Recommended Actions

Stop unauthorised egress

Enforce DLP rules, monitor large outbound transfers, and disable unnecessary cloud storage / file-sharing endpoints.

MITRET1498

High severity surge

114 high-severity indicators observed. Escalate to Tier-2 review and expand IOC blocklists across firewalls and EDR.

SEVERITYHigh

Geographic concentration in Kuala Lumpur

80 indicators (16.9%) target Kuala Lumpur. Issue a regional CERT-MY advisory and brief local infrastructure operators.

REGIONKuala Lumpur

Update endpoint signatures

Distribute the 169 malicious hashes to AV / EDR vendors and run a retroactive sweep across endpoints.

CONTROLEndpoint

Diversify intelligence sources

Cross-validate signals across multiple threat-intelligence feeds. Avoid single-source bias when triaging high-severity IOCs.

COVERAGEMulti-source

Maintain proactive hardening

Enforce MFA, patch SLAs (critical ≤72h), least-privilege access, and weekly tabletop exercises against the top observed TTPs.

POSTUREBaseline

Rotate exposed credentials

Force credential resets for accounts in regions with a high volume of brute-force / valid-account indicators and audit recent VPN logins.

CONTROLIdentity

Apply network ACLs

Block source ranges feeding the top targeted IPs and rate-limit inbound traffic to Kuala Lumpur edge gateways.

CONTROLNetwork

Most Targeted IPs

MalaysiaLive MY

Target IP	ASN	Region	Incidents	Top Severity	Last Hit
210.48.157.100	AS17971 TM-Sabah	Kota Kinabalu	10	critical	2026-09-27 06:44
202.71.100.50	AS17971 TM-Sabah	Kota Kinabalu	10	critical	2026-09-27 06:44
122.129.125.50	AS24514 GovNet	Cyberjaya	10	critical	2026-09-27 06:44
122.129.121.50	AS24514 GovNet	Putrajaya	9	critical	2026-09-27 06:44
175.141.200.50	AS4788 TM Net	Kuala Lumpur	9	critical	2026-09-27 06:44
203.106.61.108	AS4788 TM Net	Ipoh	8	critical	2026-09-27 07:13
210.48.145.50	AS17971 TM-Sarawak	Miri	8	critical	2026-09-27 06:44
183.171.10.50	AS10030 CelcomDigi	Shah Alam	8	critical	2026-09-27 07:57
180.74.142.126	AS4788 TM Net	Kuala Lumpur	8	critical	2026-09-27 06:44
103.3.20.50	AS10030 CelcomDigi	Kuala Lumpur	8	critical	2026-09-27 07:05
27.125.224.50	AS38466 U Mobile	Kuala Lumpur	8	critical	2026-09-27 06:44
202.168.69.152	AS45410 Allo Technology	Cyberjaya	7	critical	2026-09-27 06:44
49.236.198.50	AS17971 TM-Sabah	Sandakan	7	critical	2026-09-27 06:43
202.185.188.41	AS9930 AIMS Group	Kuala Lumpur	7	high	2026-09-27 06:44
180.74.238.133	AS4788 TM Net	Kuala Terengganu	6	critical	2026-09-27 06:43
124.195.130.50	AS45960 YTL Comms	Kuala Lumpur	6	critical	2026-09-27 06:44
211.25.111.50	AS9930 TIME dotCom	Seremban	6	critical	2026-09-27 06:44
183.78.10.5	AS45960 YTL Comms	Cyberjaya	6	high	09-24 22:09
122.0.30.50	AS23678 MyKris	Kuala Lumpur	5	critical	2026-09-27 07:05
113.211.50.10	AS9534 Maxis	Kuala Lumpur	5	critical	2026-09-27 07:57

Top MITRE Attack Vectors

T1498Network Denial of Service

Impact

T1567Exfiltration Over Web Service

Exfiltration

T1566Phishing

Initial Access

T1059Command and Scripting Interpreter

Execution

T1071Application Layer Protocol

Command and Control

T1486Data Encrypted for Impact

Impact

T1110Brute Force

Credential Access

T1003OS Credential Dumping

Credential Access

T1499Endpoint Denial of Service

Impact

T1190Exploit Public-Facing Application

Initial Access

Recent Indicators of Compromise

Indicator	Type	Severity	IOC Source	Source IP (Attacker)	Target IP (Malaysia)	Target Region	First Seen	Conf.
api.cemg.xyz	domain	high	OTX	—	202.185.188.41	Kuala Lumpur	08-28 02:25	78
CVE-2026-42271	cve	medium	OTX	—	180.74.238.133	Kuala Terengganu	08-27 22:16	62
CVE-2026-48710	cve	medium	OTX	—	203.106.61.108	Ipoh	08-27 22:16	62
CVE-2026-59822	cve	medium	OTX	—	210.48.157.100	Kota Kinabalu	08-27 22:16	62
http://185.62.1.8/mon/mon.zip'	url	medium	OTX	—	210.48.145.50	Miri	08-27 22:16	62
crazyeltonproxy.top	domain	medium	OTX	—	202.179.100.50	Johor Bahru	08-27 22:16	62
1710.rwlp.be	domain	medium	OTX	—	183.171.10.50	Shah Alam	08-27 22:16	62
7e2e036fec2fe7ab4bbd43978d9296563894c92a112f5ac2f39957f12108e245	hash	medium	OTX	—	202.71.100.50	Kota Kinabalu	08-27 22:16	62
ae6c356f1f09260b859f84d994ef8423540a6c0bdf98510d86b85834283e4926	hash	medium	OTX	—	180.74.142.126	Kuala Lumpur	08-27 22:16	62
b77811db4d218c65670a6c9a5b33c30ff81c6d779e15d658643138771178a818	hash	medium	OTX	—	202.71.100.50	Kota Kinabalu	08-27 22:16	62
4309d107af6a23f4a7f841b9148258e1a280b972	hash	medium	OTX	—	103.3.20.50	Kuala Lumpur	08-27 22:16	62
681b57b6bf79ff0fdcfd19633586a6dcd3491651	hash	medium	OTX	—	180.74.142.126	Kuala Lumpur	08-27 22:16	62
www.ac-link.com	domain	medium	OTX	—	122.129.125.50	Cyberjaya	08-27 22:16	62
www.findmyipaddr.com	domain	medium	OTX	—	122.0.30.50	Kuala Lumpur	08-27 22:16	62
bfaeb987faa6de2b5a5eb63b1233d055215b09b0349a9394f2175fd7cdf385e4	hash	medium	OTX	—	180.74.238.133	Kuala Terengganu	08-27 22:16	62
b9993a8ad0518849416798cf29668256ccb96598fc4423501ccab5312812653a	hash	medium	OTX	—	180.74.189.57	Johor Bahru	08-27 22:16	62
24b9ee242f21a73b55f7bb3297eafb33c60840907386b542ed79fc6b72365168	hash	medium	OTX	—	103.3.20.50	Kuala Lumpur	08-27 22:16	62
22bf76fe317ea6769bd38619bd440e42d119bd6b	hash	medium	OTX	—	124.195.130.50	Kuala Lumpur	08-27 22:16	62
c8cb3f6d5b90c46686d2bf531dc1a5786e27edc5	hash	medium	OTX	—	202.185.188.41	Kuala Lumpur	08-27 22:16	62
d602f4eeb914cf32782799376a8c5953	hash	medium	OTX	—	202.71.100.50	Kota Kinabalu	08-27 22:16	62
93d8cffab1171a115228808e526d9bd7fe935e4e	hash	medium	OTX	—	122.129.121.50	Putrajaya	08-27 22:16	62
d8a6b102c1715bd80393ce510931b1f6	hash	medium	OTX	—	103.3.20.50	Kuala Lumpur	08-27 22:16	62
apple-unlock.com	domain	high	OTX	—	124.195.130.50	Kuala Lumpur	08-27 08:04	78
buscar-lphone.com	domain	high	OTX	—	180.74.189.57	Johor Bahru	08-27 08:04	78
suporte-lcloud.com	domain	high	OTX	—	113.211.50.10	Kuala Lumpur	08-27 08:04	78
com-maps.info	domain	high	OTX	—	183.78.10.5	Cyberjaya	08-27 08:04	78
findmy-dispositivos.com	domain	high	OTX	—	183.171.10.50	Shah Alam	08-27 08:04	78
id-ubicacion.com	domain	high	OTX	—	123.136.96.50	Subang Jaya	08-27 08:04	78
findsupport.live	domain	high	OTX	—	202.168.69.152	Cyberjaya	08-27 08:04	78
zu7pl.pro	domain	high	OTX	—	175.141.200.50	Kuala Lumpur	08-27 08:04	78
fileshareapp.org	domain	high	OTX	—	202.71.100.50	Kota Kinabalu	08-26 21:59	78
sharefolders.org	domain	high	OTX	—	124.195.130.50	Kuala Lumpur	08-26 21:59	78
formshare.cloud	domain	high	OTX	—	210.48.157.100	Kota Kinabalu	08-26 21:59	78
drive.google.sharefolders.org	domain	high	OTX	—	210.48.145.50	Miri	08-26 21:59	78
drive.google.formshare.cloud	domain	high	OTX	—	122.129.125.50	Cyberjaya	08-26 21:59	78
usercontent.online	domain	high	OTX	—	49.236.198.50	Sandakan	08-26 21:59	78
drive.google.usercontent.online	domain	high	OTX	—	180.74.189.57	Johor Bahru	08-26 21:59	78
fllefolder.com	domain	high	OTX	—	210.48.157.100	Kota Kinabalu	08-26 21:59	78
CVE-2024-28000	cve	medium	OTX	—	113.23.200.50	Subang Jaya	08-26 17:18	62
fine-work-team.com	domain	medium	OTX	—	27.125.224.50	Kuala Lumpur	08-26 17:18	62
timelevel12.com	domain	medium	OTX	—	183.78.10.5	Cyberjaya	08-26 17:18	62
http://timelevel12.com/big	url	medium	OTX	—	103.3.20.50	Kuala Lumpur	08-26 17:18	62
snake.zooparkko.com	domain	medium	OTX	—	49.236.198.50	Sandakan	08-26 17:18	62
CVE-2023-49105	cve	medium	OTX	—	180.74.238.133	Kuala Terengganu	08-26 17:18	62
10df3451915ea35bcb17efe121415f24182680e2d07fc09df07ee695072104c1	hash	medium	OTX	—	210.48.157.100	Kota Kinabalu	08-26 17:18	62
7447d0d0c34779d4c519823b39bf6ddc16d2b34a226b82ee69da6f5b4a77ad82	hash	medium	OTX	—	49.236.198.50	Sandakan	08-26 17:18	62
contabilidad.icu	domain	high	OTX	—	49.236.198.50	Sandakan	08-26 17:18	78
documentodigital.cloud	domain	high	OTX	—	183.171.10.50	Shah Alam	08-26 17:18	78
getpdfdigital.cloud	domain	high	OTX	—	202.185.188.41	Kuala Lumpur	08-26 17:18	78
soportedigital.cloud	domain	high	OTX	—	113.211.50.10	Kuala Lumpur	08-26 17:18	78