Overview
Indicators of compromise associated with XOR DDoS. 15 indicators listed below.
Not exhaustive, and confidence varies. Always corroborate against your own telemetry before taking action.
| Type | Indicator | First Seen | Confidence |
|---|---|---|---|
| domain | system-patch-node.am | September 29, 2026 | 100% |
| domain | stellar-sync.to | September 29, 2026 | 100% |
| domain | relay-agent-v4.am | September 29, 2026 | 100% |
| domain | proc-mem-status.md | September 29, 2026 | 100% |
| domain | nexus-bridge.to | September 29, 2026 | 100% |
| domain | net-sync-cache.md | September 29, 2026 | 100% |
| domain | metadata-fetcher.vg | September 29, 2026 | 100% |
| domain | legacy-data-stream.su | September 29, 2026 | 100% |
| domain | host-metrics-rev.su | September 29, 2026 | 100% |
| domain | flux-net-node.to | September 29, 2026 | 100% |
| domain | dist-patch-log.vg | September 29, 2026 | 100% |
| domain | db-sync-service.ru | September 29, 2026 | 100% |
| domain | core-sync-io.tj | September 29, 2026 | 100% |
| domain | cloud-init-config.tj | September 29, 2026 | 100% |
| url | http://182.52.51.239/scripts/23 | September 27, 2026 | 90% |
Related content