HackersEye | TGSEC intelligence table

Search indicators, roles or sourcesClassification158 of 158 rows

Indicator	Type	Classification	Cluster	Role	Confidence	Asn	Provider	Observation Window	Recommended Use	Source
45[.]192[.]102[.]149:8899	Host:port	Infrastructure	TGSEC-associated	Reported control/exfil endpoint; repository independently names host	High for commit reference; reported for operational role			Historical; reviewed 2026-11-01	Correlate historical telemetry; validate role before response	HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,10
176[.]122[.]161[.]117	IPv4	Infrastructure	TGSEC-associated	Reported runner / MASTER_URL	Advisory-reported			Historical; reviewed 2026-11-01	Correlate historical telemetry; validate role before response	HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,10
101[.]35[.]246[.]71:18888	Host:port	Infrastructure	TGSEC-associated	Reported game/business API	Advisory-reported			Historical; reviewed 2026-11-01	Correlate historical telemetry; validate role before response	HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,10
154[.]213[.]181[.]207	IPv4	Infrastructure	TGSEC-associated	Reported worker / staging host	Advisory-reported			Historical; reviewed 2026-11-01	Correlate historical telemetry; validate role before response	HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,10
154[.]219[.]127[.]31	IPv4	Infrastructure	TGSEC-associated	Test/operations reference in commit	High for commit reference; reported for operational role			Historical; reviewed 2026-11-01	Correlate historical telemetry; validate role before response	HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,10
exfilacct[.]blob[.]core[.]windows[.]net	Hostname	Infrastructure	TGSEC-associated	Reported exfil storage hostname	Advisory-reported			Historical; reviewed 2026-11-01	Correlate historical telemetry; validate role before response	HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,10
103[.]109[.]21[.]198:22	Host:port	Infrastructure	TGSEC-associated	Historical SSH relay fleet entry; credentials withheld	High for repository association	AS4816	China Telecom Guangdong	Historical; reviewed 2026-11-01	Correlate historical telemetry; validate role before response	HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 9
43[.]240[.]221[.]227:22	Host:port	Infrastructure	TGSEC-associated	Historical SSH relay fleet entry; credentials withheld	High for repository association	AS58519	China Telecom Ctcloud	Historical; reviewed 2026-11-01	Correlate historical telemetry; validate role before response	HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 9
124[.]248[.]67[.]181:22	Host:port	Infrastructure	TGSEC-associated	Historical SSH relay fleet entry; credentials withheld	High for repository association	AS58461	China Telecom Hangzhou IDC	Historical; reviewed 2026-11-01	Correlate historical telemetry; validate role before response	HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 9
110[.]42[.]103[.]114:56102	Host:port	Infrastructure	TGSEC-associated	Historical SSH relay fleet entry; credentials withheld	High for repository association	AS136188	China Telecom Ningbo IDC	Historical; reviewed 2026-11-01	Correlate historical telemetry; validate role before response	HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 9
154[.]38[.]99[.]69	IPv4	Infrastructure	TGSEC-associated	historical operator-declared own infrastructure	High in engagement report; original excerpt reviewed	AS18186	Nebula Global LLC	Historical; reviewed 2026-11-01	Correlate historical telemetry; validate role before response	HackersEye preserved IOC evidence, sections 9
38[.]182[.]151[.]3	IPv4	Infrastructure	TGSEC-associated	historical operator-declared own infrastructure	High in engagement report; original excerpt reviewed	AS18186	Nebula Global LLC	Historical; reviewed 2026-11-01	Correlate historical telemetry; validate role before response	HackersEye preserved IOC evidence, sections 9
95[.]169[.]6[.]12	IPv4	Infrastructure	TGSEC-associated	historical operator-declared own infrastructure	High in engagement report; original excerpt reviewed	AS25820	IT7 Networks	Historical; reviewed 2026-11-01	Correlate historical telemetry; validate role before response	HackersEye preserved IOC evidence, sections 9
8[.]130[.]150[.]18	IPv4	Infrastructure	TGSEC-associated / 95306	Repository-listed collector shard 10; Inner Mongolia label; SSH port 22. Labels are not verified geolocation.; previously an associated cloud-host lead	High for pinned source listing; current deployment unverified	AS37963	Alibaba Cloud	Pinned repository snapshot; user captures supplied 2026-11-01	Historical log correlation; association does not establish current control or a particular intrusion	Preserved repository maintenance record; reviewed 1 November 2026
39[.]96[.]146[.]230	IPv4	Infrastructure	TGSEC-associated / 95306	Repository-listed collector shard 8; Beijing label; SSH port 22. Labels are not verified geolocation.; previously an associated cloud-host lead	High for pinned source listing; current deployment unverified	AS37963	Alibaba Cloud	Pinned repository snapshot; user captures supplied 2026-11-01	Historical log correlation; association does not establish current control or a particular intrusion	Preserved repository maintenance record; reviewed 1 November 2026
39[.]108[.]87[.]206	IPv4	Associated / review	TGSEC-associated	associated host; role unconfirmed	Medium in engagement report	AS37963	Alibaba Cloud	Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 9
101[.]35[.]246[.]71	IPv4	Associated / review	TGSEC-associated	associated host; role unconfirmed	Medium in engagement report	AS45090	Tencent Cloud	Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 9
188[.]239[.]11[.]127	IPv4	Associated / review	TGSEC-associated	associated host; role unconfirmed	Medium in engagement report	AS136907	Huawei Cloud	Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 9
61[.]136[.]78[.]115	IPv4	Associated / review	TGSEC-associated	associated host; role unconfirmed	Medium in engagement report	AS4837	China Unicom	Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 9
aigc[.]kartai88[.]com	Domain	Associated / review	TGSEC-associated	review-only lead; not confirmed malicious	Low/review			Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 9
aigc[.]umi6[.]com	Domain	Associated / review	TGSEC-associated	review-only lead; not confirmed malicious	Low/review			Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 9
api[.]wallet8[.]top	Domain	Associated / review	TGSEC-associated	review-only lead; not confirmed malicious	Low/review			Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 9
apixx5daguo[.]cc	Domain	Associated / review	TGSEC-associated	review-only lead; not confirmed malicious	Low/review			Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 9
130[.]94[.]252[.]223:54565	Host:port	Shared service / egress	TGSEC-associated	SOCKS proxy	Reported			Historical; reviewed 2026-11-01	Hunt in context; do not blanket-block	HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,4,10
130[.]94[.]254[.]199:54565	Host:port	Shared service / egress	TGSEC-associated	SOCKS proxy	Reported			Historical; reviewed 2026-11-01	Hunt in context; do not blanket-block	HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,4,10
61[.]15[.]103[.]171	IPv4	Shared service / egress	TGSEC-associated	Proxy/backend-reach reference	Reported			Historical; reviewed 2026-11-01	Hunt in context; do not blanket-block	HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,4,10
194[.]90[.]31[.]172	IPv4	Shared service / egress	TGSEC-associated	Dual-role reference: egress and target backend; resolve context	Reported			Historical; reviewed 2026-11-01	Hunt in context; do not blanket-block	HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,4,10
Brightdata IL residential	Service	Shared service / egress	TGSEC-associated	Commercial proxy service	Reported			Historical; reviewed 2026-11-01	Hunt in context; do not blanket-block	HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,4,10
ProxyRack IL	Service	Shared service / egress	TGSEC-associated	Commercial proxy service	Reported			Historical; reviewed 2026-11-01	Hunt in context; do not blanket-block	HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,4,10
api[.]ez-captcha[.]com	Domain	Shared service / egress	TGSEC-associated	Captcha solving API	Reported			Historical; reviewed 2026-11-01	Hunt in context; do not blanket-block	HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,4,10
ez-captcha[.]com	Domain	Shared service / egress	TGSEC-associated	Captcha solving service	Reported			Historical; reviewed 2026-11-01	Hunt in context; do not blanket-block	HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,4,10
77[.]107[.]99[.]203	IPv4	Associated / review	TGSEC-associated	Other-engagement egress, jump or panel reference; ownership unconfirmed	Medium in source; role unconfirmed			Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 3
185[.]22[.]60[.]103	IPv4	Associated / review	TGSEC-associated	Other-engagement egress, jump or panel reference; ownership unconfirmed	Medium in source; role unconfirmed			Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 3
70[.]39[.]130[.]220	IPv4	Associated / review	TGSEC-associated	Other-engagement egress, jump or panel reference; ownership unconfirmed	Medium in source; role unconfirmed			Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 3
113[.]25[.]1[.]167	IPv4	Associated / review	TGSEC-associated	Other-engagement egress, jump or panel reference; ownership unconfirmed	Medium in source; role unconfirmed			Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 3
118[.]73[.]70[.]32	IPv4	Associated / review	TGSEC-associated	Other-engagement egress, jump or panel reference; ownership unconfirmed	Medium in source; role unconfirmed			Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 3
14[.]119[.]66[.]81:30901	Host:port	Associated / review	TGSEC-associated	Other-engagement egress, jump or panel reference; ownership unconfirmed	Medium in source; role unconfirmed			Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 3
194[.]5[.]82[.]160	IPv4	Associated / review	TGSEC-associated	Other-engagement egress, jump or panel reference; ownership unconfirmed	Medium in source; role unconfirmed			Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 3
194[.]5[.]82[.]141	IPv4	Associated / review	TGSEC-associated	Other-engagement egress, jump or panel reference; ownership unconfirmed	Medium in source; role unconfirmed			Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 3
194[.]5[.]82[.]143	IPv4	Associated / review	TGSEC-associated	Other-engagement egress, jump or panel reference; ownership unconfirmed	Medium in source; role unconfirmed			Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 3
212[.]107[.]29[.]198	IPv4	Associated / review	TGSEC-associated	Other-engagement egress, jump or panel reference; ownership unconfirmed	Medium in source; role unconfirmed			Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 3
212[.]107[.]29[.]199	IPv4	Associated / review	TGSEC-associated	Other-engagement egress, jump or panel reference; ownership unconfirmed	Medium in source; role unconfirmed			Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 3
65[.]49[.]217[.]168	IPv4	Associated / review	TGSEC-associated	Other-engagement egress, jump or panel reference; ownership unconfirmed	Medium in source; role unconfirmed			Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 3
187[.]15[.]94[.]9	IPv4	Associated / review	TGSEC-associated	Other-engagement egress, jump or panel reference; ownership unconfirmed	Medium in source; role unconfirmed			Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 3
47[.]108[.]106[.]137	IPv4	Associated / review	TGSEC-associated	Other-engagement egress, jump or panel reference; ownership unconfirmed	Medium in source; role unconfirmed			Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 3
154[.]83[.]86[.]183	IPv4	Associated / review	TGSEC-associated	Other-engagement egress, jump or panel reference; ownership unconfirmed	Medium in source; role unconfirmed			Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 3
103[.]244[.]91[.]81	IPv4	Associated / review	TGSEC-associated	Other-engagement egress, jump or panel reference; ownership unconfirmed	Medium in source; role unconfirmed			Historical; reviewed 2026-11-01	Review only; role unconfirmed	HackersEye preserved IOC evidence, sections 3
github[.]com/lanyz1	Account	Identity / distribution	TGSEC-associated	Primary repository owner; GitHub ID 189613774	Observed label / source-reported role			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10
github[.]com/lanyz1/TGSEC-Qtzuu	Repository	Identity / distribution	TGSEC-associated	Knowledge/skill collection	Observed label / source-reported role			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10
github[.]com/lanyz1/Qtzuu-pentest-toolbox	Repository	Identity / distribution	TGSEC-associated	Skill framework	Observed label / source-reported role			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10
github[.]com/lanyz1/haidaochuan	Repository	Identity / distribution	TGSEC-associated	Release/update channel	Observed label / source-reported role			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10
github[.]com/lanyz1/haidaochuan/releases/tag/v1[.]0[.]14	Release	Identity / distribution	TGSEC-associated	ARTEX and toolkit co-distribution	Observed label / source-reported role			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10
guaixiaobei1@foxmail[.]com	Email	Identity / distribution	TGSEC-associated	Commit author label; not proof of real identity	Observed label / source-reported role			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10
tgsec@tgsec[.]com	Email	Identity / distribution	TGSEC-associated	Commit organization label	Observed label / source-reported role			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10
tgsec[.]com	Domain	Identity / distribution	TGSEC-associated	Organization-domain reference; domain registration does not establish campaign control	Observed label / source-reported role			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10
lanyz1@users[.]noreply[.]github[.]com	Email	Identity / distribution	TGSEC-associated	Commit noreply label	Observed label / source-reported role			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10
TGSEC-Qtzuu@users[.]noreply[.]github[.]com	Email	Identity / distribution	TGSEC-associated	Commit noreply label	Observed label / source-reported role			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10
ser596830521118	Hostname	Identity / distribution	TGSEC-associated	Committer-hostname artifact	Observed label / source-reported role			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10
root@ser596830521118[.]local	Email artifact	Identity / distribution	TGSEC-associated	Committer label; not an authenticated identity	Observed label / source-reported role			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10
t[.]me/pixshujubot	Telegram handle	Identity / distribution	TGSEC-associated	Delivery-bot reference; source-reported role	Observed label / source-reported role			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10
8753396940	Telegram bot ID	Identity / distribution	TGSEC-associated	Reported loot-sync / gambling-bot association	Observed label / source-reported role			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10
okayngpc28bot	Telegram handle	Identity / distribution	TGSEC-associated	Reported bot handle	Observed label / source-reported role			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10
NYJTPC20BOT	Telegram handle	Identity / distribution	TGSEC-associated	Reported sibling bot	Observed label / source-reported role			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10
t[.]me/nuoya918	Telegram handle	Identity / distribution	TGSEC-associated	Reported settlement/cashier reference	Observed label / source-reported role			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10
github[.]com/lettiad9321	Account	Identity / distribution	TGSEC-associated	Captured redistribution owner; no common-control conclusion	High for captured presence; ownership unresolved			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	Preserved repository, profile and commit records; reviewed 1 November 2026
github[.]com/mirjkb	Account	Identity / distribution	TGSEC-associated	Captured redistribution owner; no common-control conclusion	High for captured presence; ownership unresolved			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	Preserved repository, profile and commit records; reviewed 1 November 2026
github[.]com/peiqi886	Account	Identity / distribution	TGSEC-associated	Captured redistribution owner; no common-control conclusion	High for captured presence; ownership unresolved			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	Preserved repository, profile and commit records; reviewed 1 November 2026
github[.]com/tolinke	Account	Identity / distribution	TGSEC-associated	Captured redistribution owner; no common-control conclusion	High for captured presence; ownership unresolved			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	Preserved repository, profile and commit records; reviewed 1 November 2026
github[.]com/yu994419160	Account	Identity / distribution	TGSEC-associated	Captured redistribution owner; no common-control conclusion	High for captured presence; ownership unresolved			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	Preserved repository, profile and commit records; reviewed 1 November 2026
github[.]com/Yufeifeio	Account	Identity / distribution	TGSEC-associated	Captured redistribution owner; no common-control conclusion	High for captured presence; ownership unresolved			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	Preserved repository, profile and commit records; reviewed 1 November 2026
github[.]com/a15846	Account	Identity / distribution	TGSEC-associated	Captured redistribution owner; no common-control conclusion	High for captured presence; ownership unresolved			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	Preserved repository, profile and commit records; reviewed 1 November 2026
github[.]com/fakedon	Account	Identity / distribution	TGSEC-associated	Captured redistribution owner; no common-control conclusion	High for captured presence; ownership unresolved			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	Preserved repository, profile and commit records; reviewed 1 November 2026
github[.]com/huasheng505	Account	Identity / distribution	TGSEC-associated	Captured redistribution owner; no common-control conclusion	High for captured presence; ownership unresolved			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	Preserved repository, profile and commit records; reviewed 1 November 2026
github[.]com/j2580133-wq	Account	Identity / distribution	TGSEC-associated	Captured redistribution owner; no common-control conclusion	High for captured presence; ownership unresolved			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	Preserved repository, profile and commit records; reviewed 1 November 2026
github[.]com/ksamabir980-svg	Account	Identity / distribution	TGSEC-associated	Captured redistribution owner; no common-control conclusion	High for captured presence; ownership unresolved			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	Preserved repository, profile and commit records; reviewed 1 November 2026
github[.]com/qinian11	Account	Identity / distribution	TGSEC-associated	Captured redistribution owner; no common-control conclusion	High for captured presence; ownership unresolved			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	Preserved repository, profile and commit records; reviewed 1 November 2026
github[.]com/sumingfine	Account	Identity / distribution	TGSEC-associated	Captured redistribution owner; no common-control conclusion	High for captured presence; ownership unresolved			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	Preserved repository, profile and commit records; reviewed 1 November 2026
github[.]com/wudongzi10-spec	Account	Identity / distribution	TGSEC-associated	Captured redistribution owner; no common-control conclusion	High for captured presence; ownership unresolved			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	Preserved repository, profile and commit records; reviewed 1 November 2026
github[.]com/xivvixen	Account	Identity / distribution	TGSEC-associated	Captured redistribution owner; no common-control conclusion	High for captured presence; ownership unresolved			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	Preserved repository, profile and commit records; reviewed 1 November 2026
github[.]com/yanbozhao854-dot	Account	Identity / distribution	TGSEC-associated	Captured redistribution owner; no common-control conclusion	High for captured presence; ownership unresolved			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	Preserved repository, profile and commit records; reviewed 1 November 2026
github[.]com/yu7777777777	Account	Identity / distribution	TGSEC-associated	Captured redistribution owner; no common-control conclusion	High for captured presence; ownership unresolved			Historical; reviewed 2026-11-01	Attribution or download pivot; does not prove account control	Preserved repository, profile and commit records; reviewed 1 November 2026
89a5acb10db8f00385c07c0e8b1a1184fc855e94c74a81efc9cd3e3e42541dfa	SHA-256	Artifact / behavior	TGSEC-associated	artex-1.0.14-darwin-amd64.zip; archive digest, not extracted executable	High for captured digest			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §13; release metadata
d9e05c19b39fb049d52c2009414d09dfbc7e803118ae5e37b0f906a6dea8131d	SHA-256	Artifact / behavior	TGSEC-associated	artex-1.0.14-darwin-arm64.zip; archive digest, not extracted executable	High for captured digest			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §13; release metadata
6678fb8e7354ecc51a7ef73aa4b8b5ecf625aa789de98e3503ea8b3046178c1d	SHA-256	Artifact / behavior	TGSEC-associated	artex-1.0.14-linux-amd64.zip; archive digest, not extracted executable	High for captured digest			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §13; release metadata
576788cc404e6bba20f271b9f822dce98c2c532f93c0dc48a02de1cee7a4794f	SHA-256	Artifact / behavior	TGSEC-associated	artex-1.0.14-linux-arm64.zip; archive digest, not extracted executable	High for captured digest			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §13; release metadata
cecffd1834ea6623a5a37f9023dfcdbae7be71a0a910cd8b8833203fe2017bea	SHA-256	Artifact / behavior	TGSEC-associated	artex-1.0.14-windows-amd64.zip; archive digest, not extracted executable	High for captured digest			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §13; release metadata
521cfb16b3b35546a0aac8cdfa081f5bf79adc0f890663a9e5a1d0a4b6d7712b	SHA-256	Artifact / behavior	TGSEC-associated	TGSEC-toolkit-1.0.13-simple.zip; archive digest, not extracted executable	High for captured digest			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §13; release metadata
norma/0.4	Artifact / pattern	Artifact / behavior	TGSEC-associated	Reported ARTEX user-agent	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
artex-selfupdate	Artifact / pattern	Artifact / behavior	TGSEC-associated	Reported updater user-agent	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
/artex-*	Artifact / pattern	Artifact / behavior	TGSEC-associated	Reported probe-path pattern	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
AI.HackTool.ARTEX	Artifact / pattern	Artifact / behavior	TGSEC-associated	Vendor detection name	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
guangxi_police_cert.py	Artifact / pattern	Artifact / behavior	TGSEC-associated	Reported certificate/signing-tool filename; no signing key included	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
abraxas	Artifact / pattern	Artifact / behavior	TGSEC-associated	Reported exploit-pipeline name; not a unique malware indicator	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
OKPay	Artifact / pattern	Artifact / behavior	TGSEC-associated	Reported payment/workflow reference; not itself malicious	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
Noah Group	Artifact / pattern	Artifact / behavior	TGSEC-associated	Reported gambling-brand reference	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
/root/.fleet_creds	Artifact / pattern	Artifact / behavior	TGSEC-associated	Reported credential-store path; no values	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
/root/mjump	Artifact / pattern	Artifact / behavior	TGSEC-associated	Reported runner directory	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
mjump.py	Artifact / pattern	Artifact / behavior	TGSEC-associated	Multi-host runner filename	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
*ForTest	Artifact / pattern	Artifact / behavior	TGSEC-associated	Reported test-field pattern	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
x-thor-error-code	Artifact / pattern	Artifact / behavior	TGSEC-associated	Proxy response-header clue	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
/tmp/lyc_loot/	Artifact / pattern	Artifact / behavior	TGSEC-associated	Reported staging directory	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
/nacos_cfg/	Artifact / pattern	Artifact / behavior	TGSEC-associated	Reported configuration collection path	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
yzc-fileupload	Artifact / pattern	Artifact / behavior	TGSEC-associated	Reported object-store bucket name	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
kk8-tma-gambling	Artifact / pattern	Artifact / behavior	TGSEC-associated	Target-related skill/platform label	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
CLAUDE.md	Artifact / pattern	Artifact / behavior	TGSEC-associated	Agent instruction entry file; legitimate filename, not a standalone IOC	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
AGENTS.md	Artifact / pattern	Artifact / behavior	TGSEC-associated	Agent instruction entry file; legitimate filename, not a standalone IOC	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
.cursorrules	Artifact / pattern	Artifact / behavior	TGSEC-associated	Agent instruction entry file; legitimate filename	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
.aider.conf.yml	Artifact / pattern	Artifact / behavior	TGSEC-associated	Agent configuration filename; legitimate filename	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
.claude/skills/	Artifact / pattern	Artifact / behavior	TGSEC-associated	Skill-registration directory; legitimate path	Context only			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13
38[.]244[.]50[.]120:18899	Host:port	Infrastructure	South Korea finance	Reported host/open directory	Advisory synthesis; role not revalidated			Historical; reviewed 2026-11-01	Correlate historical telemetry; validate role before response	HackersEye advisory HE-TI-ADV-2026-11-01 §13; preserved IOC evidence, sections 10
154[.]201[.]79[.]246	IPv4	Shared service / egress	South Korea finance	Reported proxy API	Advisory synthesis; role not revalidated			Historical; reviewed 2026-11-01	Hunt in context; do not blanket-block	HackersEye advisory HE-TI-ADV-2026-11-01 §13; preserved IOC evidence, sections 10
205[.]214[.]59[.]31	IPv4	Shared service / egress	South Korea finance	Reported proxy API	Advisory synthesis; role not revalidated			Historical; reviewed 2026-11-01	Hunt in context; do not blanket-block	HackersEye advisory HE-TI-ADV-2026-11-01 §13; preserved IOC evidence, sections 10
xcai[.]pro/v1	URL	Shared service / egress	South Korea finance	Reported LLM gateway	Advisory synthesis; role not revalidated			Historical; reviewed 2026-11-01	Hunt in context; do not blanket-block	HackersEye advisory HE-TI-ADV-2026-11-01 §13; preserved IOC evidence, sections 10
144[.]172[.]64[.]99	IPv4	Infrastructure	Storm-0940	Sign-in / Graph infrastructure	Vendor telemetry			October 2026; vendor report 2026-10-21	Correlate historical telemetry; validate role before response	Microsoft cloud-identity investigation, 21 October 2026 (HE-R03)
144[.]172[.]64[.]128	IPv4	Infrastructure	Storm-0940	Sign-in / Graph infrastructure	Vendor telemetry			October 2026; vendor report 2026-10-21	Correlate historical telemetry; validate role before response	Microsoft cloud-identity investigation, 21 October 2026 (HE-R03)
144[.]172[.]64[.]60	IPv4	Infrastructure	Storm-0940	Sign-in / Graph infrastructure	Vendor telemetry			October 2026; vendor report 2026-10-21	Correlate historical telemetry; validate role before response	Microsoft cloud-identity investigation, 21 October 2026 (HE-R03)
187[.]15[.]88[.]186	IPv4	Shared service / egress	Storm-0940	Transient VPN address observed with affected apps	Vendor telemetry			2026-10-15 to 2026-10-16	Hunt in context; do not blanket-block	Microsoft cloud-identity investigation, 21 October 2026 (HE-R03)
187[.]15[.]90[.]217	IPv4	Shared service / egress	Storm-0940	Transient VPN address observed with affected apps	Vendor telemetry			2026-10-15 to 2026-10-16	Hunt in context; do not blanket-block	Microsoft cloud-identity investigation, 21 October 2026 (HE-R03)
187[.]15[.]89[.]186	IPv4	Shared service / egress	Storm-0940	Transient VPN address observed with affected apps	Vendor telemetry			2026-10-15 to 2026-10-16	Hunt in context; do not blanket-block	Microsoft cloud-identity investigation, 21 October 2026 (HE-R03)
506e08f9-6e9a-4da4-942b-a099a03644ae	Application ID	Artifact / behavior	Storm-0940	remote-management supplier Cloud Backup; legitimate app identity reportedly abused	Verified full ID from vendor			Historical; reviewed 2026-11-01	Review app permissions, sign-ins and Graph activity; presence alone is not abuse	Microsoft cloud-identity investigation, 21 October 2026 (HE-R03)
24205314-2b89-4e07-a2a4-579e898a5640	Application ID	Artifact / behavior	Storm-0940	remote-management supplier MS Teams; legitimate app identity reportedly abused	Verified full ID from vendor			Historical; reviewed 2026-11-01	Review app permissions, sign-ins and Graph activity; presence alone is not abuse	Microsoft cloud-identity investigation, 21 October 2026 (HE-R03)
0de14c77-b9b0-4137-9360-34878a929827	Application ID	Artifact / behavior	Storm-0940	remote-management supplier MS Graph; legitimate app identity reportedly abused	Verified full ID from vendor			Historical; reviewed 2026-11-01	Review app permissions, sign-ins and Graph activity; presence alone is not abuse	Microsoft cloud-identity investigation, 21 October 2026 (HE-R03)
156[.]240[.]236[.]28	IPv4	Infrastructure	Hong Kong / Ultra Suite	Reported HK-cluster indicator	Advisory synthesis; role not revalidated			Historical; reviewed 2026-11-01	Correlate historical telemetry; validate role before response	HackersEye advisory HE-TI-ADV-2026-11-01 §13; preserved IOC evidence, sections 10
156[.]240[.]236[.]27	IPv4	Infrastructure	Hong Kong / Ultra Suite	Reported HK-cluster indicator	Advisory synthesis; role not revalidated			Historical; reviewed 2026-11-01	Correlate historical telemetry; validate role before response	HackersEye advisory HE-TI-ADV-2026-11-01 §13; preserved IOC evidence, sections 10
156[.]240[.]236[.]14	IPv4	Infrastructure	Hong Kong / Ultra Suite	Reported HK-cluster indicator	Advisory synthesis; role not revalidated			Historical; reviewed 2026-11-01	Correlate historical telemetry; validate role before response	HackersEye advisory HE-TI-ADV-2026-11-01 §13; preserved IOC evidence, sections 10
gladdaily[.]vip	Domain	Infrastructure	Hong Kong / Ultra Suite	Reported HK-cluster indicator	Advisory synthesis; role not revalidated			Historical; reviewed 2026-11-01	Correlate historical telemetry; validate role before response	HackersEye advisory HE-TI-ADV-2026-11-01 §13; preserved IOC evidence, sections 10
Thordata:6666	Service / port	Shared service / egress	Hong Kong / Ultra Suite	Shared residential proxy reference	Advisory synthesis			Historical; reviewed 2026-11-01	Hunt in context; do not blanket-block	HackersEye advisory HE-TI-ADV-2026-11-01 §13
31[.]59[.]92[.]155	IPv4	Associated / review	Japan / AI-tool abuse	Case E source address across AI pentest-tool abuse; specific tool/actor not assigned	CERT-reported observation			2026-10-04 to 2026-10-20 JST	Historical log correlation; may now be legitimately used	https://www.jpcert.or.jp/at/2026/at260030.html Case E
31[.]56[.]206[.]187	IPv4	Associated / review	Japan / AI-tool abuse	Case E source address across AI pentest-tool abuse; specific tool/actor not assigned	CERT-reported observation			2026-09-27 to 2026-10-20 JST	Historical log correlation; may now be legitimately used	https://www.jpcert.or.jp/at/2026/at260030.html Case E
38[.]244[.]50[.]120	IPv4	Associated / review	Japan / AI-tool abuse	Case E source address across AI pentest-tool abuse; specific tool/actor not assigned	CERT-reported observation			Not specified by JPCERT/CC JST	Historical log correlation; may now be legitimately used	https://www.jpcert.or.jp/at/2026/at260030.html Case E
46[.]8[.]227[.]73	IPv4	Associated / review	Japan / AI-tool abuse	Case E source address across AI pentest-tool abuse; specific tool/actor not assigned	CERT-reported observation			2026-09-27 to 2026-10-19 JST	Historical log correlation; may now be legitimately used	https://www.jpcert.or.jp/at/2026/at260030.html Case E
64[.]44[.]24[.]195	IPv4	Associated / review	Japan / AI-tool abuse	Case E source address across AI pentest-tool abuse; specific tool/actor not assigned	CERT-reported observation			From 2026-10-15 JST	Historical log correlation; may now be legitimately used	https://www.jpcert.or.jp/at/2026/at260030.html Case E
94[.]183[.]184[.]98	IPv4	Associated / review	Japan / AI-tool abuse	Case E source address across AI pentest-tool abuse; specific tool/actor not assigned	CERT-reported observation			2026-10-13 to 2026-10-19 JST	Historical log correlation; may now be legitimately used	https://www.jpcert.or.jp/at/2026/at260030.html Case E
94[.]183[.]184[.]254	IPv4	Associated / review	Japan / AI-tool abuse	Case E source address across AI pentest-tool abuse; specific tool/actor not assigned	CERT-reported observation			2026-10-03 to 2026-10-20 JST	Historical log correlation; may now be legitimately used	https://www.jpcert.or.jp/at/2026/at260030.html Case E
95[.]182[.]99[.]112	IPv4	Associated / review	Japan / AI-tool abuse	Case E source address across AI pentest-tool abuse; specific tool/actor not assigned	CERT-reported observation			2026-10-04 to 2026-10-19 JST	Historical log correlation; may now be legitimately used	https://www.jpcert.or.jp/at/2026/at260030.html Case E
176[.]65[.]144[.]71	IPv4	Associated / review	Japan / AI-tool abuse	Case E source address across AI pentest-tool abuse; specific tool/actor not assigned	CERT-reported observation			2026-09-23 to 2026-10-17 JST	Historical log correlation; may now be legitimately used	https://www.jpcert.or.jp/at/2026/at260030.html Case E
github[.]com/Autumn-27	Account	Framework provenance	Framework ecosystem; not actor attribution	Original ARTEX author; not attributed as a campaign operator	Advisory context			Historical; reviewed 2026-11-01	Tool provenance only; do not infer compromise, malice or common control	HackersEye advisory HE-TI-ADV-2026-11-01 §§2,13
github[.]com/Autumn-27/norma	Repository	Framework provenance	Framework ecosystem; not actor attribution	Agent-harness dependency v0.4.3 in surviving source	Source-reported lineage; dependency checked in primary source			Historical; reviewed 2026-11-01	Tool provenance only; do not infer compromise, malice or common control	HackersEye advisory HE-TI-ADV-2026-11-01 §§2,13
github[.]com/Hinln/ARTEX	Repository	Framework provenance	Framework ecosystem; not actor attribution	Reported source backup; not actor ownership	Advisory context			Historical; reviewed 2026-11-01	Tool provenance only; do not infer compromise, malice or common control	HackersEye advisory HE-TI-ADV-2026-11-01 §§2,13
github[.]com/BaaRai/ARTEX	Repository	Framework provenance	Framework ecosystem; not actor attribution	Reported translated build; not actor ownership	Advisory context			Historical; reviewed 2026-11-01	Tool provenance only; do not infer compromise, malice or common control	HackersEye advisory HE-TI-ADV-2026-11-01 §§2,13
github[.]com/2561769445/ycode-auto-pentest	Repository	Framework provenance	Framework ecosystem; not actor attribution	Reported downstream variant; not actor ownership	Advisory context			Historical; reviewed 2026-11-01	Tool provenance only; do not infer compromise, malice or common control	HackersEye advisory HE-TI-ADV-2026-11-01 §§2,13
github[.]com/Gollum-code/artex	Repository	Framework provenance	Framework ecosystem; not actor attribution	Reported scanner/coverage variant; not actor ownership	Advisory context			Historical; reviewed 2026-11-01	Tool provenance only; do not infer compromise, malice or common control	HackersEye advisory HE-TI-ADV-2026-11-01 §§2,13
artex-demo[.]vercel[.]app	Hostname	Framework provenance	Framework ecosystem; not actor attribution	Reported public demonstration console; not confirmed malicious	Advisory context			Historical; reviewed 2026-11-01	Tool provenance only; do not infer compromise, malice or common control	HackersEye advisory HE-TI-ADV-2026-11-01 §§2,13
e06c4968b920c2d47c9057813ac36c88cf56b3a052662ef6b00f270c9b4a0464	SHA-256	Artifact / behavior	TGSEC-associated	SHA256SUMS manifest-file digest; not an executable	High for captured digest			Historical; reviewed 2026-11-01	Contextual hunt; not unique to this actor	HackersEye advisory HE-TI-ADV-2026-11-01 §13; preserved release metadata
8[.]133[.]188[.]178	IPv4	Infrastructure	TGSEC-associated / 95306	Repository-listed collector shard 0; Shanghai label; SSH port 22. Labels are not verified geolocation.	High for pinned source listing; current deployment unverified			Pinned repository snapshot; user captures supplied 2026-11-01	Historical log correlation; association does not establish current control or a particular intrusion	Preserved repository maintenance record; reviewed 1 November 2026
114[.]66[.]40[.]208:25175	Host:port	Infrastructure	TGSEC-associated / 95306	Repository-listed collector shard 1; Ningbo label; SSH port 25175. Labels are not verified geolocation.	High for pinned source listing; current deployment unverified			Pinned repository snapshot; user captures supplied 2026-11-01	Historical log correlation; association does not establish current control or a particular intrusion	Preserved repository maintenance record; reviewed 1 November 2026
8[.]138[.]236[.]124	IPv4	Infrastructure	TGSEC-associated / 95306	Repository-listed collector shard 2; Guangzhou label; SSH port 22. Labels are not verified geolocation.	High for pinned source listing; current deployment unverified			Pinned repository snapshot; user captures supplied 2026-11-01	Historical log correlation; association does not establish current control or a particular intrusion	Preserved repository maintenance record; reviewed 1 November 2026
47[.]108[.]152[.]60	IPv4	Infrastructure	TGSEC-associated / 95306	Repository-listed collector shard 3; Chengdu label; SSH port 22. Labels are not verified geolocation.	High for pinned source listing; current deployment unverified			Pinned repository snapshot; user captures supplied 2026-11-01	Historical log correlation; association does not establish current control or a particular intrusion	Preserved repository maintenance record; reviewed 1 November 2026
8[.]133[.]212[.]134	IPv4	Infrastructure	TGSEC-associated / 95306	Repository-listed collector shard 4; Shanghai label; SSH port 22. Labels are not verified geolocation.	High for pinned source listing; current deployment unverified			Pinned repository snapshot; user captures supplied 2026-11-01	Historical log correlation; association does not establish current control or a particular intrusion	Preserved repository maintenance record; reviewed 1 November 2026
47[.]108[.]173[.]230	IPv4	Infrastructure	TGSEC-associated / 95306	Repository-listed collector shard 5; Chengdu label; SSH port 22. Labels are not verified geolocation.	High for pinned source listing; current deployment unverified			Pinned repository snapshot; user captures supplied 2026-11-01	Historical log correlation; association does not establish current control or a particular intrusion	Preserved repository maintenance record; reviewed 1 November 2026
47[.]104[.]139[.]212	IPv4	Infrastructure	TGSEC-associated / 95306	Repository-listed collector shard 6; Qingdao label; SSH port 22. Labels are not verified geolocation.	High for pinned source listing; current deployment unverified			Pinned repository snapshot; user captures supplied 2026-11-01	Historical log correlation; association does not establish current control or a particular intrusion	Preserved repository maintenance record; reviewed 1 November 2026
47[.]107[.]124[.]62	IPv4	Infrastructure	TGSEC-associated / 95306	Repository-listed collector shard 7; Shenzhen label; SSH port 22. Labels are not verified geolocation.	High for pinned source listing; current deployment unverified			Pinned repository snapshot; user captures supplied 2026-11-01	Historical log correlation; association does not establish current control or a particular intrusion	Preserved repository maintenance record; reviewed 1 November 2026
47[.]122[.]107[.]121	IPv4	Infrastructure	TGSEC-associated / 95306	Repository-listed collector shard 9; Wuhan label; SSH port 22. Labels are not verified geolocation.	High for pinned source listing; current deployment unverified			Pinned repository snapshot; user captures supplied 2026-11-01	Historical log correlation; association does not establish current control or a particular intrusion	Preserved repository maintenance record; reviewed 1 November 2026
47[.]115[.]204[.]175	IPv4	Infrastructure	TGSEC-associated / 95306	Repository-listed collector shard 11; Source label; SSH port 22. Labels are not verified geolocation.	High for pinned source listing; current deployment unverified			Pinned repository snapshot; user captures supplied 2026-11-01	Historical log correlation; association does not establish current control or a particular intrusion	Preserved repository maintenance record; reviewed 1 November 2026
/data_pool	Artifact / path	Artifact / behavior	TGSEC-associated / 95306	Repository-described merged data pool	Observed source reference			Pinned repository snapshot; user captures supplied 2026-11-01	Historical log correlation; association does not establish current control or a particular intrusion	Preserved repository maintenance record; reviewed 1 November 2026
/data_raw	Artifact / path	Artifact / behavior	TGSEC-associated / 95306	Repository-described collector output directory	Observed source reference			Pinned repository snapshot; user captures supplied 2026-11-01	Historical log correlation; association does not establish current control or a particular intrusion	Preserved repository maintenance record; reviewed 1 November 2026
pix_bot_server	Artifact / path	Artifact / behavior	TGSEC-associated / 95306	Repository-described bot-facing service; portal implementation link not independently traced	Observed source reference			Pinned repository snapshot; user captures supplied 2026-11-01	Historical log correlation; association does not establish current control or a particular intrusion	Preserved repository maintenance record; reviewed 1 November 2026
v6collector	Artifact / path	Artifact / behavior	TGSEC-associated / 95306	Repository-described collector service name	Observed source reference			Pinned repository snapshot; user captures supplied 2026-11-01	Historical log correlation; association does not establish current control or a particular intrusion	Preserved repository maintenance record; reviewed 1 November 2026

No live-node probing was performed. ASN labels reflect historical enrichment dated 1 November 2026. Microsoft app IDs and Japan Case E source addresses were checked against their primary reports. The Japan addresses cover several tools and do not identify TGSEC.

Primary verification: Microsoft · JPCERT/CC. Other roles retain the supplied report’s provenance and uncertainty. Defanged network values require deliberate normalization before use.