Archived campaign d9fbff7ffdfbNot live
Shared-infrastructure grouping of public detections. Not an attribution claim.
This campaign is no longer live: none of its indicators are in the active feed any more. What follows is its last recorded state, from 2026-07-26. The identifier is derived from the member set, so this page comes back to life if the same infrastructure does.
Indicators
8Confidence
80%First tracked
2026-07-24Last seen
2026-07-26 Last recorded indicators
onedrive-thybncdcs.hopto.org
onedrive-thyyhncdcv.servehttp.com
onedrive-yhdtddn.myftp.org
onedrive-yhlkjcc.3utilities.com
onedrive-yhnncssdcs.ddnsking.com
onedrive-yhtcdsaa.serveblog.net
onedrive-ytbijcd.3utilities.com
onedrive-yujdgbdvd.myftp.biz
History
2026-07-26
dissolved
no members left in the active feed
2026-07-25
grew
+1, now 8
2026-07-24
created
first tracked with 7 indicators
History is kept for 180 days after the last rebuild that saw this campaign.