Known malicious kitcriticalother
BlueMoon / ShadowPad - C2 and staging domains
family: bluemoon-shadowpad-2026-09
A scan whose entry or final URL is on the actor's own C2 / payload-staging infrastructure, or that resolves to 79.133.56.90. Indicators from Proofpoint's "Once in a BlueMoon" report (2026-09) and MISP event 22904. SMQL hunts are DETECTORS, not verdict rules: match_tier 'smql' is excluded from both engines' verdict paths by design, so this collects sightings and shows a banner. Flooring for these indicators comes from the MISP feed via ioc-matcher.
Anchors
SMQL queryrun
domain:*secboxes.com OR domain:*checrity.com OR domain:*msbenefit.com OR domain:*brianwilli.com OR domain:*attcdn.com OR domain:*elixnovorem.com OR domain:*getaiexo.com OR domain:*openlumakora.com OR domain:*joinmacket.com OR domain:*velodynaity.com OR domain:*fracons.com OR ip:79.133.56.90Provenance
Added: 2026-09-12 10:36
domain:*apex is a SUFFIX match, verified live: domain:*google.co returns 1 (google.co) and NOT the 4,667 google.com scans, so these cannot bleed onto the legitimate brands these domains impersonate. 12 filter nodes (cap 20). 0 matches at creation.
Sightings (0)
No sightings recorded yet.