Skip to content

Instantly share code, notes, and snippets.

@gboddin

gboddin/sharepoint.pwned.json Secret

Last active July 26, 2025 18:51
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save gboddin/bf6ff340022a1e5f02450125409e5277 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save gboddin/bf6ff340022a1e5f02450125409e5277 to your computer and use it in GitHub Desktop.
Download ZIP
Sharepoint pwned
Raw
sharepoint.pwned.json
{"ip":"61.153.150.16","port":"80","host":"61.153.150.16","time":"2025-07-26T02:25:00.344846695Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 3643398587C7674E78D2B1F55AF915E7D4F775B8415FEFDED17FD42895DFEF35|HMACSHA256|7E5062F02C19877252B43CF9084167380EFE17A9F8F2F16DD19D7392694EBF58|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"168.167.91.139","port":"80","host":"168.167.91.139","time":"2025-07-26T02:24:59.671533192Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: F28D3666CDDFB939ACD123FD6C7DE783BBD2F24D0E77D905F17F25DC4A1EC1F7|HMACSHA256|C9EE64D0FFDEA04F0497DBD12B3C61EF2F10642FE7932FCD6D61E867128798A4|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"210.245.41.18","port":"80","host":"210.245.41.18","time":"2025-07-26T02:24:59.27920504Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 91A03AE266D9C18FD18FCE85F0B2574870F055DB80D819808AE50F10E1137FEE|HMACSHA256|A4792983259C7303F6A53B47AA3D7908A6578317CA615702AA1EF85F9C0FC438|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"52.235.27.181","port":"80","host":"52.235.27.181","time":"2025-07-26T02:07:32.205445795Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 8D2B65F5682112F1C564EA2223087809B9F4A00308F0C30F30753916A8D70874|HMACSHA256|9FCBB35DC8E397284B92DBFAD4ADCDE99C675552B2275F1AFA4BDEC1227CD81D|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"171.254.94.196","port":"443","host":"vietnamdefence.vdi.org.vn","time":"2025-07-25T12:31:12.480895097Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 9D3FFA9F2D5A25575508D5D00363CD9050C7D62085149E9776F89117F37D0E45|HMACSHA256|7BF33D2ED98F65420DFB8C5533A2A883B2EABDF8A2719214F8242C48404B426D|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"164.151.227.3","port":"443","host":"pme.premier.limpopo.gov.za","time":"2025-07-25T08:35:17.098441614Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 1E9F2F84A886974AD9A158EC3D80E41911D73CD9E9AB35123A5D29F2543A8A67|HMACSHA256|4AE9DD3FF044418E97BC9A2512C02FC5F6E98DC67102AE5E1C5ECE7F946AEF71|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.limpopo.gov.za","domain":["*.limpopo.gov.za","k2.premier.limpopo.gov.za","limpopo.gov.za","pme.premier.limpopo.gov.za"]}}}
{"ip":"113.160.144.2","port":"443","host":"dienbien.gov.vn","time":"2025-07-25T02:54:50.390689987Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: FE2BAA56FD40075604B57CCEAD803A1F29B3AF25086A74628D845A65D3622D158375D48CCB76C8BAC77CDB2D511DFC1E03069B6B291C4BEB909023B95FC62888|HMACSHA256|EF270A87645610DC8127E3C7BD060D7A70641E80544CEAF8|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"89.42.136.138","port":"443","host":"onewin-drserita.ir","time":"2025-07-25T00:58:51.721577503Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 32D823BD7C4E3A52EF9283516321D22E2CA37AA2FB509368427DEA071EFAB836|HMACSHA256|64BCFA3B4B79D8E45E36DC80862FF5735A371C93332CFE4AD440ABBACA731D21|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"104.18.0.156","port":"443","host":"www.avanzbanc.com","time":"2025-07-24T23:38:04.568182843Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 85DCDBD7E88FF72E1B05EFF80748E13F213ADC3D18662EC0735C4A6D1896A7F1|HMACSHA256|43109AC327430079716DB26859762B79E902770AC2BD70EEA43133700DF88C64|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"www.avanzbanc.com","domain":["www.avanzbanc.com","avanzbanc.com"]}}}
{"ip":"164.151.136.43","port":"443","host":"mars.dpme.gov.za","time":"2025-07-24T22:04:31.756910798Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 5CCEFCBE441BE1DF290077E47E9A095BE04306D8708B929E6695A34CD26FD941|HMACSHA256|ED0E654DFF9F38C9A5F12F021B10FEAF670D71796EDA11E1694A40ED8DD89589|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"40.142.56.138","port":"443","host":"sites.unitedbiosource.com","time":"2025-07-24T17:12:06.10696124Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 68B0F53C4C9678E51BA3CA34EB1E11000ACBDD21CB1F72E492CDC693E99C39BD|HMACSHA256|9E184CD44E3D01334828509CC4E58FDAB8BED23DE9791599A9D96241B66C9763|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"177.154.95.198","port":"443","host":"bemaqui.com","time":"2025-07-24T15:36:25.154372503Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 78DAA42B2CC3FD839C1CA0770CEB6C65CB0D294D70EF296FBDDD654F5281BF5E|HMACSHA256|4F7182C629F0DA244650AFD208C350561AC8EE50BAE2B497ABBD8A4779632808|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"195.24.43.250","port":"443","host":"d2d.a1.dev.bsh.bg","time":"2025-07-24T15:21:08.350223534Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 933EC627C38245E5F4B1723C5A0E56EF3C163DF3FDF1C06E4F67ADFD84E1346E|HMACSHA256|C370646DA8CF26D7DF3CE852250D727F9249528602E001DDBC38E42C9A9BF78F|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"remote.bsh.bg","domain":["remote.bsh.bg"]}}}
{"ip":"69.195.201.87","port":"443","host":"69.195.201.87","time":"2025-07-24T14:08:35.895481065Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 3BF43028F3165187EEFA59441BD0E7F7C2382C2D5284E733A94CB81C4219299B|HMACSHA256|EB55EBF1F038ACCC8F7BF12AD87B234D5DB201522D8AE6CE8ADAFCF379A1FE56|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"44.215.81.95","port":"443","host":"sparcsandbox.freyrdms.com","time":"2025-07-24T13:45:12.450049184Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 01E1B8A6E4F48A433D868C133D000862A477F45563372A0EF805F6A162DEC541|HMACSHA256|E5A45544ECE91126D856DBCDDC39191AB5147A2AEB44C659EA7650565A6266D4|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"sparcsandbox.freyrdms.com","domain":["sparcsandbox.freyrdms.com"]}}}
{"ip":"20.165.51.1","port":"443","host":"newcudriver.kintivo.com","time":"2025-07-24T11:39:16.642015341Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: AB360B00C7F6A89AE2EC792AF50B1D15E0E4416C8EACE56100DB0FFC68BC8B45|HMACSHA256|D28E1EA40B63D5B4EA1133F4C7158ACF86A0BABC4B8936C0251B53CBA89BFFC2|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"newcudriver.kintivo.com","domain":["newcudriver.kintivo.com"]}}}
{"ip":"200.26.173.142","port":"443","host":"www.segurosreservas.com","time":"2025-07-24T11:39:05.929192689Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: C12EE671575EDFF2254958FE2F2584F9FD8CCD258C114E2E85E3B4FA39F6B23C|HMACSHA256|06C23285DA622B6E5B11E02E5D5AFEDEF2E361FE6B510D9A5DA6E2AC25BEF9FF|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"203.254.240.158","port":"443","host":"203.254.240.158","time":"2025-07-24T11:35:50.455745363Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: B86D4B5DE733B90699E90A337ED7B21FF3C2C3219733CD431681189BC3498D79|HMACSHA256|37B7F4E5B08CC794492396872DB5F8A0FA5A7AF7D1033DA38EDA15E526ED764F|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"206.127.14.203","port":"443","host":"206.127.14.203","time":"2025-07-24T03:11:05.443297034Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: B44DA7CD54B6EFDF796A823EE734EB9B7471981E925A38C5B0CE503E0F86C4FA|HMACSHA256|5FB29E86C26DD57C8EFC62C7B8203DA2AEADCE900EF805FDCB2187D6E98982E0|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"207.219.27.47","port":"443","host":"forward.captus.com","time":"2025-07-23T08:59:58.974313635Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 8AB7F8369F8FA84B0A5BFA24055AFD02F817086B4466E91AA58B230A4195D8A4|HMACSHA256|37F98B4BF6A42997962F56457B36B5A22FEB5249BAE9CE9D71C7F777D00A3DCC|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"forward.captus.com","domain":["forward.captus.com","captus.com","www.captus.com","info.captus.com","eclients.captus.com","emedia.captus.com","elearn.captus.com"]}}}
{"ip":"8.14.195.41","port":"443","host":"calportal.calibresys.com","time":"2025-07-23T07:52:27.498088842Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 00BA37B1C22457D99F314B037168AFA12381CA3F60BDE0EC752ACB086910AD5D|HMACSHA256|E287A9D41B4313822970BA5BB21836AAB611BF27E08C2C7B83D85BDD819386C5|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"91.73.143.86","port":"443","host":"www.consumerrights.ae","time":"2025-07-23T07:52:16.25081746Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 1E38F9E27D12007C101F91E5C5995425B31891FC214CCD21F93677AB5FF260A9|HMACSHA256|186555548FD82F27CADE7F6818C815541D43883813A935C46715CA2ECB9A7213|DES|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"20.12.2.199","port":"443","host":"partnerportal-demo.trustage.com","time":"2025-07-23T07:52:05.310197632Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: E51C5FFAC684BD37A24440ED79B06F35E5DA32D9132653582001E398BA7EFC39|HMACSHA256|A338AD3EABB2B73A075DCB2F7337EF505431A4C582100CB05DF5C0C902ED2792|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"77.154.155.2","port":"443","host":"appcold.sfr.fr","time":"2025-07-22T17:10:10.773440848Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 0E83679B4C157BA4F7738D544F967C433E3DF797002C9EA28404D2AB0D2245D2|HMACSHA256|1E85688177562FFFBC400630621DB5EC035F6BF7E7060B6735BC2214F881123D|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"165.233.63.45","port":"443","host":"www.nbcrfli.org.za","time":"2025-07-22T17:09:49.582874364Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: C8FC77FFEB92163EA0934876B91139995A31A59C11B6A0AF13431A7D8A333491|HMACSHA256|7D68E6D31E17F879C9A1AF1F867F7CF29CBC15BA6F9876A3272C937B7370F2D0|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"103.244.126.49","port":"443","host":"103.244.126.49","time":"2025-07-22T17:09:46.713826495Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 1D451EF21173347792F6443E7204F804CD3A243FDB08B5171B39AD2E956BD56F|HMACSHA256|AEC2F766600DA37506447C63B7C0F0877A0AF5145BA4A20B414EE2498F67D125|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"50.201.199.185","port":"443","host":"plans.responsegroup.com","time":"2025-07-22T17:09:46.118224206Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 2D212B06AF27B3C7F9D477AF21DD2E70E0A0CDA131EB76F703AD48550F494102|HMACSHA256|2B7EF7C78B4412655DEB093144CAC8C06611BAFFC459C907BE5D8367084D4FF6|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"71.57.101.6","port":"443","host":"tscmembers.ddns.net","time":"2025-07-22T17:09:46.111709108Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 77E796058EABA0E6523961B684DBA4E8F33A3E7B1C1299C67DDBCF566BF2FC43|HMACSHA256|706AE8BF2A07E064BB8CFBB5D353503D1E8DAE46C42CD34D240D7AA5572D6AE4|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"20.62.123.207","port":"443","host":"partnerportal.trustage.com","time":"2025-07-22T17:09:46.111580431Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 301B70F2F4E22AA802E12674CD6960084390BB616C0D7AEB5C39E4114D0A5B3D|HMACSHA256|5384BFEA5C76B4230DAD34BF2D3EE46F1A457D985D91C4DC9DA223CBC3CF0AE9|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"8.213.16.139","port":"80","host":"8.213.16.139","time":"2025-07-22T17:09:40.842414256Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 0C941010AB4838FEB31AF1219EB812B89B8F8FA392A48BD19BA28CBA40CC4953|HMACSHA256|4641626CCB3EA0524CCE195053D5C76500C82AF76014FC3240E2DD424B3520D9|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"146.232.21.213","port":"443","host":"library.sun.ac.za","time":"2025-07-22T17:09:34.541124056Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 4EFAAD342EEBD08CCB1372D84623DF1A50D6408D9DC35E9CC30F72114720D69A|HMACSHA256|574812B9DB8C8990A0F9828A25E2DCB5D444A433A09C11FC77416ECB6246B1FE|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"109.24.47.237","port":"443","host":"appcol.sfr.fr","time":"2025-07-22T17:04:24.807449963Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 0E83679B4C157BA4F7738D544F967C433E3DF797002C9EA28404D2AB0D2245D2|HMACSHA256|1E85688177562FFFBC400630621DB5EC035F6BF7E7060B6735BC2214F881123D|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"appcol.sfr.fr","domain":["appcol.sfr.fr"]}}}
{"ip":"217.111.164.20","port":"443","host":"217.111.164.20","time":"2025-07-22T15:20:15.310217656Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: E0D2C5C9BBF6D48E2C7AA7B69AC369B484EB569F56D3F8DD4295A934C77562EF|HMACSHA256|64AD0E1B8502535FA92B0E79A2B8933C8A4D7E0BD518F790C413F8C53771DB7B|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"spportal.colt.net","domain":["spportal.colt.net","eshare.colt.net","share.colt.net","sharehelp.colt.net","esharehelp.colt.net","apps.colt.net","share.sd.colt.net","eshare.sd.colt.net"]}}}
{"ip":"152.107.143.141","port":"443","host":"ipartner.vwgroup.co.za","time":"2025-07-22T14:40:58.105473826Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: F15AB926D5385389B4279D0AD333CEEE0270F440E3C2BE1EBDC903FF4D6EE2A0|HMACSHA256|E0BB493FBE3666C940BA799E18A7E12D09CE6A311E8E0D4A2393DEED8E48EE54|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"20.103.220.160","port":"443","host":"www.p2endure-project.eu","time":"2025-07-22T12:03:54.679677493Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 20A6E38CDE806C360E3273E940C2F7F4DB16D53CD29DA1CDBFC0A8D4686383A6|HMACSHA256|98D68E4F85DFBBD75B416C2DDF9AA6EC9A24AF52F8326A39CD305A9377371CC1|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"103.5.210.144","port":"443","host":"103.5.210.144","time":"2025-07-22T03:16:40.842259216Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 40D0A238510FCB23C4527B118FA4B8EEFC3D9939C547649608DCAA000D5807B6|HMACSHA256|FAA74671E53048DDCD75586C1201E676E8E23F0F60AEBB439312B254B5800B72|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.vjst.vn","domain":["*.vjst.vn","vjst.vn"]}}}
{"ip":"51.144.180.87","port":"80","host":"51.144.180.87","time":"2025-07-22T02:07:59.328012557Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 0AC1C02881E9AC14E628B0E2A10CFAA9D5642965ADA69186EE31C5D0B8C5D9D7|HMACSHA256|A1DFE293D3FF496E89843312899A2C0BBC267F6F0E7E1EB611E6EC8318E7E9F4|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"103.244.124.138","port":"443","host":"103.244.124.138","time":"2025-07-22T02:07:58.770629982Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 4C87262D06D6C6EF6658FD4955BD110562412D31BBAFDB36E43CE3DAE57C25E4|HMACSHA256|C43ED05E557623DD1BAC4BEF8200E6463DDA864F57C0483194B87B36877A19F5|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.indiapost.gov.in","domain":["*.indiapost.gov.in","indiapost.gov.in"]}}}
{"ip":"194.8.219.140","port":"80","host":"194.8.219.140","time":"2025-07-22T01:43:29.3778613Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 5E6F910472102C5F787475816881AA56E8B0710FA2506C944879E05903E550B7|HMACSHA256|D2178050DB82BE41F828F67BFED8AF9376000B26F952758C098400463860A08A|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"103.251.171.245","port":"443","host":"reggie.asqa.gov.au","time":"2025-07-21T16:08:55.425549992Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: FBE0AEECE7C131B526E0D2B430E45464006AA5EF0F787F8DD24E22024564544C|HMACSHA256|C51459B650021FD909C82F5941DE2C2DB8A011AE3D8E673CF6A0090654C42171|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"20.10.96.170","port":"443","host":"20.10.96.170","time":"2025-07-21T16:08:55.36377993Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: B63DC431047E7F31855E90A80AEFACE9C4504BD195A76C767EB100E1DF2743DE|HMACSHA256|CC45E6F504786AB5D6287ABCD53F61CB2A5A11F26F23E67DB55954F8C9406578|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.sapsf.com","domain":["*.sapsf.com"]}}}
{"ip":"185.54.19.55","port":"443","host":"generalcivilaviationauthority.gov.ae","time":"2025-07-21T16:08:55.36327934Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: E2434DD788E63DFB7ED11D149D24B14733B954482DF695661AA23E7B3A4E90D3|HMACSHA256|BD5981AB8F462E62FC02B1934F268A403A7EF8E56BFE4FEE3EAF1ECFBDEF1AF0|AES|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"20.122.211.251","port":"443","host":"20.122.211.251","time":"2025-07-21T16:08:55.329082015Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 80F0F862621D5C90E8E5F582380C9D10473744BECC9E3D58A1CF4CC4CF48AFA4|HMACSHA256|39985DEAB638B8A2390DB8E2B5C17E4EA4074A7D8FAAD873CD1DD8F33899262C|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.successfactors.com","domain":["*.successfactors.com","successfactors.com"]}}}
{"ip":"20.22.87.66","port":"443","host":"20.22.87.66","time":"2025-07-21T16:08:55.329184396Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: B63DC431047E7F31855E90A80AEFACE9C4504BD195A76C767EB100E1DF2743DE|HMACSHA256|CC45E6F504786AB5D6287ABCD53F61CB2A5A11F26F23E67DB55954F8C9406578|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.sapsf.com","domain":["*.sapsf.com"]}}}
{"ip":"85.194.123.18","port":"443","host":"pnu.edu.sa","time":"2025-07-21T16:08:55.328214825Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 0D71E206234399E2FDB89FC259080683497659CC29C1CD3467D45A6BD9B89FD7|HMACSHA256|E5990B80A380598FCF55D68616CFAC517DF6AD2030F75D372FFD993F49F178D3|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"13.82.135.39","port":"80","host":"13.82.135.39","time":"2025-07-21T16:08:55.32773047Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: FEC841813B7CE9D625F973D7DCAA91145F422E56E0F6C51516A3B410648ABA67|HMACSHA256|D90FD268C13FC77786F03602E1E6459DCCD814F9A725596BBD27FCF197CC6DAA|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"193.140.255.1","port":"443","host":"www.yok.edu.tr","time":"2025-07-21T16:08:55.324557387Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: CB60F496E50515F08875DD8393B1841F36A44DB9E76C94ED72E44857ADDF00E3|HMACSHA256|51EE828B8EFCD25D298F03EBCB6AF9760F9EAFA474585E73DD502CBD700BAD96|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"20.53.89.205","port":"443","host":"20.53.89.205","time":"2025-07-21T16:08:55.323079482Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 72AC95D1523D5AE425E2182DAD3ABE365698719217CDEB38B85A13217CAFE7F1|HMACSHA256|43A9B358DAB82846BAFE24173FCD62EA58DDE9DCCB3AA70A3FE67ACBD7B32828|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.successfactors.com","domain":["*.successfactors.com","successfactors.com"]}}}
{"ip":"20.48.134.247","port":"443","host":"20.48.134.247","time":"2025-07-21T16:08:55.322821186Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 1EEC5CE771BEBE92F3D36D6EE582D94F806E1E3F0081EF7EAA343F89375024E5|HMACSHA256|A0BB32A41EFC11AEC9F3DE93974515EB6323BF98D17D95009525341DA9FD55CC|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.sapsf.com","domain":["*.sapsf.com"]}}}
{"ip":"18.171.30.181","port":"443","host":"anp.org.ma","time":"2025-07-21T16:08:55.320040628Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 97AAA21C69EC232CC55CAC3D09B6ACF3D7404A38E3C54C244308D8E71C58582B|HMACSHA256|472C6484774437E880D36CFAB2FC0545406478B661E235AD77ACFD8241DDD6B5|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"46.31.70.144","port":"443","host":"futureaviators.gcaa.gov.ae","time":"2025-07-21T16:08:55.320493123Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: FFCAF99AD995011C0D0FDD6BCAE955C7F9E1F11000153C968A7007E62AA644C0|HMACSHA256|8C56FC304465B6EA2BBC438ABFA613EA501CD0FD4F2B498984ACD020D3A607F6|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"84.233.229.217","port":"443","host":"www.ca-ifcam.fr","time":"2025-07-21T16:08:55.315356138Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 66424E4DD6DA3D12702D0A656DD324C1F601616B7D8D8C3BF2CB17E3EC327AE1|HMACSHA256|223E7E54F1881916E43062E577D2273CE32AE24C19B68BB729726821A2C9DE83|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"20.42.35.13","port":"443","host":"20.42.35.13","time":"2025-07-21T16:08:55.315812329Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 85F07192AB45F5648149A2AC8871288C5AC40E6CE333D852F714BA541FA950BF|HMACSHA256|9B2996AE6755DFD43C5E73B3CE5346E4127425BAF222FC659DB3B37D12D384A7|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.sapsf.com","domain":["*.sapsf.com"]}}}
{"ip":"20.122.212.192","port":"443","host":"20.122.212.192","time":"2025-07-21T16:08:55.312775879Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 84BFEDE1A0FFEF3A57B1AD594E1C9A0013947F533AB555D29FFAA153D12D6D43|HMACSHA256|E543C5E899FFF3088EB29AD3B6637ED725FE9DCE062C7BF3B77022D6592B49F3|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.successfactors.com","domain":["*.successfactors.com","successfactors.com"]}}}
{"ip":"20.7.96.143","port":"443","host":"20.7.96.143","time":"2025-07-21T16:08:55.305009487Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: CB0ADD6A260F5F9EE62364AC53B158D9A34848FD76ECDFD9580956C2D5849E63|HMACSHA256|8DBA833CD6F0221C2095A5B7BD6851AF6DC5E8C18C9181EC574B0B3F30924657|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.sapsf.com","domain":["*.sapsf.com"]}}}
{"ip":"188.114.96.0","port":"443","host":"dcm.filebankinc.com","time":"2025-07-21T16:08:55.299408477Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: C5B55AB0798BEF4BCDB1ECE9ADA90E64C9704C297283540762C1A96D93F7460F|HMACSHA256|57241468B6A33210B8FDD17FA6C5A2D8D45D1574261AE6DDBED9862B050954C3|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"20.201.47.40","port":"443","host":"20.201.47.40","time":"2025-07-21T16:08:55.295715466Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 6F5B4C5456A673AB8745288D2AAA027E88FB8B3C05B6C6CDDDD8A2DFF66AACAE|HMACSHA256|D3786AFAD960D666A34C61373BC15A6620791CD714F942CB7100AECB2FE7C045|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.sapsf.com","domain":["*.sapsf.com"]}}}
{"ip":"52.139.251.221","port":"443","host":"www.rgo.researchgrant.gov.sg","time":"2025-07-21T16:08:55.293523207Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 9FDBE741167F9E61DB1F80C1FFC41B3C3FBD9049C7E4F9127B1C4D759FF072C0|HMACSHA256|8062682725F86F2268CE3E45D8E0E7FC7DD57E85301999E31C4E871F7E08696A|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"46.31.70.248","port":"443","host":"uae-icao.gcaa.gov.ae","time":"2025-07-21T16:08:55.284051209Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: E2434DD788E63DFB7ED11D149D24B14733B954482DF695661AA23E7B3A4E90D3|HMACSHA256|BD5981AB8F462E62FC02B1934F268A403A7EF8E56BFE4FEE3EAF1ECFBDEF1AF0|AES|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"37.252.222.68","port":"443","host":"uop.edu.jo","time":"2025-07-21T16:08:55.277708209Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 12E9CEB644FF7785A99BACAE8B638A3C0625F4CCA494A935697A687C1EF5D7F5|HMACSHA256|BAD9F6806FFFB8D039B5C3B496BE939A70C22CEE3CD7FDD22411001FD7D2EF1C|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"13.107.246.60","port":"443","host":"rgo.researchgrant.gov.sg","time":"2025-07-21T16:08:55.275142874Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 9FDBE741167F9E61DB1F80C1FFC41B3C3FBD9049C7E4F9127B1C4D759FF072C0|HMACSHA256|8062682725F86F2268CE3E45D8E0E7FC7DD57E85301999E31C4E871F7E08696A|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"20.96.136.20","port":"443","host":"20.96.136.20","time":"2025-07-21T16:08:55.275312473Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 0709E10B8257730A8BD9348ED52E6142006456BC0652988F28F4EE8F89CC0504|HMACSHA256|5232684AC0644BFB1CB381CDB308D9C13030D35A1FD470201C048AFA71DA9A97|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.successfactors.com","domain":["*.successfactors.com","successfactors.com"]}}}
{"ip":"201.175.27.182","port":"443","host":"201.175.27.182","time":"2025-07-21T16:08:55.274874686Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 1C5C943941382FF337066D646E33BD4F66FD8FB23B22D9BD4F41242246C40718|HMACSHA256|89E9312E3B5595E1EDEB78976299E9756D3649936DC282E99E4E57FCD7B68102|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"20.48.135.25","port":"443","host":"20.48.135.25","time":"2025-07-21T16:08:55.272198097Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 25752883851C672C8F0A62B10368A1C426B94BBB9A3BA9C854AE474D344EF498|HMACSHA256|56E09CE69EBC23D970F33DB8EDCE07795D450EFA9CBBF386CA98F7A57E2FD717|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.sapsf.com","domain":["*.sapsf.com"]}}}
{"ip":"52.170.163.187","port":"443","host":"52.170.163.187","time":"2025-07-21T16:08:55.268347499Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: CDF4110177D79D7FA9A33E865621FA9356BBA8B89707843C67680BC9C51BAD8A|HMACSHA256|C7A2285719A9C90C2B5CD8232740A7579DFBAFB47FBD7ABDF01EB4AA8CBC3CD2|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.sapsf.com","domain":["*.sapsf.com"]}}}
{"ip":"190.213.5.218","port":"443","host":"190.213.5.218","time":"2025-07-21T16:08:55.253174274Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: ED20D08758177976D21AB5504173F76BED7AF3C2783ECAF1B804F98A9DCC49F0|HMACSHA256|942FCED876E02DF02331FC2A9DE7B80865B34116B91B6A71A9F7D53978DAA1BF|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"20.53.92.38","port":"443","host":"20.53.92.38","time":"2025-07-21T16:08:55.249230557Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 9A0292946C8D264009A6F5410D539E1921B59E6805806C6D0C2DDFA9E48FECF5|HMACSHA256|17CFA2EDE348AB8C2E801EE8659D27BE058E76E92AB1D71C59C67AF85F790269|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.successfactors.com","domain":["*.successfactors.com","successfactors.com"]}}}
{"ip":"20.201.65.23","port":"443","host":"20.201.65.23","time":"2025-07-21T16:08:21.163892344Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 9BD4F7256E471520FC1742D6A40A630A9E6334E7852F315E57996A7F152247DE|HMACSHA256|BF11CE2E4F7294B4C3417E48E7AD9408ED87B0AF8B211E95D08A415247C7C643|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.sapsf.com","domain":["*.sapsf.com"]}}}
{"ip":"185.141.15.102","port":"443","host":"ajwaa.gcaa.gov.ae","time":"2025-07-21T16:08:17.425501861Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: E2434DD788E63DFB7ED11D149D24B14733B954482DF695661AA23E7B3A4E90D3|HMACSHA256|BD5981AB8F462E62FC02B1934F268A403A7EF8E56BFE4FEE3EAF1ECFBDEF1AF0|AES|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"20.72.79.198","port":"443","host":"20.72.79.198","time":"2025-07-21T16:08:17.35434433Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 803F01FFDA635927F09231CB954EB7541CEFF995B2251169C5870B248B0670B0|HMACSHA256|486276D186788052C910698DE7C8A91A135730C755B79A8A83791C082B23591F|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.successfactors.com","domain":["*.successfactors.com","successfactors.com"]}}}
{"ip":"84.252.116.9","port":"443","host":"84.252.116.9","time":"2025-07-21T15:25:06.218753985Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: BDFC8ED8DE4F1879465DBBAC81487BC1D1A8CF3433BA41A87FF859C0D480C7E1|HMACSHA256|B7DB5DD3902DBB697FC7DBAFC7DBC44FE82BE77CF9DAC999E6B12A40B94942EA|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.lenovo.com","domain":["*.lenovo.com","lenovo.com"]}}}
{"ip":"103.4.188.110","port":"443","host":"climatechange.gov.bn","time":"2025-07-21T15:23:48.006430376Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 784369F3D89065DF0C6BEA393A4FBFAF8FB76C67B079C33405B45FB4B622BDE2|HMACSHA256|208C8D87E1F98CFD8583993D148929A0FA2B269E75377EBEA612F312A14170DB|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"104.232.254.49","port":"443","host":"104.232.254.49","time":"2025-07-21T15:23:23.899186155Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: BDFC8ED8DE4F1879465DBBAC81487BC1D1A8CF3433BA41A87FF859C0D480C7E1|HMACSHA256|B7DB5DD3902DBB697FC7DBAFC7DBC44FE82BE77CF9DAC999E6B12A40B94942EA|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.lenovo.com","domain":["*.lenovo.com","lenovo.com"]}}}
{"ip":"43.255.227.70","port":"443","host":"43.255.227.70","time":"2025-07-21T15:23:03.010027855Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: BDFC8ED8DE4F1879465DBBAC81487BC1D1A8CF3433BA41A87FF859C0D480C7E1|HMACSHA256|B7DB5DD3902DBB697FC7DBAFC7DBC44FE82BE77CF9DAC999E6B12A40B94942EA|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.lenovo.com","domain":["*.lenovo.com","lenovo.com"]}}}
{"ip":"103.30.235.197","port":"443","host":"103.30.235.197","time":"2025-07-21T15:23:02.142016821Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: BDFC8ED8DE4F1879465DBBAC81487BC1D1A8CF3433BA41A87FF859C0D480C7E1|HMACSHA256|B7DB5DD3902DBB697FC7DBAFC7DBC44FE82BE77CF9DAC999E6B12A40B94942EA|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.lenovo.com","domain":["*.lenovo.com","lenovo.com"]}}}
{"ip":"20.21.184.82","port":"443","host":"20.21.184.82","time":"2025-07-21T11:14:25.957257597Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 09A7E4D078A7911009A2D5AFEBC84686E014311CC1E084DE2A110F6CB096F5C8|HMACSHA256|8707DDA25F95713C06876AFAB3EB443EA087471B7DD6B7121E5DE5EF190C1CC4|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"ncihlqa.org","domain":["ncihlqa.org","www.ncihlqa.org"]}}}
{"ip":"104.16.47.58","port":"443","host":"ess-kev.tnb.com.my","time":"2025-07-21T09:33:24.39909196Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 0185E9C74B9A9A7B1936A693ED408D1A9F90734B9D0FC35A08B7A48488058796|HMACSHA256|F652C18F02CC4791D91332F437142A8DE16947D817E11EC3400BAB4F63DD7E50|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"132.167.146.72","port":"443","host":"irel.partenaires.cea.fr","time":"2025-07-21T09:21:37.649018814Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 03FAE05BB3BE37E14CE6CE340649A49583ED14DF5A841314D8CEBD0DB1B6D740|HMACSHA256|085537CAD970695CD5B552C61A72C5546DC22A65049A6D2CFE2FC262F636153F|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"irel.partenaires.cea.fr","domain":["irel.partenaires.cea.fr"]}}}
{"ip":"108.143.106.245","port":"443","host":"www.ppc.gov.qa","time":"2025-07-21T09:20:38.837505997Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: DFD84F1024D82C5796F16967C5C5723FBA9106FDE8095AD394A8D6E4D6D93A6C|HMACSHA256|80CD1D20569A56B8CD23402A9390149CF29DB72FF3812B1219BBA0C60F02A4FE|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"www.psa.gov.qa","domain":["www.psa.gov.qa","www.ppc.gov.qa"]}}}
{"ip":"195.35.66.57","port":"443","host":"infoportal.claranet.pt","time":"2025-07-21T08:39:12.34317276Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 756A6955C322764038385C23C55A85DAFA939331C858C86194A1E7AB9078A903|HMACSHA256|A928280BAAE88ABF5DBC66A23F86C23DCA1CA8507B51933466C2EE7324F67A41|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"infoportal.claranet.pt","domain":["infoportal.claranet.pt","www.infoportal.claranet.pt"]}}}
{"ip":"116.111.214.75","port":"443","host":"vass.gov.vn","time":"2025-07-21T06:52:22.855235397Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 11A11A89711C99AB62679582DF5C25C37B86778AA4BE1CE730B3B936F6DF2B96|HMACSHA256|E932DC0A7F0B58313006B5D55FAA5306991862C46ADC38806735A73FD32342BB|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"vass.gov.vn","domain":["vass.gov.vn","*.vass.gov.vn"]}}}
{"ip":"193.23.170.220","port":"443","host":"isave.hs-duesseldorf.de","time":"2025-07-21T06:10:19.507390717Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: FFBC9F8DC1FCD0ED46A426B42FA58C8B15299741B5B024616BF8BB3BEBF69F8A|HMACSHA256|02DF7B1F5DCFDE20831D74DCBFEFEC68B694A30903C4C80465C4C2A438EFB36B|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.hs-duesseldorf.de","domain":["*.hs-duesseldorf.de","hs-duesseldorf.de","*.hsd.nrw","hsd.nrw","portale.kofi.hs-duesseldorf.de"]}}}
{"ip":"213.95.76.200","port":"443","host":"bauprojektarchiv.stadt-koeln.de","time":"2025-07-21T05:51:17.188039795Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 0196ED4A94EC044A6F5A61A5A5D7E1393B0D06072D96A8B0F5BAC3BEE4096A84|HMACSHA256|40A1C6DFD1A211CF8B1DA09A981C8C9E366AF81FFD7E1D4F03BDC7B1FACA9182|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"bauprojektarchiv.stadt-koeln.de","domain":["bauprojektarchiv.stadt-koeln.de","www.bauprojektarchiv.stadt-koeln.de"]}}}
{"ip":"149.156.27.30","port":"443","host":"149.156.27.30","time":"2025-07-21T05:47:17.96174951Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: DCC47B9A281A54C1CE79277E11B23E239A4F0B2109285A3CBC4432C2863CD076|HMACSHA256|8D1FB9C814A453EBD6FD2821E918F829F59D672A4DC6AB960ACF2E2566F28BE9|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.up.krakow.pl","domain":["*.up.krakow.pl","up.krakow.pl"]}}}
{"ip":"20.224.89.119","port":"443","host":"20.224.89.119","time":"2025-07-21T05:34:55.43125664Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 38A88338FB4E79C033C7978D909DC5C44EB7BBDCD886AD1C3057DF65D42BAEC6|HMACSHA256|921B52A9F36B0B1378526CB7675A169AA0F38002FBE3B31C09A466EF6F6106AB|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"www.psa.gov.qa","domain":["www.psa.gov.qa","www.ppc.gov.qa"]}}}
{"ip":"195.93.217.36","port":"443","host":"195.93.217.36","time":"2025-07-21T05:14:37.464888854Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 9931D299C690F7F6919C8E6447880B6595955D6C77F4E5509C09799C929B34F7|HMACSHA256|0B466DE07EB549007E930866C8005F159E5703EA66B20E057C8B338E0B8DDAED|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"*.kr-vysocina.cz","domain":["*.kr-vysocina.cz","kr-vysocina.cz"]}}}
{"ip":"20.54.150.32","port":"443","host":"20.54.150.32","time":"2025-07-21T04:45:47.828229474Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 38A88338FB4E79C033C7978D909DC5C44EB7BBDCD886AD1C3057DF65D42BAEC6|HMACSHA256|921B52A9F36B0B1378526CB7675A169AA0F38002FBE3B31C09A466EF6F6106AB|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"195.229.57.55","port":"443","host":"zajelviewer.shj.ae","time":"2025-07-21T04:43:59.145300678Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 512DCAB3B879785296BAF74798391EE3824914BAD2947B2ABA4FBCB3D5BD5D0D|HMACSHA256|96E1496EE5E6E2040BFC08B09BD03A60E006D28367833E31D6DD692F74B72E56|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"20.229.102.27","port":"443","host":"20.229.102.27","time":"2025-07-21T04:43:45.65917737Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 38A88338FB4E79C033C7978D909DC5C44EB7BBDCD886AD1C3057DF65D42BAEC6|HMACSHA256|921B52A9F36B0B1378526CB7675A169AA0F38002FBE3B31C09A466EF6F6106AB|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"4.175.65.167","port":"443","host":"4.175.65.167","time":"2025-07-21T04:43:45.278784374Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 38A88338FB4E79C033C7978D909DC5C44EB7BBDCD886AD1C3057DF65D42BAEC6|HMACSHA256|921B52A9F36B0B1378526CB7675A169AA0F38002FBE3B31C09A466EF6F6106AB|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"160.98.8.31","port":"443","host":"ged19dev.hefr.ch","time":"2025-07-21T04:43:42.531725367Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 1791FFF3ADE8A25688D3D621ABE587674D02E15B3BD7A26181912657924098E1|HMACSHA256|87FA75B05E5B3422132213A046A88A10DF75F6FE21F6A0598E82F6CEFE8303F6|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
{"ip":"213.95.76.203","port":"443","host":"projects.ubm.at","time":"2025-07-21T04:43:24.977173273Z","summary":"Found backdoored SharePoint instance:\nURL: /_layouts/15/spinstall0.aspx\nKey: 3822BA88BFD56DDE9BEA00B6648F7CE4AB49D1B0A7ED514E0B330508E98C0062|HMACSHA256|8D343973E2AF81060F5903EC65F1C2CF559208BFC627619A0533D2EFC1647AF0|Auto|Framework20SP1\n","SSL":{"certificate":{"CN":"","domain":null}}}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment