============================================================================== CYBER THREAT INTELLIGENCE - INDICATORS OF COMPROMISE (IOC) LIST ============================================================================== Generated: 2026-11-11 12:15 UTC Report ID: IOC-20261111-121526 Total Indicators: 28 Classification: OPEN - Law Enforcement / DFIR use Sources: CISA KEV Catalog, OpenPhish SUMMARY ------------------------------------------------------------------------------ CISA KEV (Known Exploited Vulnerability): 10 Phishing URL: 9 Domain: 9 Severity: CRITICAL=28 ============================================================================== [CISA KEV (KNOWN EXPLOITED VULNERABILITY)] - 10 indicator(s) ============================================================================== #1 CVE-2026-124194 Severity: CRITICAL Description: Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network. Product: Office (Microsoft) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-124194 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-10 Tags: kev,cisa,active-exploitation #2 CVE-2026-111793 Severity: CRITICAL Description: Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience. Product: Webtop Media Transcoder (Openwave Messaging Limited) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-111793 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-10 Tags: kev,cisa,active-exploitation #3 CVE-2026-20320 Severity: CRITICAL Description: Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. Product: BroadWorks (Cisco) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-20320 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-10 Tags: kev,cisa,active-exploitation #4 CVE-2026-111560 Severity: CRITICAL Description: Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vu Product: Multiple Products (Barracuda Networks) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-111560 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-10 Tags: kev,cisa,active-exploitation #5 CVE-2026-116606 Severity: CRITICAL Description: Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backu Product: Barracuda Email Security Gateway (ESG) (Barracuda Networks) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-116606 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-10 Tags: kev,cisa,active-exploitation #6 CVE-2026-125350 Severity: CRITICAL Description: Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that u Product: Chromium (Google) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-125350 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-10 Tags: kev,cisa,active-exploitation #7 CVE-2026-102895 Severity: CRITICAL Description: GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code Product: GPUStack (GPUStack) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102895 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-09 Tags: kev,cisa,active-exploitation #8 CVE-2026-123158 Severity: CRITICAL Description: OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass. Product: OpenSSH (OpenBSD) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-123158 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-09 Tags: kev,cisa,active-exploitation #9 CVE-2026-116779 Severity: CRITICAL Description: SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution. Product: FreeSwitch (SignalWire) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-116779 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-09 Tags: kev,cisa,active-exploitation #10 CVE-2026-123218 Severity: CRITICAL Description: IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations. Product: Aspera Faspex (IBM) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-123218 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-11-09 Tags: kev,cisa,active-exploitation ============================================================================== [PHISHING URL] - 9 indicator(s) ============================================================================== #11 http://netflix-clone-manishbisht123.vercel.app/ Severity: CRITICAL Description: Active phishing URL: http://netflix-clone-manishbisht123.vercel.app/ Source: OpenPhish URL: http://netflix-clone-manishbisht123.vercel.app/ Date: Tags: phishing,openphish #12 https://phenomenal-gnome-11223a.netlify.app/ Severity: CRITICAL Description: Active phishing URL: https://phenomenal-gnome-11223a.netlify.app/ Source: OpenPhish URL: https://phenomenal-gnome-11223a.netlify.app/ Date: Tags: phishing,openphish #13 https://808.top-qwe123-asd456-zxc789.yoqceqmcqoosawsu.com/downapp Severity: CRITICAL Description: Active phishing URL: https://808.top-qwe123-asd456-zxc789.yoqceqmcqoosawsu.com/downapp Source: OpenPhish URL: https://808.top-qwe123-asd456-zxc789.yoqceqmcqoosawsu.com/downapp Date: Tags: phishing,openphish #14 https://petsonpoint.co.uk/ Severity: CRITICAL Description: Active phishing URL: https://petsonpoint.co.uk/ Source: OpenPhish URL: https://petsonpoint.co.uk/ Date: Tags: phishing,openphish #15 http://finance.petsonpoint.co.uk/ Severity: CRITICAL Description: Active phishing URL: http://finance.petsonpoint.co.uk/ Source: OpenPhish URL: http://finance.petsonpoint.co.uk/ Date: Tags: phishing,openphish #16 https://365.qwe123-asd456-zxc789.osqcoyqssguomueq.com/downapp Severity: CRITICAL Description: Active phishing URL: https://365.qwe123-asd456-zxc789.osqcoyqssguomueq.com/downapp Source: OpenPhish URL: https://365.qwe123-asd456-zxc789.osqcoyqssguomueq.com/downapp Date: Tags: phishing,openphish #17 https://brilliant-tanuki-dd87f9.netlify.app/ Severity: CRITICAL Description: Active phishing URL: https://brilliant-tanuki-dd87f9.netlify.app/ Source: OpenPhish URL: https://brilliant-tanuki-dd87f9.netlify.app/ Date: Tags: phishing,openphish #18 https://shopee896.blogspot.com/ Severity: CRITICAL Description: Active phishing URL: https://shopee896.blogspot.com/ Source: OpenPhish URL: https://shopee896.blogspot.com/ Date: Tags: phishing,openphish #19 https://uspss.pages.dev/entreg/LoginAction_input%252CN/A%252Chttps%253A/ship/index.html Severity: CRITICAL Description: Active phishing URL: https://uspss.pages.dev/entreg/LoginAction_input%252CN/A%252Chttps%253A/ship/index.html Source: OpenPhish URL: https://uspss.pages.dev/entreg/LoginAction_input%252CN/A%252Chttps%253A/ship/index.html Date: Tags: phishing,openphish ============================================================================== [DOMAIN] - 9 indicator(s) ============================================================================== #20 netflix-clone-manishbisht123.vercel Severity: CRITICAL Description: Phishing domain: netflix-clone-manishbisht123.vercel Source: OpenPhish URL: http://netflix-clone-manishbisht123.vercel.app/ Date: Tags: phishing,openphish,domain #21 phenomenal-gnome-11223a.netlify Severity: CRITICAL Description: Phishing domain: phenomenal-gnome-11223a.netlify Source: OpenPhish URL: https://phenomenal-gnome-11223a.netlify.app/ Date: Tags: phishing,openphish,domain #22 top-qwe123-asd456-zxc789.yoqceqmcqoosawsu Severity: CRITICAL Description: Phishing domain: top-qwe123-asd456-zxc789.yoqceqmcqoosawsu Source: OpenPhish URL: https://808.top-qwe123-asd456-zxc789.yoqceqmcqoosawsu.com/downapp Date: Tags: phishing,openphish,domain #23 petsonpoint.co Severity: CRITICAL Description: Phishing domain: petsonpoint.co Source: OpenPhish URL: https://petsonpoint.co.uk/ Date: Tags: phishing,openphish,domain #24 finance.petsonpoint Severity: CRITICAL Description: Phishing domain: finance.petsonpoint Source: OpenPhish URL: http://finance.petsonpoint.co.uk/ Date: Tags: phishing,openphish,domain #25 qwe123-asd456-zxc789.osqcoyqssguomueq Severity: CRITICAL Description: Phishing domain: qwe123-asd456-zxc789.osqcoyqssguomueq Source: OpenPhish URL: https://365.qwe123-asd456-zxc789.osqcoyqssguomueq.com/downapp Date: Tags: phishing,openphish,domain #26 brilliant-tanuki-dd87f9.netlify Severity: CRITICAL Description: Phishing domain: brilliant-tanuki-dd87f9.netlify Source: OpenPhish URL: https://brilliant-tanuki-dd87f9.netlify.app/ Date: Tags: phishing,openphish,domain #27 shopee896.blogspot Severity: CRITICAL Description: Phishing domain: shopee896.blogspot Source: OpenPhish URL: https://shopee896.blogspot.com/ Date: Tags: phishing,openphish,domain #28 uspss.pages Severity: CRITICAL Description: Phishing domain: uspss.pages Source: OpenPhish URL: https://uspss.pages.dev/entreg/LoginAction_input%252CN/A%252Chttps%253A/ship/index.html Date: Tags: phishing,openphish,domain ============================================================================== RECOMMENDED ACTIONS ============================================================================== 1. Search SIEM/network logs for all listed indicators 2. Block listed domains at DNS/proxy immediately 3. Scan endpoints for listed SHA256 hashes 4. Check email gateways for listed sender addresses/links 5. Block listed IP addresses at the firewall 6. Share IOCs with partner agencies and ISACs 7. Update detection rules (Sigma/YARA/Suricata/Splunk) 8. Monitor for indicator rotation (new domains, IP changes) ============================================================================== END OF IOC LIST - IOC-20261111-121526 ==============================================================================