IFIN Lists
IFIN Lists are a curated collection of long-term blocklists and hunting targets for all organizations, along with documentation and explanations. The site lists.ifin.network provides the documentation of the lists, links to built versions of them, and explanations for how to use the build pipeline in create your own lists.
Copyright and License
This site and the associated lists (“The Work”) are copyright 2026 by The Independent Federated Intelligence Network Inc., aka “IFIN.” The Work is licensed under the Affero GNU Public License version 3.0.
Acknowledgements
IFIN recognizes and thanks the contributors to this project.
- Mike Bunner (B’ad Samurai) (IFIN Staff)
- Michael Taggart (IFIN Staff)
Webhooks-as-a-Service
Observable Types: domain
Description
Webhooks-as-a-Service made its living-off-the-land debut during the September 2025 Shai Hulud attacks on the NPM supply chain. These services range from free trials to completely anonymous usage.
Blocking these domains neutralizes multiple classes of current malware and data exfiltration.
Techniques
References
Lists
Paste Bins - Code
Observable Types: domain
Description
Functionally similar to “paste bins” with the added features of code storage, allowing abuse for C2.
Unlike regular paste bins, many organizations may implicitly trust these services for development code snippets and training. These services may also allow updating of code snippets via API.
These are not IOCs, but legitimate services that may be leveraged by an actor. Use this list to mitigate organizational risk accordingly.
Techniques
References
- https://authentic8.com/blog/what-is-pastebin-cyberthreat-intelligence/
- https://socradar.io/blog/top-5-paste-sites-used-by-threat-actors/
- https://community.hpe.com/t5/hpe-threat-labs/new-pastebin-like-service-used-in-multiple-malware-campaigns/ba-p/7265783
Lists
Unrestricted AI Services
Observable Types: domain
Description
Hosted AI / LLM service where safety mechanisms are deliberately removed or reduced.
Techniques
References
Lists
RPC Nodes
Observable Types: domain
Description
Etherhiding has become a common technique for malware second stages. While this is effective for dynamically cycling C2 addresses and third stages, it creates a hard reliance on cryptocurrency RPC node APIs to access the wallets and smart contracts that provide that dynamic information. As a result, blocking those RPC endpoints is a highly effective defensive strategy. This list comprises most known RPC nodes, and certainly the most popular.
Blocking these domains neutralizes multiple classes of current malware before damaging impact occurs.
Techniques
References
- https://ifin-intel.org/blog/etherhiding
- https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding
- https://www.netskope.com/blog/openclaw-trap-ai-assisted-lure-factory-targets-developers-gamers
- https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/
- https://labs.guard.io/etherhiding-hiding-web2-malicious-code-in-web3-smart-contracts-65ea78efad16
Lists
AI Meeting Bots
Observable Types: domain
Description
This list incudes AI Meeting “Notetaker” bots that join Microsoft Teams’ and Zoom meetings, posing a large risk of data exfiltration.
The list additionally includes “bot free” or “botless” AI notetakers and AI interview cheat agents. These tools work as overlays, hijacking the mic and screen, promising an invisible experience for the user and meeting participants. The layer between botless meeting notetakers and cheat bots is blurring, with additional FOSS versions on GitHub.
Botless agents may take the form of Windows and macOS installations, and in the case of Windows, installing to user folders to bypass UAC. They may also be web-based or operated through a browser extension. For the purpose of this list, we’re limited to domains for now, but defenders should be aware they will also need to hunt and block installations via browser stores and 3rd-party file-mirrors.
Some notetakers are designed for full API control, meaning there is a risk to of hidden inclusion within spyware and malware. Bots will still join meetings in these cases, so tenant controls are important.
Blocking unapproved domains at the egress and email limits the access, registration, proliferation of AI notetakers within an organization’s environment. Bidirectional blocks applied in email filters limit registration and forwarding of meetings to notetaking services.
Monday[.]com and clickup[.]com have been excluded due to the high-friction they encounter for many organizations, but include their own bots. Organizations should also consider Microsoft’s new Teams policy to block 3rd-party agents.
Techniques
References
- https://www.nudgesecurity.com/post/shadow-ai-is-taking-notes-the-growing-risk-of-ai-meeting-assistants
- https://apnews.com/article/ai-notetaker-work-meetings-privacy-data-c700299371ca7cfec77dafdfb948067f
- https://office365itpros.com/2026/08/24/teams-meeting-notetaking-bots/
- https://www.gruensteinlaw.com/news-memos/ai-notetaking-privilege-risks
- https://www.courtlistener.com/docket/71118721/brewer-v-otterai-inc/
Lists
Paste Bins
Observable Types: domain
Description
Public “paste bin” services allow (usually) anonymous posting and retrieval of arbitrary text.
These services are commonly abused as dead-drop resolvers, staging locations for second-stage payloads and scripts, and low-cost exfiltration destinations. Many are permitted by default because they aren’t categorized well by security vendors.
These are not IOCs, but legitimate services that may be leveraged by an actor. Use this list to mitigate organizational risk accordingly.
Techniques
References
- https://authentic8.com/blog/what-is-pastebin-cyberthreat-intelligence/
- https://socradar.io/blog/top-5-paste-sites-used-by-threat-actors/
- https://community.hpe.com/t5/hpe-threat-labs/new-pastebin-like-service-used-in-multiple-malware-campaigns/ba-p/7265783
- https://opensourcemalware.com/blog/introducing-weaselbiscuit
- https://blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm/