PAYLOAD IOCs (URLs, GitHub repos, Monero wallets) extracted from tarpit log
===========================================================================
Period: 2026-04-19 to 2026-05-06 UTC.

--- GitHub repositories referenced by attackers ---
repo	raw_url_observed	peer	first_seen
https://github.com/ApexDms/pv	https://raw.githubusercontent.com/ApexDms/pv/main/pool9.sh	5.75.200.1	2026-04-22T22:44:18Z

--- URLs ---
count	unique_peers	first_seen	last_seen	url	peers
10	1	2026-04-22T20:24:54.019128Z	2026-04-28T11:52:32.231045Z	https://204.76.203.196/sh	130.12.180.51
8	1	2026-04-22T19:44:46.894804Z	2026-04-23T17:28:51.585094Z	http://87.121.79.73/ok	193.142.146.230
8	1	2026-04-30T23:32:46.687499Z	2026-05-03T20:58:45.480466Z	https://125.135.169.171/sh	130.12.180.51
4	1	2026-04-28T20:08:00.739400Z	2026-04-30T13:12:00.493429Z	https://217.60.241.36/sh	130.12.180.51
2	1	2026-04-26T13:31:28.661286Z	2026-04-26T13:31:28.661286Z	http://176.65.132.197/cat.sh	151.115.54.206
2	1	2026-04-20T21:22:31.395059Z	2026-04-20T21:22:31.395059Z	https://46.151.182.82/sh	130.12.180.51
2	1	2026-04-19T21:52:48.037469Z	2026-04-20T02:16:32.369286Z	https://download.c3pool.org/xmrig_setup/raw/master/setup_c3pool_miner.sh	5.75.203.70
1	1	2026-04-22T22:44:18.161853Z	2026-04-22T22:44:18.161853Z	https://raw.githubusercontent.com/ApexDms/pv/main/pool9.sh	5.75.200.1

--- Monero wallet addresses ---
count	unique_peers	first_seen	last_seen	wallet	peers
2	1	2026-04-19T21:52:48.037469Z	2026-04-20T02:16:32.369286Z	45X8Lw1K5jwXvCyhtmf8vBjRfMs31UqMpXdzqbhuBKFnSZAmMxQRweW9VQmqr81bXB9QrHdQqqNGcgWn3aZ4yfHZL18a1eo	5.75.203.70
1	1	2026-04-22T22:44:18.161853Z	2026-04-22T22:44:18.161853Z	43SWagDS89Z1WaafHa7Cb4igfJqVKa6US2WchmxptbvmfJaf9gANzwy1brNprfZQsqQuPq1ie62WFSNF3fa7XmrGApPGr1P	5.75.200.1