logo

LockBit 5’s “new secure blog domain” infra leaked already

ID: fc02cfd0-b429-55f0-a6d9-62987da9b5bb

STIX ID: report--fc02cfd0-b429-55f0-a6d9-62987da9b5bb

Feed Name: DataBreaches.Net

Threat Score
70/100

Date Published: 2025-12-07

Date Updated: 2026-05-13

Author: Dissent

...
...

The report describes the exposure of LockBit 5.0’s new leak-site infrastructure (domain karma0.xyz and IP 205.185.116.233) revealed on X.com, notes the group reposting/recycling victim data, references the group’s use of Smokeloader, and highlights scan findings of multiple open ports on the server — an operational-security failure defenders should block and monitor.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.