First seen January 15, 2026 · Last seen March 20, 2026 · Campaign
Public preview
IOC type, status and defensive guidance visible. Pro adds alert context, Pro+ adds exports and deeper relationships.
Context
Expired mock C2 IP from Operation EduLock campaign targeting education sector. No longer active.
Defensive Guidance
Historical indicator. Retain in threat intelligence for correlation. No active blocking required.
Tags
Safety Note
RFC 5737 documentation IP (192.0.2.0/24). Not a real indicator.
Actions
