Researchers Map DNS and WHOIS Infrastructure Linked to ForceMemo
Summary
An analysis of 20 network IoCs tied to ForceMemo used DNS and WHOIS data to identify look-alike registrations, linked domains and additional IPs; the researchers caution that some flagged entities may prove harmless.
Key points
- StepSecurity says ForceMemo reportedly injected the same malware into hundreds of Python repositories on developers’ GitHub accounts beginning March 8, 2026.
- The researchers analyzed 20 network IoCs: nine subdomains, five domains and six IP addresses, using DNS and WHOIS data to find related artifacts.
- The domain pocket[.]network was bulk-registered with 11 look-alike domains in 2022 and was flagged as likely registered with malicious intent in 2024.
- The nine subdomain IoCs mapped to code-repository and developer-service endpoints; the article says the associated domains were not categorized as malicious, though code hosted on them could have been injected.
- Historical WHOIS records yielded seven unique email addresses; reverse-WHOIS searches found 86 connected domains, and further DNS queries identified nine additional IPs, four already classified as malicious.
- The six IP IoCs were geolocated to France and administered by one ISP; historical resolution dates led the researchers to suggest the campaign may have moved to newer IPs.
- The analysis also found 557 string-connected domains. The authors caution that entities identified as threats may prove harmless and recommend further investigation.
Article Details
- Attack Vectors
- The ForceMemo campaign reportedly injected malware into hundreds of Python repositories on developers’ GitHub accounts beginning 2026-03-08.
- The investigation identified campaign-related domain and IP indicators, including a domain reported as bulk-registered with look-alike domains and IPs with historical domain resolutions.
- Defensive Notes
- Review relevant Python repositories for injected code and assess whether developer accounts or repository contents were compromised.
- Corroborate domain and IP findings before blocking or treating related infrastructure as malicious; the article cautions that some identified entities may later be deemed harmless.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | pocket[.]network | Identified as a ForceMemo campaign domain IoC; the article says it was bulk-registered with 11 look-alike domains and was flagged as likely registered with malicious intent. |
| IPV4 | 217[.]69[.]11[.]57 | Identified as a ForceMemo-related IP IoC; the article reports historical IP-to-domain resolutions and says the IP was geolocated to France. |
| IPV4 | 45[.]32[.]151[.]157 | Identified as a ForceMemo-related IP IoC; the article reports historical IP-to-domain resolutions and says the IP was geolocated to France. |
MITRE ATT&CK
T1195 · Supply Chain CompromiseThe campaign reportedly injected malware into hundreds of Python repositories on developers’ GitHub accounts.T1583.001 · DomainsThe article reports that pocket[.]network was bulk-registered with 11 look-alike domains.T1583.002 · DNS ServerThe article identifies campaign-related IP infrastructure and reports that the IP IoCs were administered by a single ISP; it also describes historical IP-to-domain resolutions.
Vendors
Products
Tools
DNS Chronicle APIDNS Chronicle API queries for the domains showed that four recorded 1,368 historical domain-to-IP resolutions over time.DNS Lookup APIWe then queried the domains on DNS Lookup API and learned that four actively resolved to nine unique IP addresses that were not in the list of IoCs.Domain Info APIWe then queried the domains on WHOIS API and filled in gaps (i.e., missing details) specifically for blockeden[.]xyz using Domain Info API, which gave us the latest available information from its historical records.First Watch Malicious Domains Data FeedOur searches on the First Watch Malicious Domains Data Feed, meanwhile, revealed that the same domain—pocket[.]network—was deemed to have been registered with malicious intent on 23 February 2024, 750 days before beingReverse WHOIS APIReverse WHOIS API queries for the public email addresses led to the discovery of 86 unique email-connected domains after those already named as IoCs were filtered out.Threat Intelligence APIThreat Intelligence API queries for the additional IP addresses revealed that four have already been weaponized for various attacks.Typosquatting Data FeedWe scoured the Typosquatting Data Feed and found out that the domain pocket[.]network was bulk-registered with 11 look-alike domains on 20 April 2022.WHOIS APIWe then queried the domains on WHOIS API and filled in gaps (i.e., missing details) specifically for blockeden[.]xyz using Domain Info API, which gave us the latest available information from its historical records.WHOIS History APIWe began by querying the five domains tagged as IoCs on WHOIS History API.WhoisXML API MCP ServerWe extracted domains from the subdomains tagged as IoCs and weeded out those that belonged to legitimate entities aided by the WhoisXML API MCP Server.