LockBit 5’s “new secure blog domain” infra leaked already

DataBreaches[.]Net reports that LockBit 5’s claimed “new secure blog domain” infrastructure has already been exposed, with details shared in a December X post revealing the server’s IP address and domain. The post on X[.]com by @RakeshKrish12 shows IP 205.185.116[.]233 and domain karma0[.]xyz, registered 2 November 2025, and notes that LockBit Group uses Smokeloader in their attacks.

The same source mentions that on 4 December 2025 the group announced 23 new victims on their DLS, with 11 victims recycled from April 2025 LockBit Leaks and 2 victims from Weyhro and RansomHouse Group. According to Cyber Security News, scans reveal multiple open ports on the IP, including vulnerable remote access, exposing the server to potential disruption and highlighting ongoing opsec failures for the group.

DataBreaches[.]Net attaches cautionary context to these findings, emphasising the need for defenders to monitor and for researchers to track further leaks.