MalwarePublished 24 Apr 2026Updated 25 Apr 2026

tlp clear · Maltrail IOC for 2026-04-25

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

Maltrail IOC for 2026-04-25

Impact

The impact is assessed as medium risk based on the source classification. Since no specific vulnerabilities or exploits are identified, the impact is limited to the detection of potentially malicious network activity. There is no evidence of active exploitation or direct compromise from this IOC alone.

Defensive guidance

Security teams should consider this IOC as part of their threat detection and monitoring efforts but no urgent action is mandated by the vendor or source. Standard monitoring for related network activity may be prudent.

Summary

The report details a malware-related IOC identified by Maltrail on April 25, 2026, derived from CIRCL OSINT data. It represents an observation of suspicious network activity linked to malware but lacks detailed technical indicators or affected software versions. No exploits or vulnerabilities are explicitly described, and no remediation or patch is available.

Indicators of compromise

Domains 1,305

b0kdetsz.comnetsupport
extr-bkn.comnetsupport
hmstkoy.comnetsupport
extranet-books.comek_clearfake
shosurterk.comek_clearfake
tomcontrolls.comek_clearfake
youtude-dl.proek_clearfake
bkneu.comnetsupport
1eryou.comek_clearfake
1xbet-today.comek_clearfake

URLs 25

https://api.github.com/repos/stamparm/maltrail/commits/4a3cc46481bbc2cdfe7fbef7f50e9deb8fdbb5ccnetsupport
https://api.github.com/repos/stamparm/maltrail/commits/0b29470e9b752a9401013ce26bd3adeaac2056a2ek_clearfake
https://api.github.com/repos/stamparm/maltrail/commits/b1fef53b3798d0af19079f3f87cdfe111628ec7bnetsupport
https://api.github.com/repos/stamparm/maltrail/commits/3753fe8ea3d6a8510e7e89859e9638dabc0b7f0dek_clearfake
https://x.com/JAMESWT_WT/status/2047971403652043004ek_clearfake
https://x.com/skocherhan/status/2047973661018046916ek_clearfake
https://app.any.run/tasks/ff854da3-2b2e-46f5-8be7-20fa5100f62cek_clearfake
https://api.github.com/repos/stamparm/maltrail/commits/87bad85283881b2c889f77894b10c4c8c98aecfbhacked_npmrepos
https://x.com/npm_malware/status/2047770322938835364hacked_npmrepos
https://socket.dev/npm/package/ikyy/files/4.0.6/lib/buathtml.jshacked_npmrepos

IP addresses 4

176.65.139.81elf_mirai
176.65.139.131elf_mirai
176.65.139.0worst_asns
45.227.254.10netsupport

Community reviews

Loading reviews…