ThreatFox IOCs for 2025-02-23

Severity: mediumType: malware

AI Analysis

Technical Summary

The provided information pertains to a malware-related threat identified as "ThreatFox IOCs for 2025-02-23," sourced from ThreatFox, a platform known for sharing Indicators of Compromise (IOCs) and threat intelligence data. The threat is categorized under "type:osint," indicating that it primarily involves open-source intelligence data or is related to OSINT methodologies. There are no specific affected product versions or detailed technical indicators provided, and no known exploits in the wild have been reported. The threat level is rated as 2 on an unspecified scale, with an analysis rating of 1 and a distribution rating of 3, suggesting moderate dissemination potential but limited detailed analysis or technical depth available. The absence of CWE identifiers and patch links implies that this threat may not be tied to a specific vulnerability or software flaw but rather represents a collection or dissemination of malicious indicators or malware samples. The lack of indicators and technical details restricts the ability to perform a deep technical dissection; however, the classification as malware and the medium severity rating suggest that this threat could potentially be used in cyber operations involving reconnaissance, infection, or lateral movement if leveraged by threat actors. Given the TLP (Traffic Light Protocol) white tag, the information is intended for unrestricted sharing, which may facilitate widespread awareness and defensive measures across organizations.

Potential Impact

For European organizations, the impact of this threat is currently limited due to the absence of known active exploits and specific affected systems. However, the distribution rating of 3 indicates a moderate potential for spread, which could lead to increased exposure to malware-related activities such as data exfiltration, system compromise, or network infiltration if threat actors utilize these IOCs effectively. Organizations relying on OSINT tools or integrating ThreatFox data into their security operations centers (SOCs) may experience an increased workload in triaging alerts related to these IOCs. Additionally, if the malware or associated indicators are part of a broader campaign targeting critical infrastructure, governmental, or financial sectors, the impact could escalate, affecting confidentiality, integrity, and availability of sensitive data and services. The medium severity rating reflects a balanced risk where the threat is notable but not currently critical, emphasizing the need for vigilance without immediate alarm.

Mitigation Recommendations

1. Integrate ThreatFox IOCs into existing threat intelligence platforms and security information and event management (SIEM) systems to enhance detection capabilities. 2. Conduct regular OSINT monitoring to identify emerging indicators related to this threat and update defensive measures accordingly. 3. Implement network segmentation and strict access controls to limit potential lateral movement if malware infection occurs. 4. Enhance endpoint detection and response (EDR) solutions to recognize and quarantine suspicious activities linked to the shared IOCs. 5. Train SOC analysts to recognize patterns associated with OSINT-related malware campaigns and to prioritize alerts based on contextual threat intelligence. 6. Maintain up-to-date backups and incident response plans tailored to malware incidents, ensuring rapid recovery and containment. 7. Collaborate with information sharing and analysis centers (ISACs) within Europe to exchange intelligence and coordinate defensive actions specific to regional threat landscapes.

Affected Countries

Germany, France, United Kingdom, Netherlands, Italy, Spain, Poland

Indicators of Compromise

domain: check.aayai.icu
file: 159.223.83.97
hash: 59666
domain: batnet.proxyapi.my.id
url: https://metalcourthur.fun/api
domain: metalcourthur.fun
domain: uncertainyelemz.bet
domain: prideforgek.fun
domain: subawhipnator.life
domain: privileggoe.live
domain: decreaserid.world
url: https://hobbyedsmoker.live/api
url: https://goaledharmfuk.live/api
url: https://baconqualit.live/api
url: https://resqueoppos.live/api
url: https://privileggoe.live/api
url: https://concentratecr.world/api
url: https://neglectdivid.world/api
domain: hobbyedsmoker.live
domain: goaledharmfuk.live
domain: baconqualit.live
domain: resqueoppos.live
domain: privileggoe.live
domain: concentratecr.world
url: https://miscrirarisz.today/api
url: https://owerenvokken.run/api
url: https://reasonablerwi.today/api
url: https://bennedospok.run/api
url: https://dryentaidne.run/api
url: https://grendyreushe.run/api
url: https://porkedbunned.run/api
url: https://lawyesaved.today/api
url: https://deaddereaste.today/api
url: https://kurrenpowed.run/api
domain: bennedospok.run
domain: dryentaidne.run
domain: grendyreushe.run
domain: porkedbunned.run
domain: deaddereaste.today
domain: download.caringheadboard.buzz
domain: ping.caringheadboard.buzz
domain: ai.fdswgw.shop
domain: vatloopedo.bet
file: 94.154.34.34
hash: 3778
url: https://seraphicridge.xyz/mdqyztc1mju5mjzi/
url: https://crimsonpeak.xyz/odmyzdm0yjliownl/
url: https://shadowpeak.xyz/ywvhnmm2otc3mzzi/
url: http://289098cm.shnyash.ru/phpcentral.php
file: 192.236.147.186
hash: 80
file: 54.159.96.171
hash: 443
file: 89.23.108.220
hash: 443
file: 179.43.171.220
hash: 3390
file: 128.90.123.17
hash: 8808
file: 37.114.57.39
hash: 7443
domain: 12825.funian.xyz
url: http://593412cm.nyanyash.ru/externallinemultidefaulttrafficwpcentraluploads.php
file: 37.18.37.70
hash: 444
file: 175.27.241.169
hash: 80
file: 189.150.95.96
hash: 1604
file: 103.186.117.61
hash: 2404
domain: blackbirdessential.cloud
file: 13.38.77.31
hash: 7443
file: 41.251.18.204
hash: 18246
file: 41.251.18.204
hash: 19096
file: 41.251.18.204
hash: 49152
file: 41.251.18.204
hash: 43
file: 173.208.190.227
hash: 80
file: 161.248.87.243
hash: 8888
file: 115.77.122.212
hash: 8808
file: 83.168.105.166
hash: 80
file: 13.210.62.90
hash: 443
file: 16.170.155.214
hash: 3333
file: 18.197.6.78
hash: 80
file: 43.200.119.184
hash: 80
file: 144.48.240.54
hash: 3333
file: 34.23.189.87
hash: 3333
file: 3.86.227.121
hash: 3333
url: http://610188cm.nyanyash.ru/vmcpugamesqlcentral.php
domain: check.oaaea.icu
url: https://check.oaaea.icu/gkcxv.google
domain: check.iuuoo.icu
url: http://a1081343.xsph.ru/0fce162f.php
url: https://check.iuuoo.icu/gkcxv.google
domain: check.ioeoe.icu
url: http://175.107.2.254:50638/mozi.m
url: https://check.ioeoe.icu/gkcxv.google
file: 124.222.122.160
hash: 8845
file: 49.234.38.224
hash: 50050
file: 185.239.86.3
hash: 8099
file: 184.174.96.162
hash: 31337
file: 95.169.203.67
hash: 31337
file: 64.94.85.91
hash: 31337
file: 196.251.69.39
hash: 31337
file: 190.10.11.55
hash: 6001
file: 15.152.34.157
hash: 221
file: 18.133.140.136
hash: 15
file: 197.44.133.250
hash: 6001
file: 24.248.236.7
hash: 9001
file: 70.168.169.19
hash: 4433
file: 24.249.21.245
hash: 1080
file: 24.248.236.7
hash: 62078
file: 185.189.200.20
hash: 443
file: 35.225.155.44
hash: 4443
file: 141.95.193.74
hash: 3333
url: http://5.42.64.28/39f98d2ea5ca5476/sqlite3.dll
url: http://185.254.37.234/61c7c6a1a965cae9/vcruntime140.dll
url: http://91.92.240.120/5ae9ffc2ed73fda7/vcruntime140.dll
url: http://5.35.36.211/b1204656088244d5/mozglue.dll
url: http://5.35.36.211/b1204656088244d5/vcruntime140.dll
url: http://5.35.36.211/b1204656088244d5/sqlite3.dll
url: http://109.206.241.81/htdocs/bmqkbenzdymsrtz.exe
url: http://81.161.229.110/htdocs/btmicczwxrrytqj.exe
url: http://87.120.84.38/txt/rnuwcr38irnohzk.exe
url: https://potentiashelt.site/api
url: https://embarkiffe.shop/api
url: https://sebel.sbs/devil/pws/pvqdq929bsx_a_d_m1n_a.php
url: https://recaptcha-phish.pages.dev/
url: https://api.telegram.org/bot5656780330:aahzylie6okscdg1d9lg5rtz3msapsmed3u/
domain: hvip.freeddns.org
domain: maintenance-embedded.gl.at.ply.gg
domain: cobolrationumelawrtewarms.co
url: https://pastebin.com/raw/wxyjm7vm
domain: projects-sunny.gl.at.ply.gg
domain: study-conclusions.gl.at.ply.gg
domain: visit-judges.gl.at.ply.gg
file: 147.185.221.21
hash: 4709
file: 185.232.205.104
hash: 5555
file: 47.115.144.12
hash: 7000
file: 161.248.87.245
hash: 8888
domain: trumpboost.com
domain: v279259.hosted-by-vdsina.com
file: 147.189.170.105
hash: 7000
file: 195.26.240.251
hash: 4782
file: 174.70.151.61
hash: 2406
file: 15.228.237.18
hash: 88
file: 51.17.159.232
hash: 52662
domain: check.auieu.icu
url: https://check.auieu.icu/gkcxv.google
file: 113.44.194.13
hash: 8888
domain: check.ieooy.icu
url: https://check.ieooy.icu/gkcxv.google
file: 1.161.106.193
hash: 443
file: 117.135.222.2
hash: 4506
file: 143.198.18.85
hash: 8888
file: 172.232.236.45
hash: 443
file: 2.88.94.239
hash: 995
file: 3.101.57.14
hash: 18246
domain: sha-11x.pages.dev
file: 43.153.17.95
hash: 4000
file: 43.153.53.237
hash: 4000
url: https://176.111.216.82:3333/login
domain: check.eooii.icu
url: https://check.eooii.icu/gkcxv.google
domain: check.ueoie.icu
url: https://check.ueoie.icu/gkcxv.google
domain: check.eioye.icu
url: https://check.eioye.icu/gkcxv.google
domain: check.iyuei.icu
url: https://check.iyuei.icu/gkcxv.google
file: 173.208.190.227
hash: 4258
domain: dns-verify-me.pro
file: 87.121.84.56
hash: 38777
domain: human-verify.shop
domain: human-verify-4r.pro
url: http://u1.gossipsurrender.shop/china.mp4
domain: u1.gossipsurrender.shop
file: 213.152.161.114
hash: 43366
domain: check.aiyay.icu
url: https://check.aiyay.icu/gkcxv.google
file: 45.125.66.124
hash: 69
file: 198.98.50.251
hash: 2214
file: 217.195.153.175
hash: 2214
file: 45.61.169.138
hash: 2214
file: 199.195.248.181
hash: 2214
file: 154.12.94.68
hash: 1995
domain: ownerbotnet.opyddos.my.id
domain: z17fz0bleone.com
domain: lmikelnf.com
domain: l49ulrayu.com
domain: jqt98lp5859rjjerry.club
domain: cmarleneu24delores.top
domain: dmurrayh52k.club
domain: r52yoo.top
domain: fsg8869eih.com
domain: wxan.com
domain: osakax.zapto.org
domain: walledd.no-ip.org
domain: zohan.dyndns-free.com
domain: caprilesradosky.no-ip.org
domain: jejemon6969.no-ip.biz
domain: vvindows32system.zapto.org
domain: camfrogvmm.no-ip.org
domain: imtifade.servebeer.com
domain: amriknation.no-ip.org
domain: khkh.no-ip.info
domain: h07.no-ip.org
domain: smashscape.no-ip.biz
domain: yassin2009.zapto.org
domain: cybergate01.no-ip.biz
domain: zarrixhost.no-ip.biz
domain: daimond.no-ip.biz
domain: tamaghart.no-ip.biz
domain: codeur-dz.no-ip.biz
domain: datatransferserver.servehttp.com
domain: newday.zapto.org
domain: aspirinx.no-ip.org
domain: victor-fs.no-ip.org
domain: nd1.no-ip.biz
domain: smedders.no-ip.biz
domain: coelkas.dyndns.org
domain: chupacrew.no-ip.org
domain: kylezyzz.no-ip.biz
domain: katilim.dyndns.org
domain: cpthero.sytes.net
domain: future.bounceme.net
domain: cyberjesse.no-ip.biz
domain: jamee.no-ip.info
domain: soq.zapto.org
domain: runescapeauth.no-ip.biz
domain: bifrost007.no-ip.biz
domain: cow.myvnc.com
domain: ldoormoj.no-ip.biz
domain: alwasn4.noip.biz
domain: rahhoum.no-ip.biz
domain: 10line.zapto.org
domain: tehguvs.no-ip.org
domain: worry.zapto.org
domain: nessview.no-ip.org
domain: secatrix.no-ip.org
domain: prohomst.zapto.org
domain: dnsservice.sytes.net
domain: taliban.no-ip.org
domain: mtesthost.dynu.com
domain: zaferseyit.dinamikdns.com
domain: gpx.servehalflife.com
domain: mska.no-ip.biz
domain: mohamedmz.no-ip.biz
domain: skunz.no-ip.biz
domain: darkconsumption.no-ip.org
domain: boner-scape.no-ip.org
domain: bajs.zapto.org
domain: subgoofy.no-ip.info
domain: vlemzik.no-ip.org
domain: hlangdale.no-ip.org
domain: salim10.no-ip.biz
domain: pittskaterg.no-ip.biz
domain: sweetaz3ar.no-ip.org
domain: roma93.no-ip.info
domain: bernhad.servblog.net
domain: cybernon.zapto.org
domain: ohbex.no-ip.org
domain: mhjul.no-ip.org
domain: amjadd.no-ip.biz
domain: karammm.no-ip.biz
domain: youdontmattertome.no-ip.biz
domain: mr-sahi.no-ip.biz
domain: xyat.no-ip.biz
domain: xa4.no-ip.info
domain: dub1337.no-ip.biz
domain: alwasn2.noip.biz
domain: cyber1236.no-ip.biz
domain: leoesgay.zapto.org
domain: whds.no-ip.org
domain: darkcomet5.no-ip.biz
domain: haker2015.no-ip.biz
domain: karalkasap5.no-ip.org
domain: kabomaxx.no-ip.org
domain: ua1.darksell.com
domain: jedixsuca.bounceme.net
domain: probandopoison.no-ip.org
domain: awesomeip4125.no-ip.info
domain: ownerbybicekangel.no-ip.org
domain: 401828766.no-ip.biz
domain: hackeed.zapto.org
domain: tokkan.zapto.org
domain: livepix.no-ip.info
domain: risipc.no-ip.biz
domain: projectxile.no-ip.org
domain: a7bk.no-ip.info
domain: floyd69.zapto.org
domain: pknju.sytes.net
domain: shadowhack1.no-ip.biz
domain: zort205.zapto.org
domain: abdelellah.zapto.org
domain: opybiddo.zapto.org
domain: my1337shiz.no-ip.org
domain: lkdrgtwty.no-ip.org
domain: paltalkes.no-ip.org
domain: samahatony.no-ip.info
file: 92.69.255.47
hash: 2754
file: 200.82.129.56
hash: 2998
file: 85.137.57.212
hash: 59
file: 81.169.247.195
hash: 8080
file: 122.224.4.113
hash: 443
file: 96.23.147.93
hash: 100
file: 89.2.212.121
hash: 81
file: 41.238.76.87
hash: 81
file: 201.82.49.10
hash: 25565
file: 103.9.77.253
hash: 4444
file: 194.15.36.98
hash: 1111
file: 194.87.138.40
hash: 700
file: 185.145.131.243
hash: 23
file: 138.197.71.23
hash: 12345
file: 193.239.147.7
hash: 4258
file: 179.43.146.30
hash: 23
file: 84.200.154.119
hash: 4567
file: 198.167.140.187
hash: 53
file: 13.78.133.250
hash: 152
file: 64.188.99.14
hash: 4258
file: 156.229.233.170
hash: 6149
file: 185.239.242.109
hash: 4269
file: 162.249.170.28
hash: 666
file: 107.175.69.129
hash: 12345
file: 193.239.147.192
hash: 23
file: 45.43.18.249
hash: 4258
file: 31.7.62.118
hash: 65000
file: 85.209.0.57
hash: 4258
file: 185.189.151.64
hash: 42516
file: 157.245.83.214
hash: 4258
file: 40.114.85.63
hash: 872
file: 37.120.222.43
hash: 42516
file: 84.200.154.119
hash: 4568
file: 51.222.140.164
hash: 839
file: 23.94.24.13
hash: 49998
file: 107.175.69.114
hash: 812
file: 171.22.27.172
hash: 1024
file: 185.145.131.173
hash: 23
file: 37.44.238.66
hash: 23
file: 13.78.133.250
hash: 252
file: 185.239.242.5
hash: 811
file: 167.99.218.185
hash: 800
file: 23.94.99.40
hash: 872
file: 37.46.150.225
hash: 4258
file: 45.141.58.75
hash: 839
file: 35.180.191.56
hash: 4545
file: 185.165.29.24
hash: 444
file: 167.99.211.83
hash: 666
file: 199.195.248.181
hash: 606
file: 50.115.174.112
hash: 839
file: 77.247.178.189
hash: 23
file: 13.81.41.97
hash: 872
file: 69.90.132.142
hash: 53
file: 149.56.7.255
hash: 839
file: 46.29.163.64
hash: 443
file: 35.180.191.56
hash: 1331
file: 13.78.133.250
hash: 23
file: 185.189.151.195
hash: 42516
file: 185.239.242.5
hash: 1111
file: 104.236.60.124
hash: 1111
file: 79.133.46.173
hash: 666
file: 20.73.180.13
hash: 872
file: 185.145.131.236
hash: 23
file: 107.174.34.70
hash: 23
file: 45.80.149.159
hash: 1337
file: 194.37.82.160
hash: 292
domain: uyt.hopto.org
domain: allseeingeyes.ddns.net
domain: gospish.no-ip.biz
domain: bugzteam.no-ip.org
domain: rsnoip.zapto.org
domain: nsoonsamer.no-ip.biz
domain: zayan.no-ip.org
domain: leetrsps.zapto.org
domain: tqmix7.no-ip.biz
domain: faction212.no-ip.biz
domain: grrga.no-ip.biz
domain: gandhihaxx.no-ip.org
domain: live1.no-ip.org
domain: fangsnake3.zapto.org
domain: pourmoi.zapto.org
domain: swaglife.no-ip.org
domain: nbn9hide46fro8mu.hopto.org
domain: ankie123.zapto.org
domain: orik745.redirectme.net
domain: jomomma259.no-ip.biz
domain: ratdoshuzo.no-ip.biz
domain: t4t00.no-ip.biz
domain: nydarion2.zapto.org
domain: mrdn.no-ip.biz
domain: otthon.no-ip.biz
domain: dofusrude.no-ip.biz
domain: 07scape.zapto.org
domain: callboyblf.no-ip.org
domain: ijskar135.no-ip.biz
domain: minecraftnet.servegame.com
domain: asyoffset.no-ip.org
domain: eurancia.no-ip.org
domain: myrat123.no-ip.biz
domain: barbarian.no-ip.biz
domain: kaypiper.no-ip.org
domain: ad2.admart.tv
domain: rjsrat.servebeer.com
domain: windowsing.no-ip.org
domain: pirata88.no-ip.biz
domain: hostmeiii.no-ip.info
domain: joeastig.no-ip.biz
domain: chavo2.zapto.org
domain: dcbooter.no-ip.info
domain: toddxdgold.no-ip.biz
domain: cabalth.no-ip.biz
domain: asdfghjas.3322.org
domain: dan123.no-ip.info
domain: dnsscertsmb.no-ip.org
domain: fatgrandma.no-ip.org
domain: rainbowclaydough.myftp.org
domain: aris617.no-ip.org
domain: musculaire.servebeer.com
domain: nipa1.hopto.org
domain: gamzelim110.no-ip.biz
domain: mo3u8se.no-ip.org
domain: chrisssssssssssss.zapto.org
domain: dcrat.no-ip.org
domain: ludovicflorent1.no-ip.org
domain: xtremeproxy1.sytes.net
domain: johnjohn186.no-ip.org
domain: eikyuu.no-ip.org
domain: sfacc51.zapto.org
domain: emilnordman.no-ip.biz
domain: chitan.myftp.org
domain: portforward.zapto.org
domain: chirdent.no-ip.org
domain: nxxbkiller.no-ip.biz
domain: dcdemerde.no-ip.org
domain: wndsmanager.no-ip.biz
domain: dangerous0.zapto.org
domain: n76.no-ip.info
domain: hackers-2007.zapto.org
domain: black12345.zapto.org
domain: aylin.sytes.net
domain: gauss89.no-ip.biz
domain: nikki.no-ip.biz
domain: bugzteam.no-ip.biz
domain: annodomini1771.no-ip.info
domain: limboland1.no-ip.biz
domain: darkvader.zapto.org
domain: 3247828.no-ip.org
domain: coolcrazyfly.no-ip.biz
domain: moker1234.no-ip.biz
domain: villainouswitch.no-ip.org
domain: toxyde.no-ip.biz
domain: minecraftserverc.no-ip.biz
file: 5.19.149.204
hash: 1604
file: 117.205.58.32
hash: 1604
file: 110.33.161.101
hash: 14499
file: 91.67.105.101
hash: 1601
file: 5.19.149.204
hash: 1243
file: 178.83.184.7
hash: 1604
file: 82.222.203.137
hash: 81
file: 84.169.70.18
hash: 1604
file: 62.1.148.197
hash: 85
file: 173.175.148.195
hash: 1602
file: 76.123.20.198
hash: 1604
file: 62.10.212.197
hash: 1604
file: 41.239.67.138
hash: 1604
file: 150.95.104.230
hash: 80
file: 47.93.33.30
hash: 80
file: 8.138.34.17
hash: 80
file: 5.181.158.24
hash: 587
file: 103.195.236.246
hash: 2404
file: 139.59.240.97
hash: 5000
file: 196.251.71.89
hash: 443
file: 52.53.221.221
hash: 6362
file: 13.38.47.41
hash: 8080
url: http://fluf5ikyan.temp.swtest.ru/d71be0a9.php
domain: speedtransitnet.com
file: 209.133.211.242
hash: 8888
file: 69.46.16.164
hash: 8888
url: http://u1.gossipsurrender.shop/camcorder.m4a
domain: botnet.voct.org
file: 178.162.156.169
hash: 2020
domain: check.oeoye.icu
url: https://check.oeoye.icu/gkcxv.google
domain: check.zoxod.icu
url: https://check.zoxod.icu/gkcxv.google
file: 185.224.0.240
hash: 3778
file: 91.188.254.129
hash: 1311
file: 87.121.84.56
hash: 20722
file: 87.121.84.56
hash: 2454
file: 87.121.84.56
hash: 6007
file: 87.121.84.56
hash: 2079
file: 87.121.84.56
hash: 2404
file: 87.121.84.56
hash: 5985
file: 87.121.84.56
hash: 11112
file: 87.121.84.56
hash: 21942
file: 87.121.84.56
hash: 1883
file: 87.121.84.56
hash: 1962
file: 87.121.84.56
hash: 10258
file: 87.121.84.56
hash: 15256
file: 87.121.84.56
hash: 16992
file: 87.121.84.56
hash: 20546
file: 87.121.84.56
hash: 2038
file: 87.121.84.56
hash: 8081
file: 87.121.84.56
hash: 21037
file: 87.121.84.56
hash: 22705
file: 87.121.84.56
hash: 1912
file: 87.121.84.56
hash: 1961
file: 185.121.15.44
hash: 1295
file: 194.85.251.80
hash: 2143
file: 194.85.251.80
hash: 5977
file: 194.85.251.80
hash: 14265
file: 194.85.251.80
hash: 22585
file: 194.85.251.80
hash: 2086
file: 194.85.251.80
hash: 22222
file: 194.85.251.80
hash: 16993
file: 194.85.251.80
hash: 2080
file: 194.85.251.80
hash: 5957
file: 194.85.251.80
hash: 6007
file: 194.85.251.80
hash: 6362
file: 194.85.251.80
hash: 3389
file: 194.85.251.80
hash: 3260
file: 194.85.251.80
hash: 17763
file: 194.85.251.80
hash: 18444
file: 194.85.251.80
hash: 15568
file: 194.85.251.80
hash: 1961
file: 194.85.251.80
hash: 1963
file: 194.85.251.80
hash: 6238
file: 194.85.251.80
hash: 8088
file: 194.85.251.80
hash: 9599
file: 194.85.251.80
hash: 17761
file: 194.85.251.80
hash: 18246
file: 194.85.251.80
hash: 20548
file: 194.85.251.80
hash: 14326
file: 209.200.246.80
hash: 1311
file: 194.85.251.79
hash: 4369
file: 194.85.251.79
hash: 5671
file: 194.85.251.79
hash: 6362
file: 194.85.251.79
hash: 11101
file: 194.85.251.79
hash: 16765
file: 194.85.251.79
hash: 18673
file: 194.85.251.79
hash: 1801
file: 194.85.251.79
hash: 2281
file: 194.85.251.79
hash: 5324
file: 194.85.251.79
hash: 5985
file: 194.85.251.79
hash: 15443
file: 194.85.251.79
hash: 2096
file: 194.85.251.79
hash: 10002
file: 194.85.251.79
hash: 1949
file: 194.85.251.79
hash: 5000
file: 194.85.251.79
hash: 5061
file: 194.85.251.79
hash: 18245
file: 217.195.153.175
hash: 1311
file: 109.104.153.181
hash: 1291
file: 45.61.169.138
hash: 1299
file: 91.244.197.150
hash: 1311
file: 87.121.84.84
hash: 4242
file: 87.121.84.84
hash: 6005
file: 87.121.84.84
hash: 6808
file: 87.121.84.84
hash: 8387
file: 87.121.84.84
hash: 2086
file: 87.121.84.84
hash: 2281
file: 87.121.84.84
hash: 3389
file: 87.121.84.84
hash: 3684
file: 87.121.84.84
hash: 10002
file: 87.121.84.84
hash: 18444
file: 87.121.84.84
hash: 2087
file: 87.121.84.84
hash: 4840
file: 87.121.84.84
hash: 9999
file: 87.121.84.84
hash: 21104
file: 87.121.84.84
hash: 9052
file: 87.121.84.84
hash: 11450
file: 87.121.84.84
hash: 16561
file: 87.121.84.84
hash: 18244
file: 87.121.84.84
hash: 2077
file: 87.121.84.84
hash: 5061
file: 87.121.84.84
hash: 8010
file: 87.121.84.84
hash: 10259
file: 193.17.183.20
hash: 1308
file: 154.213.200.12
hash: 1289
file: 91.244.197.12
hash: 1311
file: 199.195.248.181
hash: 1311
file: 185.198.58.166
hash: 1298
file: 216.146.25.64
hash: 1311
file: 216.146.25.49
hash: 1298
file: 172.86.73.60
hash: 1309
file: 87.121.61.24
hash: 1311
file: 128.254.207.40
hash: 1286
file: 204.76.203.175
hash: 1311
file: 103.214.71.65
hash: 1311
file: 103.214.71.66
hash: 1311
file: 103.214.71.67
hash: 1311
file: 216.73.158.27
hash: 1293
file: 158.69.175.235
hash: 1294
file: 103.214.71.72
hash: 1311
file: 204.76.203.188
hash: 1338
file: 204.76.203.173
hash: 1311
file: 185.121.15.49
hash: 1311
url: https://top.4t.com/
url: https://65.109.226.203/
domain: top.4t.com
file: 65.109.226.203
hash: 443
file: 87.121.84.84
hash: 1311
file: 87.121.84.56
hash: 1311
file: 194.85.251.80
hash: 1311
file: 194.85.251.79
hash: 1311
file: 47.122.1.243
hash: 80
file: 103.80.19.179
hash: 52668
file: 103.80.19.180
hash: 52668
file: 128.90.123.17
hash: 5000
file: 69.48.202.241
hash: 7707
domain: webmail.10bestbusiness.website
domain: cpanel.sportscasino.website
domain: check.fuher.icu
url: https://check.fuher.icu/gkcxv.google
file: 156.238.238.83
hash: 3883
domain: check.nevyz.icu
url: https://check.nevyz.icu/gkcxv.google
url: http://u1.gossipsurrender.shop/12.mp4
file: 160.22.161.157
hash: 56999
domain: sroglad.com
file: 202.95.22.2
hash: 4433
url: https://uokota.online/concerto/blend
url: https://chekagustario.com/
url: https://booking.chekagustario.com/
domain: effectsstardust.shop
domain: check.sinev.icu
url: https://check.sinev.icu/gkcxv.google
file: 194.85.251.76
hash: 1999
file: 161.248.239.28
hash: 80
file: 196.251.84.215
hash: 789
file: 185.91.72.143
hash: 443
file: 69.48.202.241
hash: 6606
file: 92.255.85.23
hash: 15647
file: 92.255.85.23
hash: 15747
file: 102.117.173.86
hash: 7443
file: 105.69.240.227
hash: 8080
file: 173.249.52.37
hash: 443
domain: cpcontacts.fivetopbusiness.xyz
domain: cpcontacts.bestgamesofufabet.xyz
domain: webmail.sportsfootball.website
domain: webdisk.businesseshub.xyz
domain: webmail.enjoyedufabet.xyz
domain: webmail.businesspros.xyz
domain: cpanel.dmfortsites.xyz
domain: cpcontacts.artnewzdaily.xyz
domain: webmail.homeremodel.website
domain: cpcontacts.generalztipsal.xyz
domain: webdisk.businesswithloyal.website
domain: webmail.dgmrtktnewz.website
domain: webdisk.businesshostz.xyz
domain: cpanel.domizmusk.website
domain: cpanel.fieldznorms.xyz
file: 193.124.205.36
hash: 33006
url: https://check.losex.icu/gkcxv.google
file: 188.253.125.96
hash: 2096
url: http://u1.shalebrussels.shop/china.mp4
domain: u1.shalebrussels.shop
file: 200.91.114.50
hash: 443
file: 44.246.4.119
hash: 443
file: 101.34.66.77
hash: 50050
file: 107.175.194.55
hash: 443
file: 216.118.230.118
hash: 31337
file: 216.126.229.110
hash: 31337
file: 185.102.75.120
hash: 31337
file: 216.118.230.114
hash: 31337
file: 54.170.28.226
hash: 12209
file: 43.207.217.215
hash: 993
file: 61.76.179.183
hash: 6000
file: 196.251.90.21
hash: 54984
file: 72.219.193.69
hash: 8880
file: 13.60.202.169
hash: 443
file: 47.129.14.236
hash: 3306
url: http://542148cm.nyanyash.ru/phpsecuregeo.php
url: http://439153cm.nyashk.ru/geosqlwpuploads.php

ThreatFox IOCs for 2025-02-23

Severity: medium

Type: malware

ThreatFox IOCs for 2025-02-23

Technical Summary

Potential Impact

Mitigation Recommendations

Affected Countries

Germany, France, United Kingdom, Netherlands, Italy, Spain, Poland

Indicators of Compromise

domain: check.aayai.icu
file: 159.223.83.97
hash: 59666
domain: batnet.proxyapi.my.id
url: https://metalcourthur.fun/api
domain: metalcourthur.fun
domain: uncertainyelemz.bet
domain: prideforgek.fun
domain: subawhipnator.life
domain: privileggoe.live
domain: decreaserid.world
url: https://hobbyedsmoker.live/api
url: https://goaledharmfuk.live/api
url: https://baconqualit.live/api
url: https://resqueoppos.live/api
url: https://privileggoe.live/api
url: https://concentratecr.world/api
url: https://neglectdivid.world/api
domain: hobbyedsmoker.live
domain: goaledharmfuk.live
domain: baconqualit.live
domain: resqueoppos.live
domain: privileggoe.live
domain: concentratecr.world
url: https://miscrirarisz.today/api
url: https://owerenvokken.run/api
url: https://reasonablerwi.today/api
url: https://bennedospok.run/api
url: https://dryentaidne.run/api
url: https://grendyreushe.run/api
url: https://porkedbunned.run/api
url: https://lawyesaved.today/api
url: https://deaddereaste.today/api
url: https://kurrenpowed.run/api
domain: bennedospok.run
domain: dryentaidne.run
domain: grendyreushe.run
domain: porkedbunned.run
domain: deaddereaste.today
domain: download.caringheadboard.buzz
domain: ping.caringheadboard.buzz
domain: ai.fdswgw.shop
domain: vatloopedo.bet
file: 94.154.34.34
hash: 3778
url: https://seraphicridge.xyz/mdqyztc1mju5mjzi/
url: https://crimsonpeak.xyz/odmyzdm0yjliownl/
url: https://shadowpeak.xyz/ywvhnmm2otc3mzzi/
url: http://289098cm.shnyash.ru/phpcentral.php
file: 192.236.147.186
hash: 80
file: 54.159.96.171
hash: 443
file: 89.23.108.220
hash: 443
file: 179.43.171.220
hash: 3390
file: 128.90.123.17
hash: 8808
file: 37.114.57.39
hash: 7443
domain: 12825.funian.xyz
url: http://593412cm.nyanyash.ru/externallinemultidefaulttrafficwpcentraluploads.php
file: 37.18.37.70
hash: 444
file: 175.27.241.169
hash: 80
file: 189.150.95.96
hash: 1604
file: 103.186.117.61
hash: 2404
domain: blackbirdessential.cloud
file: 13.38.77.31
hash: 7443
file: 41.251.18.204
hash: 18246
file: 41.251.18.204
hash: 19096
file: 41.251.18.204
hash: 49152
file: 41.251.18.204
hash: 43
file: 173.208.190.227
hash: 80
file: 161.248.87.243
hash: 8888
file: 115.77.122.212
hash: 8808
file: 83.168.105.166
hash: 80
file: 13.210.62.90
hash: 443
file: 16.170.155.214
hash: 3333
file: 18.197.6.78
hash: 80
file: 43.200.119.184
hash: 80
file: 144.48.240.54
hash: 3333
file: 34.23.189.87
hash: 3333
file: 3.86.227.121
hash: 3333
url: http://610188cm.nyanyash.ru/vmcpugamesqlcentral.php
domain: check.oaaea.icu
url: https://check.oaaea.icu/gkcxv.google
domain: check.iuuoo.icu
url: http://a1081343.xsph.ru/0fce162f.php
url: https://check.iuuoo.icu/gkcxv.google
domain: check.ioeoe.icu
url: http://175.107.2.254:50638/mozi.m
url: https://check.ioeoe.icu/gkcxv.google
file: 124.222.122.160
hash: 8845
file: 49.234.38.224
hash: 50050
file: 185.239.86.3
hash: 8099
file: 184.174.96.162
hash: 31337
file: 95.169.203.67
hash: 31337
file: 64.94.85.91
hash: 31337
file: 196.251.69.39
hash: 31337
file: 190.10.11.55
hash: 6001
file: 15.152.34.157
hash: 221
file: 18.133.140.136
hash: 15
file: 197.44.133.250
hash: 6001
file: 24.248.236.7
hash: 9001
file: 70.168.169.19
hash: 4433
file: 24.249.21.245
hash: 1080
file: 24.248.236.7
hash: 62078
file: 185.189.200.20
hash: 443
file: 35.225.155.44
hash: 4443
file: 141.95.193.74
hash: 3333
url: http://5.42.64.28/39f98d2ea5ca5476/sqlite3.dll
url: http://185.254.37.234/61c7c6a1a965cae9/vcruntime140.dll
url: http://91.92.240.120/5ae9ffc2ed73fda7/vcruntime140.dll
url: http://5.35.36.211/b1204656088244d5/mozglue.dll
url: http://5.35.36.211/b1204656088244d5/vcruntime140.dll
url: http://5.35.36.211/b1204656088244d5/sqlite3.dll
url: http://109.206.241.81/htdocs/bmqkbenzdymsrtz.exe
url: http://81.161.229.110/htdocs/btmicczwxrrytqj.exe
url: http://87.120.84.38/txt/rnuwcr38irnohzk.exe
url: https://potentiashelt.site/api
url: https://embarkiffe.shop/api
url: https://sebel.sbs/devil/pws/pvqdq929bsx_a_d_m1n_a.php
url: https://recaptcha-phish.pages.dev/
url: https://api.telegram.org/bot5656780330:aahzylie6okscdg1d9lg5rtz3msapsmed3u/
domain: hvip.freeddns.org
domain: maintenance-embedded.gl.at.ply.gg
domain: cobolrationumelawrtewarms.co
url: https://pastebin.com/raw/wxyjm7vm
domain: projects-sunny.gl.at.ply.gg
domain: study-conclusions.gl.at.ply.gg
domain: visit-judges.gl.at.ply.gg
file: 147.185.221.21
hash: 4709
file: 185.232.205.104
hash: 5555
file: 47.115.144.12
hash: 7000
file: 161.248.87.245
hash: 8888
domain: trumpboost.com
domain: v279259.hosted-by-vdsina.com
file: 147.189.170.105
hash: 7000
file: 195.26.240.251
hash: 4782
file: 174.70.151.61
hash: 2406
file: 15.228.237.18
hash: 88
file: 51.17.159.232
hash: 52662
domain: check.auieu.icu
url: https://check.auieu.icu/gkcxv.google
file: 113.44.194.13
hash: 8888
domain: check.ieooy.icu
url: https://check.ieooy.icu/gkcxv.google
file: 1.161.106.193
hash: 443
file: 117.135.222.2
hash: 4506
file: 143.198.18.85
hash: 8888
file: 172.232.236.45
hash: 443
file: 2.88.94.239
hash: 995
file: 3.101.57.14
hash: 18246
domain: sha-11x.pages.dev
file: 43.153.17.95
hash: 4000
file: 43.153.53.237
hash: 4000
url: https://176.111.216.82:3333/login
domain: check.eooii.icu
url: https://check.eooii.icu/gkcxv.google
domain: check.ueoie.icu
url: https://check.ueoie.icu/gkcxv.google
domain: check.eioye.icu
url: https://check.eioye.icu/gkcxv.google
domain: check.iyuei.icu
url: https://check.iyuei.icu/gkcxv.google
file: 173.208.190.227
hash: 4258
domain: dns-verify-me.pro
file: 87.121.84.56
hash: 38777
domain: human-verify.shop
domain: human-verify-4r.pro
url: http://u1.gossipsurrender.shop/china.mp4
domain: u1.gossipsurrender.shop
file: 213.152.161.114
hash: 43366
domain: check.aiyay.icu
url: https://check.aiyay.icu/gkcxv.google
file: 45.125.66.124
hash: 69
file: 198.98.50.251
hash: 2214
file: 217.195.153.175
hash: 2214
file: 45.61.169.138
hash: 2214
file: 199.195.248.181
hash: 2214
file: 154.12.94.68
hash: 1995
domain: ownerbotnet.opyddos.my.id
domain: z17fz0bleone.com
domain: lmikelnf.com
domain: l49ulrayu.com
domain: jqt98lp5859rjjerry.club
domain: cmarleneu24delores.top
domain: dmurrayh52k.club
domain: r52yoo.top
domain: fsg8869eih.com
domain: wxan.com
domain: osakax.zapto.org
domain: walledd.no-ip.org
domain: zohan.dyndns-free.com
domain: caprilesradosky.no-ip.org
domain: jejemon6969.no-ip.biz
domain: vvindows32system.zapto.org
domain: camfrogvmm.no-ip.org
domain: imtifade.servebeer.com
domain: amriknation.no-ip.org
domain: khkh.no-ip.info
domain: h07.no-ip.org
domain: smashscape.no-ip.biz
domain: yassin2009.zapto.org
domain: cybergate01.no-ip.biz
domain: zarrixhost.no-ip.biz
domain: daimond.no-ip.biz
domain: tamaghart.no-ip.biz
domain: codeur-dz.no-ip.biz
domain: datatransferserver.servehttp.com
domain: newday.zapto.org
domain: aspirinx.no-ip.org
domain: victor-fs.no-ip.org
domain: nd1.no-ip.biz
domain: smedders.no-ip.biz
domain: coelkas.dyndns.org
domain: chupacrew.no-ip.org
domain: kylezyzz.no-ip.biz
domain: katilim.dyndns.org
domain: cpthero.sytes.net
domain: future.bounceme.net
domain: cyberjesse.no-ip.biz
domain: jamee.no-ip.info
domain: soq.zapto.org
domain: runescapeauth.no-ip.biz
domain: bifrost007.no-ip.biz
domain: cow.myvnc.com
domain: ldoormoj.no-ip.biz
domain: alwasn4.noip.biz
domain: rahhoum.no-ip.biz
domain: 10line.zapto.org
domain: tehguvs.no-ip.org
domain: worry.zapto.org
domain: nessview.no-ip.org
domain: secatrix.no-ip.org
domain: prohomst.zapto.org
domain: dnsservice.sytes.net
domain: taliban.no-ip.org
domain: mtesthost.dynu.com
domain: zaferseyit.dinamikdns.com
domain: gpx.servehalflife.com
domain: mska.no-ip.biz
domain: mohamedmz.no-ip.biz
domain: skunz.no-ip.biz
domain: darkconsumption.no-ip.org
domain: boner-scape.no-ip.org
domain: bajs.zapto.org
domain: subgoofy.no-ip.info
domain: vlemzik.no-ip.org
domain: hlangdale.no-ip.org
domain: salim10.no-ip.biz
domain: pittskaterg.no-ip.biz
domain: sweetaz3ar.no-ip.org
domain: roma93.no-ip.info
domain: bernhad.servblog.net
domain: cybernon.zapto.org
domain: ohbex.no-ip.org
domain: mhjul.no-ip.org
domain: amjadd.no-ip.biz
domain: karammm.no-ip.biz
domain: youdontmattertome.no-ip.biz
domain: mr-sahi.no-ip.biz
domain: xyat.no-ip.biz
domain: xa4.no-ip.info
domain: dub1337.no-ip.biz
domain: alwasn2.noip.biz
domain: cyber1236.no-ip.biz
domain: leoesgay.zapto.org
domain: whds.no-ip.org
domain: darkcomet5.no-ip.biz
domain: haker2015.no-ip.biz
domain: karalkasap5.no-ip.org
domain: kabomaxx.no-ip.org
domain: ua1.darksell.com
domain: jedixsuca.bounceme.net
domain: probandopoison.no-ip.org
domain: awesomeip4125.no-ip.info
domain: ownerbybicekangel.no-ip.org
domain: 401828766.no-ip.biz
domain: hackeed.zapto.org
domain: tokkan.zapto.org
domain: livepix.no-ip.info
domain: risipc.no-ip.biz
domain: projectxile.no-ip.org
domain: a7bk.no-ip.info
domain: floyd69.zapto.org
domain: pknju.sytes.net
domain: shadowhack1.no-ip.biz
domain: zort205.zapto.org
domain: abdelellah.zapto.org
domain: opybiddo.zapto.org
domain: my1337shiz.no-ip.org
domain: lkdrgtwty.no-ip.org
domain: paltalkes.no-ip.org
domain: samahatony.no-ip.info
file: 92.69.255.47
hash: 2754
file: 200.82.129.56
hash: 2998
file: 85.137.57.212
hash: 59
file: 81.169.247.195
hash: 8080
file: 122.224.4.113
hash: 443
file: 96.23.147.93
hash: 100
file: 89.2.212.121
hash: 81
file: 41.238.76.87
hash: 81
file: 201.82.49.10
hash: 25565
file: 103.9.77.253
hash: 4444
file: 194.15.36.98
hash: 1111
file: 194.87.138.40
hash: 700
file: 185.145.131.243
hash: 23
file: 138.197.71.23
hash: 12345
file: 193.239.147.7
hash: 4258
file: 179.43.146.30
hash: 23
file: 84.200.154.119
hash: 4567
file: 198.167.140.187
hash: 53
file: 13.78.133.250
hash: 152
file: 64.188.99.14
hash: 4258
file: 156.229.233.170
hash: 6149
file: 185.239.242.109
hash: 4269
file: 162.249.170.28
hash: 666
file: 107.175.69.129
hash: 12345
file: 193.239.147.192
hash: 23
file: 45.43.18.249
hash: 4258
file: 31.7.62.118
hash: 65000
file: 85.209.0.57
hash: 4258
file: 185.189.151.64
hash: 42516
file: 157.245.83.214
hash: 4258
file: 40.114.85.63
hash: 872
file: 37.120.222.43
hash: 42516
file: 84.200.154.119
hash: 4568
file: 51.222.140.164
hash: 839
file: 23.94.24.13
hash: 49998
file: 107.175.69.114
hash: 812
file: 171.22.27.172
hash: 1024
file: 185.145.131.173
hash: 23
file: 37.44.238.66
hash: 23
file: 13.78.133.250
hash: 252
file: 185.239.242.5
hash: 811
file: 167.99.218.185
hash: 800
file: 23.94.99.40
hash: 872
file: 37.46.150.225
hash: 4258
file: 45.141.58.75
hash: 839
file: 35.180.191.56
hash: 4545
file: 185.165.29.24
hash: 444
file: 167.99.211.83
hash: 666
file: 199.195.248.181
hash: 606
file: 50.115.174.112
hash: 839
file: 77.247.178.189
hash: 23
file: 13.81.41.97
hash: 872
file: 69.90.132.142
hash: 53
file: 149.56.7.255
hash: 839
file: 46.29.163.64
hash: 443
file: 35.180.191.56
hash: 1331
file: 13.78.133.250
hash: 23
file: 185.189.151.195
hash: 42516
file: 185.239.242.5
hash: 1111
file: 104.236.60.124
hash: 1111
file: 79.133.46.173
hash: 666
file: 20.73.180.13
hash: 872
file: 185.145.131.236
hash: 23
file: 107.174.34.70
hash: 23
file: 45.80.149.159
hash: 1337
file: 194.37.82.160
hash: 292
domain: uyt.hopto.org
domain: allseeingeyes.ddns.net
domain: gospish.no-ip.biz
domain: bugzteam.no-ip.org
domain: rsnoip.zapto.org
domain: nsoonsamer.no-ip.biz
domain: zayan.no-ip.org
domain: leetrsps.zapto.org
domain: tqmix7.no-ip.biz
domain: faction212.no-ip.biz
domain: grrga.no-ip.biz
domain: gandhihaxx.no-ip.org
domain: live1.no-ip.org
domain: fangsnake3.zapto.org
domain: pourmoi.zapto.org
domain: swaglife.no-ip.org
domain: nbn9hide46fro8mu.hopto.org
domain: ankie123.zapto.org
domain: orik745.redirectme.net
domain: jomomma259.no-ip.biz
domain: ratdoshuzo.no-ip.biz
domain: t4t00.no-ip.biz
domain: nydarion2.zapto.org
domain: mrdn.no-ip.biz
domain: otthon.no-ip.biz
domain: dofusrude.no-ip.biz
domain: 07scape.zapto.org
domain: callboyblf.no-ip.org
domain: ijskar135.no-ip.biz
domain: minecraftnet.servegame.com
domain: asyoffset.no-ip.org
domain: eurancia.no-ip.org
domain: myrat123.no-ip.biz
domain: barbarian.no-ip.biz
domain: kaypiper.no-ip.org
domain: ad2.admart.tv
domain: rjsrat.servebeer.com
domain: windowsing.no-ip.org
domain: pirata88.no-ip.biz
domain: hostmeiii.no-ip.info
domain: joeastig.no-ip.biz
domain: chavo2.zapto.org
domain: dcbooter.no-ip.info
domain: toddxdgold.no-ip.biz
domain: cabalth.no-ip.biz
domain: asdfghjas.3322.org
domain: dan123.no-ip.info
domain: dnsscertsmb.no-ip.org
domain: fatgrandma.no-ip.org
domain: rainbowclaydough.myftp.org
domain: aris617.no-ip.org
domain: musculaire.servebeer.com
domain: nipa1.hopto.org
domain: gamzelim110.no-ip.biz
domain: mo3u8se.no-ip.org
domain: chrisssssssssssss.zapto.org
domain: dcrat.no-ip.org
domain: ludovicflorent1.no-ip.org
domain: xtremeproxy1.sytes.net
domain: johnjohn186.no-ip.org
domain: eikyuu.no-ip.org
domain: sfacc51.zapto.org
domain: emilnordman.no-ip.biz
domain: chitan.myftp.org
domain: portforward.zapto.org
domain: chirdent.no-ip.org
domain: nxxbkiller.no-ip.biz
domain: dcdemerde.no-ip.org
domain: wndsmanager.no-ip.biz
domain: dangerous0.zapto.org
domain: n76.no-ip.info
domain: hackers-2007.zapto.org
domain: black12345.zapto.org
domain: aylin.sytes.net
domain: gauss89.no-ip.biz
domain: nikki.no-ip.biz
domain: bugzteam.no-ip.biz
domain: annodomini1771.no-ip.info
domain: limboland1.no-ip.biz
domain: darkvader.zapto.org
domain: 3247828.no-ip.org
domain: coolcrazyfly.no-ip.biz
domain: moker1234.no-ip.biz
domain: villainouswitch.no-ip.org
domain: toxyde.no-ip.biz
domain: minecraftserverc.no-ip.biz
file: 5.19.149.204
hash: 1604
file: 117.205.58.32
hash: 1604
file: 110.33.161.101
hash: 14499
file: 91.67.105.101
hash: 1601
file: 5.19.149.204
hash: 1243
file: 178.83.184.7
hash: 1604
file: 82.222.203.137
hash: 81
file: 84.169.70.18
hash: 1604
file: 62.1.148.197
hash: 85
file: 173.175.148.195
hash: 1602
file: 76.123.20.198
hash: 1604
file: 62.10.212.197
hash: 1604
file: 41.239.67.138
hash: 1604
file: 150.95.104.230
hash: 80
file: 47.93.33.30
hash: 80
file: 8.138.34.17
hash: 80
file: 5.181.158.24
hash: 587
file: 103.195.236.246
hash: 2404
file: 139.59.240.97
hash: 5000
file: 196.251.71.89
hash: 443
file: 52.53.221.221
hash: 6362
file: 13.38.47.41
hash: 8080
url: http://fluf5ikyan.temp.swtest.ru/d71be0a9.php
domain: speedtransitnet.com
file: 209.133.211.242
hash: 8888
file: 69.46.16.164
hash: 8888
url: http://u1.gossipsurrender.shop/camcorder.m4a
domain: botnet.voct.org
file: 178.162.156.169
hash: 2020
domain: check.oeoye.icu
url: https://check.oeoye.icu/gkcxv.google
domain: check.zoxod.icu
url: https://check.zoxod.icu/gkcxv.google
file: 185.224.0.240
hash: 3778
file: 91.188.254.129
hash: 1311
file: 87.121.84.56
hash: 20722
file: 87.121.84.56
hash: 2454
file: 87.121.84.56
hash: 6007
file: 87.121.84.56
hash: 2079
file: 87.121.84.56
hash: 2404
file: 87.121.84.56
hash: 5985
file: 87.121.84.56
hash: 11112
file: 87.121.84.56
hash: 21942
file: 87.121.84.56
hash: 1883
file: 87.121.84.56
hash: 1962
file: 87.121.84.56
hash: 10258
file: 87.121.84.56
hash: 15256
file: 87.121.84.56
hash: 16992
file: 87.121.84.56
hash: 20546
file: 87.121.84.56
hash: 2038
file: 87.121.84.56
hash: 8081
file: 87.121.84.56
hash: 21037
file: 87.121.84.56
hash: 22705
file: 87.121.84.56
hash: 1912
file: 87.121.84.56
hash: 1961
file: 185.121.15.44
hash: 1295
file: 194.85.251.80
hash: 2143
file: 194.85.251.80
hash: 5977
file: 194.85.251.80
hash: 14265
file: 194.85.251.80
hash: 22585
file: 194.85.251.80
hash: 2086
file: 194.85.251.80
hash: 22222
file: 194.85.251.80
hash: 16993
file: 194.85.251.80
hash: 2080
file: 194.85.251.80
hash: 5957
file: 194.85.251.80
hash: 6007
file: 194.85.251.80
hash: 6362
file: 194.85.251.80
hash: 3389
file: 194.85.251.80
hash: 3260
file: 194.85.251.80
hash: 17763
file: 194.85.251.80
hash: 18444
file: 194.85.251.80
hash: 15568
file: 194.85.251.80
hash: 1961
file: 194.85.251.80
hash: 1963
file: 194.85.251.80
hash: 6238
file: 194.85.251.80
hash: 8088
file: 194.85.251.80
hash: 9599
file: 194.85.251.80
hash: 17761
file: 194.85.251.80
hash: 18246
file: 194.85.251.80
hash: 20548
file: 194.85.251.80
hash: 14326
file: 209.200.246.80
hash: 1311
file: 194.85.251.79
hash: 4369
file: 194.85.251.79
hash: 5671
file: 194.85.251.79
hash: 6362
file: 194.85.251.79
hash: 11101
file: 194.85.251.79
hash: 16765
file: 194.85.251.79
hash: 18673
file: 194.85.251.79
hash: 1801
file: 194.85.251.79
hash: 2281
file: 194.85.251.79
hash: 5324
file: 194.85.251.79
hash: 5985
file: 194.85.251.79
hash: 15443
file: 194.85.251.79
hash: 2096
file: 194.85.251.79
hash: 10002
file: 194.85.251.79
hash: 1949
file: 194.85.251.79
hash: 5000
file: 194.85.251.79
hash: 5061
file: 194.85.251.79
hash: 18245
file: 217.195.153.175
hash: 1311
file: 109.104.153.181
hash: 1291
file: 45.61.169.138
hash: 1299
file: 91.244.197.150
hash: 1311
file: 87.121.84.84
hash: 4242
file: 87.121.84.84
hash: 6005
file: 87.121.84.84
hash: 6808
file: 87.121.84.84
hash: 8387
file: 87.121.84.84
hash: 2086
file: 87.121.84.84
hash: 2281
file: 87.121.84.84
hash: 3389
file: 87.121.84.84
hash: 3684
file: 87.121.84.84
hash: 10002
file: 87.121.84.84
hash: 18444
file: 87.121.84.84
hash: 2087
file: 87.121.84.84
hash: 4840
file: 87.121.84.84
hash: 9999
file: 87.121.84.84
hash: 21104
file: 87.121.84.84
hash: 9052
file: 87.121.84.84
hash: 11450
file: 87.121.84.84
hash: 16561
file: 87.121.84.84
hash: 18244
file: 87.121.84.84
hash: 2077
file: 87.121.84.84
hash: 5061
file: 87.121.84.84
hash: 8010
file: 87.121.84.84
hash: 10259
file: 193.17.183.20
hash: 1308
file: 154.213.200.12
hash: 1289
file: 91.244.197.12
hash: 1311
file: 199.195.248.181
hash: 1311
file: 185.198.58.166
hash: 1298
file: 216.146.25.64
hash: 1311
file: 216.146.25.49
hash: 1298
file: 172.86.73.60
hash: 1309
file: 87.121.61.24
hash: 1311
file: 128.254.207.40
hash: 1286
file: 204.76.203.175
hash: 1311
file: 103.214.71.65
hash: 1311
file: 103.214.71.66
hash: 1311
file: 103.214.71.67
hash: 1311
file: 216.73.158.27
hash: 1293
file: 158.69.175.235
hash: 1294
file: 103.214.71.72
hash: 1311
file: 204.76.203.188
hash: 1338
file: 204.76.203.173
hash: 1311
file: 185.121.15.49
hash: 1311
url: https://top.4t.com/
url: https://65.109.226.203/
domain: top.4t.com
file: 65.109.226.203
hash: 443
file: 87.121.84.84
hash: 1311
file: 87.121.84.56
hash: 1311
file: 194.85.251.80
hash: 1311
file: 194.85.251.79
hash: 1311
file: 47.122.1.243
hash: 80
file: 103.80.19.179
hash: 52668
file: 103.80.19.180
hash: 52668
file: 128.90.123.17
hash: 5000
file: 69.48.202.241
hash: 7707
domain: webmail.10bestbusiness.website
domain: cpanel.sportscasino.website
domain: check.fuher.icu
url: https://check.fuher.icu/gkcxv.google
file: 156.238.238.83
hash: 3883
domain: check.nevyz.icu
url: https://check.nevyz.icu/gkcxv.google
url: http://u1.gossipsurrender.shop/12.mp4
file: 160.22.161.157
hash: 56999
domain: sroglad.com
file: 202.95.22.2
hash: 4433
url: https://uokota.online/concerto/blend
url: https://chekagustario.com/
url: https://booking.chekagustario.com/
domain: effectsstardust.shop
domain: check.sinev.icu
url: https://check.sinev.icu/gkcxv.google
file: 194.85.251.76
hash: 1999
file: 161.248.239.28
hash: 80
file: 196.251.84.215
hash: 789
file: 185.91.72.143
hash: 443
file: 69.48.202.241
hash: 6606
file: 92.255.85.23
hash: 15647
file: 92.255.85.23
hash: 15747
file: 102.117.173.86
hash: 7443
file: 105.69.240.227
hash: 8080
file: 173.249.52.37
hash: 443
domain: cpcontacts.fivetopbusiness.xyz
domain: cpcontacts.bestgamesofufabet.xyz
domain: webmail.sportsfootball.website
domain: webdisk.businesseshub.xyz
domain: webmail.enjoyedufabet.xyz
domain: webmail.businesspros.xyz
domain: cpanel.dmfortsites.xyz
domain: cpcontacts.artnewzdaily.xyz
domain: webmail.homeremodel.website
domain: cpcontacts.generalztipsal.xyz
domain: webdisk.businesswithloyal.website
domain: webmail.dgmrtktnewz.website
domain: webdisk.businesshostz.xyz
domain: cpanel.domizmusk.website
domain: cpanel.fieldznorms.xyz
file: 193.124.205.36
hash: 33006
url: https://check.losex.icu/gkcxv.google
file: 188.253.125.96
hash: 2096
url: http://u1.shalebrussels.shop/china.mp4
domain: u1.shalebrussels.shop
file: 200.91.114.50
hash: 443
file: 44.246.4.119
hash: 443
file: 101.34.66.77
hash: 50050
file: 107.175.194.55
hash: 443
file: 216.118.230.118
hash: 31337
file: 216.126.229.110
hash: 31337
file: 185.102.75.120
hash: 31337
file: 216.118.230.114
hash: 31337
file: 54.170.28.226
hash: 12209
file: 43.207.217.215
hash: 993
file: 61.76.179.183
hash: 6000
file: 196.251.90.21
hash: 54984
file: 72.219.193.69
hash: 8880
file: 13.60.202.169
hash: 443
file: 47.129.14.236
hash: 3306
url: http://542148cm.nyanyash.ru/phpsecuregeo.php
url: http://439153cm.nyashk.ru/geosqlwpuploads.php

Source: ThreatFox

Published: Sun Feb 23 2025

ThreatFox IOCs for 2025-02-23

Medium

Malwaretype:osint tlp:white

Published: Sun Feb 23 2025 (02/23/2025, 00:00:00 UTC)

Source: ThreatFox

Vendor/Project: type

Product: osint

Description

ThreatFox IOCs for 2025-02-23

AI-Powered Analysis

AILast updated: 06/19/2025, 16:05:19 UTC

Technical Analysis

Potential Impact

Mitigation Recommendations

Affected Countries

Need more detailed analysis?Get Pro

Pro Feature

For access to advanced analysis and higher rate limits, contact root@offseq.com

Technical Details

Threat Level: 2
Analysis: 1
Distribution: 3
Uuid: c16f77a6-7db0-4598-b0d5-c07846d9c93b
Original Timestamp: 1740355388

Indicators of Compromise

Domain

Value	Description	Copy
domaincheck.aayai.icu	ClearFake payload delivery domain (confidence level: 100%)
domainbatnet.proxyapi.my.id	Mirai botnet C2 domain (confidence level: 75%)
domainmetalcourthur.fun	Lumma Stealer payload delivery domain (confidence level: 100%)
domainuncertainyelemz.bet	Lumma Stealer payload delivery domain (confidence level: 100%)
domainprideforgek.fun	Lumma Stealer payload delivery domain (confidence level: 100%)
domainsubawhipnator.life	Lumma Stealer payload delivery domain (confidence level: 100%)
domainprivileggoe.live	Lumma Stealer payload delivery domain (confidence level: 100%)
domaindecreaserid.world	Lumma Stealer payload delivery domain (confidence level: 100%)
domainhobbyedsmoker.live	Lumma Stealer botnet C2 domain (confidence level: 100%)
domaingoaledharmfuk.live	Lumma Stealer botnet C2 domain (confidence level: 100%)
domainbaconqualit.live	Lumma Stealer botnet C2 domain (confidence level: 100%)
domainresqueoppos.live	Lumma Stealer botnet C2 domain (confidence level: 100%)
domainprivileggoe.live	Lumma Stealer botnet C2 domain (confidence level: 100%)
domainconcentratecr.world	Lumma Stealer botnet C2 domain (confidence level: 100%)
domainbennedospok.run	Lumma Stealer botnet C2 domain (confidence level: 100%)
domaindryentaidne.run	Lumma Stealer botnet C2 domain (confidence level: 100%)
domaingrendyreushe.run	Lumma Stealer botnet C2 domain (confidence level: 100%)
domainporkedbunned.run	Lumma Stealer botnet C2 domain (confidence level: 100%)
domaindeaddereaste.today	Lumma Stealer botnet C2 domain (confidence level: 100%)
domaindownload.caringheadboard.buzz	Lumma Stealer botnet C2 domain (confidence level: 100%)
domainping.caringheadboard.buzz	Lumma Stealer botnet C2 domain (confidence level: 100%)
domainai.fdswgw.shop	Lumma Stealer botnet C2 domain (confidence level: 100%)
domainvatloopedo.bet	Lumma Stealer botnet C2 domain (confidence level: 100%)
domain12825.funian.xyz	Bashlite botnet C2 domain (confidence level: 100%)
domainblackbirdessential.cloud	Remcos botnet C2 domain (confidence level: 100%)
domaincheck.oaaea.icu	ClearFake payload delivery domain (confidence level: 100%)
domaincheck.iuuoo.icu	ClearFake payload delivery domain (confidence level: 100%)
domaincheck.ioeoe.icu	ClearFake payload delivery domain (confidence level: 100%)
domainhvip.freeddns.org	NjRAT botnet C2 domain (confidence level: 50%)
domainmaintenance-embedded.gl.at.ply.gg	Quasar RAT botnet C2 domain (confidence level: 50%)
domaincobolrationumelawrtewarms.co	SystemBC botnet C2 domain (confidence level: 50%)
domainprojects-sunny.gl.at.ply.gg	XWorm botnet C2 domain (confidence level: 50%)
domainstudy-conclusions.gl.at.ply.gg	XWorm botnet C2 domain (confidence level: 50%)
domainvisit-judges.gl.at.ply.gg	XWorm botnet C2 domain (confidence level: 50%)
domaintrumpboost.com	Hook botnet C2 domain (confidence level: 100%)
domainv279259.hosted-by-vdsina.com	Hook botnet C2 domain (confidence level: 100%)
domaincheck.auieu.icu	ClearFake payload delivery domain (confidence level: 100%)
domaincheck.ieooy.icu	ClearFake payload delivery domain (confidence level: 100%)
domainsha-11x.pages.dev	ClearFake payload delivery domain (confidence level: 100%)
domaincheck.eooii.icu	ClearFake payload delivery domain (confidence level: 100%)
domaincheck.ueoie.icu	ClearFake payload delivery domain (confidence level: 100%)
domaincheck.eioye.icu	ClearFake payload delivery domain (confidence level: 100%)
domaincheck.iyuei.icu	ClearFake payload delivery domain (confidence level: 100%)
domaindns-verify-me.pro	Lumma Stealer payload delivery domain (confidence level: 100%)
domainhuman-verify.shop	Lumma Stealer payload delivery domain (confidence level: 100%)
domainhuman-verify-4r.pro	Lumma Stealer payload delivery domain (confidence level: 100%)
domainu1.gossipsurrender.shop	ClearFake payload delivery domain (confidence level: 100%)
domaincheck.aiyay.icu	ClearFake payload delivery domain (confidence level: 100%)
domainownerbotnet.opyddos.my.id	MooBot botnet C2 domain (confidence level: 100%)
domainz17fz0bleone.com	Gozi botnet C2 domain (confidence level: 100%)
domainlmikelnf.com	Gozi botnet C2 domain (confidence level: 100%)
domainl49ulrayu.com	Gozi botnet C2 domain (confidence level: 100%)
domainjqt98lp5859rjjerry.club	Gozi botnet C2 domain (confidence level: 100%)
domaincmarleneu24delores.top	Gozi botnet C2 domain (confidence level: 100%)
domaindmurrayh52k.club	Gozi botnet C2 domain (confidence level: 100%)
domainr52yoo.top	Gozi botnet C2 domain (confidence level: 100%)
domainfsg8869eih.com	Gozi botnet C2 domain (confidence level: 100%)
domainwxan.com	Gozi botnet C2 domain (confidence level: 100%)
domainosakax.zapto.org	CyberGate botnet C2 domain (confidence level: 100%)
domainwalledd.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainzohan.dyndns-free.com	CyberGate botnet C2 domain (confidence level: 100%)
domaincaprilesradosky.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainjejemon6969.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainvvindows32system.zapto.org	CyberGate botnet C2 domain (confidence level: 100%)
domaincamfrogvmm.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainimtifade.servebeer.com	CyberGate botnet C2 domain (confidence level: 100%)
domainamriknation.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainkhkh.no-ip.info	CyberGate botnet C2 domain (confidence level: 100%)
domainh07.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainsmashscape.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainyassin2009.zapto.org	CyberGate botnet C2 domain (confidence level: 100%)
domaincybergate01.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainzarrixhost.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domaindaimond.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domaintamaghart.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domaincodeur-dz.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domaindatatransferserver.servehttp.com	CyberGate botnet C2 domain (confidence level: 100%)
domainnewday.zapto.org	CyberGate botnet C2 domain (confidence level: 100%)
domainaspirinx.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainvictor-fs.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainnd1.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainsmedders.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domaincoelkas.dyndns.org	CyberGate botnet C2 domain (confidence level: 100%)
domainchupacrew.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainkylezyzz.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainkatilim.dyndns.org	CyberGate botnet C2 domain (confidence level: 100%)
domaincpthero.sytes.net	CyberGate botnet C2 domain (confidence level: 100%)
domainfuture.bounceme.net	CyberGate botnet C2 domain (confidence level: 100%)
domaincyberjesse.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainjamee.no-ip.info	CyberGate botnet C2 domain (confidence level: 100%)
domainsoq.zapto.org	CyberGate botnet C2 domain (confidence level: 100%)
domainrunescapeauth.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainbifrost007.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domaincow.myvnc.com	CyberGate botnet C2 domain (confidence level: 100%)
domainldoormoj.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainalwasn4.noip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainrahhoum.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domain10line.zapto.org	CyberGate botnet C2 domain (confidence level: 100%)
domaintehguvs.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainworry.zapto.org	CyberGate botnet C2 domain (confidence level: 100%)
domainnessview.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainsecatrix.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainprohomst.zapto.org	CyberGate botnet C2 domain (confidence level: 100%)
domaindnsservice.sytes.net	CyberGate botnet C2 domain (confidence level: 100%)
domaintaliban.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainmtesthost.dynu.com	CyberGate botnet C2 domain (confidence level: 100%)
domainzaferseyit.dinamikdns.com	CyberGate botnet C2 domain (confidence level: 100%)
domaingpx.servehalflife.com	CyberGate botnet C2 domain (confidence level: 100%)
domainmska.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainmohamedmz.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainskunz.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domaindarkconsumption.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainboner-scape.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainbajs.zapto.org	CyberGate botnet C2 domain (confidence level: 100%)
domainsubgoofy.no-ip.info	CyberGate botnet C2 domain (confidence level: 100%)
domainvlemzik.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainhlangdale.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainsalim10.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainpittskaterg.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainsweetaz3ar.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainroma93.no-ip.info	CyberGate botnet C2 domain (confidence level: 100%)
domainbernhad.servblog.net	CyberGate botnet C2 domain (confidence level: 100%)
domaincybernon.zapto.org	CyberGate botnet C2 domain (confidence level: 100%)
domainohbex.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainmhjul.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainamjadd.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainkarammm.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainyoudontmattertome.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainmr-sahi.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainxyat.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainxa4.no-ip.info	CyberGate botnet C2 domain (confidence level: 100%)
domaindub1337.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainalwasn2.noip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domaincyber1236.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainleoesgay.zapto.org	CyberGate botnet C2 domain (confidence level: 100%)
domainwhds.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domaindarkcomet5.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainhaker2015.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainkaralkasap5.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainkabomaxx.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainua1.darksell.com	CyberGate botnet C2 domain (confidence level: 100%)
domainjedixsuca.bounceme.net	CyberGate botnet C2 domain (confidence level: 100%)
domainprobandopoison.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainawesomeip4125.no-ip.info	CyberGate botnet C2 domain (confidence level: 100%)
domainownerbybicekangel.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domain401828766.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainhackeed.zapto.org	CyberGate botnet C2 domain (confidence level: 100%)
domaintokkan.zapto.org	CyberGate botnet C2 domain (confidence level: 100%)
domainlivepix.no-ip.info	CyberGate botnet C2 domain (confidence level: 100%)
domainrisipc.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainprojectxile.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domaina7bk.no-ip.info	CyberGate botnet C2 domain (confidence level: 100%)
domainfloyd69.zapto.org	CyberGate botnet C2 domain (confidence level: 100%)
domainpknju.sytes.net	CyberGate botnet C2 domain (confidence level: 100%)
domainshadowhack1.no-ip.biz	CyberGate botnet C2 domain (confidence level: 100%)
domainzort205.zapto.org	CyberGate botnet C2 domain (confidence level: 100%)
domainabdelellah.zapto.org	CyberGate botnet C2 domain (confidence level: 100%)
domainopybiddo.zapto.org	CyberGate botnet C2 domain (confidence level: 100%)
domainmy1337shiz.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainlkdrgtwty.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainpaltalkes.no-ip.org	CyberGate botnet C2 domain (confidence level: 100%)
domainsamahatony.no-ip.info	CyberGate botnet C2 domain (confidence level: 100%)
domainuyt.hopto.org	DarkComet botnet C2 domain (confidence level: 100%)
domainallseeingeyes.ddns.net	DarkComet botnet C2 domain (confidence level: 100%)
domaingospish.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainbugzteam.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domainrsnoip.zapto.org	DarkComet botnet C2 domain (confidence level: 100%)
domainnsoonsamer.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainzayan.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domainleetrsps.zapto.org	DarkComet botnet C2 domain (confidence level: 100%)
domaintqmix7.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainfaction212.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domaingrrga.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domaingandhihaxx.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domainlive1.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domainfangsnake3.zapto.org	DarkComet botnet C2 domain (confidence level: 100%)
domainpourmoi.zapto.org	DarkComet botnet C2 domain (confidence level: 100%)
domainswaglife.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domainnbn9hide46fro8mu.hopto.org	DarkComet botnet C2 domain (confidence level: 100%)
domainankie123.zapto.org	DarkComet botnet C2 domain (confidence level: 100%)
domainorik745.redirectme.net	DarkComet botnet C2 domain (confidence level: 100%)
domainjomomma259.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainratdoshuzo.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domaint4t00.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainnydarion2.zapto.org	DarkComet botnet C2 domain (confidence level: 100%)
domainmrdn.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainotthon.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domaindofusrude.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domain07scape.zapto.org	DarkComet botnet C2 domain (confidence level: 100%)
domaincallboyblf.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domainijskar135.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainminecraftnet.servegame.com	DarkComet botnet C2 domain (confidence level: 100%)
domainasyoffset.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domaineurancia.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domainmyrat123.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainbarbarian.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainkaypiper.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domainad2.admart.tv	DarkComet botnet C2 domain (confidence level: 100%)
domainrjsrat.servebeer.com	DarkComet botnet C2 domain (confidence level: 100%)
domainwindowsing.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domainpirata88.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainhostmeiii.no-ip.info	DarkComet botnet C2 domain (confidence level: 100%)
domainjoeastig.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainchavo2.zapto.org	DarkComet botnet C2 domain (confidence level: 100%)
domaindcbooter.no-ip.info	DarkComet botnet C2 domain (confidence level: 100%)
domaintoddxdgold.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domaincabalth.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainasdfghjas.3322.org	DarkComet botnet C2 domain (confidence level: 100%)
domaindan123.no-ip.info	DarkComet botnet C2 domain (confidence level: 100%)
domaindnsscertsmb.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domainfatgrandma.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domainrainbowclaydough.myftp.org	DarkComet botnet C2 domain (confidence level: 100%)
domainaris617.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domainmusculaire.servebeer.com	DarkComet botnet C2 domain (confidence level: 100%)
domainnipa1.hopto.org	DarkComet botnet C2 domain (confidence level: 100%)
domaingamzelim110.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainmo3u8se.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domainchrisssssssssssss.zapto.org	DarkComet botnet C2 domain (confidence level: 100%)
domaindcrat.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domainludovicflorent1.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domainxtremeproxy1.sytes.net	DarkComet botnet C2 domain (confidence level: 100%)
domainjohnjohn186.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domaineikyuu.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domainsfacc51.zapto.org	DarkComet botnet C2 domain (confidence level: 100%)
domainemilnordman.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainchitan.myftp.org	DarkComet botnet C2 domain (confidence level: 100%)
domainportforward.zapto.org	DarkComet botnet C2 domain (confidence level: 100%)
domainchirdent.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domainnxxbkiller.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domaindcdemerde.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domainwndsmanager.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domaindangerous0.zapto.org	DarkComet botnet C2 domain (confidence level: 100%)
domainn76.no-ip.info	DarkComet botnet C2 domain (confidence level: 100%)
domainhackers-2007.zapto.org	DarkComet botnet C2 domain (confidence level: 100%)
domainblack12345.zapto.org	DarkComet botnet C2 domain (confidence level: 100%)
domainaylin.sytes.net	DarkComet botnet C2 domain (confidence level: 100%)
domaingauss89.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainnikki.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainbugzteam.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainannodomini1771.no-ip.info	DarkComet botnet C2 domain (confidence level: 100%)
domainlimboland1.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domaindarkvader.zapto.org	DarkComet botnet C2 domain (confidence level: 100%)
domain3247828.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domaincoolcrazyfly.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainmoker1234.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainvillainouswitch.no-ip.org	DarkComet botnet C2 domain (confidence level: 100%)
domaintoxyde.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainminecraftserverc.no-ip.biz	DarkComet botnet C2 domain (confidence level: 100%)
domainspeedtransitnet.com	Cobalt Strike botnet C2 domain (confidence level: 75%)
domainbotnet.voct.org	MooBot botnet C2 domain (confidence level: 100%)
domaincheck.oeoye.icu	ClearFake payload delivery domain (confidence level: 100%)
domaincheck.zoxod.icu	ClearFake payload delivery domain (confidence level: 100%)
domaintop.4t.com	Vidar botnet C2 domain (confidence level: 100%)
domainwebmail.10bestbusiness.website	Havoc botnet C2 domain (confidence level: 100%)
domaincpanel.sportscasino.website	Havoc botnet C2 domain (confidence level: 100%)
domaincheck.fuher.icu	ClearFake payload delivery domain (confidence level: 100%)
domaincheck.nevyz.icu	ClearFake payload delivery domain (confidence level: 100%)
domainsroglad.com	Mirai botnet C2 domain (confidence level: 75%)
domaineffectsstardust.shop	ACR Stealer botnet C2 domain (confidence level: 100%)
domaincheck.sinev.icu	ClearFake payload delivery domain (confidence level: 100%)
domaincpcontacts.fivetopbusiness.xyz	Havoc botnet C2 domain (confidence level: 100%)
domaincpcontacts.bestgamesofufabet.xyz	Havoc botnet C2 domain (confidence level: 100%)
domainwebmail.sportsfootball.website	Havoc botnet C2 domain (confidence level: 100%)
domainwebdisk.businesseshub.xyz	Havoc botnet C2 domain (confidence level: 100%)
domainwebmail.enjoyedufabet.xyz	Havoc botnet C2 domain (confidence level: 100%)
domainwebmail.businesspros.xyz	Havoc botnet C2 domain (confidence level: 100%)
domaincpanel.dmfortsites.xyz	Havoc botnet C2 domain (confidence level: 100%)
domaincpcontacts.artnewzdaily.xyz	Havoc botnet C2 domain (confidence level: 100%)
domainwebmail.homeremodel.website	Havoc botnet C2 domain (confidence level: 100%)
domaincpcontacts.generalztipsal.xyz	Havoc botnet C2 domain (confidence level: 100%)
domainwebdisk.businesswithloyal.website	Havoc botnet C2 domain (confidence level: 100%)
domainwebmail.dgmrtktnewz.website	Havoc botnet C2 domain (confidence level: 100%)
domainwebdisk.businesshostz.xyz	Havoc botnet C2 domain (confidence level: 100%)
domaincpanel.domizmusk.website	Havoc botnet C2 domain (confidence level: 100%)
domaincpanel.fieldznorms.xyz	Havoc botnet C2 domain (confidence level: 100%)
domainu1.shalebrussels.shop	ClearFake payload delivery domain (confidence level: 100%)

File

Value	Description	Copy
file159.223.83.97	Mirai botnet C2 server (confidence level: 75%)
file94.154.34.34	Mirai botnet C2 server (confidence level: 100%)
file192.236.147.186	Cobalt Strike botnet C2 server (confidence level: 100%)
file54.159.96.171	Cobalt Strike botnet C2 server (confidence level: 100%)
file89.23.108.220	Remcos botnet C2 server (confidence level: 100%)
file179.43.171.220	Remcos botnet C2 server (confidence level: 100%)
file128.90.123.17	AsyncRAT botnet C2 server (confidence level: 100%)
file37.114.57.39	Unknown malware botnet C2 server (confidence level: 100%)
file37.18.37.70	RMS botnet C2 server (confidence level: 100%)
file175.27.241.169	Cobalt Strike botnet C2 server (confidence level: 100%)
file189.150.95.96	DarkComet botnet C2 server (confidence level: 100%)
file103.186.117.61	Remcos botnet C2 server (confidence level: 100%)
file13.38.77.31	Unknown malware botnet C2 server (confidence level: 100%)
file41.251.18.204	Venom RAT botnet C2 server (confidence level: 100%)
file41.251.18.204	Venom RAT botnet C2 server (confidence level: 100%)
file41.251.18.204	Venom RAT botnet C2 server (confidence level: 100%)
file41.251.18.204	Venom RAT botnet C2 server (confidence level: 100%)
file173.208.190.227	Bashlite botnet C2 server (confidence level: 100%)
file161.248.87.243	Unknown malware botnet C2 server (confidence level: 100%)
file115.77.122.212	AsyncRAT botnet C2 server (confidence level: 100%)
file83.168.105.166	MooBot botnet C2 server (confidence level: 100%)
file13.210.62.90	Unknown malware botnet C2 server (confidence level: 100%)
file16.170.155.214	Unknown malware botnet C2 server (confidence level: 100%)
file18.197.6.78	Unknown malware botnet C2 server (confidence level: 100%)
file43.200.119.184	Unknown malware botnet C2 server (confidence level: 100%)
file144.48.240.54	Unknown malware botnet C2 server (confidence level: 100%)
file34.23.189.87	Unknown malware botnet C2 server (confidence level: 100%)
file3.86.227.121	Unknown malware botnet C2 server (confidence level: 100%)
file124.222.122.160	Cobalt Strike botnet C2 server (confidence level: 50%)
file49.234.38.224	Cobalt Strike botnet C2 server (confidence level: 50%)
file185.239.86.3	Cobalt Strike botnet C2 server (confidence level: 50%)
file184.174.96.162	Sliver botnet C2 server (confidence level: 50%)
file95.169.203.67	Sliver botnet C2 server (confidence level: 50%)
file64.94.85.91	Sliver botnet C2 server (confidence level: 50%)
file196.251.69.39	Sliver botnet C2 server (confidence level: 50%)
file190.10.11.55	NetSupportManager RAT botnet C2 server (confidence level: 50%)
file15.152.34.157	NetSupportManager RAT botnet C2 server (confidence level: 50%)
file18.133.140.136	NetSupportManager RAT botnet C2 server (confidence level: 50%)
file197.44.133.250	NetSupportManager RAT botnet C2 server (confidence level: 50%)
file24.248.236.7	Xtreme RAT botnet C2 server (confidence level: 50%)
file70.168.169.19	Xtreme RAT botnet C2 server (confidence level: 50%)
file24.249.21.245	Xtreme RAT botnet C2 server (confidence level: 50%)
file24.248.236.7	Xtreme RAT botnet C2 server (confidence level: 50%)
file185.189.200.20	Ghost RAT botnet C2 server (confidence level: 50%)
file35.225.155.44	Unknown malware botnet C2 server (confidence level: 50%)
file141.95.193.74	Unknown malware botnet C2 server (confidence level: 50%)
file147.185.221.21	XWorm botnet C2 server (confidence level: 50%)
file185.232.205.104	Mirai botnet C2 server (confidence level: 75%)
file47.115.144.12	Cobalt Strike botnet C2 server (confidence level: 100%)
file161.248.87.245	Unknown malware botnet C2 server (confidence level: 100%)
file147.189.170.105	Quasar RAT botnet C2 server (confidence level: 100%)
file195.26.240.251	Quasar RAT botnet C2 server (confidence level: 100%)
file174.70.151.61	DCRat botnet C2 server (confidence level: 100%)
file15.228.237.18	NetSupportManager RAT botnet C2 server (confidence level: 100%)
file51.17.159.232	NetSupportManager RAT botnet C2 server (confidence level: 100%)
file113.44.194.13	Cobalt Strike botnet C2 server (confidence level: 100%)
file1.161.106.193	QakBot botnet C2 server (confidence level: 75%)
file117.135.222.2	DeimosC2 botnet C2 server (confidence level: 75%)
file143.198.18.85	Sliver botnet C2 server (confidence level: 75%)
file172.232.236.45	DeimosC2 botnet C2 server (confidence level: 75%)
file2.88.94.239	QakBot botnet C2 server (confidence level: 75%)
file3.101.57.14	NetSupportManager RAT botnet C2 server (confidence level: 75%)
file43.153.17.95	Unknown malware botnet C2 server (confidence level: 100%)
file43.153.53.237	Unknown malware botnet C2 server (confidence level: 100%)
file173.208.190.227	Bashlite botnet C2 server (confidence level: 75%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file213.152.161.114	Nanocore RAT botnet C2 server (confidence level: 100%)
file45.125.66.124	Mirai botnet C2 server (confidence level: 100%)
file198.98.50.251	Mirai botnet C2 server (confidence level: 100%)
file217.195.153.175	Mirai botnet C2 server (confidence level: 100%)
file45.61.169.138	Mirai botnet C2 server (confidence level: 100%)
file199.195.248.181	Mirai botnet C2 server (confidence level: 100%)
file154.12.94.68	MooBot botnet C2 server (confidence level: 100%)
file92.69.255.47	CyberGate botnet C2 server (confidence level: 100%)
file200.82.129.56	CyberGate botnet C2 server (confidence level: 100%)
file85.137.57.212	CyberGate botnet C2 server (confidence level: 100%)
file81.169.247.195	CyberGate botnet C2 server (confidence level: 100%)
file122.224.4.113	CyberGate botnet C2 server (confidence level: 100%)
file96.23.147.93	CyberGate botnet C2 server (confidence level: 100%)
file89.2.212.121	CyberGate botnet C2 server (confidence level: 100%)
file41.238.76.87	CyberGate botnet C2 server (confidence level: 100%)
file201.82.49.10	CyberGate botnet C2 server (confidence level: 100%)
file103.9.77.253	Bashlite botnet C2 server (confidence level: 100%)
file194.15.36.98	Bashlite botnet C2 server (confidence level: 100%)
file194.87.138.40	Bashlite botnet C2 server (confidence level: 100%)
file185.145.131.243	Bashlite botnet C2 server (confidence level: 100%)
file138.197.71.23	Bashlite botnet C2 server (confidence level: 100%)
file193.239.147.7	Bashlite botnet C2 server (confidence level: 100%)
file179.43.146.30	Bashlite botnet C2 server (confidence level: 100%)
file84.200.154.119	Bashlite botnet C2 server (confidence level: 100%)
file198.167.140.187	Bashlite botnet C2 server (confidence level: 100%)
file13.78.133.250	Bashlite botnet C2 server (confidence level: 100%)
file64.188.99.14	Bashlite botnet C2 server (confidence level: 100%)
file156.229.233.170	Bashlite botnet C2 server (confidence level: 100%)
file185.239.242.109	Bashlite botnet C2 server (confidence level: 100%)
file162.249.170.28	Bashlite botnet C2 server (confidence level: 100%)
file107.175.69.129	Bashlite botnet C2 server (confidence level: 100%)
file193.239.147.192	Bashlite botnet C2 server (confidence level: 100%)
file45.43.18.249	Bashlite botnet C2 server (confidence level: 100%)
file31.7.62.118	Bashlite botnet C2 server (confidence level: 100%)
file85.209.0.57	Bashlite botnet C2 server (confidence level: 100%)
file185.189.151.64	Bashlite botnet C2 server (confidence level: 100%)
file157.245.83.214	Bashlite botnet C2 server (confidence level: 100%)
file40.114.85.63	Bashlite botnet C2 server (confidence level: 100%)
file37.120.222.43	Bashlite botnet C2 server (confidence level: 100%)
file84.200.154.119	Bashlite botnet C2 server (confidence level: 100%)
file51.222.140.164	Bashlite botnet C2 server (confidence level: 100%)
file23.94.24.13	Bashlite botnet C2 server (confidence level: 100%)
file107.175.69.114	Bashlite botnet C2 server (confidence level: 100%)
file171.22.27.172	Bashlite botnet C2 server (confidence level: 100%)
file185.145.131.173	Bashlite botnet C2 server (confidence level: 100%)
file37.44.238.66	Bashlite botnet C2 server (confidence level: 100%)
file13.78.133.250	Bashlite botnet C2 server (confidence level: 100%)
file185.239.242.5	Bashlite botnet C2 server (confidence level: 100%)
file167.99.218.185	Bashlite botnet C2 server (confidence level: 100%)
file23.94.99.40	Bashlite botnet C2 server (confidence level: 100%)
file37.46.150.225	Bashlite botnet C2 server (confidence level: 100%)
file45.141.58.75	Bashlite botnet C2 server (confidence level: 100%)
file35.180.191.56	Bashlite botnet C2 server (confidence level: 100%)
file185.165.29.24	Bashlite botnet C2 server (confidence level: 100%)
file167.99.211.83	Bashlite botnet C2 server (confidence level: 100%)
file199.195.248.181	Bashlite botnet C2 server (confidence level: 100%)
file50.115.174.112	Bashlite botnet C2 server (confidence level: 100%)
file77.247.178.189	Bashlite botnet C2 server (confidence level: 100%)
file13.81.41.97	Bashlite botnet C2 server (confidence level: 100%)
file69.90.132.142	Bashlite botnet C2 server (confidence level: 100%)
file149.56.7.255	Bashlite botnet C2 server (confidence level: 100%)
file46.29.163.64	Bashlite botnet C2 server (confidence level: 100%)
file35.180.191.56	Bashlite botnet C2 server (confidence level: 100%)
file13.78.133.250	Bashlite botnet C2 server (confidence level: 100%)
file185.189.151.195	Bashlite botnet C2 server (confidence level: 100%)
file185.239.242.5	Bashlite botnet C2 server (confidence level: 100%)
file104.236.60.124	Bashlite botnet C2 server (confidence level: 100%)
file79.133.46.173	Bashlite botnet C2 server (confidence level: 100%)
file20.73.180.13	Bashlite botnet C2 server (confidence level: 100%)
file185.145.131.236	Bashlite botnet C2 server (confidence level: 100%)
file107.174.34.70	Bashlite botnet C2 server (confidence level: 100%)
file45.80.149.159	Bashlite botnet C2 server (confidence level: 100%)
file194.37.82.160	Bashlite botnet C2 server (confidence level: 100%)
file5.19.149.204	DarkComet botnet C2 server (confidence level: 100%)
file117.205.58.32	DarkComet botnet C2 server (confidence level: 100%)
file110.33.161.101	DarkComet botnet C2 server (confidence level: 100%)
file91.67.105.101	DarkComet botnet C2 server (confidence level: 100%)
file5.19.149.204	DarkComet botnet C2 server (confidence level: 100%)
file178.83.184.7	DarkComet botnet C2 server (confidence level: 100%)
file82.222.203.137	DarkComet botnet C2 server (confidence level: 100%)
file84.169.70.18	DarkComet botnet C2 server (confidence level: 100%)
file62.1.148.197	DarkComet botnet C2 server (confidence level: 100%)
file173.175.148.195	DarkComet botnet C2 server (confidence level: 100%)
file76.123.20.198	DarkComet botnet C2 server (confidence level: 100%)
file62.10.212.197	DarkComet botnet C2 server (confidence level: 100%)
file41.239.67.138	DarkComet botnet C2 server (confidence level: 100%)
file150.95.104.230	Cobalt Strike botnet C2 server (confidence level: 100%)
file47.93.33.30	Cobalt Strike botnet C2 server (confidence level: 100%)
file8.138.34.17	Cobalt Strike botnet C2 server (confidence level: 100%)
file5.181.158.24	Remcos botnet C2 server (confidence level: 100%)
file103.195.236.246	Remcos botnet C2 server (confidence level: 100%)
file139.59.240.97	Venom RAT botnet C2 server (confidence level: 100%)
file196.251.71.89	Venom RAT botnet C2 server (confidence level: 100%)
file52.53.221.221	NetSupportManager RAT botnet C2 server (confidence level: 100%)
file13.38.47.41	MimiKatz botnet C2 server (confidence level: 100%)
file209.133.211.242	Cobalt Strike botnet C2 server (confidence level: 75%)
file69.46.16.164	Cobalt Strike botnet C2 server (confidence level: 75%)
file178.162.156.169	Remcos botnet C2 server (confidence level: 100%)
file185.224.0.240	Mirai botnet C2 server (confidence level: 75%)
file91.188.254.129	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file185.121.15.44	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file209.200.246.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.79	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.79	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.79	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.79	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.79	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.79	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.79	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.79	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.79	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.79	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.79	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.79	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.79	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.79	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.79	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.79	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.79	Mirai botnet C2 server (confidence level: 100%)
file217.195.153.175	Mirai botnet C2 server (confidence level: 100%)
file109.104.153.181	Mirai botnet C2 server (confidence level: 100%)
file45.61.169.138	Mirai botnet C2 server (confidence level: 100%)
file91.244.197.150	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file193.17.183.20	Mirai botnet C2 server (confidence level: 100%)
file154.213.200.12	Mirai botnet C2 server (confidence level: 100%)
file91.244.197.12	Mirai botnet C2 server (confidence level: 100%)
file199.195.248.181	Mirai botnet C2 server (confidence level: 100%)
file185.198.58.166	Mirai botnet C2 server (confidence level: 100%)
file216.146.25.64	Mirai botnet C2 server (confidence level: 100%)
file216.146.25.49	Mirai botnet C2 server (confidence level: 100%)
file172.86.73.60	Mirai botnet C2 server (confidence level: 100%)
file87.121.61.24	Mirai botnet C2 server (confidence level: 100%)
file128.254.207.40	Mirai botnet C2 server (confidence level: 100%)
file204.76.203.175	Mirai botnet C2 server (confidence level: 100%)
file103.214.71.65	Mirai botnet C2 server (confidence level: 100%)
file103.214.71.66	Mirai botnet C2 server (confidence level: 100%)
file103.214.71.67	Mirai botnet C2 server (confidence level: 100%)
file216.73.158.27	Mirai botnet C2 server (confidence level: 100%)
file158.69.175.235	Mirai botnet C2 server (confidence level: 100%)
file103.214.71.72	Mirai botnet C2 server (confidence level: 100%)
file204.76.203.188	Mirai botnet C2 server (confidence level: 100%)
file204.76.203.173	Mirai botnet C2 server (confidence level: 100%)
file185.121.15.49	Mirai botnet C2 server (confidence level: 100%)
file65.109.226.203	Vidar botnet C2 server (confidence level: 100%)
file87.121.84.84	Mirai botnet C2 server (confidence level: 100%)
file87.121.84.56	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.80	Mirai botnet C2 server (confidence level: 100%)
file194.85.251.79	Mirai botnet C2 server (confidence level: 100%)
file47.122.1.243	Cobalt Strike botnet C2 server (confidence level: 100%)
file103.80.19.179	Cobalt Strike botnet C2 server (confidence level: 100%)
file103.80.19.180	Cobalt Strike botnet C2 server (confidence level: 100%)
file128.90.123.17	AsyncRAT botnet C2 server (confidence level: 100%)
file69.48.202.241	AsyncRAT botnet C2 server (confidence level: 100%)
file156.238.238.83	ValleyRAT botnet C2 server (confidence level: 100%)
file160.22.161.157	Mirai botnet C2 server (confidence level: 75%)
file202.95.22.2	ValleyRAT botnet C2 server (confidence level: 100%)
file194.85.251.76	Mirai botnet C2 server (confidence level: 100%)
file161.248.239.28	Cobalt Strike botnet C2 server (confidence level: 100%)
file196.251.84.215	Remcos botnet C2 server (confidence level: 100%)
file185.91.72.143	Sliver botnet C2 server (confidence level: 100%)
file69.48.202.241	AsyncRAT botnet C2 server (confidence level: 100%)
file92.255.85.23	SectopRAT botnet C2 server (confidence level: 100%)
file92.255.85.23	SectopRAT botnet C2 server (confidence level: 100%)
file102.117.173.86	Unknown malware botnet C2 server (confidence level: 100%)
file105.69.240.227	Quasar RAT botnet C2 server (confidence level: 100%)
file173.249.52.37	Havoc botnet C2 server (confidence level: 100%)
file193.124.205.36	MooBot botnet C2 server (confidence level: 100%)
file188.253.125.96	DeimosC2 botnet C2 server (confidence level: 75%)
file200.91.114.50	QakBot botnet C2 server (confidence level: 75%)
file44.246.4.119	DeimosC2 botnet C2 server (confidence level: 75%)
file101.34.66.77	Cobalt Strike botnet C2 server (confidence level: 50%)
file107.175.194.55	Cobalt Strike botnet C2 server (confidence level: 50%)
file216.118.230.118	Sliver botnet C2 server (confidence level: 50%)
file216.126.229.110	Sliver botnet C2 server (confidence level: 50%)
file185.102.75.120	Sliver botnet C2 server (confidence level: 50%)
file216.118.230.114	Sliver botnet C2 server (confidence level: 50%)
file54.170.28.226	NetSupportManager RAT botnet C2 server (confidence level: 50%)
file43.207.217.215	NetSupportManager RAT botnet C2 server (confidence level: 50%)
file61.76.179.183	NetSupportManager RAT botnet C2 server (confidence level: 50%)
file196.251.90.21	Nanocore RAT botnet C2 server (confidence level: 50%)
file72.219.193.69	Xtreme RAT botnet C2 server (confidence level: 50%)
file13.60.202.169	Havoc botnet C2 server (confidence level: 50%)
file47.129.14.236	Unknown malware botnet C2 server (confidence level: 50%)

Hash

Value	Description	Copy
hash59666	Mirai botnet C2 server (confidence level: 75%)
hash3778	Mirai botnet C2 server (confidence level: 100%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)
hash443	Cobalt Strike botnet C2 server (confidence level: 100%)
hash443	Remcos botnet C2 server (confidence level: 100%)
hash3390	Remcos botnet C2 server (confidence level: 100%)
hash8808	AsyncRAT botnet C2 server (confidence level: 100%)
hash7443	Unknown malware botnet C2 server (confidence level: 100%)
hash444	RMS botnet C2 server (confidence level: 100%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)
hash1604	DarkComet botnet C2 server (confidence level: 100%)
hash2404	Remcos botnet C2 server (confidence level: 100%)
hash7443	Unknown malware botnet C2 server (confidence level: 100%)
hash18246	Venom RAT botnet C2 server (confidence level: 100%)
hash19096	Venom RAT botnet C2 server (confidence level: 100%)
hash49152	Venom RAT botnet C2 server (confidence level: 100%)
hash43	Venom RAT botnet C2 server (confidence level: 100%)
hash80	Bashlite botnet C2 server (confidence level: 100%)
hash8888	Unknown malware botnet C2 server (confidence level: 100%)
hash8808	AsyncRAT botnet C2 server (confidence level: 100%)
hash80	MooBot botnet C2 server (confidence level: 100%)
hash443	Unknown malware botnet C2 server (confidence level: 100%)
hash3333	Unknown malware botnet C2 server (confidence level: 100%)
hash80	Unknown malware botnet C2 server (confidence level: 100%)
hash80	Unknown malware botnet C2 server (confidence level: 100%)
hash3333	Unknown malware botnet C2 server (confidence level: 100%)
hash3333	Unknown malware botnet C2 server (confidence level: 100%)
hash3333	Unknown malware botnet C2 server (confidence level: 100%)
hash8845	Cobalt Strike botnet C2 server (confidence level: 50%)
hash50050	Cobalt Strike botnet C2 server (confidence level: 50%)
hash8099	Cobalt Strike botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash6001	NetSupportManager RAT botnet C2 server (confidence level: 50%)
hash221	NetSupportManager RAT botnet C2 server (confidence level: 50%)
hash15	NetSupportManager RAT botnet C2 server (confidence level: 50%)
hash6001	NetSupportManager RAT botnet C2 server (confidence level: 50%)
hash9001	Xtreme RAT botnet C2 server (confidence level: 50%)
hash4433	Xtreme RAT botnet C2 server (confidence level: 50%)
hash1080	Xtreme RAT botnet C2 server (confidence level: 50%)
hash62078	Xtreme RAT botnet C2 server (confidence level: 50%)
hash443	Ghost RAT botnet C2 server (confidence level: 50%)
hash4443	Unknown malware botnet C2 server (confidence level: 50%)
hash3333	Unknown malware botnet C2 server (confidence level: 50%)
hash4709	XWorm botnet C2 server (confidence level: 50%)
hash5555	Mirai botnet C2 server (confidence level: 75%)
hash7000	Cobalt Strike botnet C2 server (confidence level: 100%)
hash8888	Unknown malware botnet C2 server (confidence level: 100%)
hash7000	Quasar RAT botnet C2 server (confidence level: 100%)
hash4782	Quasar RAT botnet C2 server (confidence level: 100%)
hash2406	DCRat botnet C2 server (confidence level: 100%)
hash88	NetSupportManager RAT botnet C2 server (confidence level: 100%)
hash52662	NetSupportManager RAT botnet C2 server (confidence level: 100%)
hash8888	Cobalt Strike botnet C2 server (confidence level: 100%)
hash443	QakBot botnet C2 server (confidence level: 75%)
hash4506	DeimosC2 botnet C2 server (confidence level: 75%)
hash8888	Sliver botnet C2 server (confidence level: 75%)
hash443	DeimosC2 botnet C2 server (confidence level: 75%)
hash995	QakBot botnet C2 server (confidence level: 75%)
hash18246	NetSupportManager RAT botnet C2 server (confidence level: 75%)
hash4000	Unknown malware botnet C2 server (confidence level: 100%)
hash4000	Unknown malware botnet C2 server (confidence level: 100%)
hash4258	Bashlite botnet C2 server (confidence level: 75%)
hash38777	Mirai botnet C2 server (confidence level: 100%)
hash43366	Nanocore RAT botnet C2 server (confidence level: 100%)
hash69	Mirai botnet C2 server (confidence level: 100%)
hash2214	Mirai botnet C2 server (confidence level: 100%)
hash2214	Mirai botnet C2 server (confidence level: 100%)
hash2214	Mirai botnet C2 server (confidence level: 100%)
hash2214	Mirai botnet C2 server (confidence level: 100%)
hash1995	MooBot botnet C2 server (confidence level: 100%)
hash2754	CyberGate botnet C2 server (confidence level: 100%)
hash2998	CyberGate botnet C2 server (confidence level: 100%)
hash59	CyberGate botnet C2 server (confidence level: 100%)
hash8080	CyberGate botnet C2 server (confidence level: 100%)
hash443	CyberGate botnet C2 server (confidence level: 100%)
hash100	CyberGate botnet C2 server (confidence level: 100%)
hash81	CyberGate botnet C2 server (confidence level: 100%)
hash81	CyberGate botnet C2 server (confidence level: 100%)
hash25565	CyberGate botnet C2 server (confidence level: 100%)
hash4444	Bashlite botnet C2 server (confidence level: 100%)
hash1111	Bashlite botnet C2 server (confidence level: 100%)
hash700	Bashlite botnet C2 server (confidence level: 100%)
hash23	Bashlite botnet C2 server (confidence level: 100%)
hash12345	Bashlite botnet C2 server (confidence level: 100%)
hash4258	Bashlite botnet C2 server (confidence level: 100%)
hash23	Bashlite botnet C2 server (confidence level: 100%)
hash4567	Bashlite botnet C2 server (confidence level: 100%)
hash53	Bashlite botnet C2 server (confidence level: 100%)
hash152	Bashlite botnet C2 server (confidence level: 100%)
hash4258	Bashlite botnet C2 server (confidence level: 100%)
hash6149	Bashlite botnet C2 server (confidence level: 100%)
hash4269	Bashlite botnet C2 server (confidence level: 100%)
hash666	Bashlite botnet C2 server (confidence level: 100%)
hash12345	Bashlite botnet C2 server (confidence level: 100%)
hash23	Bashlite botnet C2 server (confidence level: 100%)
hash4258	Bashlite botnet C2 server (confidence level: 100%)
hash65000	Bashlite botnet C2 server (confidence level: 100%)
hash4258	Bashlite botnet C2 server (confidence level: 100%)
hash42516	Bashlite botnet C2 server (confidence level: 100%)
hash4258	Bashlite botnet C2 server (confidence level: 100%)
hash872	Bashlite botnet C2 server (confidence level: 100%)
hash42516	Bashlite botnet C2 server (confidence level: 100%)
hash4568	Bashlite botnet C2 server (confidence level: 100%)
hash839	Bashlite botnet C2 server (confidence level: 100%)
hash49998	Bashlite botnet C2 server (confidence level: 100%)
hash812	Bashlite botnet C2 server (confidence level: 100%)
hash1024	Bashlite botnet C2 server (confidence level: 100%)
hash23	Bashlite botnet C2 server (confidence level: 100%)
hash23	Bashlite botnet C2 server (confidence level: 100%)
hash252	Bashlite botnet C2 server (confidence level: 100%)
hash811	Bashlite botnet C2 server (confidence level: 100%)
hash800	Bashlite botnet C2 server (confidence level: 100%)
hash872	Bashlite botnet C2 server (confidence level: 100%)
hash4258	Bashlite botnet C2 server (confidence level: 100%)
hash839	Bashlite botnet C2 server (confidence level: 100%)
hash4545	Bashlite botnet C2 server (confidence level: 100%)
hash444	Bashlite botnet C2 server (confidence level: 100%)
hash666	Bashlite botnet C2 server (confidence level: 100%)
hash606	Bashlite botnet C2 server (confidence level: 100%)
hash839	Bashlite botnet C2 server (confidence level: 100%)
hash23	Bashlite botnet C2 server (confidence level: 100%)
hash872	Bashlite botnet C2 server (confidence level: 100%)
hash53	Bashlite botnet C2 server (confidence level: 100%)
hash839	Bashlite botnet C2 server (confidence level: 100%)
hash443	Bashlite botnet C2 server (confidence level: 100%)
hash1331	Bashlite botnet C2 server (confidence level: 100%)
hash23	Bashlite botnet C2 server (confidence level: 100%)
hash42516	Bashlite botnet C2 server (confidence level: 100%)
hash1111	Bashlite botnet C2 server (confidence level: 100%)
hash1111	Bashlite botnet C2 server (confidence level: 100%)
hash666	Bashlite botnet C2 server (confidence level: 100%)
hash872	Bashlite botnet C2 server (confidence level: 100%)
hash23	Bashlite botnet C2 server (confidence level: 100%)
hash23	Bashlite botnet C2 server (confidence level: 100%)
hash1337	Bashlite botnet C2 server (confidence level: 100%)
hash292	Bashlite botnet C2 server (confidence level: 100%)
hash1604	DarkComet botnet C2 server (confidence level: 100%)
hash1604	DarkComet botnet C2 server (confidence level: 100%)
hash14499	DarkComet botnet C2 server (confidence level: 100%)
hash1601	DarkComet botnet C2 server (confidence level: 100%)
hash1243	DarkComet botnet C2 server (confidence level: 100%)
hash1604	DarkComet botnet C2 server (confidence level: 100%)
hash81	DarkComet botnet C2 server (confidence level: 100%)
hash1604	DarkComet botnet C2 server (confidence level: 100%)
hash85	DarkComet botnet C2 server (confidence level: 100%)
hash1602	DarkComet botnet C2 server (confidence level: 100%)
hash1604	DarkComet botnet C2 server (confidence level: 100%)
hash1604	DarkComet botnet C2 server (confidence level: 100%)
hash1604	DarkComet botnet C2 server (confidence level: 100%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)
hash587	Remcos botnet C2 server (confidence level: 100%)
hash2404	Remcos botnet C2 server (confidence level: 100%)
hash5000	Venom RAT botnet C2 server (confidence level: 100%)
hash443	Venom RAT botnet C2 server (confidence level: 100%)
hash6362	NetSupportManager RAT botnet C2 server (confidence level: 100%)
hash8080	MimiKatz botnet C2 server (confidence level: 100%)
hash8888	Cobalt Strike botnet C2 server (confidence level: 75%)
hash8888	Cobalt Strike botnet C2 server (confidence level: 75%)
hash2020	Remcos botnet C2 server (confidence level: 100%)
hash3778	Mirai botnet C2 server (confidence level: 75%)
hash1311	Mirai botnet C2 server (confidence level: 100%)
hash20722	Mirai botnet C2 server (confidence level: 100%)
hash2454	Mirai botnet C2 server (confidence level: 100%)
hash6007	Mirai botnet C2 server (confidence level: 100%)
hash2079	Mirai botnet C2 server (confidence level: 100%)
hash2404	Mirai botnet C2 server (confidence level: 100%)
hash5985	Mirai botnet C2 server (confidence level: 100%)
hash11112	Mirai botnet C2 server (confidence level: 100%)
hash21942	Mirai botnet C2 server (confidence level: 100%)
hash1883	Mirai botnet C2 server (confidence level: 100%)
hash1962	Mirai botnet C2 server (confidence level: 100%)
hash10258	Mirai botnet C2 server (confidence level: 100%)
hash15256	Mirai botnet C2 server (confidence level: 100%)
hash16992	Mirai botnet C2 server (confidence level: 100%)
hash20546	Mirai botnet C2 server (confidence level: 100%)
hash2038	Mirai botnet C2 server (confidence level: 100%)
hash8081	Mirai botnet C2 server (confidence level: 100%)
hash21037	Mirai botnet C2 server (confidence level: 100%)
hash22705	Mirai botnet C2 server (confidence level: 100%)
hash1912	Mirai botnet C2 server (confidence level: 100%)
hash1961	Mirai botnet C2 server (confidence level: 100%)
hash1295	Mirai botnet C2 server (confidence level: 100%)
hash2143	Mirai botnet C2 server (confidence level: 100%)
hash5977	Mirai botnet C2 server (confidence level: 100%)
hash14265	Mirai botnet C2 server (confidence level: 100%)
hash22585	Mirai botnet C2 server (confidence level: 100%)
hash2086	Mirai botnet C2 server (confidence level: 100%)
hash22222	Mirai botnet C2 server (confidence level: 100%)
hash16993	Mirai botnet C2 server (confidence level: 100%)
hash2080	Mirai botnet C2 server (confidence level: 100%)
hash5957	Mirai botnet C2 server (confidence level: 100%)
hash6007	Mirai botnet C2 server (confidence level: 100%)
hash6362	Mirai botnet C2 server (confidence level: 100%)
hash3389	Mirai botnet C2 server (confidence level: 100%)
hash3260	Mirai botnet C2 server (confidence level: 100%)
hash17763	Mirai botnet C2 server (confidence level: 100%)
hash18444	Mirai botnet C2 server (confidence level: 100%)
hash15568	Mirai botnet C2 server (confidence level: 100%)
hash1961	Mirai botnet C2 server (confidence level: 100%)
hash1963	Mirai botnet C2 server (confidence level: 100%)
hash6238	Mirai botnet C2 server (confidence level: 100%)
hash8088	Mirai botnet C2 server (confidence level: 100%)
hash9599	Mirai botnet C2 server (confidence level: 100%)
hash17761	Mirai botnet C2 server (confidence level: 100%)
hash18246	Mirai botnet C2 server (confidence level: 100%)
hash20548	Mirai botnet C2 server (confidence level: 100%)
hash14326	Mirai botnet C2 server (confidence level: 100%)
hash1311	Mirai botnet C2 server (confidence level: 100%)
hash4369	Mirai botnet C2 server (confidence level: 100%)
hash5671	Mirai botnet C2 server (confidence level: 100%)
hash6362	Mirai botnet C2 server (confidence level: 100%)
hash11101	Mirai botnet C2 server (confidence level: 100%)
hash16765	Mirai botnet C2 server (confidence level: 100%)
hash18673	Mirai botnet C2 server (confidence level: 100%)
hash1801	Mirai botnet C2 server (confidence level: 100%)
hash2281	Mirai botnet C2 server (confidence level: 100%)
hash5324	Mirai botnet C2 server (confidence level: 100%)
hash5985	Mirai botnet C2 server (confidence level: 100%)
hash15443	Mirai botnet C2 server (confidence level: 100%)
hash2096	Mirai botnet C2 server (confidence level: 100%)
hash10002	Mirai botnet C2 server (confidence level: 100%)
hash1949	Mirai botnet C2 server (confidence level: 100%)
hash5000	Mirai botnet C2 server (confidence level: 100%)
hash5061	Mirai botnet C2 server (confidence level: 100%)
hash18245	Mirai botnet C2 server (confidence level: 100%)
hash1311	Mirai botnet C2 server (confidence level: 100%)
hash1291	Mirai botnet C2 server (confidence level: 100%)
hash1299	Mirai botnet C2 server (confidence level: 100%)
hash1311	Mirai botnet C2 server (confidence level: 100%)
hash4242	Mirai botnet C2 server (confidence level: 100%)
hash6005	Mirai botnet C2 server (confidence level: 100%)
hash6808	Mirai botnet C2 server (confidence level: 100%)
hash8387	Mirai botnet C2 server (confidence level: 100%)
hash2086	Mirai botnet C2 server (confidence level: 100%)
hash2281	Mirai botnet C2 server (confidence level: 100%)
hash3389	Mirai botnet C2 server (confidence level: 100%)
hash3684	Mirai botnet C2 server (confidence level: 100%)
hash10002	Mirai botnet C2 server (confidence level: 100%)
hash18444	Mirai botnet C2 server (confidence level: 100%)
hash2087	Mirai botnet C2 server (confidence level: 100%)
hash4840	Mirai botnet C2 server (confidence level: 100%)
hash9999	Mirai botnet C2 server (confidence level: 100%)
hash21104	Mirai botnet C2 server (confidence level: 100%)
hash9052	Mirai botnet C2 server (confidence level: 100%)
hash11450	Mirai botnet C2 server (confidence level: 100%)
hash16561	Mirai botnet C2 server (confidence level: 100%)
hash18244	Mirai botnet C2 server (confidence level: 100%)
hash2077	Mirai botnet C2 server (confidence level: 100%)
hash5061	Mirai botnet C2 server (confidence level: 100%)
hash8010	Mirai botnet C2 server (confidence level: 100%)
hash10259	Mirai botnet C2 server (confidence level: 100%)
hash1308	Mirai botnet C2 server (confidence level: 100%)
hash1289	Mirai botnet C2 server (confidence level: 100%)
hash1311	Mirai botnet C2 server (confidence level: 100%)
hash1311	Mirai botnet C2 server (confidence level: 100%)
hash1298	Mirai botnet C2 server (confidence level: 100%)
hash1311	Mirai botnet C2 server (confidence level: 100%)
hash1298	Mirai botnet C2 server (confidence level: 100%)
hash1309	Mirai botnet C2 server (confidence level: 100%)
hash1311	Mirai botnet C2 server (confidence level: 100%)
hash1286	Mirai botnet C2 server (confidence level: 100%)
hash1311	Mirai botnet C2 server (confidence level: 100%)
hash1311	Mirai botnet C2 server (confidence level: 100%)
hash1311	Mirai botnet C2 server (confidence level: 100%)
hash1311	Mirai botnet C2 server (confidence level: 100%)
hash1293	Mirai botnet C2 server (confidence level: 100%)
hash1294	Mirai botnet C2 server (confidence level: 100%)
hash1311	Mirai botnet C2 server (confidence level: 100%)
hash1338	Mirai botnet C2 server (confidence level: 100%)
hash1311	Mirai botnet C2 server (confidence level: 100%)
hash1311	Mirai botnet C2 server (confidence level: 100%)
hash443	Vidar botnet C2 server (confidence level: 100%)
hash1311	Mirai botnet C2 server (confidence level: 100%)
hash1311	Mirai botnet C2 server (confidence level: 100%)
hash1311	Mirai botnet C2 server (confidence level: 100%)
hash1311	Mirai botnet C2 server (confidence level: 100%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)
hash52668	Cobalt Strike botnet C2 server (confidence level: 100%)
hash52668	Cobalt Strike botnet C2 server (confidence level: 100%)
hash5000	AsyncRAT botnet C2 server (confidence level: 100%)
hash7707	AsyncRAT botnet C2 server (confidence level: 100%)
hash3883	ValleyRAT botnet C2 server (confidence level: 100%)
hash56999	Mirai botnet C2 server (confidence level: 75%)
hash4433	ValleyRAT botnet C2 server (confidence level: 100%)
hash1999	Mirai botnet C2 server (confidence level: 100%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)
hash789	Remcos botnet C2 server (confidence level: 100%)
hash443	Sliver botnet C2 server (confidence level: 100%)
hash6606	AsyncRAT botnet C2 server (confidence level: 100%)
hash15647	SectopRAT botnet C2 server (confidence level: 100%)
hash15747	SectopRAT botnet C2 server (confidence level: 100%)
hash7443	Unknown malware botnet C2 server (confidence level: 100%)
hash8080	Quasar RAT botnet C2 server (confidence level: 100%)
hash443	Havoc botnet C2 server (confidence level: 100%)
hash33006	MooBot botnet C2 server (confidence level: 100%)
hash2096	DeimosC2 botnet C2 server (confidence level: 75%)
hash443	QakBot botnet C2 server (confidence level: 75%)
hash443	DeimosC2 botnet C2 server (confidence level: 75%)
hash50050	Cobalt Strike botnet C2 server (confidence level: 50%)
hash443	Cobalt Strike botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash12209	NetSupportManager RAT botnet C2 server (confidence level: 50%)
hash993	NetSupportManager RAT botnet C2 server (confidence level: 50%)
hash6000	NetSupportManager RAT botnet C2 server (confidence level: 50%)
hash54984	Nanocore RAT botnet C2 server (confidence level: 50%)
hash8880	Xtreme RAT botnet C2 server (confidence level: 50%)
hash443	Havoc botnet C2 server (confidence level: 50%)
hash3306	Unknown malware botnet C2 server (confidence level: 50%)

Url

Value	Description	Copy
urlhttps://metalcourthur.fun/api	Lumma Stealer payload delivery URL (confidence level: 100%)
urlhttps://hobbyedsmoker.live/api	Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://goaledharmfuk.live/api	Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://baconqualit.live/api	Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://resqueoppos.live/api	Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://privileggoe.live/api	Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://concentratecr.world/api	Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://neglectdivid.world/api	Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://miscrirarisz.today/api	Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://owerenvokken.run/api	Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://reasonablerwi.today/api	Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://bennedospok.run/api	Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://dryentaidne.run/api	Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://grendyreushe.run/api	Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://porkedbunned.run/api	Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://lawyesaved.today/api	Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://deaddereaste.today/api	Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://kurrenpowed.run/api	Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://seraphicridge.xyz/mdqyztc1mju5mjzi/	Coper botnet C2 (confidence level: 100%)
urlhttps://crimsonpeak.xyz/odmyzdm0yjliownl/	Coper botnet C2 (confidence level: 100%)
urlhttps://shadowpeak.xyz/ywvhnmm2otc3mzzi/	Coper botnet C2 (confidence level: 100%)
urlhttp://289098cm.shnyash.ru/phpcentral.php	DCRat botnet C2 (confidence level: 100%)
urlhttp://593412cm.nyanyash.ru/externallinemultidefaulttrafficwpcentraluploads.php	DCRat botnet C2 (confidence level: 100%)
urlhttp://610188cm.nyanyash.ru/vmcpugamesqlcentral.php	DCRat botnet C2 (confidence level: 100%)
urlhttps://check.oaaea.icu/gkcxv.google	ClearFake payload delivery URL (confidence level: 100%)
urlhttp://a1081343.xsph.ru/0fce162f.php	DCRat botnet C2 (confidence level: 100%)
urlhttps://check.iuuoo.icu/gkcxv.google	ClearFake payload delivery URL (confidence level: 100%)
urlhttp://175.107.2.254:50638/mozi.m	Mozi payload delivery URL (confidence level: 50%)
urlhttps://check.ioeoe.icu/gkcxv.google	ClearFake payload delivery URL (confidence level: 100%)
urlhttp://5.42.64.28/39f98d2ea5ca5476/sqlite3.dll	Stealc payload delivery URL (confidence level: 50%)
urlhttp://185.254.37.234/61c7c6a1a965cae9/vcruntime140.dll	Stealc payload delivery URL (confidence level: 50%)
urlhttp://91.92.240.120/5ae9ffc2ed73fda7/vcruntime140.dll	Stealc payload delivery URL (confidence level: 50%)
urlhttp://5.35.36.211/b1204656088244d5/mozglue.dll	Stealc payload delivery URL (confidence level: 50%)
urlhttp://5.35.36.211/b1204656088244d5/vcruntime140.dll	Stealc payload delivery URL (confidence level: 50%)
urlhttp://5.35.36.211/b1204656088244d5/sqlite3.dll	Stealc payload delivery URL (confidence level: 50%)
urlhttp://109.206.241.81/htdocs/bmqkbenzdymsrtz.exe	MASS Logger payload delivery URL (confidence level: 50%)
urlhttp://81.161.229.110/htdocs/btmicczwxrrytqj.exe	MASS Logger payload delivery URL (confidence level: 50%)
urlhttp://87.120.84.38/txt/rnuwcr38irnohzk.exe	MASS Logger payload delivery URL (confidence level: 50%)
urlhttps://potentiashelt.site/api	Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://embarkiffe.shop/api	Lumma Stealer botnet C2 (confidence level: 50%)
urlhttps://sebel.sbs/devil/pws/pvqdq929bsx_a_d_m1n_a.php	Loki Password Stealer (PWS) botnet C2 (confidence level: 50%)
urlhttps://recaptcha-phish.pages.dev/	Unknown malware payload delivery URL (confidence level: 50%)
urlhttps://api.telegram.org/bot5656780330:aahzylie6okscdg1d9lg5rtz3msapsmed3u/	Agent Tesla botnet C2 (confidence level: 50%)
urlhttps://pastebin.com/raw/wxyjm7vm	XWorm botnet C2 (confidence level: 50%)
urlhttps://check.auieu.icu/gkcxv.google	ClearFake payload delivery URL (confidence level: 100%)
urlhttps://check.ieooy.icu/gkcxv.google	ClearFake payload delivery URL (confidence level: 100%)
urlhttps://176.111.216.82:3333/login	Unknown malware botnet C2 (confidence level: 100%)
urlhttps://check.eooii.icu/gkcxv.google	ClearFake payload delivery URL (confidence level: 100%)
urlhttps://check.ueoie.icu/gkcxv.google	ClearFake payload delivery URL (confidence level: 100%)
urlhttps://check.eioye.icu/gkcxv.google	ClearFake payload delivery URL (confidence level: 100%)
urlhttps://check.iyuei.icu/gkcxv.google	ClearFake payload delivery URL (confidence level: 100%)
urlhttp://u1.gossipsurrender.shop/china.mp4	ClearFake payload delivery URL (confidence level: 100%)
urlhttps://check.aiyay.icu/gkcxv.google	ClearFake payload delivery URL (confidence level: 100%)
urlhttp://fluf5ikyan.temp.swtest.ru/d71be0a9.php	DCRat botnet C2 (confidence level: 100%)
urlhttp://u1.gossipsurrender.shop/camcorder.m4a	ClearFake payload delivery URL (confidence level: 100%)
urlhttps://check.oeoye.icu/gkcxv.google	ClearFake payload delivery URL (confidence level: 100%)
urlhttps://check.zoxod.icu/gkcxv.google	ClearFake payload delivery URL (confidence level: 100%)
urlhttps://top.4t.com/	Vidar botnet C2 (confidence level: 100%)
urlhttps://65.109.226.203/	Vidar botnet C2 (confidence level: 100%)
urlhttps://check.fuher.icu/gkcxv.google	ClearFake payload delivery URL (confidence level: 100%)
urlhttps://check.nevyz.icu/gkcxv.google	ClearFake payload delivery URL (confidence level: 100%)
urlhttp://u1.gossipsurrender.shop/12.mp4	ClearFake payload delivery URL (confidence level: 100%)
urlhttps://uokota.online/concerto/blend	XWorm payload delivery URL (confidence level: 100%)
urlhttps://chekagustario.com/	XWorm payload delivery URL (confidence level: 100%)
urlhttps://booking.chekagustario.com/	XWorm payload delivery URL (confidence level: 100%)
urlhttps://check.sinev.icu/gkcxv.google	ClearFake payload delivery URL (confidence level: 100%)
urlhttps://check.losex.icu/gkcxv.google	ClearFake payload delivery URL (confidence level: 100%)
urlhttp://u1.shalebrussels.shop/china.mp4	ClearFake payload delivery URL (confidence level: 100%)
urlhttp://542148cm.nyanyash.ru/phpsecuregeo.php	DCRat botnet C2 (confidence level: 100%)
urlhttp://439153cm.nyashk.ru/geosqlwpuploads.php	DCRat botnet C2 (confidence level: 100%)

Threat ID: 682c7dbee8347ec82d2cc12e

Added to database: 5/20/2025, 1:03:58 PM

Last enriched: 6/19/2025, 4:05:19 PM

Last updated: 8/13/2025, 3:30:11 PM

Related Threats

Actions

PRO

Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.

Please log in to the Console to use AI analysis features.

External Links

Search on Google

Need enhanced features?

Contact root@offseq.com for Pro access with improved analysis and higher rate limits.

ThreatFox IOCs for 2025-02-23

AI Analysis

Technical Summary

Potential Impact

Mitigation Recommendations

Affected Countries

Indicators of Compromise

ThreatFox IOCs for 2025-02-23

Description

AI-Powered Analysis

Technical Analysis

Potential Impact

Mitigation Recommendations

Affected Countries

Technical Details

Indicators of Compromise

Domain

File

Hash

Url

Related Threats

ThreatFox IOCs for 2025-08-16

Scammers Compromised by Own Malware, Expose $4.67M Operation and Identities

ThreatFox IOCs for 2025-08-15

Threat Actor Profile: Interlock Ransomware

'Blue Locker' Analysis: Ransomware Targeting Oil & Gas Sector in Pakistan

Actions

External Links

Need enhanced features?

Latest Threats

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility