ThreatFox IOCs for 2025-03-20
Severity: mediumType: malware
ThreatFox IOCs for 2025-03-20
AI Analysis
Technical Summary
The provided threat intelligence relates to a malware-related report titled "ThreatFox IOCs for 2025-03-20," sourced from ThreatFox, a platform known for sharing Indicators of Compromise (IOCs) and threat intelligence data. The report is categorized under 'type:osint,' indicating that it primarily involves open-source intelligence data rather than a specific malware family or exploit. There are no affected product versions or specific vulnerabilities listed, and no known exploits in the wild have been reported. The technical details include a threat level of 2 (on an unspecified scale), an analysis rating of 1, and a distribution rating of 3, suggesting moderate dissemination or visibility of the threat indicators. The absence of concrete IOCs, CWE identifiers, or patch links implies that this report serves more as a situational awareness update rather than detailing an active or emerging exploit. The medium severity rating assigned by the source likely reflects the potential for this intelligence to aid in detecting or mitigating malware threats rather than indicating a direct, immediate risk. Overall, this threat intelligence appears to be a collection or update of OSINT-based malware indicators that could support defensive operations but does not describe a novel or actively exploited vulnerability or malware strain.
Potential Impact
For European organizations, the impact of this threat intelligence is primarily informational and preparatory. Since no specific malware variants, vulnerabilities, or exploits are detailed, the direct risk to confidentiality, integrity, or availability is limited at this stage. However, the distribution rating of 3 suggests that the associated IOCs or related malware activity may be moderately widespread, which could imply that European entities might encounter related threats if they rely on the shared OSINT for detection. The medium severity indicates that while the threat is not immediately critical, organizations should remain vigilant, as the intelligence could help identify or prevent malware infections. The lack of known exploits in the wild reduces the urgency but does not eliminate the possibility of future exploitation. European organizations involved in cybersecurity monitoring, threat hunting, or incident response could benefit from integrating this intelligence to enhance detection capabilities. The impact is thus more strategic and operational rather than immediate or catastrophic.
Mitigation Recommendations
Given the nature of this threat intelligence as an OSINT-based update without specific vulnerabilities or exploits, mitigation should focus on enhancing threat detection and response capabilities. Organizations should: 1) Integrate the provided IOCs (when available) into existing security information and event management (SIEM) systems and endpoint detection and response (EDR) tools to improve detection of related malware activity. 2) Maintain up-to-date threat intelligence feeds and ensure security teams are trained to interpret and act on OSINT data effectively. 3) Conduct regular threat hunting exercises leveraging the latest OSINT to proactively identify potential compromises. 4) Collaborate with information sharing and analysis centers (ISACs) relevant to their sector and region to receive timely updates and contextualize threat intelligence. 5) Ensure robust incident response plans are in place to quickly contain and remediate any malware infections detected through these indicators. These steps go beyond generic advice by emphasizing operational integration of OSINT and proactive threat hunting tailored to the intelligence provided.
Affected Countries
Germany, France, United Kingdom, Netherlands, Italy, Spain
Indicators of Compromise
- url: http://202.146.222.166:8888/supershell/login/
- file: 202.146.222.166
- hash: 8888
- domain: check.asiu4.icu
- url: https://janhugo.com/1q2w.js
- domain: janhugo.com
- url: https://janhugo.com/js.php
- file: 135.125.21.41
- hash: 1912
- url: https://janhugo.com/5s1j.js
- file: 185.194.205.79
- hash: 61003
- file: 154.82.92.133
- hash: 888
- file: 196.251.72.250
- hash: 80
- file: 120.24.64.74
- hash: 63211
- file: 196.251.69.85
- hash: 2404
- file: 45.62.170.96
- hash: 2404
- file: 172.111.131.195
- hash: 2404
- file: 66.248.206.248
- hash: 2404
- file: 24.137.215.157
- hash: 443
- file: 104.193.69.145
- hash: 443
- file: 194.32.142.52
- hash: 80
- file: 154.12.60.69
- hash: 8888
- file: 45.200.51.134
- hash: 16521
- file: 172.191.137.101
- hash: 80
- file: 179.43.172.173
- hash: 443
- file: 171.232.0.161
- hash: 8000
- file: 172.86.109.207
- hash: 32132
- file: 185.184.123.94
- hash: 80
- domain: webdisk.f.multi-canale.com
- domain: webdisk.gfjd.104-168-101-27.cprapid.com
- domain: mail.c.multi-canale.com
- domain: webmail.aa.104-168-101-27.cprapid.com
- domain: ez-ssb.sipos.services
- domain: hackthisshit.no-ip.biz
- domain: krpt.dyndns.info
- domain: roundbluerobin.no-ip.biz
- domain: jarmen.no-ip.biz
- domain: wiseagle101.zapto.org
- domain: intercool.zapto.org
- domain: lodoclan.servegame.com
- domain: thepowerguido.no-ip.org
- domain: raid88rush.myphotos.cc
- domain: dr-mat.zapto.org
- domain: xradox.no-ip.org
- domain: microsoftskype.no-ip.biz
- domain: turkkilainen.no-ip.biz
- domain: proalexpro.no-ip.org
- domain: atlantise.zapto.org
- domain: datasecurity32.no-ip.biz
- domain: susunahi3.no-ip.info
- domain: poison00.no-ip.org
- domain: chakra22.zapto.org
- domain: salla.no-ip.biz
- domain: hack993.sytes.net
- domain: medo99.no-ip.info
- domain: pooptit1.no-ip.biz
- domain: update-microsoft.no-ip.info
- domain: james1990.no-ip.biz
- domain: xbladeinc.zapto.org
- domain: nwal.zapto.org
- domain: asment34.no-ip.biz
- domain: chamta1.zapto.org
- domain: kevinj123.no-ip.org
- domain: sp1ffy.no-ip.biz
- domain: susunahi1.no-ip.info
- domain: frozenrats.no-ip.org
- domain: snowhost.no-ip.biz
- domain: revennaras.no-ip.org
- domain: kakawe2004.no-ip.biz
- domain: darkrounge.no-ip.biz
- domain: lamafiahacker.no-ip.org
- domain: dkcyb.no-ip.org
- domain: tutorial2016.ddns.net
- domain: mena.ath.cx
- domain: testy.no-ip.biz
- domain: ph9xlplaunlx150.sytes.net
- domain: shniwel0.no-ip.biz
- domain: microsoft1342.no-ip.biz
- domain: hxh.ath.cx
- domain: jaja1334.zapto.org
- domain: korpz1.no-ip.info
- domain: hackerpool.no-ip.biz
- domain: meiko-s.no-ip.org
- domain: asssh2010.no-ip.biz
- domain: checkers-world.no-ip.biz
- domain: snypz.poseidonbot.com
- domain: 1337krypton.no-ip.biz
- domain: ihrbekommtmichnie.zapto.org
- domain: dietimee.no-ip.org
- domain: incomingdisaster.no-ip.org
- domain: injector.no-ip.biz
- domain: t1t4n.no-ip.info
- domain: thisworldiscrazy.no-ip.biz
- domain: enhanceddomains.no-ip.biz
- domain: chillastube.podzone.org
- domain: gillamp.no-ip.info
- domain: lawlzorz.no-ip.biz
- domain: sadvent.no-ip.biz
- domain: michaudb.no-ip.biz
- domain: mark92.no-ip.biz
- domain: egoexxpress.servebbs.net
- domain: sunral.no-ip.info
- domain: xperrtcybergate.no-ip.info
- domain: runescapemodstaff.no-ip.biz
- domain: fahadm.no-ip.biz
- domain: d1a3l0.no-ip.biz
- domain: derdar.zapto.org
- domain: matrix-zloy.no-ip.biz
- domain: susunahi.no-ip.info
- domain: number.no-ip.org
- domain: senhordacaveira.no-ip.org
- domain: unfor1987.serveftp.net
- domain: skikda.sytes.net
- domain: hazavit.no-ip.biz
- domain: crackear.no-ip.org
- domain: pinkpanther54.no-ip.org
- domain: kptkmm.no-ip.org
- domain: pri1.no-ip.org
- domain: asas.hopto.org
- domain: picudobot.no-ip.org
- domain: 123qwe.no-ip.org
- domain: lahssen1984.no-ip.biz
- domain: pleite.no-ip.org
- domain: ken1234.no-ip.info
- domain: chamta.zapto.org
- domain: solidest.dyndns.info
- domain: mstlj.no-ip.biz
- domain: onlycryy.no-ip.biz
- domain: tysonscape.zapto.org
- domain: barthssss.no-ip.biz
- domain: caveiranegro.no-ip.org
- domain: no0od.zapto.org
- domain: efeseaprimera.no-ip.org
- domain: xll.no-ip.info
- domain: genjitakiya.zapto.org
- domain: m3m0colk.zapto.org
- domain: obv.no-ip.info
- domain: mita.zapto.org
- domain: ogeniohacker.no-ip.org
- domain: hackeck.no-ip.info
- domain: thepowerguido.no-ip.biz
- domain: ttnet.gotdns.com
- domain: troyan-nikos.no-ip.org
- domain: best-man.no-ip.org
- domain: tahugejrot.no-ip.biz
- domain: 5onny.no-ip.biz
- domain: minecraft-batlle.servegame.com
- domain: hacker37.zapto.org
- domain: jacky2020.zapto.org
- domain: microsoftupd.no-ip.info
- domain: okaybabe.zapto.org
- domain: raidrush.zapto.org
- domain: morianos.no-ip.org
- domain: traphier-traph.serveftp.com
- domain: filehost1.zapto.org
- domain: ghostraider.zapto.org
- domain: morimor72.no-ip.org
- domain: project12222.no-ip.biz
- domain: bakainu.no-ip.info
- domain: canadabeta.no-ip.org
- domain: darkcomet2.no-ip.biz
- domain: zgogo.no-ip.info
- domain: stephie.zapto.org
- domain: cybergatecrack.no-ip.info
- domain: implingfinderv3.zapto.org
- domain: aytac.zapto.org
- domain: arschloch456.no-ip.biz
- domain: sansho007.no-ip.biz
- domain: minoip1001.zapto.org
- domain: coderz.no-ip.biz
- domain: nextlogon.no-ip.biz
- domain: 733t.no-ip.org
- domain: tangodown.no-ip.biz
- domain: khdt2.zapto.org
- domain: lobo-lol.no-ip.biz
- domain: cable.cable-modem.org
- domain: patrick1232.no-ip.biz
- domain: fantasmas.no-ip.org
- domain: a3n-hacker.no-ip.biz
- domain: lolbadkid.no-ip.biz
- domain: forever.no-ip.info
- domain: locuraaaaaa.zapto.org
- domain: chouchou.no-ip.biz
- domain: cinemaproduction.no-ip.biz
- domain: leopars.no-ip.biz
- domain: burgy.no-ip.org
- domain: grumpyemo.no-no.biz
- domain: wearethehorde.no-ip.org
- domain: gonza09.no-ip.org
- domain: grumpylucas.no-ip.biz
- domain: persis.no-ip.biz
- domain: lt1.zapto.org
- domain: jagexfails.zapto.org
- domain: ibm30073007.no-ip.org
- domain: cyberk.no-ip.org
- domain: syndrome.servemp3.com
- domain: hacker13.no-ip.org
- domain: aptem18.no-ip.biz
- domain: susunahi2.no-ip.info
- domain: dieforfree.no-ip.biz
- domain: tupeoramenaza.zapto.org
- domain: bullseye23.no-ip.biz
- domain: godimath.no-ip.org
- domain: goodalge.zapto.org
- domain: msgh.no-ip.biz
- domain: disgow1.no-ip.org
- domain: infectadoemo.no-ip.org
- domain: biv3.no-ip.biz
- domain: sada.zapto.org
- domain: ishaqkhan.redirectme.net
- domain: susunahi4.no-ip.info
- file: 69.116.218.10
- hash: 100
- file: 37.72.20.177
- hash: 81
- file: 94.209.216.217
- hash: 666
- file: 187.61.156.97
- hash: 81
- file: 82.242.243.50
- hash: 1604
- file: 188.49.81.147
- hash: 80
- file: 84.240.10.41
- hash: 1456
- file: 85.216.30.19
- hash: 81
- file: 75.127.106.18
- hash: 80
- file: 200.85.213.103
- hash: 3460
- file: 103.77.246.204
- hash: 55555
- file: 176.65.142.137
- hash: 12345
- file: 212.183.137.12
- hash: 8799
- file: 46.37.123.142
- hash: 666
- file: 94.154.34.34
- hash: 666
- file: 192.223.29.160
- hash: 42516
- file: 45.125.12.175
- hash: 65500
- domain: roobinos.no-ip.biz
- domain: vegasredbull.no-ip.biz
- domain: fredchen.gotdns.ch
- domain: testconnect.no-ip.org
- domain: 4mph33.no-ip.org
- domain: emirhan-rat1.no-ip.biz
- domain: cr4nk1337.no-ip.org
- domain: 0000.ole32.com
- domain: finga.no-ip.biz
- domain: windowshaxor.no-ip.org
- domain: doulnulla.serveblog.net
- domain: jakeykid.no-ip.org
- domain: darwerft.no-ip.info
- domain: peelsupport.no-ip.org
- domain: fail-rat.zapto.org
- domain: syricounette.no-ip.biz
- domain: nervernvm.zapto.org
- domain: cinar12322.zapto.org
- domain: devils-hackers.no-ip.org
- domain: celp.zapto.org
- domain: serveftm.serveftp.com
- domain: xxyyzz.no-ip.biz
- domain: ladladladladlad.no-ip.org
- domain: zxzakozxz.no-ip.org
- domain: waleed-hakerz.no-ip.biz
- domain: facebook-abuse.tk
- domain: aha76.no-ip.biz
- domain: b0b1.zapto.org
- domain: darkhelper.no-ip.biz
- domain: 18479.3322.org
- domain: dannyisadon.no-ip.biz
- domain: suloname.no-ip.info
- domain: zagazoo.zapto.org
- domain: everemete.zapto.org
- domain: teknohd.no-ip.org
- domain: tswans.no-ip.org
- domain: ihacker.dnsd.me
- domain: iberat2012.no-ip.org
- domain: rfox.no-ip.biz
- domain: wow-ftw.no-ip.org
- domain: jakeyboy159.no-ip.org
- domain: eman.no-ip.info
- domain: kgsoloman5000.no-ip.biz
- domain: jacksonmayjones.zapto.org
- domain: fangtbn.no-ip.org
- domain: 351625.zapto.org
- domain: shizo1337.zapto.org
- domain: snarglozog.zapto.org
- domain: pablit89.no-ip.biz
- domain: xfuego.no-ip.org
- domain: dnse.zapto.org
- domain: bspeanut.no-ip.org
- domain: korabika.no-ip.org
- domain: 00000.zapto.org
- domain: nillumronnoc.no-ip.biz
- domain: darwerft.no-ip.org
- domain: hostmaster.no-ip.org
- domain: cheeseburger.no-ip.biz
- domain: kann.no-ip.biz
- domain: dannydanny.zapto.org
- domain: jehadpal10.no-ip.biz
- domain: nicksdcrat1.no-ip.org
- domain: dcownz1.no-ip.org
- domain: logo1212.no-ip.biz
- domain: amjay.myftp.biz
- domain: pazuzu11.zapto.org
- domain: sdat.no-ip.biz
- domain: kam3leon.no-ip.biz
- domain: roobinosratlocal.no-ip.biz
- domain: bitz.servepics.com
- domain: darkcomethiday.no-ip.org
- domain: indeednewb.no-ip.biz
- domain: opsec.mine.nu
- domain: darkcomet2011.no-ip.org
- domain: rattatattat.no-ip.biz
- domain: wwws.zapto.org
- domain: bekiap3332424.sytes.net
- domain: myftp.homeftp.net
- domain: maxiserp.no-ip.biz
- domain: galitma12.zapto.org
- domain: hnoo0oody.zapto.org
- domain: jbsoloman5000.no-ip.biz
- domain: newzath.no-ip.org
- domain: lovemoon93.dyndns-ip.com
- domain: msaudio.servemp3.com
- domain: vaghavethepower.no-ip.biz
- domain: bole93.no-ip.org
- domain: hammatov.no-ip.org
- domain: jelixhff.no-ip.org
- domain: fanbase.no-ip.org
- domain: fytyrlybri2323.zapto.org
- domain: ultimata.no-ip.org
- domain: cacaj.no-ip.biz
- domain: deanlet.no-ip.biz
- domain: shahruz007n.no-ip.info
- domain: steamacc123.no-ip.biz
- domain: st33lc1tyf4n.zapto.org
- domain: vikky38.no-ip.biz
- url: http://jaxxyg5.zapto.org
- file: 72.39.80.238
- hash: 82
- file: 91.234.104.220
- hash: 1604
- file: 108.34.128.228
- hash: 81
- file: 185.246.113.247
- hash: 4231
- file: 85.113.180.44
- hash: 1604
- file: 109.154.48.141
- hash: 1604
- file: 84.143.193.35
- hash: 1604
- file: 62.45.180.50
- hash: 1604
- file: 98.222.26.73
- hash: 2056
- file: 77.120.29.157
- hash: 1604
- file: 79.183.169.134
- hash: 1604
- file: 86.76.24.22
- hash: 1604
- file: 200.98.174.142
- hash: 1604
- file: 95.168.194.192
- hash: 11056
- domain: s3awscloud.com
- domain: fluber12.duckdns.org
- domain: l0opo0l.zapto.org
- domain: 111111q.no-ip.org
- domain: bibilomp.servemp3.com
- domain: balooba-holinlolitago.servegame.com
- domain: kokaxp.hopto.org
- domain: uae577.no-ip.biz
- domain: hdbdg.myftp.biz
- domain: sophian.no-ip.biz
- domain: azert123.no-ip.org
- domain: kaito.no-ip.org
- domain: hectorr.no-ip.org
- domain: arabc.no-ip.org
- domain: 250.batcom.top
- domain: botnet.getsolara.info
- domain: data.hello4443.xyz
- domain: position-idea.gl.at.ply.gg
- domain: worldwide-contributor.gl.at.ply.gg
- domain: est-unfortunately.gl.at.ply.gg
- domain: featured-lt.gl.at.ply.gg
- domain: select-as.gl.at.ply.gg
- domain: mr-committees.gl.at.ply.gg
- domain: adminadmin2023.ddns.net
- domain: what-release.gl.at.ply.gg
- file: 194.67.193.20
- hash: 6667
- file: 103.54.153.7
- hash: 4545
- file: 46.197.220.52
- hash: 4444
- file: 46.39.31.25
- hash: 16021
- file: 103.216.118.53
- hash: 1111
- file: 154.82.92.133
- hash: 80
- file: 47.116.208.81
- hash: 8001
- file: 5.252.74.203
- hash: 30120
- file: 196.251.81.96
- hash: 8808
- file: 207.244.247.213
- hash: 972
- file: 192.238.133.242
- hash: 8089
- file: 192.238.133.237
- hash: 8089
- file: 148.113.214.176
- hash: 4782
- file: 161.35.3.214
- hash: 80
- domain: mybkbfpvaixipfsxoa.space
- file: 171.232.0.161
- hash: 6001
- file: 42.119.37.212
- hash: 4444
- domain: adm.dreamad.mobi
- domain: lmyz.yiqing99.cn
- file: 113.45.128.31
- hash: 8080
- file: 45.55.107.101
- hash: 31337
- domain: ec2-23-20-183-202.compute-1.amazonaws.com
- domain: topclth.click
- file: 94.242.53.120
- hash: 5000
- file: 45.144.53.177
- hash: 43957
- file: 137.184.72.185
- hash: 3333
- file: 104.248.43.181
- hash: 443
- file: 91.121.224.84
- hash: 443
- file: 184.82.103.200
- hash: 3333
- file: 23.160.56.29
- hash: 3333
- file: 43.160.207.83
- hash: 8080
- file: 51.75.125.53
- hash: 3333
- file: 35.247.239.132
- hash: 2087
- file: 178.128.122.83
- hash: 3333
- file: 63.177.170.151
- hash: 3333
- file: 3.142.194.205
- hash: 3333
- file: 133.218.149.45
- hash: 3333
- file: 5.182.19.40
- hash: 8080
- file: 3.139.129.22
- hash: 443
- file: 209.38.61.237
- hash: 3333
- file: 18.193.106.246
- hash: 80
- file: 20.40.54.115
- hash: 8080
- file: 216.176.190.164
- hash: 8080
- file: 154.12.235.22
- hash: 3333
- file: 161.35.16.202
- hash: 80
- domain: mfaicoffice.com
- file: 45.125.66.57
- hash: 34509
- url: https://176.65.141.165:8587/0721217eab03d184996db/jks0dfje.0f4gv
- file: 176.65.141.165
- hash: 8587
- domain: gogetxto.life
- url: http://humorbone.icu/ury.php
- url: http://humorbone.icu/uri.php
- file: 45.138.16.211
- hash: 7000
- domain: jpkinki.com
- file: 139.180.192.163
- hash: 443
- file: 139.180.192.163
- hash: 5000
- domain: check.axei3.icu
- url: https://check.axei3.icu/gkcxv.google
- file: 103.107.105.35
- hash: 443
- file: 103.107.105.35
- hash: 5000
- domain: beaminduggl.top
- domain: alicevivianny.com
- domain: aljazddra.com
- domain: antioxidantsnews.com
- domain: conflictaslesson.com
- domain: crappienews.com
- domain: createcopilot.com
- domain: electrictulsa.com
- domain: erpdown.com
- domain: estmongolia.com
- domain: financialextremed.com
- domain: getfiledown.com
- domain: globaleyenews.com
- domain: hajjnewsbd.com
- domain: hisnhershealthynhappy.com
- domain: importsmall.com
- domain: infotechtelecom.com
- domain: inhller.com
- domain: itduniversity.com
- domain: ivibers.com
- domain: kerrvillehomeschoolers.com
- domain: linkonmarketing.com
- domain: looksnews.com
- domain: maineasce.com
- domain: meetviberapi.com
- domain: mexicoglobaluniversity.com
- domain: mobilefiledownload.com
- domain: mojhaloton.com
- domain: mrytlebeachinfo.com
- domain: newslandtoday.net
- domain: oncalltechnical.com
- domain: quickoffice360.com
- domain: redactnews.com
- domain: reformporta.com
- domain: riversidebreakingnews.com
- domain: sangkayrealnews.com
- domain: tasensors.com
- domain: techoilproducts.com
- domain: tigernewsmedia.com
- domain: truff-evadee.com
- domain: tychonews.com
- domain: usedownload.com
- domain: vopaklatinamerica.com
- domain: windowsfiledownload.com
- domain: rem9rrr.duckdns.org
- domain: rem9rrr2.duckdns.org
- domain: tentyfive5.ydns.eu
- domain: thirtyfive5.ydns.eu
- domain: thirtyfive335.crabdance.com
- file: 196.251.72.66
- hash: 3440
- file: 176.65.134.39
- hash: 3124
- file: 124.222.38.4
- hash: 80
- file: 139.196.181.1
- hash: 10001
- file: 156.238.233.109
- hash: 800
- file: 47.253.165.251
- hash: 7777
- file: 113.125.100.178
- hash: 8888
- file: 39.108.176.121
- hash: 8888
- url: http://147.45.42.161/pages/login.php
- file: 123.57.37.108
- hash: 80
- file: 1.94.105.194
- hash: 2222
- file: 113.44.87.199
- hash: 443
- file: 91.223.3.141
- hash: 2404
- file: 95.216.118.42
- hash: 2404
- domain: pipbinorel99.com
- file: 206.123.152.41
- hash: 3191
- file: 70.34.242.59
- hash: 443
- file: 51.89.242.58
- hash: 8808
- file: 206.123.138.205
- hash: 6606
- file: 185.206.148.210
- hash: 444
- file: 161.35.246.140
- hash: 7443
- file: 5.34.176.4
- hash: 443
- file: 185.5.124.254
- hash: 445
- file: 161.35.3.214
- hash: 443
- file: 148.66.21.236
- hash: 4433
- file: 130.164.163.76
- hash: 443
- file: 54.193.163.62
- hash: 503
- file: 156.229.233.104
- hash: 9999
- domain: autodiscover.a.multi-canale.com
- domain: cpcontacts.b.multi-canale.com
- domain: cpcontacts.eversioneweb.com
- file: 209.94.59.194
- hash: 8080
- file: 185.208.158.227
- hash: 8080
- url: https://y.p.formaxprime.co.uk/
- domain: y.p.formaxprime.co.uk
- file: 108.207.102.13
- hash: 443
- file: 2.88.108.213
- hash: 995
- file: 206.71.148.172
- hash: 80
- file: 47.79.18.250
- hash: 60000
- domain: check.atuu7.icu
- url: https://check.atuu7.icu/gkcxv.google
- url: https://176.65.141.166:2405/0721217eab03d184996db/0c8607s1.q8xnq
- file: 176.65.141.166
- hash: 2405
- domain: unrealfabricdo.click
- file: 216.9.225.133
- hash: 10890
- file: 216.9.225.133
- hash: 49067
- file: 103.39.108.224
- hash: 101
- file: 92.246.141.75
- hash: 101
- file: 2.59.132.84
- hash: 3
- domain: mrgenuis.no-ip.org
- url: https://starbits.world/api
- domain: starbits.world
- file: 139.84.168.77
- hash: 5000
- file: 139.84.168.77
- hash: 443
- domain: getfiledata.com
- file: 192.9.159.128
- hash: 4443
- file: 202.182.122.237
- hash: 443
- file: 139.9.92.182
- hash: 8088
- file: 42.51.44.204
- hash: 8088
- file: 107.174.127.130
- hash: 18444
- file: 47.116.208.81
- hash: 443
- file: 80.76.49.130
- hash: 5000
- file: 45.74.46.34
- hash: 46167
- file: 154.9.25.94
- hash: 8888
- file: 142.93.165.203
- hash: 7443
- file: 27.124.4.223
- hash: 8089
- file: 112.213.116.35
- hash: 8848
- file: 193.68.89.17
- hash: 80
- file: 87.251.78.30
- hash: 4000
- domain: cpanel.e.ora-0-web.com
- domain: autodiscover.e.ora-0-web.com
- domain: autodiscover.web-app-on.com
- domain: autodiscover.m.web-app-on.com
- domain: mail.e.ora-0-web.com
- url: https://vfclan.com/4q5t.js
- domain: vfclan.com
- url: https://vfclan.com/js.php
- url: https://7297383.cfd/
- url: https://92841.cfd/
- url: https://378945.cfd/
- url: https://payment-comfirmation.com/
- url: https://927484.cfd/
- url: https://927842.cfd/
- url: https://994521.cfd/
- url: https://836787.cfd/
- url: https://stripe-connect.org/
- url: https://booking.sales-id-4021.com
- url: https://complaints6236.cfd
- url: https://idguset64325643.com
- url: https://userguestid28956.com
- url: https://idreserverationguest72353456.cfd
- url: https://reserveratinid991.com
- url: https://guestid73436.cfd
- url: https://reserveratinguestid662233.cfd
- url: https://id5512.com
- url: https://check-errorguestis.com
- url: https://idreservguest2622748.com
- url: https://complaintreservaid3.com
- url: https://elmdenlhotel.cfd
- url: https://complaintreservaid4.com
- url: https://idguestreservation634812.com
- url: https://complaintsidguest4.com
- url: https://guesterror23125.com
- url: https://complaintguest3.com
- url: https://idguestres72346.click
- url: https://booking.complaints99831.shop
- url: https://idverefication1.com
- url: https://complaints99831.shop
- url: https://idres123.click
- url: https://guestid3329912.cfd
- url: https://guesterrorid612353.com
- url: https://other-errorreserw.com
- url: https://complaintguest5.com
- url: https://complaintreservaid2.com
- url: https://reservations-id.com
- url: https://verefication731346.cfd
- url: https://consumer-policy.info
- url: https://reviews-57391.info
- url: https://id-1888213.info
- url: https://idreservaguest1.com
- url: https://idguestres3.com
- url: https://id-120199821.world
- url: https://idguestreserva12462.cfd
- url: https://idguest99366623.cfd
- url: https://complaintguest1.com
- url: https://compliteguest5215.cfd
- url: https://idcomplaint3.com
- url: https://error-reserwisgusta.com
- url: https://idreservaguset124634.com
- url: https://idguestreserva995231.com
- url: https://booking.id-1888213.info
- url: https://idvereficaton3.com
- url: https://idcomlreserva3527.com
- url: https://id3315.com
- url: https://policy-consume.com
- url: https://policy-consumer.world
- url: https://userguestid18956.com
- url: https://reserveratinguestid662233.shop
- url: https://id723467.com
- url: https://idcomplaint4.com
- url: https://reservation-id.com
- url: https://guestid734523.cfd
- url: https://idguest44215.cfd
- url: https://compliteguest5215.top
- url: https://compliteguest5215.shop
- url: https://ajksndfroghvnc4asdf.live
- url: https://comlpt7721.cfd
- url: https://guestid3329912.shop
- url: https://complaints99831.cfd
- url: https://compliteguest5215.world
- url: https://userguestid38956.com
- url: https://bedingfeldarms634.cfd
- url: https://booking.reservations-id.com
- url: https://vereficatin6124.world
- url: https://compliteguest5215.live
- url: https://dlmparis623.cfd
- url: https://idres123.world
- url: https://reservagusetid645234.cfd
- url: https://complaintsidguest3.com
- url: https://idreserv7323.cfd
- url: https://idverefication2.com
- url: https://booking.id-120199821.world
- url: https://com-review2815.info
- url: https://booking.reviews-57391.info
- domain: 1329742111-h1rmesk2t.ap-guangzhou.tencentscf.com
- domain: a-0001.a2-msedge.net
- domain: cngov.oss-cn-shanghai.aliyuncs.com
- domain: microsofts.wiki
- domain: oversizes.ghostgames.mom
- domain: vozaspecial.com
- file: 111.230.30.197
- hash: 4443
- file: 124.221.117.90
- hash: 80
- file: 150.158.80.227
- hash: 443
- file: 164.92.166.25
- hash: 443
- file: 185.208.158.227
- hash: 8443
- file: 20.74.209.192
- hash: 8081
- file: 213.94.218.16
- hash: 80
- file: 213.94.218.22
- hash: 80
- file: 217.156.50.139
- hash: 8443
- file: 39.105.11.167
- hash: 80
- file: 18.198.77.177
- hash: 14131
- file: 3.121.139.82
- hash: 14131
- domain: azmamiraixd.duckdns.org
- file: 51.38.137.108
- hash: 47925
- url: https://vfclan.com/1q2w.js
- file: 3.126.37.18
- hash: 18848
- file: 107.189.4.201
- hash: 1995
- domain: bot.gribostress.pro
- file: 5.252.176.71
- hash: 443
- file: 128.90.113.83
- hash: 2000
- file: 196.251.84.194
- hash: 3306
- file: 111.31.93.136
- hash: 7443
- file: 45.207.197.14
- hash: 8089
- domain: cpcontacts.efcommxerce.ru
- file: 173.237.206.178
- hash: 443
- file: 123.56.127.50
- hash: 443
- file: 35.177.77.164
- hash: 443
- file: 161.35.3.214
- hash: 7443
- url: https://check.uhaa4.icu/gkcxv.google
- file: 3.75.243.103
- hash: 80
- file: 120.26.122.132
- hash: 50001
- file: 52.68.47.107
- hash: 80
- file: 194.59.31.69
- hash: 2571
- file: 8.137.63.19
- hash: 8080
- file: 104.245.241.254
- hash: 9090
- file: 185.93.89.137
- hash: 8888
- file: 27.124.4.224
- hash: 8089
- file: 148.66.21.234
- hash: 4433
- file: 13.233.80.253
- hash: 3796
- file: 107.172.151.193
- hash: 80
- file: 123.136.93.211
- hash: 60000
- file: 146.190.173.119
- hash: 8080
- file: 188.4.205.235
- hash: 995
- file: 2.88.108.213
- hash: 443
- file: 172.233.162.232
- hash: 8443
ThreatFox IOCs for 2025-03-20
Medium
Published: Thu Mar 20 2025 (03/20/2025, 00:00:00 UTC)
Source: ThreatFox
Vendor/Project: type
Product: osint
Description
ThreatFox IOCs for 2025-03-20
AI-Powered Analysis
AILast updated: 06/19/2025, 15:48:48 UTC
Technical Analysis
The provided threat intelligence relates to a malware-related report titled "ThreatFox IOCs for 2025-03-20," sourced from ThreatFox, a platform known for sharing Indicators of Compromise (IOCs) and threat intelligence data. The report is categorized under 'type:osint,' indicating that it primarily involves open-source intelligence data rather than a specific malware family or exploit. There are no affected product versions or specific vulnerabilities listed, and no known exploits in the wild have been reported. The technical details include a threat level of 2 (on an unspecified scale), an analysis rating of 1, and a distribution rating of 3, suggesting moderate dissemination or visibility of the threat indicators. The absence of concrete IOCs, CWE identifiers, or patch links implies that this report serves more as a situational awareness update rather than detailing an active or emerging exploit. The medium severity rating assigned by the source likely reflects the potential for this intelligence to aid in detecting or mitigating malware threats rather than indicating a direct, immediate risk. Overall, this threat intelligence appears to be a collection or update of OSINT-based malware indicators that could support defensive operations but does not describe a novel or actively exploited vulnerability or malware strain.
Potential Impact
For European organizations, the impact of this threat intelligence is primarily informational and preparatory. Since no specific malware variants, vulnerabilities, or exploits are detailed, the direct risk to confidentiality, integrity, or availability is limited at this stage. However, the distribution rating of 3 suggests that the associated IOCs or related malware activity may be moderately widespread, which could imply that European entities might encounter related threats if they rely on the shared OSINT for detection. The medium severity indicates that while the threat is not immediately critical, organizations should remain vigilant, as the intelligence could help identify or prevent malware infections. The lack of known exploits in the wild reduces the urgency but does not eliminate the possibility of future exploitation. European organizations involved in cybersecurity monitoring, threat hunting, or incident response could benefit from integrating this intelligence to enhance detection capabilities. The impact is thus more strategic and operational rather than immediate or catastrophic.
Mitigation Recommendations
Given the nature of this threat intelligence as an OSINT-based update without specific vulnerabilities or exploits, mitigation should focus on enhancing threat detection and response capabilities. Organizations should: 1) Integrate the provided IOCs (when available) into existing security information and event management (SIEM) systems and endpoint detection and response (EDR) tools to improve detection of related malware activity. 2) Maintain up-to-date threat intelligence feeds and ensure security teams are trained to interpret and act on OSINT data effectively. 3) Conduct regular threat hunting exercises leveraging the latest OSINT to proactively identify potential compromises. 4) Collaborate with information sharing and analysis centers (ISACs) relevant to their sector and region to receive timely updates and contextualize threat intelligence. 5) Ensure robust incident response plans are in place to quickly contain and remediate any malware infections detected through these indicators. These steps go beyond generic advice by emphasizing operational integration of OSINT and proactive threat hunting tailored to the intelligence provided.
Affected Countries
Need more detailed analysis?Get Pro
Pro Feature
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Threat Level
- 2
- Analysis
- 1
- Distribution
- 3
- Uuid
- 5ab893f2-505c-456a-9f35-c69aa0224623
- Original Timestamp
- 1742515386
Indicators of Compromise
Url
| Value | Description | Copy |
|---|---|---|
urlhttp://202.146.222.166:8888/supershell/login/ | Unknown malware botnet C2 (confidence level: 100%) | |
urlhttps://janhugo.com/1q2w.js | FAKEUPDATES payload delivery URL (confidence level: 100%) | |
urlhttps://janhugo.com/js.php | FAKEUPDATES payload delivery URL (confidence level: 100%) | |
urlhttps://janhugo.com/5s1j.js | FAKEUPDATES payload delivery URL (confidence level: 100%) | |
urlhttp://jaxxyg5.zapto.org | DarkComet botnet C2 (confidence level: 100%) | |
urlhttps://176.65.141.165:8587/0721217eab03d184996db/jks0dfje.0f4gv | Rhadamanthys botnet C2 (confidence level: 100%) | |
urlhttp://humorbone.icu/ury.php | Unknown Loader botnet C2 (confidence level: 100%) | |
urlhttp://humorbone.icu/uri.php | Unknown Loader botnet C2 (confidence level: 100%) | |
urlhttps://check.axei3.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttp://147.45.42.161/pages/login.php | Unknown malware botnet C2 (confidence level: 100%) | |
urlhttps://y.p.formaxprime.co.uk/ | Vidar botnet C2 (confidence level: 100%) | |
urlhttps://check.atuu7.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://176.65.141.166:2405/0721217eab03d184996db/0c8607s1.q8xnq | Rhadamanthys botnet C2 (confidence level: 100%) | |
urlhttps://starbits.world/api | Lumma Stealer botnet C2 (confidence level: 100%) | |
urlhttps://vfclan.com/4q5t.js | FAKEUPDATES payload delivery URL (confidence level: 100%) | |
urlhttps://vfclan.com/js.php | FAKEUPDATES payload delivery URL (confidence level: 100%) | |
urlhttps://7297383.cfd/ | Lumma Stealer payload delivery URL (confidence level: 100%) | |
urlhttps://92841.cfd/ | Lumma Stealer payload delivery URL (confidence level: 100%) | |
urlhttps://378945.cfd/ | Lumma Stealer payload delivery URL (confidence level: 100%) | |
urlhttps://payment-comfirmation.com/ | Lumma Stealer payload delivery URL (confidence level: 100%) | |
urlhttps://927484.cfd/ | Lumma Stealer payload delivery URL (confidence level: 100%) | |
urlhttps://927842.cfd/ | Lumma Stealer payload delivery URL (confidence level: 100%) | |
urlhttps://994521.cfd/ | Lumma Stealer payload delivery URL (confidence level: 100%) | |
urlhttps://836787.cfd/ | Lumma Stealer payload delivery URL (confidence level: 100%) | |
urlhttps://stripe-connect.org/ | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://booking.sales-id-4021.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://complaints6236.cfd | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idguset64325643.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://userguestid28956.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idreserverationguest72353456.cfd | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://reserveratinid991.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://guestid73436.cfd | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://reserveratinguestid662233.cfd | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://id5512.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://check-errorguestis.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idreservguest2622748.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://complaintreservaid3.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://elmdenlhotel.cfd | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://complaintreservaid4.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idguestreservation634812.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://complaintsidguest4.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://guesterror23125.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://complaintguest3.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idguestres72346.click | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://booking.complaints99831.shop | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idverefication1.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://complaints99831.shop | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idres123.click | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://guestid3329912.cfd | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://guesterrorid612353.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://other-errorreserw.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://complaintguest5.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://complaintreservaid2.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://reservations-id.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://verefication731346.cfd | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://consumer-policy.info | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://reviews-57391.info | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://id-1888213.info | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idreservaguest1.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idguestres3.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://id-120199821.world | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idguestreserva12462.cfd | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idguest99366623.cfd | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://complaintguest1.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://compliteguest5215.cfd | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idcomplaint3.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://error-reserwisgusta.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idreservaguset124634.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idguestreserva995231.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://booking.id-1888213.info | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idvereficaton3.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idcomlreserva3527.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://id3315.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://policy-consume.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://policy-consumer.world | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://userguestid18956.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://reserveratinguestid662233.shop | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://id723467.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idcomplaint4.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://reservation-id.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://guestid734523.cfd | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idguest44215.cfd | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://compliteguest5215.top | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://compliteguest5215.shop | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://ajksndfroghvnc4asdf.live | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://comlpt7721.cfd | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://guestid3329912.shop | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://complaints99831.cfd | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://compliteguest5215.world | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://userguestid38956.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://bedingfeldarms634.cfd | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://booking.reservations-id.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://vereficatin6124.world | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://compliteguest5215.live | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://dlmparis623.cfd | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idres123.world | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://reservagusetid645234.cfd | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://complaintsidguest3.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idreserv7323.cfd | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://idverefication2.com | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://booking.id-120199821.world | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://com-review2815.info | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://booking.reviews-57391.info | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttps://vfclan.com/1q2w.js | FAKEUPDATES payload delivery URL (confidence level: 100%) | |
urlhttps://check.uhaa4.icu/gkcxv.google | ClearFake payload delivery URL (confidence level: 100%) |
File
| Value | Description | Copy |
|---|---|---|
file202.146.222.166 | Unknown malware botnet C2 server (confidence level: 100%) | |
file135.125.21.41 | RedLine Stealer botnet C2 server (confidence level: 100%) | |
file185.194.205.79 | Mirai botnet C2 server (confidence level: 75%) | |
file154.82.92.133 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file196.251.72.250 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file120.24.64.74 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file196.251.69.85 | Remcos botnet C2 server (confidence level: 100%) | |
file45.62.170.96 | Remcos botnet C2 server (confidence level: 100%) | |
file172.111.131.195 | Remcos botnet C2 server (confidence level: 100%) | |
file66.248.206.248 | Remcos botnet C2 server (confidence level: 100%) | |
file24.137.215.157 | Sliver botnet C2 server (confidence level: 100%) | |
file104.193.69.145 | Sliver botnet C2 server (confidence level: 100%) | |
file194.32.142.52 | Sliver botnet C2 server (confidence level: 100%) | |
file154.12.60.69 | Unknown malware botnet C2 server (confidence level: 100%) | |
file45.200.51.134 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file172.191.137.101 | Havoc botnet C2 server (confidence level: 100%) | |
file179.43.172.173 | Havoc botnet C2 server (confidence level: 100%) | |
file171.232.0.161 | Venom RAT botnet C2 server (confidence level: 100%) | |
file172.86.109.207 | Crimson RAT botnet C2 server (confidence level: 100%) | |
file185.184.123.94 | Stealc botnet C2 server (confidence level: 100%) | |
file69.116.218.10 | CyberGate botnet C2 server (confidence level: 100%) | |
file37.72.20.177 | CyberGate botnet C2 server (confidence level: 100%) | |
file94.209.216.217 | CyberGate botnet C2 server (confidence level: 100%) | |
file187.61.156.97 | CyberGate botnet C2 server (confidence level: 100%) | |
file82.242.243.50 | CyberGate botnet C2 server (confidence level: 100%) | |
file188.49.81.147 | CyberGate botnet C2 server (confidence level: 100%) | |
file84.240.10.41 | CyberGate botnet C2 server (confidence level: 100%) | |
file85.216.30.19 | CyberGate botnet C2 server (confidence level: 100%) | |
file75.127.106.18 | CyberGate botnet C2 server (confidence level: 100%) | |
file200.85.213.103 | CyberGate botnet C2 server (confidence level: 100%) | |
file103.77.246.204 | Bashlite botnet C2 server (confidence level: 100%) | |
file176.65.142.137 | Bashlite botnet C2 server (confidence level: 100%) | |
file212.183.137.12 | Bashlite botnet C2 server (confidence level: 100%) | |
file46.37.123.142 | Bashlite botnet C2 server (confidence level: 100%) | |
file94.154.34.34 | Bashlite botnet C2 server (confidence level: 100%) | |
file192.223.29.160 | Bashlite botnet C2 server (confidence level: 100%) | |
file45.125.12.175 | Bashlite botnet C2 server (confidence level: 100%) | |
file72.39.80.238 | DarkComet botnet C2 server (confidence level: 100%) | |
file91.234.104.220 | DarkComet botnet C2 server (confidence level: 100%) | |
file108.34.128.228 | DarkComet botnet C2 server (confidence level: 100%) | |
file185.246.113.247 | DarkComet botnet C2 server (confidence level: 100%) | |
file85.113.180.44 | DarkComet botnet C2 server (confidence level: 100%) | |
file109.154.48.141 | DarkComet botnet C2 server (confidence level: 100%) | |
file84.143.193.35 | DarkComet botnet C2 server (confidence level: 100%) | |
file62.45.180.50 | DarkComet botnet C2 server (confidence level: 100%) | |
file98.222.26.73 | DarkComet botnet C2 server (confidence level: 100%) | |
file77.120.29.157 | DarkComet botnet C2 server (confidence level: 100%) | |
file79.183.169.134 | DarkComet botnet C2 server (confidence level: 100%) | |
file86.76.24.22 | DarkComet botnet C2 server (confidence level: 100%) | |
file200.98.174.142 | DarkComet botnet C2 server (confidence level: 100%) | |
file95.168.194.192 | DarkComet botnet C2 server (confidence level: 100%) | |
file194.67.193.20 | SpyNote botnet C2 server (confidence level: 100%) | |
file103.54.153.7 | SpyNote botnet C2 server (confidence level: 100%) | |
file46.197.220.52 | SpyNote botnet C2 server (confidence level: 100%) | |
file46.39.31.25 | SpyNote botnet C2 server (confidence level: 100%) | |
file103.216.118.53 | SpyNote botnet C2 server (confidence level: 100%) | |
file154.82.92.133 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file47.116.208.81 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file5.252.74.203 | DarkComet botnet C2 server (confidence level: 100%) | |
file196.251.81.96 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file207.244.247.213 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file192.238.133.242 | Hook botnet C2 server (confidence level: 100%) | |
file192.238.133.237 | Hook botnet C2 server (confidence level: 100%) | |
file148.113.214.176 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file161.35.3.214 | Havoc botnet C2 server (confidence level: 100%) | |
file171.232.0.161 | Venom RAT botnet C2 server (confidence level: 100%) | |
file42.119.37.212 | Orcus RAT botnet C2 server (confidence level: 100%) | |
file113.45.128.31 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file45.55.107.101 | Sliver botnet C2 server (confidence level: 90%) | |
file94.242.53.120 | Unknown malware botnet C2 server (confidence level: 100%) | |
file45.144.53.177 | MooBot botnet C2 server (confidence level: 100%) | |
file137.184.72.185 | Unknown malware botnet C2 server (confidence level: 100%) | |
file104.248.43.181 | Unknown malware botnet C2 server (confidence level: 100%) | |
file91.121.224.84 | Unknown malware botnet C2 server (confidence level: 100%) | |
file184.82.103.200 | Unknown malware botnet C2 server (confidence level: 100%) | |
file23.160.56.29 | Unknown malware botnet C2 server (confidence level: 100%) | |
file43.160.207.83 | Unknown malware botnet C2 server (confidence level: 100%) | |
file51.75.125.53 | Unknown malware botnet C2 server (confidence level: 100%) | |
file35.247.239.132 | Unknown malware botnet C2 server (confidence level: 100%) | |
file178.128.122.83 | Unknown malware botnet C2 server (confidence level: 100%) | |
file63.177.170.151 | Unknown malware botnet C2 server (confidence level: 100%) | |
file3.142.194.205 | Unknown malware botnet C2 server (confidence level: 100%) | |
file133.218.149.45 | Unknown malware botnet C2 server (confidence level: 100%) | |
file5.182.19.40 | Unknown malware botnet C2 server (confidence level: 100%) | |
file3.139.129.22 | Unknown malware botnet C2 server (confidence level: 100%) | |
file209.38.61.237 | Unknown malware botnet C2 server (confidence level: 100%) | |
file18.193.106.246 | Unknown malware botnet C2 server (confidence level: 100%) | |
file20.40.54.115 | Unknown malware botnet C2 server (confidence level: 100%) | |
file216.176.190.164 | Unknown malware botnet C2 server (confidence level: 100%) | |
file154.12.235.22 | Unknown malware botnet C2 server (confidence level: 100%) | |
file161.35.16.202 | Unknown malware botnet C2 server (confidence level: 100%) | |
file45.125.66.57 | Remcos botnet C2 server (confidence level: 75%) | |
file176.65.141.165 | Rhadamanthys botnet C2 server (confidence level: 100%) | |
file45.138.16.211 | XWorm botnet C2 server (confidence level: 75%) | |
file139.180.192.163 | PlugX botnet C2 server (confidence level: 100%) | |
file139.180.192.163 | PlugX botnet C2 server (confidence level: 100%) | |
file103.107.105.35 | PlugX botnet C2 server (confidence level: 100%) | |
file103.107.105.35 | PlugX botnet C2 server (confidence level: 100%) | |
file196.251.72.66 | DarkVision RAT botnet C2 server (confidence level: 75%) | |
file176.65.134.39 | Remcos botnet C2 server (confidence level: 75%) | |
file124.222.38.4 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file139.196.181.1 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file156.238.233.109 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file47.253.165.251 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file113.125.100.178 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file39.108.176.121 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file123.57.37.108 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file1.94.105.194 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file113.44.87.199 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file91.223.3.141 | Remcos botnet C2 server (confidence level: 100%) | |
file95.216.118.42 | Remcos botnet C2 server (confidence level: 100%) | |
file206.123.152.41 | Remcos botnet C2 server (confidence level: 100%) | |
file70.34.242.59 | pupy botnet C2 server (confidence level: 100%) | |
file51.89.242.58 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file206.123.138.205 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file185.206.148.210 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file161.35.246.140 | Unknown malware botnet C2 server (confidence level: 100%) | |
file5.34.176.4 | Unknown malware botnet C2 server (confidence level: 100%) | |
file185.5.124.254 | Havoc botnet C2 server (confidence level: 100%) | |
file161.35.3.214 | Havoc botnet C2 server (confidence level: 100%) | |
file148.66.21.236 | DCRat botnet C2 server (confidence level: 100%) | |
file130.164.163.76 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file54.193.163.62 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file156.229.233.104 | MooBot botnet C2 server (confidence level: 100%) | |
file209.94.59.194 | MimiKatz botnet C2 server (confidence level: 100%) | |
file185.208.158.227 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file108.207.102.13 | DeimosC2 botnet C2 server (confidence level: 75%) | |
file2.88.108.213 | QakBot botnet C2 server (confidence level: 75%) | |
file206.71.148.172 | Broomstick botnet C2 server (confidence level: 75%) | |
file47.79.18.250 | Unknown malware botnet C2 server (confidence level: 75%) | |
file176.65.141.166 | Rhadamanthys botnet C2 server (confidence level: 100%) | |
file216.9.225.133 | Remcos botnet C2 server (confidence level: 75%) | |
file216.9.225.133 | Remcos botnet C2 server (confidence level: 75%) | |
file103.39.108.224 | Mirai botnet C2 server (confidence level: 100%) | |
file92.246.141.75 | Mirai botnet C2 server (confidence level: 100%) | |
file2.59.132.84 | Mirai botnet C2 server (confidence level: 100%) | |
file139.84.168.77 | DOPLUGS botnet C2 server (confidence level: 100%) | |
file139.84.168.77 | DOPLUGS botnet C2 server (confidence level: 100%) | |
file192.9.159.128 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file202.182.122.237 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file139.9.92.182 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file42.51.44.204 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file107.174.127.130 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file47.116.208.81 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file80.76.49.130 | Remcos botnet C2 server (confidence level: 100%) | |
file45.74.46.34 | Remcos botnet C2 server (confidence level: 100%) | |
file154.9.25.94 | Unknown malware botnet C2 server (confidence level: 100%) | |
file142.93.165.203 | Unknown malware botnet C2 server (confidence level: 100%) | |
file27.124.4.223 | Hook botnet C2 server (confidence level: 100%) | |
file112.213.116.35 | DCRat botnet C2 server (confidence level: 100%) | |
file193.68.89.17 | Stealc botnet C2 server (confidence level: 100%) | |
file87.251.78.30 | Unknown malware botnet C2 server (confidence level: 100%) | |
file111.230.30.197 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file124.221.117.90 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file150.158.80.227 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file164.92.166.25 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file185.208.158.227 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file20.74.209.192 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file213.94.218.16 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file213.94.218.22 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file217.156.50.139 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file39.105.11.167 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file18.198.77.177 | NjRAT botnet C2 server (confidence level: 75%) | |
file3.121.139.82 | NjRAT botnet C2 server (confidence level: 75%) | |
file51.38.137.108 | Mirai botnet C2 server (confidence level: 75%) | |
file3.126.37.18 | NjRAT botnet C2 server (confidence level: 75%) | |
file107.189.4.201 | Mirai botnet C2 server (confidence level: 75%) | |
file5.252.176.71 | Sliver botnet C2 server (confidence level: 100%) | |
file128.90.113.83 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file196.251.84.194 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file111.31.93.136 | Unknown malware botnet C2 server (confidence level: 100%) | |
file45.207.197.14 | Hook botnet C2 server (confidence level: 100%) | |
file173.237.206.178 | Havoc botnet C2 server (confidence level: 100%) | |
file123.56.127.50 | Havoc botnet C2 server (confidence level: 100%) | |
file35.177.77.164 | Havoc botnet C2 server (confidence level: 100%) | |
file161.35.3.214 | Unknown malware botnet C2 server (confidence level: 100%) | |
file3.75.243.103 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file120.26.122.132 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file52.68.47.107 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file194.59.31.69 | Remcos botnet C2 server (confidence level: 100%) | |
file8.137.63.19 | Sliver botnet C2 server (confidence level: 100%) | |
file104.245.241.254 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file185.93.89.137 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file27.124.4.224 | Hook botnet C2 server (confidence level: 100%) | |
file148.66.21.234 | DCRat botnet C2 server (confidence level: 100%) | |
file13.233.80.253 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file107.172.151.193 | MooBot botnet C2 server (confidence level: 100%) | |
file123.136.93.211 | Unknown malware botnet C2 server (confidence level: 75%) | |
file146.190.173.119 | Havoc botnet C2 server (confidence level: 75%) | |
file188.4.205.235 | QakBot botnet C2 server (confidence level: 75%) | |
file2.88.108.213 | QakBot botnet C2 server (confidence level: 75%) | |
file172.233.162.232 | Meterpreter botnet C2 server (confidence level: 75%) |
Hash
| Value | Description | Copy |
|---|---|---|
hash8888 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash1912 | RedLine Stealer botnet C2 server (confidence level: 100%) | |
hash61003 | Mirai botnet C2 server (confidence level: 75%) | |
hash888 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash63211 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash443 | Sliver botnet C2 server (confidence level: 100%) | |
hash443 | Sliver botnet C2 server (confidence level: 100%) | |
hash80 | Sliver botnet C2 server (confidence level: 100%) | |
hash8888 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash16521 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash80 | Havoc botnet C2 server (confidence level: 100%) | |
hash443 | Havoc botnet C2 server (confidence level: 100%) | |
hash8000 | Venom RAT botnet C2 server (confidence level: 100%) | |
hash32132 | Crimson RAT botnet C2 server (confidence level: 100%) | |
hash80 | Stealc botnet C2 server (confidence level: 100%) | |
hash100 | CyberGate botnet C2 server (confidence level: 100%) | |
hash81 | CyberGate botnet C2 server (confidence level: 100%) | |
hash666 | CyberGate botnet C2 server (confidence level: 100%) | |
hash81 | CyberGate botnet C2 server (confidence level: 100%) | |
hash1604 | CyberGate botnet C2 server (confidence level: 100%) | |
hash80 | CyberGate botnet C2 server (confidence level: 100%) | |
hash1456 | CyberGate botnet C2 server (confidence level: 100%) | |
hash81 | CyberGate botnet C2 server (confidence level: 100%) | |
hash80 | CyberGate botnet C2 server (confidence level: 100%) | |
hash3460 | CyberGate botnet C2 server (confidence level: 100%) | |
hash55555 | Bashlite botnet C2 server (confidence level: 100%) | |
hash12345 | Bashlite botnet C2 server (confidence level: 100%) | |
hash8799 | Bashlite botnet C2 server (confidence level: 100%) | |
hash666 | Bashlite botnet C2 server (confidence level: 100%) | |
hash666 | Bashlite botnet C2 server (confidence level: 100%) | |
hash42516 | Bashlite botnet C2 server (confidence level: 100%) | |
hash65500 | Bashlite botnet C2 server (confidence level: 100%) | |
hash82 | DarkComet botnet C2 server (confidence level: 100%) | |
hash1604 | DarkComet botnet C2 server (confidence level: 100%) | |
hash81 | DarkComet botnet C2 server (confidence level: 100%) | |
hash4231 | DarkComet botnet C2 server (confidence level: 100%) | |
hash1604 | DarkComet botnet C2 server (confidence level: 100%) | |
hash1604 | DarkComet botnet C2 server (confidence level: 100%) | |
hash1604 | DarkComet botnet C2 server (confidence level: 100%) | |
hash1604 | DarkComet botnet C2 server (confidence level: 100%) | |
hash2056 | DarkComet botnet C2 server (confidence level: 100%) | |
hash1604 | DarkComet botnet C2 server (confidence level: 100%) | |
hash1604 | DarkComet botnet C2 server (confidence level: 100%) | |
hash1604 | DarkComet botnet C2 server (confidence level: 100%) | |
hash1604 | DarkComet botnet C2 server (confidence level: 100%) | |
hash11056 | DarkComet botnet C2 server (confidence level: 100%) | |
hash6667 | SpyNote botnet C2 server (confidence level: 100%) | |
hash4545 | SpyNote botnet C2 server (confidence level: 100%) | |
hash4444 | SpyNote botnet C2 server (confidence level: 100%) | |
hash16021 | SpyNote botnet C2 server (confidence level: 100%) | |
hash1111 | SpyNote botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8001 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash30120 | DarkComet botnet C2 server (confidence level: 100%) | |
hash8808 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash972 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash8089 | Hook botnet C2 server (confidence level: 100%) | |
hash8089 | Hook botnet C2 server (confidence level: 100%) | |
hash4782 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash80 | Havoc botnet C2 server (confidence level: 100%) | |
hash6001 | Venom RAT botnet C2 server (confidence level: 100%) | |
hash4444 | Orcus RAT botnet C2 server (confidence level: 100%) | |
hash8080 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash31337 | Sliver botnet C2 server (confidence level: 90%) | |
hash5000 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash43957 | MooBot botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8080 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash2087 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8080 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash80 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8080 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8080 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash80 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash34509 | Remcos botnet C2 server (confidence level: 75%) | |
hash8587 | Rhadamanthys botnet C2 server (confidence level: 100%) | |
hash7000 | XWorm botnet C2 server (confidence level: 75%) | |
hash443 | PlugX botnet C2 server (confidence level: 100%) | |
hash5000 | PlugX botnet C2 server (confidence level: 100%) | |
hash443 | PlugX botnet C2 server (confidence level: 100%) | |
hash5000 | PlugX botnet C2 server (confidence level: 100%) | |
hash3440 | DarkVision RAT botnet C2 server (confidence level: 75%) | |
hash3124 | Remcos botnet C2 server (confidence level: 75%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash10001 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash800 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash7777 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8888 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8888 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash2222 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash3191 | Remcos botnet C2 server (confidence level: 100%) | |
hash443 | pupy botnet C2 server (confidence level: 100%) | |
hash8808 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash6606 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash444 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash7443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash445 | Havoc botnet C2 server (confidence level: 100%) | |
hash443 | Havoc botnet C2 server (confidence level: 100%) | |
hash4433 | DCRat botnet C2 server (confidence level: 100%) | |
hash443 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash503 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash9999 | MooBot botnet C2 server (confidence level: 100%) | |
hash8080 | MimiKatz botnet C2 server (confidence level: 100%) | |
hash8080 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | DeimosC2 botnet C2 server (confidence level: 75%) | |
hash995 | QakBot botnet C2 server (confidence level: 75%) | |
hash80 | Broomstick botnet C2 server (confidence level: 75%) | |
hash60000 | Unknown malware botnet C2 server (confidence level: 75%) | |
hash2405 | Rhadamanthys botnet C2 server (confidence level: 100%) | |
hash10890 | Remcos botnet C2 server (confidence level: 75%) | |
hash49067 | Remcos botnet C2 server (confidence level: 75%) | |
hash101 | Mirai botnet C2 server (confidence level: 100%) | |
hash101 | Mirai botnet C2 server (confidence level: 100%) | |
hash3 | Mirai botnet C2 server (confidence level: 100%) | |
hash5000 | DOPLUGS botnet C2 server (confidence level: 100%) | |
hash443 | DOPLUGS botnet C2 server (confidence level: 100%) | |
hash4443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8088 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8088 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash18444 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash5000 | Remcos botnet C2 server (confidence level: 100%) | |
hash46167 | Remcos botnet C2 server (confidence level: 100%) | |
hash8888 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash7443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8089 | Hook botnet C2 server (confidence level: 100%) | |
hash8848 | DCRat botnet C2 server (confidence level: 100%) | |
hash80 | Stealc botnet C2 server (confidence level: 100%) | |
hash4000 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash4443 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash8443 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash8081 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash8443 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash14131 | NjRAT botnet C2 server (confidence level: 75%) | |
hash14131 | NjRAT botnet C2 server (confidence level: 75%) | |
hash47925 | Mirai botnet C2 server (confidence level: 75%) | |
hash18848 | NjRAT botnet C2 server (confidence level: 75%) | |
hash1995 | Mirai botnet C2 server (confidence level: 75%) | |
hash443 | Sliver botnet C2 server (confidence level: 100%) | |
hash2000 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash3306 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash7443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8089 | Hook botnet C2 server (confidence level: 100%) | |
hash443 | Havoc botnet C2 server (confidence level: 100%) | |
hash443 | Havoc botnet C2 server (confidence level: 100%) | |
hash443 | Havoc botnet C2 server (confidence level: 100%) | |
hash7443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash50001 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash2571 | Remcos botnet C2 server (confidence level: 100%) | |
hash8080 | Sliver botnet C2 server (confidence level: 100%) | |
hash9090 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash8888 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash8089 | Hook botnet C2 server (confidence level: 100%) | |
hash4433 | DCRat botnet C2 server (confidence level: 100%) | |
hash3796 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash80 | MooBot botnet C2 server (confidence level: 100%) | |
hash60000 | Unknown malware botnet C2 server (confidence level: 75%) | |
hash8080 | Havoc botnet C2 server (confidence level: 75%) | |
hash995 | QakBot botnet C2 server (confidence level: 75%) | |
hash443 | QakBot botnet C2 server (confidence level: 75%) | |
hash8443 | Meterpreter botnet C2 server (confidence level: 75%) |
Domain
| Value | Description | Copy |
|---|---|---|
domaincheck.asiu4.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domainjanhugo.com | FAKEUPDATES payload delivery domain (confidence level: 100%) | |
domainwebdisk.f.multi-canale.com | Bashlite botnet C2 domain (confidence level: 100%) | |
domainwebdisk.gfjd.104-168-101-27.cprapid.com | Bashlite botnet C2 domain (confidence level: 100%) | |
domainmail.c.multi-canale.com | Bashlite botnet C2 domain (confidence level: 100%) | |
domainwebmail.aa.104-168-101-27.cprapid.com | Bashlite botnet C2 domain (confidence level: 100%) | |
domainez-ssb.sipos.services | FAKEUPDATES payload delivery domain (confidence level: 80%) | |
domainhackthisshit.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainkrpt.dyndns.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domainroundbluerobin.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainjarmen.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainwiseagle101.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainintercool.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainlodoclan.servegame.com | CyberGate botnet C2 domain (confidence level: 100%) | |
domainthepowerguido.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainraid88rush.myphotos.cc | CyberGate botnet C2 domain (confidence level: 100%) | |
domaindr-mat.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainxradox.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainmicrosoftskype.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainturkkilainen.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainproalexpro.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainatlantise.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domaindatasecurity32.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainsusunahi3.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domainpoison00.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainchakra22.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainsalla.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainhack993.sytes.net | CyberGate botnet C2 domain (confidence level: 100%) | |
domainmedo99.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domainpooptit1.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainupdate-microsoft.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domainjames1990.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainxbladeinc.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainnwal.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainasment34.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainchamta1.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainkevinj123.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainsp1ffy.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainsusunahi1.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domainfrozenrats.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainsnowhost.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainrevennaras.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainkakawe2004.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domaindarkrounge.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainlamafiahacker.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domaindkcyb.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domaintutorial2016.ddns.net | CyberGate botnet C2 domain (confidence level: 100%) | |
domainmena.ath.cx | CyberGate botnet C2 domain (confidence level: 100%) | |
domaintesty.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainph9xlplaunlx150.sytes.net | CyberGate botnet C2 domain (confidence level: 100%) | |
domainshniwel0.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainmicrosoft1342.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainhxh.ath.cx | CyberGate botnet C2 domain (confidence level: 100%) | |
domainjaja1334.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainkorpz1.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domainhackerpool.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainmeiko-s.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainasssh2010.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domaincheckers-world.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainsnypz.poseidonbot.com | CyberGate botnet C2 domain (confidence level: 100%) | |
domain1337krypton.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainihrbekommtmichnie.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domaindietimee.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainincomingdisaster.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domaininjector.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domaint1t4n.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domainthisworldiscrazy.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainenhanceddomains.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainchillastube.podzone.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domaingillamp.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domainlawlzorz.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainsadvent.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainmichaudb.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainmark92.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainegoexxpress.servebbs.net | CyberGate botnet C2 domain (confidence level: 100%) | |
domainsunral.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domainxperrtcybergate.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domainrunescapemodstaff.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainfahadm.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domaind1a3l0.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainderdar.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainmatrix-zloy.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainsusunahi.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domainnumber.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainsenhordacaveira.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainunfor1987.serveftp.net | CyberGate botnet C2 domain (confidence level: 100%) | |
domainskikda.sytes.net | CyberGate botnet C2 domain (confidence level: 100%) | |
domainhazavit.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domaincrackear.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainpinkpanther54.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainkptkmm.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainpri1.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainasas.hopto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainpicudobot.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domain123qwe.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainlahssen1984.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainpleite.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainken1234.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domainchamta.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainsolidest.dyndns.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domainmstlj.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainonlycryy.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domaintysonscape.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainbarthssss.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domaincaveiranegro.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainno0od.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainefeseaprimera.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainxll.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domaingenjitakiya.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainm3m0colk.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainobv.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domainmita.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainogeniohacker.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainhackeck.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domainthepowerguido.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainttnet.gotdns.com | CyberGate botnet C2 domain (confidence level: 100%) | |
domaintroyan-nikos.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainbest-man.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domaintahugejrot.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domain5onny.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainminecraft-batlle.servegame.com | CyberGate botnet C2 domain (confidence level: 100%) | |
domainhacker37.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainjacky2020.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainmicrosoftupd.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domainokaybabe.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainraidrush.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainmorianos.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domaintraphier-traph.serveftp.com | CyberGate botnet C2 domain (confidence level: 100%) | |
domainfilehost1.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainghostraider.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainmorimor72.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainproject12222.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainbakainu.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domaincanadabeta.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domaindarkcomet2.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainzgogo.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domainstephie.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domaincybergatecrack.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domainimplingfinderv3.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainaytac.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainarschloch456.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainsansho007.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainminoip1001.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domaincoderz.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainnextlogon.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domain733t.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domaintangodown.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainkhdt2.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainlobo-lol.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domaincable.cable-modem.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainpatrick1232.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainfantasmas.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domaina3n-hacker.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainlolbadkid.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainforever.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domainlocuraaaaaa.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainchouchou.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domaincinemaproduction.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainleopars.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainburgy.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domaingrumpyemo.no-no.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainwearethehorde.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domaingonza09.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domaingrumpylucas.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainpersis.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainlt1.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainjagexfails.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainibm30073007.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domaincyberk.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainsyndrome.servemp3.com | CyberGate botnet C2 domain (confidence level: 100%) | |
domainhacker13.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainaptem18.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainsusunahi2.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domaindieforfree.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domaintupeoramenaza.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainbullseye23.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domaingodimath.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domaingoodalge.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainmsgh.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domaindisgow1.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domaininfectadoemo.no-ip.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainbiv3.no-ip.biz | CyberGate botnet C2 domain (confidence level: 100%) | |
domainsada.zapto.org | CyberGate botnet C2 domain (confidence level: 100%) | |
domainishaqkhan.redirectme.net | CyberGate botnet C2 domain (confidence level: 100%) | |
domainsusunahi4.no-ip.info | CyberGate botnet C2 domain (confidence level: 100%) | |
domainroobinos.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainvegasredbull.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainfredchen.gotdns.ch | DarkComet botnet C2 domain (confidence level: 100%) | |
domaintestconnect.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domain4mph33.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainemirhan-rat1.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domaincr4nk1337.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domain0000.ole32.com | DarkComet botnet C2 domain (confidence level: 100%) | |
domainfinga.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainwindowshaxor.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domaindoulnulla.serveblog.net | DarkComet botnet C2 domain (confidence level: 100%) | |
domainjakeykid.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domaindarwerft.no-ip.info | DarkComet botnet C2 domain (confidence level: 100%) | |
domainpeelsupport.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainfail-rat.zapto.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainsyricounette.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainnervernvm.zapto.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domaincinar12322.zapto.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domaindevils-hackers.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domaincelp.zapto.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainserveftm.serveftp.com | DarkComet botnet C2 domain (confidence level: 100%) | |
domainxxyyzz.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainladladladladlad.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainzxzakozxz.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainwaleed-hakerz.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainfacebook-abuse.tk | DarkComet botnet C2 domain (confidence level: 100%) | |
domainaha76.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainb0b1.zapto.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domaindarkhelper.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domain18479.3322.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domaindannyisadon.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainsuloname.no-ip.info | DarkComet botnet C2 domain (confidence level: 100%) | |
domainzagazoo.zapto.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domaineveremete.zapto.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainteknohd.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domaintswans.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainihacker.dnsd.me | DarkComet botnet C2 domain (confidence level: 100%) | |
domainiberat2012.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainrfox.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainwow-ftw.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainjakeyboy159.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domaineman.no-ip.info | DarkComet botnet C2 domain (confidence level: 100%) | |
domainkgsoloman5000.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainjacksonmayjones.zapto.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainfangtbn.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domain351625.zapto.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainshizo1337.zapto.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainsnarglozog.zapto.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainpablit89.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainxfuego.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domaindnse.zapto.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainbspeanut.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainkorabika.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domain00000.zapto.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainnillumronnoc.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domaindarwerft.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainhostmaster.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domaincheeseburger.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainkann.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domaindannydanny.zapto.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainjehadpal10.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainnicksdcrat1.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domaindcownz1.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainlogo1212.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainamjay.myftp.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainpazuzu11.zapto.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainsdat.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainkam3leon.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainroobinosratlocal.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainbitz.servepics.com | DarkComet botnet C2 domain (confidence level: 100%) | |
domaindarkcomethiday.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainindeednewb.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainopsec.mine.nu | DarkComet botnet C2 domain (confidence level: 100%) | |
domaindarkcomet2011.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainrattatattat.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainwwws.zapto.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainbekiap3332424.sytes.net | DarkComet botnet C2 domain (confidence level: 100%) | |
domainmyftp.homeftp.net | DarkComet botnet C2 domain (confidence level: 100%) | |
domainmaxiserp.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domaingalitma12.zapto.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainhnoo0oody.zapto.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainjbsoloman5000.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainnewzath.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainlovemoon93.dyndns-ip.com | DarkComet botnet C2 domain (confidence level: 100%) | |
domainmsaudio.servemp3.com | DarkComet botnet C2 domain (confidence level: 100%) | |
domainvaghavethepower.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainbole93.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainhammatov.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainjelixhff.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainfanbase.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainfytyrlybri2323.zapto.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainultimata.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domaincacaj.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domaindeanlet.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainshahruz007n.no-ip.info | DarkComet botnet C2 domain (confidence level: 100%) | |
domainsteamacc123.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domainst33lc1tyf4n.zapto.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainvikky38.no-ip.biz | DarkComet botnet C2 domain (confidence level: 100%) | |
domains3awscloud.com | NetWire RC botnet C2 domain (confidence level: 100%) | |
domainfluber12.duckdns.org | Xtreme RAT botnet C2 domain (confidence level: 100%) | |
domainl0opo0l.zapto.org | Xtreme RAT botnet C2 domain (confidence level: 100%) | |
domain111111q.no-ip.org | Xtreme RAT botnet C2 domain (confidence level: 100%) | |
domainbibilomp.servemp3.com | Xtreme RAT botnet C2 domain (confidence level: 100%) | |
domainbalooba-holinlolitago.servegame.com | Xtreme RAT botnet C2 domain (confidence level: 100%) | |
domainkokaxp.hopto.org | Xtreme RAT botnet C2 domain (confidence level: 100%) | |
domainuae577.no-ip.biz | Xtreme RAT botnet C2 domain (confidence level: 100%) | |
domainhdbdg.myftp.biz | Xtreme RAT botnet C2 domain (confidence level: 100%) | |
domainsophian.no-ip.biz | Xtreme RAT botnet C2 domain (confidence level: 100%) | |
domainazert123.no-ip.org | Xtreme RAT botnet C2 domain (confidence level: 100%) | |
domainkaito.no-ip.org | Xtreme RAT botnet C2 domain (confidence level: 100%) | |
domainhectorr.no-ip.org | Xtreme RAT botnet C2 domain (confidence level: 100%) | |
domainarabc.no-ip.org | Xtreme RAT botnet C2 domain (confidence level: 100%) | |
domain250.batcom.top | Mirai botnet C2 domain (confidence level: 100%) | |
domainbotnet.getsolara.info | Mirai botnet C2 domain (confidence level: 100%) | |
domaindata.hello4443.xyz | Mirai botnet C2 domain (confidence level: 100%) | |
domainposition-idea.gl.at.ply.gg | SpyNote botnet C2 domain (confidence level: 100%) | |
domainworldwide-contributor.gl.at.ply.gg | SpyNote botnet C2 domain (confidence level: 100%) | |
domainest-unfortunately.gl.at.ply.gg | SpyNote botnet C2 domain (confidence level: 100%) | |
domainfeatured-lt.gl.at.ply.gg | SpyNote botnet C2 domain (confidence level: 100%) | |
domainselect-as.gl.at.ply.gg | SpyNote botnet C2 domain (confidence level: 100%) | |
domainmr-committees.gl.at.ply.gg | SpyNote botnet C2 domain (confidence level: 100%) | |
domainadminadmin2023.ddns.net | SpyNote botnet C2 domain (confidence level: 100%) | |
domainwhat-release.gl.at.ply.gg | SpyNote botnet C2 domain (confidence level: 100%) | |
domainmybkbfpvaixipfsxoa.space | Havoc botnet C2 domain (confidence level: 100%) | |
domainadm.dreamad.mobi | Cobalt Strike botnet C2 domain (confidence level: 100%) | |
domainlmyz.yiqing99.cn | Cobalt Strike botnet C2 domain (confidence level: 100%) | |
domainec2-23-20-183-202.compute-1.amazonaws.com | Unknown malware botnet C2 domain (confidence level: 100%) | |
domaintopclth.click | Unknown malware botnet C2 domain (confidence level: 100%) | |
domainmfaicoffice.com | PlugX botnet C2 domain (confidence level: 75%) | |
domaingogetxto.life | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainjpkinki.com | PlugX botnet C2 domain (confidence level: 100%) | |
domaincheck.axei3.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domainbeaminduggl.top | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainalicevivianny.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainaljazddra.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainantioxidantsnews.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainconflictaslesson.com | PlugX botnet C2 domain (confidence level: 100%) | |
domaincrappienews.com | PlugX botnet C2 domain (confidence level: 100%) | |
domaincreatecopilot.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainelectrictulsa.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainerpdown.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainestmongolia.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainfinancialextremed.com | PlugX botnet C2 domain (confidence level: 100%) | |
domaingetfiledown.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainglobaleyenews.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainhajjnewsbd.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainhisnhershealthynhappy.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainimportsmall.com | PlugX botnet C2 domain (confidence level: 100%) | |
domaininfotechtelecom.com | PlugX botnet C2 domain (confidence level: 100%) | |
domaininhller.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainitduniversity.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainivibers.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainkerrvillehomeschoolers.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainlinkonmarketing.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainlooksnews.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainmaineasce.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainmeetviberapi.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainmexicoglobaluniversity.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainmobilefiledownload.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainmojhaloton.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainmrytlebeachinfo.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainnewslandtoday.net | PlugX botnet C2 domain (confidence level: 100%) | |
domainoncalltechnical.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainquickoffice360.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainredactnews.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainreformporta.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainriversidebreakingnews.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainsangkayrealnews.com | PlugX botnet C2 domain (confidence level: 100%) | |
domaintasensors.com | PlugX botnet C2 domain (confidence level: 100%) | |
domaintechoilproducts.com | PlugX botnet C2 domain (confidence level: 100%) | |
domaintigernewsmedia.com | PlugX botnet C2 domain (confidence level: 100%) | |
domaintruff-evadee.com | PlugX botnet C2 domain (confidence level: 100%) | |
domaintychonews.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainusedownload.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainvopaklatinamerica.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainwindowsfiledownload.com | PlugX botnet C2 domain (confidence level: 100%) | |
domainrem9rrr.duckdns.org | Remcos botnet C2 domain (confidence level: 100%) | |
domainrem9rrr2.duckdns.org | Remcos botnet C2 domain (confidence level: 100%) | |
domaintentyfive5.ydns.eu | Quasar RAT botnet C2 domain (confidence level: 100%) | |
domainthirtyfive5.ydns.eu | Quasar RAT botnet C2 domain (confidence level: 100%) | |
domainthirtyfive335.crabdance.com | Quasar RAT botnet C2 domain (confidence level: 100%) | |
domainpipbinorel99.com | Remcos botnet C2 domain (confidence level: 100%) | |
domainautodiscover.a.multi-canale.com | Bashlite botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.b.multi-canale.com | Bashlite botnet C2 domain (confidence level: 100%) | |
domaincpcontacts.eversioneweb.com | Bashlite botnet C2 domain (confidence level: 100%) | |
domainy.p.formaxprime.co.uk | Vidar botnet C2 domain (confidence level: 100%) | |
domaincheck.atuu7.icu | ClearFake payload delivery domain (confidence level: 100%) | |
domainunrealfabricdo.click | SectopRAT payload delivery domain (confidence level: 90%) | |
domainmrgenuis.no-ip.org | DarkComet botnet C2 domain (confidence level: 100%) | |
domainstarbits.world | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domaingetfiledata.com | DOPLUGS botnet C2 domain (confidence level: 100%) | |
domaincpanel.e.ora-0-web.com | Bashlite botnet C2 domain (confidence level: 100%) | |
domainautodiscover.e.ora-0-web.com | Bashlite botnet C2 domain (confidence level: 100%) | |
domainautodiscover.web-app-on.com | Bashlite botnet C2 domain (confidence level: 100%) | |
domainautodiscover.m.web-app-on.com | Bashlite botnet C2 domain (confidence level: 100%) | |
domainmail.e.ora-0-web.com | Bashlite botnet C2 domain (confidence level: 100%) | |
domainvfclan.com | FAKEUPDATES payload delivery domain (confidence level: 100%) | |
domain1329742111-h1rmesk2t.ap-guangzhou.tencentscf.com | Cobalt Strike botnet C2 domain (confidence level: 75%) | |
domaina-0001.a2-msedge.net | Cobalt Strike botnet C2 domain (confidence level: 75%) | |
domaincngov.oss-cn-shanghai.aliyuncs.com | Cobalt Strike botnet C2 domain (confidence level: 75%) | |
domainmicrosofts.wiki | Cobalt Strike botnet C2 domain (confidence level: 75%) | |
domainoversizes.ghostgames.mom | Cobalt Strike botnet C2 domain (confidence level: 75%) | |
domainvozaspecial.com | Cobalt Strike botnet C2 domain (confidence level: 75%) | |
domainazmamiraixd.duckdns.org | Mirai botnet C2 domain (confidence level: 100%) | |
domainbot.gribostress.pro | Mirai botnet C2 domain (confidence level: 75%) | |
domaincpcontacts.efcommxerce.ru | Hook botnet C2 domain (confidence level: 100%) |
Threat ID: 682c7db8e8347ec82d2bff06
Added to database: 5/20/2025, 1:03:52 PM
Last enriched: 6/19/2025, 3:48:48 PM
Last updated: 7/25/2025, 6:28:34 PM
Views: 15
Related Threats
ThreatFox IOCs for 2025-08-09
MediumMalwareSun Aug 10 2025
Embargo Ransomware nets $34.2M in crypto since April 2024
MediumMalwareSat Aug 09 2025
ThreatFox IOCs for 2025-08-08
MediumMalwareSat Aug 09 2025
Efimer Trojan delivered via email and hacked WordPress websites
MediumMalwareFri Aug 08 2025
Unmasking SocGholish: Untangling the Malware Web Behind the 'Pioneer of Fake Updates' and Its Operator
MediumMalwareFri Aug 08 2025
Actions
PRO
Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.
Please log in to the Console to use AI analysis features.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.