Reconnecting to live updates…

ThreatFox IOCs for 2025-11-15

Severity: mediumType: malware

AI Analysis

Technical Summary

This report from ThreatFox MISP feed dated November 15, 2025, outlines a malware-related threat focusing on OSINT (Open Source Intelligence) and payload delivery through network activity. The threat is categorized under OSINT and payload delivery, suggesting that adversaries may be leveraging publicly available intelligence to facilitate malware distribution or network intrusion. The technical details are sparse, with no specific affected software versions or CVEs listed, and no known exploits currently active in the wild. The threat level is rated as 2 on an unspecified scale, with moderate distribution potential (level 3) and minimal analysis depth (level 1). The absence of indicators of compromise (IOCs) and CWE classifications limits the ability to pinpoint exact attack vectors or malware families involved. No patches or remediation links are provided, indicating either a novel or poorly documented threat. The medium severity rating implies a moderate risk, likely due to potential network-based payload delivery without requiring user interaction or authentication. The threat appears to be in an early or reconnaissance phase, leveraging OSINT techniques to identify targets or deliver malicious payloads. Organizations should consider this a warning to enhance monitoring of network traffic and OSINT-related activities to detect early signs of compromise.

Potential Impact

For European organizations, this threat could lead to unauthorized network access, malware infection, and potential data exfiltration or disruption of services. Since the threat involves payload delivery and network activity, it may affect critical infrastructure, government agencies, and enterprises relying on open-source intelligence tools or exposed network services. The medium severity suggests that while the threat is not immediately critical, it could escalate if adversaries develop exploits or expand distribution. The lack of known exploits in the wild currently limits immediate impact, but the potential for reconnaissance and payload delivery means organizations could face targeted attacks or supply chain compromises. Disruption to confidentiality, integrity, and availability could occur if malware payloads are successfully delivered and executed. European entities with high digital dependency and interconnected networks are particularly at risk, especially if they lack robust network monitoring and threat intelligence capabilities.

Mitigation Recommendations

1. Implement advanced network traffic monitoring and anomaly detection to identify unusual payload delivery attempts or OSINT-related reconnaissance activities. 2. Integrate ThreatFox and other OSINT feeds into existing SIEM and SOAR platforms to enhance early detection of emerging threats. 3. Conduct regular threat hunting exercises focusing on network activity patterns associated with payload delivery. 4. Enforce strict network segmentation to limit lateral movement in case of successful compromise. 5. Harden perimeter defenses, including firewalls and intrusion prevention systems, to block known malicious payload delivery vectors. 6. Educate security teams on emerging OSINT-based threat tactics to improve incident response readiness. 7. Maintain up-to-date asset inventories and vulnerability assessments to quickly identify and remediate potential exposure points. 8. Collaborate with national cybersecurity centers and information sharing organizations to stay informed about evolving threats and mitigation strategies.

Affected Countries

Germany, France, United Kingdom, Netherlands, Italy

Indicators of Compromise

url: http://194.38.20.95/mono
url: http://194.38.20.95/1
url: http://194.38.20.95/2
url: http://194.38.20.95/xmr.exe
domain: leathes.qpon
domain: drugtrh.qpon
file: 213.209.143.34
hash: 3778
domain: aasdtvcvchcvhhhhh.com
url: https://aasdtvcvchcvhhhhh.com/ootot
domain: ldasldalsd.com
url: https://ldasldalsd.com/asgg.js
url: https://sistemdetect.com/client32.wav
domain: sistemdetect.com
url: https://uploadclient32.com/client32.wav
domain: uploadclient32.com
domain: bindlib.com
url: https://bindlib.com/xss/buf.js
url: https://bindlib.com/xss/index.php
file: 103.133.178.24
hash: 4782
file: 3.101.56.242
hash: 10002
file: 5.22.214.179
hash: 8000
file: 4.209.183.220
hash: 4321
file: 175.24.73.192
hash: 4321
domain: moor.saffronhafen.ru
domain: klee.saffronhafen.ru
domain: glut.saffronhafen.ru
domain: weald.saffronhafen.ru
domain: berg.graniteweide.ru
domain: strom.graniteweide.ru
domain: adler.graniteweide.ru
domain: pfad.onyxkamm.ru
domain: ufer.onyxkamm.ru
domain: licht.onyxkamm.ru
domain: schild.onyxkamm.ru
domain: dorn.onyxkamm.ru
domain: wald.quillgipfel.ru
domain: tau.quillgipfel.ru
domain: stein.quillgipfel.ru
domain: fluss.quillgipfel.ru
domain: farn.quillgipfel.ru
domain: rune.zephyrquelle.ru
domain: bach.zephyrquelle.ru
url: https://egyeditalpbetet.batz.hu/
url: https://verificationsbycapcha.center/
url: https://b.pendantkart.in/
domain: nebel.zephyrquelle.ru
domain: fjord.maplerand.ru
domain: kraut.maplerand.ru
domain: stern.maplerand.ru
domain: hain.maplerand.ru
domain: gleis.auroralinde.ru
domain: moos.auroralinde.ru
file: 87.120.93.66
hash: 443
file: 82.223.101.63
hash: 8808
file: 37.221.66.166
hash: 9000
file: 188.225.73.201
hash: 80
domain: weald.auroralinde.ru
domain: klee.tundragrund.ru
domain: licht.tundragrund.ru
domain: ufer.tundragrund.ru
domain: tau.tundragrund.ru
domain: kreis.tundragrund.ru
domain: falke.silvanbruch.ru
domain: zorn.silvanbruch.ru
url: https://91.212.166.51:443
url: https://194.28.225.230:443
url: https://147.45.197.92:443
url: https://94.228.161.88:443
url: https://77.239.121.3:443
url: https://77.239.120.249:443
url: https://84.201.4.120:443
url: https://206.245.157.177:443
url: https://172.245.112.202:443
url: https://poochse.qpon/api
domain: tal.silvanbruch.ru
domain: glanz.silvanbruch.ru
domain: eg-buzz.gl.at.ply.gg
file: 70.176.154.122
hash: 49971
domain: agosto13.con-ip.com
file: 166.117.156.6
hash: 21666
file: 91.92.243.183
hash: 1000
file: 68.183.159.114
hash: 443
file: 47.104.237.103
hash: 7777
file: 137.220.194.49
hash: 5555
file: 39.96.163.78
hash: 9999
url: https://digitalservice365cloud.com/richfamily/nfburmok45
url: https://mceenzie.sbs/richfamily/nfburmok45
domain: xsud.idealbros.com
domain: jet.idealbros.com
file: 64.188.66.7
hash: 25565
file: 195.200.17.158
hash: 8080
file: 198.98.51.203
hash: 8888
domain: mvu5.idealbros.com
file: 62.4.0.66
hash: 7443
file: 79.107.136.166
hash: 995
file: 94.49.199.72
hash: 443
domain: tap6.bestffriend.com
domain: pn.bestffriend.com
url: http://62.60.178.163/ce369e7324834845.php
url: http://62.60.226.248:5553/cb687a0a0c034c878a1d11f85d7e81d3_7065635553_build.bin
domain: echo5.bestffriend.com
domain: simmexcontrol.com
domain: x2n.bestffriend.com
domain: abstractoffieldtrialofblackgram.com
url: https://shift-art.com/123/cloudflare/verify/humanverfification/cloudflarechallenge/customerid37832738/
domain: adultgamesps4.com
domain: tsutsuifujiko.com
domain: delix.misecretaria.com.ar
domain: tap6.bestffriend.digital
domain: xshby.com
domain: bestmoneytree.com
domain: conqueringtheland.com
domain: beasteadyhand.org
domain: urbannewsnow.com
domain: pn.bestffriend.digital
domain: samleapp.com
domain: mondotalk.co.uk
domain: dnss.pro
domain: egao25.com
domain: gameofbones.net
domain: diamondmusicent.com.ng
domain: echo5.bestffriend.digital
domain: epfindiauan.com
domain: cargo.aquafex.in
domain: fuckrabbit.com
domain: flavorista.branding-bar.com
domain: tildotsignatures.com
domain: vibe.bestffriend.digital
domain: cptchdm.icu
domain: sleepkids.app
domain: archilabdesigns.com
domain: super.namatin.com
domain: pokkaloh.com
domain: x2n.bestffriend.digital
domain: q0ck.dripanchor.ru
domain: anchor.dripanchor.ru
domain: ac3d0ee370745f757.awsglobalaccelerator.com
domain: obte.dripanchor.ru
domain: kans.s1nkflare.ru
file: 82.156.235.177
hash: 8089
file: 77.90.185.30
hash: 80
file: 90.58.26.10
hash: 4040
file: 52.59.255.232
hash: 443
file: 164.90.131.243
hash: 7443
file: 71.71.132.141
hash: 8443
file: 142.90.219.232
hash: 8443
file: 138.197.58.180
hash: 3333
file: 198.211.102.142
hash: 443
file: 209.97.133.115
hash: 3333
file: 72.60.76.73
hash: 8443
domain: chromiumgo.bond
domain: drip2.s1nkflare.ru
file: 141.98.10.11
hash: 2113
domain: chroeminstant.com
domain: chromeupdate.download
domain: trace.s1nkflare.ru
domain: scramble3.orbitling.ru
domain: f3.orbitling.ru
domain: yspm.orbitling.ru
domain: 7uo.g0sslamp.ru
file: 47.118.83.147
hash: 80
file: 174.138.24.216
hash: 80
domain: tuesday-gamma.gl.at.ply.gg
domain: source-gtk.gl.at.ply.gg
domain: kamazec-35137.portmap.host
file: 185.243.96.19
hash: 443
domain: ezpz1.xyz
file: 144.31.90.139
hash: 9000
file: 102.117.163.144
hash: 7443
domain: center-lost.gl.at.ply.gg
domain: debt-apartment.gl.at.ply.gg
url: http://proproproaaa.fun
domain: lj.g0sslamp.ru
domain: 1ojva.g0sslamp.ru
domain: beacon1.kn1fecast.ru
domain: 35k.kn1fecast.ru
domain: kpow.kn1fecast.ru
domain: www.acd852.me
file: 45.200.17.43
hash: 8080
file: 45.200.17.43
hash: 8443
file: 87.120.93.66
hash: 80
domain: hover3.g-0-ss-lamp.ru
domain: ylr.g-0-ss-lamp.ru
domain: he2.g-0-ss-lamp.ru
domain: q9p4.meltquark.ru
domain: fvfsf.meltquark.ru
domain: e0.meltquark.ru
domain: ye.scramblehub.ru
domain: rah.scramblehub.ru
domain: pulse.scramblehub.ru
domain: 98.drip-anchor.ru
domain: ly.drip-anchor.ru
domain: flux.drip-anchor.ru
domain: ewgmd.patchvine.ru
domain: vale.patchvine.ru
domain: drs.patchvine.ru
domain: nd9eh.kn-1-fecast.ru
url: http://124.71.229.16:8888/supershell/login/
url: http://117.72.209.125:18888/supershell/login/
file: 117.72.209.125
hash: 18888
domain: l8lp.kn-1-fecast.ru
domain: spark8.kn-1-fecast.ru
domain: quark.waveretch.ru
domain: ieqs.waveretch.ru
url: http://8586.vercel.app/
url: http://ads-signal-core-point.pages.dev/appeal_form
url: http://ads-signal-core-point.pages.dev/welcome_to_meta_for_business
url: http://amazon-clone-project-alpha.vercel.app/
url: http://apollox-finance.gitbook.io/apollox-finance/welcome/trading-on-v1/wallet-connection
url: http://asjaga.github.io/amazon-clone
url: http://bdo-r5f.cc/ph
url: http://bhagirathsinhrana378.github.io/amazon_landing_page_clone
url: http://brandinless.com/admin/webmail/index2.html
url: http://buslink-nodehold.pages.dev/welcome_to_meta_for_business
url: http://campaign-data-control-hub.pages.dev/form_submit
url: http://cn.mcdvdh.com/
url: http://cvmsv.3656l.co/
url: http://data-center-bullying-impersonation.pages.dev/
url: http://data-center-compliance-harassment.pages.dev/
url: http://data-center-compliance-impersonation.pages.dev/
url: http://data-center-data-violation.pages.dev/
url: http://data-center-disablement-copyright.pages.dev/
url: http://data-center-disablement-strike.pages.dev/
url: http://data-center-evaluation-bullying.pages.dev/
url: http://data-center-evaluation-violence.pages.dev/
url: http://data-center-guideline-claim.pages.dev/
url: http://data-center-guideline-control.pages.dev/
url: http://data-center-harassment-transparency.pages.dev/
url: http://data-center-impersonation-privacy.pages.dev/
url: http://data-center-quality-bullying.pages.dev/
url: http://data-center-quality-compliance.pages.dev/
url: http://data-center-quality-standard.pages.dev/
url: http://data-center-quality-takedown.pages.dev/
url: http://data-center-reporting-policy.pages.dev/
url: http://data-center-reporting-takedown.pages.dev/
url: http://data-center-restriction-violence.pages.dev/
url: http://data-center-service-trademark.pages.dev/
url: http://data-center-strike-customer.pages.dev/
url: http://data-center-suspension-standard.pages.dev/
url: http://data-center-trademark-data.pages.dev/
url: http://data-center-transparency-support.pages.dev/
url: http://data-center-violence-guideline.pages.dev/
url: http://datashieldoz-cagid14z11-authguardex.pages.dev/
url: http://easybank-landing-page-master-lime.vercel.app/
url: http://eclipse-decipher.pages.dev/
url: http://f.digitalmaillane.com/igit/4/c44val3y16h930hs82yltjyp0kzec2yid7y54wyfsy8y1
url: http://incandescent-panda-e4a44a.netlify.app/
url: http://instagram-clone-brown-seven.vercel.app/
url: http://instagram-clone-gray-eight.vercel.app/
url: http://instagram-clone-lime-ten.vercel.app/
url: http://instagram-clone-teal-eight.vercel.app/
url: http://instagram-login-page-eight.vercel.app/
url: http://instagram-login-page-seven.vercel.app/
url: http://kucoinnlgoin.godaddysites.com/
url: http://kuconilogi-us.godaddysites.com/
url: http://m-mettamusklo.godaddysites.com/
url: http://meta-balir-syvon.pages.dev/
url: http://meta-borlivex.pages.dev/
url: http://meta-bralvistol.pages.dev/
url: http://meta-brysol-deron.pages.dev/
url: http://meta-cernivor.pages.dev/
url: http://meta-deepwell.pages.dev/
url: http://meta-delvindor.pages.dev/
url: http://meta-dyvox-belon.pages.dev/
url: http://meta-gornivex.pages.dev/
url: http://meta-hervinton.pages.dev/
url: http://meta-ilvixonar.pages.dev/
url: http://meta-jarin-melon.pages.dev/
url: http://meta-jonox-myral.pages.dev/
url: http://meta-juren-kryso.pages.dev/
url: http://meta-kornidex.pages.dev/
url: http://meta-kornivax.pages.dev/
url: http://meta-lirvandon.pages.dev/
url: http://meta-morvandar.pages.dev/
url: http://meta-nirvaxon.pages.dev/
url: http://meta-olrendix.pages.dev/
url: http://meta-olstavir.pages.dev/
url: http://meta-rosvinar.pages.dev/
url: http://meta-ulmarix.pages.dev/
url: http://meta-vornivon.pages.dev/
url: http://meta-xorvitel.pages.dev/
url: http://meta-yervaxin.pages.dev/
url: http://meta-yorvindal.pages.dev/
url: http://meta-zervalon.pages.dev/
url: http://methamskkloggeys.godaddysites.com/
url: http://mxx123.net/
url: http://mxx66.net/
url: http://opensea-six.vercel.app/
url: http://pay.mojdpd.si/payment/dpd2001/16952010327078
url: http://pay.mojdpd.si/payment/dpd2001/16962031288646
url: http://pay.mojdpd.si/payment/dpd2001/16962035153501
url: http://pay.mojdpd.si/payment/dpd2001/16992002029937
url: http://portal-smec.cloudevents.ai/
url: http://pub-4f9d90fc7af3453b8b1d803589a070ff.r2.dev/index.html
url: http://sage-node.pages.dev/
url: http://stellar-grove-guardian-signal-haven.pages.dev/
url: http://stone-brook.pages.dev/
url: http://tokevpocket.com/
url: http://vortex-labs-6r0.pages.dev/
url: http://vpass-jp.wkahl.cn/
url: http://welcomed-guardrails.weebly.com/
url: http://www.913789161621147280198065376576ipjpsvqgzrmxyey.adelon.com.br/
url: http://www.amazon-clone-dhoblesakshi19-gmailcoms-projects.vercel.app/
url: http://www.avibnb-xi.vercel.app/
url: https://gnarlus.qpon/api
url: http://www.cn-live-five.vercel.app/
url: http://www.cnnectsfinity.weebly.com/
url: http://www.entcusecures.vercel.app/
url: http://www.facebook-one-psi.vercel.app/
url: http://www.instagramvoting.weebly.com/
url: http://www.mail-supporto-tiscali.weebly.com/
url: http://www.mjunhgedbs.weebly.com/
url: http://www.my-online-web-site-capitalone-app.vercel.app/
url: http://www.p365666.com/
url: http://www.rbxdedw.vercel.app/
url: http://www.spotify-clone-iota-ashen.vercel.app/
url: http://www.useryttnbtntt.weebly.com/
url: http://www.wallet-connector-main.vercel.app/
url: http://www.welcomed-guardrails.weebly.com/
url: http://www.www-fifa22.com/
url: http://www3-vpass.pkbvi.cn/
url: http://zora-hold-3ue.pages.dev/
url: https://ai-robust.github.io/edu-test/
url: https://amazon-clone-dhoblesakshi19-gmailcoms-projects.vercel.app/
url: https://avibnb-xi.vercel.app/
url: https://b-12312.github.io/facebook-homepage/
url: https://bdo-r5f.cc/ph/
url: https://beautyworkid.com/m/user/assets
url: https://biolinky.co/homebtee
url: https://booking-checkinarrivale2.com/bnubxp5b
url: https://booking-checkinarrivale2.com/too62wbm
url: https://booking-checkinarrivale4.com/vnub7u3z
url: https://booking-checkinarrivale5.com/ltk41g7f
url: https://booking-checkinarrivale6.com/orj0m33n
url: https://bookingverifycenter.com/259385603850
url: https://bookingverifycenter.com/450971646948
url: https://case36842.agency-partner-apply.com/
url: https://case36862.agency-partner-apply.com/
url: https://clam-clam-79999.netlify.app/
url: https://cn.1mebetx.com/home/register?code=39593
url: https://cn.mbx800.net/home/register
url: https://cn.plhhovyj.com/home/register
url: https://data-center-bullying-messenger.pages.dev/
url: https://data-center-standard-messenger.pages.dev/
url: https://data-center-trademark-policy.pages.dev/
url: https://data-center-violation-transparency.pages.dev/
url: https://derfla.eu/mobile.de
url: https://durgeshdhakar5282.github.io/amazon_clone/
url: https://dusk-stream.pages.dev/
url: https://echo-stream.pages.dev/
url: https://facebook-one-psi.vercel.app/
url: https://hotelreservationverify.com/231180426913
url: https://hotelreservationverify.com/480855227260
url: https://hotelreservationverify.com/517622059912
url: https://hotelreservationverify.com/622573773337
url: https://jayanthisennaiyan.github.io/airbnb
url: https://kautilya-bhatt.github.io/amazon-clone/
url: https://loginform.co.in/
url: https://lost-glen.pages.dev/
url: https://mayank1174.github.io/website-demo/
url: https://meta-cascade-a0n.pages.dev/
url: https://meta-cynor-527.pages.dev/
domain: rift.waveretch.ru
url: https://meta-dorin-xylav.pages.dev/
url: https://meta-feros-nalon.pages.dev/
url: https://meta-hyron-lisav.pages.dev/
url: https://meta-hyrox-ferin.pages.dev/
url: https://meta-hyroz-feral.pages.dev/
url: https://meta-hytek-loran.pages.dev/
url: https://meta-hyven-ravil.pages.dev/
url: https://meta-jyson-raliv.pages.dev/
url: https://meta-jyxen-ferlo.pages.dev/
url: https://meta-kavon-girax.pages.dev/
url: https://meta-keru-vilon.pages.dev/
url: https://meta-kreva-hyson.pages.dev/
url: https://meta-lavex-tiron.pages.dev/
url: https://meta-lavon-vyrox.pages.dev/
url: https://meta-lenor-vysal.pages.dev/
url: https://meta-linox-syren.pages.dev/
url: https://meta-lixon-gavis.pages.dev/
url: https://meta-luren-syval.pages.dev/
url: https://meta-melon-hyrex.pages.dev/
url: https://meta-menra.pages.dev/
url: https://meta-miron-vyzel.pages.dev/
url: https://meta-monar-zenil.pages.dev/
url: https://meta-navor-girin.pages.dev/
url: https://meta-navor-lyzen.pages.dev/
url: https://meta-nyrex-feral.pages.dev/
url: https://meta-prilo-hyvox.pages.dev/
url: https://meta-pyrox-laven.pages.dev/
url: https://meta-runnel.pages.dev/
url: https://meta-salir-dynek.pages.dev/
url: https://meta-savin-4ur.pages.dev/
url: https://meta-sorin-wylar.pages.dev/
url: https://meta-synor-dravek.pages.dev/
url: https://meta-syren-tyrox.pages.dev/
url: https://meta-syvar-jonex.pages.dev/
url: https://meta-syver-halix.pages.dev/
url: https://meta-syvo-trenil.pages.dev/
url: https://meta-syvon-jarix.pages.dev/
url: https://meta-syxel-laven.pages.dev/
url: https://meta-telon-syrov.pages.dev/
url: https://meta-tovin-keral.pages.dev/
url: https://meta-trava-jorin.pages.dev/
url: https://meta-trivo-hylen.pages.dev/
url: https://meta-tylos-ferna.pages.dev/
url: https://meta-valex-nyron.pages.dev/
url: https://meta-voran-fylis.pages.dev/
url: https://meta-wylen-zelor.pages.dev/
url: https://meta-wylyn-marex.pages.dev/
url: https://meta-wyra-denox.pages.dev/
url: https://meta-wyrox-delor.pages.dev/
url: https://meta-wyson-kirel.pages.dev/
url: https://meta-wyvan-delin.pages.dev/
url: https://meta-wyxel-tyron.pages.dev/
url: https://meta-xarin-gelon.pages.dev/
url: https://meta-xavox-silur.pages.dev/
url: https://meta-xyver-lanin.pages.dev/
url: https://meta-zerin-hyrox.pages.dev/
url: https://midnight-bay.pages.dev/
url: https://midnight-stream.pages.dev/
url: https://misty-stream.pages.dev/
url: https://nhhkl.blogspot.al/
url: https://pending-guestf81553.com/twiz5x6i
url: https://pending-guetsf3306.com/a9umz5t1
url: https://pending-guetsf3306.com/wmdahzz2
url: https://polybutyleneflorida.com/blonew.html
url: https://quiet-hollow.pages.dev/
url: https://quiet-shore.pages.dev/
url: https://rbfcu-star.azurewebsites.net/(s(0rbofb3ohekmaspmljtz4b5i))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(1fzsbumnhccslx10cjnwynpe))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(1hlh5nwtq0elual41zjmkptt))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(1la1pww1gk5wnctkh0dvcom4))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(1tlcip53j5vtcmuyjbrtqyx2))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(23hmcxie24ni2j3kyco2yfg1))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(2fhgtlx5seoh2lyjcyfinri4))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(3e44k04iw3brusu2403vbin3))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(3swpzsjbzsiweems0irg0k2u))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(41fkds3ukfh5zx4on2cgv2ha))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(4piv1nr4otfxfhxzzuroda5h))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(5frfnrybykpdrla0rw3ryzza))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(ae5gmdnagiscsag15vinhudg))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(avq2rriit3y2hmaufkv4ry5q))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(bnbyxmupomxoqpsz3ahimrfe))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(brefrzka25qdess4ogkjmh2e))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(c3uqaewfwzhvtehoovctskfh))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(c4bwkalw4nkm1bxthe3hnac4))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(ce5a235v102neg1zknsjj2gn))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(cg5wb5413bjco1ao54jimbpn))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(csfvbcakpmfsmenq3j0popow))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(dtzhqgf2vd4gwhazgmcdyqlm))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(e0hzd05n4clwsu5h4w2htgo5))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(fckxdbrw0b2oyfdvippwzk1z))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(gg5dfy0q5rxfp2rz50ruhu21))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(h2tuyfx5mj4hzjau3h2irzdd))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(hflmi2iwg5ub02dnwypvmusz))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(i0macwkjsn15v4lo2ezs2x2g))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(ifd4kq1d5u51arg2tojabfrw))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(iixdxoj43elhgr1z5omkxpi2))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(iwan3piuixrx0td0o5uzuo0y))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(jf51v4b5o2gtc1uc4h3vpx1r))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(joo1hcvva3slsowsu5upfoku))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(koapmn1nntn1tspjfocfuflb))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(lmbjs1v3xitrvkcdwipdjkt4))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(m3o4v4xbq5yc1jnzetfgzixk))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(m4twevmtbrfyaxsehe0f2fs5))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(npugcaao2qqilpl4alhqeddo))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(o30wa23bs3k4ejfi2w0kre5p))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(ohpplrvzboydkzubks52lmib))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(r5c5hwp4kicjprur0ogorsys))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(ts2wcvwvcsrngd2glncksg4x))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(u4kc33f5s2jjpzyjx01bzhdr))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(uevuwkovv5linwr4yfbdmae4))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(uql0ar1ylg5axckio1gvhqvr))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(veudvc3ghwn0v2e1pgruzxj4))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(w2bnk4jkbraeb3hyilglmtul))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(w554kmwssy3mg3givk2cgz0w))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(wajqa1j2spmze4gyhqauglpy))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(x5yhoigyci0byfmoprrgaziw))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(xvytimsgxgs2ybtcy55sjpya))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(yqrwx05isais24tbhwi5fhoi))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(z41okpc51grzf2mcrtfpwqjt))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(ziaekhg144rqr3lkfaucrsi0))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(ztwvisgd1fmx3sgxi1esa2sp))/main/login
url: https://silver-bay.pages.dev/
url: https://site-h1gzufxrm.godaddysites.com/
url: https://site-q91z6r31h.godaddysites.com/
url: https://spotify-clone-iota-ashen.vercel.app/
url: https://timber-ridge.pages.dev/
url: https://v-vpass-jp.foryongroup.com/
url: https://vpass-jp.fnloa.cn/
url: https://vpass-jp.ifffz.cn/
url: https://vpass-jp.puqcf.cn/
url: https://vpass-jp.uuzuf.cn/
url: https://wallet-connector-main.vercel.app/
url: https://www.easy-bank-landing-page-pi.vercel.app/
url: https://www.rectification-service.vercel.app/
url: https://www.tutanakhukukdava.org/
url: https://www3-vpass.bpcot.cn/
url: https://www3-vpass.ernlp.cn/
url: https://www3-vpass.fpbrg.cn/
url: https://www3-vpass.fxxgh.cn/
url: https://www3-vpass.laihuikuaiche.com/
url: https://www3-vpass.pmllo.cn/
domain: wolke.stormlaterne.ru
domain: glanz.stormlaterne.ru
file: 43.173.118.80
hash: 443
file: 42.125.196.173
hash: 2404
file: 164.90.136.126
hash: 80
file: 64.176.179.199
hash: 7443
file: 8.215.50.80
hash: 7443
file: 160.178.221.129
hash: 2222
domain: bach.stormlaterne.ru
domain: tau.stormlaterne.ru
domain: moor.emberhochland.ru
domain: stern.emberhochland.ru
domain: rune.emberhochland.ru
domain: weald.emberhochland.ru
domain: korn.emberhochland.ru
domain: pfad.quartzfeder.ru
domain: kamm.quartzfeder.ru
domain: nebel.quartzfeder.ru
domain: nacht.midnightkiefer.ru
domain: wald.midnightkiefer.ru
domain: rune.midnightkiefer.ru
domain: falke.midnightkiefer.ru
domain: dorn.midnightkiefer.ru
domain: archive-medical.gl.at.ply.gg
file: 64.188.66.196
hash: 64769
domain: newssystemcopilotdrivertresmil.ydns.eu
url: http://196.251.107.23
domain: ak1.xingxings2.cc
domain: birch.aurorafels.ru
url: http://still-man.tk/aye/index.php
domain: grat.aurorafels.ru
domain: wind.aurorafels.ru
domain: glade.aurorafels.ru
file: 155.102.132.57
hash: 4506
file: 171.105.25.168
hash: 10250
file: 3.30.169.188
hash: 443
file: 5.189.147.128
hash: 4567
domain: moor.copperalpen.ru
file: 107.173.171.200
hash: 443
file: 107.173.171.200
hash: 80
domain: bach.copperalpen.ru
domain: stern.copperalpen.ru
domain: adler.ravenkloster.ru
domain: turm.ravenkloster.ru
domain: pfad.ravenkloster.ru
domain: weide.ravenkloster.ru
domain: fels.glaciertal.ru
file: 149.88.81.215
hash: 81
file: 95.181.175.140
hash: 8082
domain: moor.glaciertal.ru
domain: wind.glaciertal.ru
domain: bach.glaciertal.ru
domain: hafen.glaciertal.ru
domain: brook.willowsteg.ru
file: 128.241.225.47
hash: 8082
domain: dune.willowsteg.ru
url: http://gitavatika.com/app/pl341/index.php
domain: stern.willowsteg.ru
domain: wolke.granitekamm.ru
domain: zorn.granitekamm.ru
domain: fluss.granitekamm.ru
domain: hammer.granitekamm.ru
domain: trail3.brimhopper.ru
domain: ku3.brimhopper.ru
domain: nova.brimhopper.ru
domain: cwv2t.s0larbudge.ru
domain: phase0.s0larbudge.ru
domain: mesh.s0larbudge.ru
file: 113.250.188.15
hash: 8077
domain: wepe.j1gglestone.ru
domain: cap.j1gglestone.ru
domain: sparkle6.j1gglestone.ru
domain: forge4.cl0udvex.ru
domain: blink.cl0udvex.ru
domain: hover.cl0udvex.ru
domain: switch.ventrill.ru

ThreatFox IOCs for 2025-11-15

Severity: medium

Type: malware

ThreatFox IOCs for 2025-11-15

Technical Summary

Potential Impact

Mitigation Recommendations

Affected Countries

Germany, France, United Kingdom, Netherlands, Italy

Indicators of Compromise

url: http://194.38.20.95/mono
url: http://194.38.20.95/1
url: http://194.38.20.95/2
url: http://194.38.20.95/xmr.exe
domain: leathes.qpon
domain: drugtrh.qpon
file: 213.209.143.34
hash: 3778
domain: aasdtvcvchcvhhhhh.com
url: https://aasdtvcvchcvhhhhh.com/ootot
domain: ldasldalsd.com
url: https://ldasldalsd.com/asgg.js
url: https://sistemdetect.com/client32.wav
domain: sistemdetect.com
url: https://uploadclient32.com/client32.wav
domain: uploadclient32.com
domain: bindlib.com
url: https://bindlib.com/xss/buf.js
url: https://bindlib.com/xss/index.php
file: 103.133.178.24
hash: 4782
file: 3.101.56.242
hash: 10002
file: 5.22.214.179
hash: 8000
file: 4.209.183.220
hash: 4321
file: 175.24.73.192
hash: 4321
domain: moor.saffronhafen.ru
domain: klee.saffronhafen.ru
domain: glut.saffronhafen.ru
domain: weald.saffronhafen.ru
domain: berg.graniteweide.ru
domain: strom.graniteweide.ru
domain: adler.graniteweide.ru
domain: pfad.onyxkamm.ru
domain: ufer.onyxkamm.ru
domain: licht.onyxkamm.ru
domain: schild.onyxkamm.ru
domain: dorn.onyxkamm.ru
domain: wald.quillgipfel.ru
domain: tau.quillgipfel.ru
domain: stein.quillgipfel.ru
domain: fluss.quillgipfel.ru
domain: farn.quillgipfel.ru
domain: rune.zephyrquelle.ru
domain: bach.zephyrquelle.ru
url: https://egyeditalpbetet.batz.hu/
url: https://verificationsbycapcha.center/
url: https://b.pendantkart.in/
domain: nebel.zephyrquelle.ru
domain: fjord.maplerand.ru
domain: kraut.maplerand.ru
domain: stern.maplerand.ru
domain: hain.maplerand.ru
domain: gleis.auroralinde.ru
domain: moos.auroralinde.ru
file: 87.120.93.66
hash: 443
file: 82.223.101.63
hash: 8808
file: 37.221.66.166
hash: 9000
file: 188.225.73.201
hash: 80
domain: weald.auroralinde.ru
domain: klee.tundragrund.ru
domain: licht.tundragrund.ru
domain: ufer.tundragrund.ru
domain: tau.tundragrund.ru
domain: kreis.tundragrund.ru
domain: falke.silvanbruch.ru
domain: zorn.silvanbruch.ru
url: https://91.212.166.51:443
url: https://194.28.225.230:443
url: https://147.45.197.92:443
url: https://94.228.161.88:443
url: https://77.239.121.3:443
url: https://77.239.120.249:443
url: https://84.201.4.120:443
url: https://206.245.157.177:443
url: https://172.245.112.202:443
url: https://poochse.qpon/api
domain: tal.silvanbruch.ru
domain: glanz.silvanbruch.ru
domain: eg-buzz.gl.at.ply.gg
file: 70.176.154.122
hash: 49971
domain: agosto13.con-ip.com
file: 166.117.156.6
hash: 21666
file: 91.92.243.183
hash: 1000
file: 68.183.159.114
hash: 443
file: 47.104.237.103
hash: 7777
file: 137.220.194.49
hash: 5555
file: 39.96.163.78
hash: 9999
url: https://digitalservice365cloud.com/richfamily/nfburmok45
url: https://mceenzie.sbs/richfamily/nfburmok45
domain: xsud.idealbros.com
domain: jet.idealbros.com
file: 64.188.66.7
hash: 25565
file: 195.200.17.158
hash: 8080
file: 198.98.51.203
hash: 8888
domain: mvu5.idealbros.com
file: 62.4.0.66
hash: 7443
file: 79.107.136.166
hash: 995
file: 94.49.199.72
hash: 443
domain: tap6.bestffriend.com
domain: pn.bestffriend.com
url: http://62.60.178.163/ce369e7324834845.php
url: http://62.60.226.248:5553/cb687a0a0c034c878a1d11f85d7e81d3_7065635553_build.bin
domain: echo5.bestffriend.com
domain: simmexcontrol.com
domain: x2n.bestffriend.com
domain: abstractoffieldtrialofblackgram.com
url: https://shift-art.com/123/cloudflare/verify/humanverfification/cloudflarechallenge/customerid37832738/
domain: adultgamesps4.com
domain: tsutsuifujiko.com
domain: delix.misecretaria.com.ar
domain: tap6.bestffriend.digital
domain: xshby.com
domain: bestmoneytree.com
domain: conqueringtheland.com
domain: beasteadyhand.org
domain: urbannewsnow.com
domain: pn.bestffriend.digital
domain: samleapp.com
domain: mondotalk.co.uk
domain: dnss.pro
domain: egao25.com
domain: gameofbones.net
domain: diamondmusicent.com.ng
domain: echo5.bestffriend.digital
domain: epfindiauan.com
domain: cargo.aquafex.in
domain: fuckrabbit.com
domain: flavorista.branding-bar.com
domain: tildotsignatures.com
domain: vibe.bestffriend.digital
domain: cptchdm.icu
domain: sleepkids.app
domain: archilabdesigns.com
domain: super.namatin.com
domain: pokkaloh.com
domain: x2n.bestffriend.digital
domain: q0ck.dripanchor.ru
domain: anchor.dripanchor.ru
domain: ac3d0ee370745f757.awsglobalaccelerator.com
domain: obte.dripanchor.ru
domain: kans.s1nkflare.ru
file: 82.156.235.177
hash: 8089
file: 77.90.185.30
hash: 80
file: 90.58.26.10
hash: 4040
file: 52.59.255.232
hash: 443
file: 164.90.131.243
hash: 7443
file: 71.71.132.141
hash: 8443
file: 142.90.219.232
hash: 8443
file: 138.197.58.180
hash: 3333
file: 198.211.102.142
hash: 443
file: 209.97.133.115
hash: 3333
file: 72.60.76.73
hash: 8443
domain: chromiumgo.bond
domain: drip2.s1nkflare.ru
file: 141.98.10.11
hash: 2113
domain: chroeminstant.com
domain: chromeupdate.download
domain: trace.s1nkflare.ru
domain: scramble3.orbitling.ru
domain: f3.orbitling.ru
domain: yspm.orbitling.ru
domain: 7uo.g0sslamp.ru
file: 47.118.83.147
hash: 80
file: 174.138.24.216
hash: 80
domain: tuesday-gamma.gl.at.ply.gg
domain: source-gtk.gl.at.ply.gg
domain: kamazec-35137.portmap.host
file: 185.243.96.19
hash: 443
domain: ezpz1.xyz
file: 144.31.90.139
hash: 9000
file: 102.117.163.144
hash: 7443
domain: center-lost.gl.at.ply.gg
domain: debt-apartment.gl.at.ply.gg
url: http://proproproaaa.fun
domain: lj.g0sslamp.ru
domain: 1ojva.g0sslamp.ru
domain: beacon1.kn1fecast.ru
domain: 35k.kn1fecast.ru
domain: kpow.kn1fecast.ru
domain: www.acd852.me
file: 45.200.17.43
hash: 8080
file: 45.200.17.43
hash: 8443
file: 87.120.93.66
hash: 80
domain: hover3.g-0-ss-lamp.ru
domain: ylr.g-0-ss-lamp.ru
domain: he2.g-0-ss-lamp.ru
domain: q9p4.meltquark.ru
domain: fvfsf.meltquark.ru
domain: e0.meltquark.ru
domain: ye.scramblehub.ru
domain: rah.scramblehub.ru
domain: pulse.scramblehub.ru
domain: 98.drip-anchor.ru
domain: ly.drip-anchor.ru
domain: flux.drip-anchor.ru
domain: ewgmd.patchvine.ru
domain: vale.patchvine.ru
domain: drs.patchvine.ru
domain: nd9eh.kn-1-fecast.ru
url: http://124.71.229.16:8888/supershell/login/
url: http://117.72.209.125:18888/supershell/login/
file: 117.72.209.125
hash: 18888
domain: l8lp.kn-1-fecast.ru
domain: spark8.kn-1-fecast.ru
domain: quark.waveretch.ru
domain: ieqs.waveretch.ru
url: http://8586.vercel.app/
url: http://ads-signal-core-point.pages.dev/appeal_form
url: http://ads-signal-core-point.pages.dev/welcome_to_meta_for_business
url: http://amazon-clone-project-alpha.vercel.app/
url: http://apollox-finance.gitbook.io/apollox-finance/welcome/trading-on-v1/wallet-connection
url: http://asjaga.github.io/amazon-clone
url: http://bdo-r5f.cc/ph
url: http://bhagirathsinhrana378.github.io/amazon_landing_page_clone
url: http://brandinless.com/admin/webmail/index2.html
url: http://buslink-nodehold.pages.dev/welcome_to_meta_for_business
url: http://campaign-data-control-hub.pages.dev/form_submit
url: http://cn.mcdvdh.com/
url: http://cvmsv.3656l.co/
url: http://data-center-bullying-impersonation.pages.dev/
url: http://data-center-compliance-harassment.pages.dev/
url: http://data-center-compliance-impersonation.pages.dev/
url: http://data-center-data-violation.pages.dev/
url: http://data-center-disablement-copyright.pages.dev/
url: http://data-center-disablement-strike.pages.dev/
url: http://data-center-evaluation-bullying.pages.dev/
url: http://data-center-evaluation-violence.pages.dev/
url: http://data-center-guideline-claim.pages.dev/
url: http://data-center-guideline-control.pages.dev/
url: http://data-center-harassment-transparency.pages.dev/
url: http://data-center-impersonation-privacy.pages.dev/
url: http://data-center-quality-bullying.pages.dev/
url: http://data-center-quality-compliance.pages.dev/
url: http://data-center-quality-standard.pages.dev/
url: http://data-center-quality-takedown.pages.dev/
url: http://data-center-reporting-policy.pages.dev/
url: http://data-center-reporting-takedown.pages.dev/
url: http://data-center-restriction-violence.pages.dev/
url: http://data-center-service-trademark.pages.dev/
url: http://data-center-strike-customer.pages.dev/
url: http://data-center-suspension-standard.pages.dev/
url: http://data-center-trademark-data.pages.dev/
url: http://data-center-transparency-support.pages.dev/
url: http://data-center-violence-guideline.pages.dev/
url: http://datashieldoz-cagid14z11-authguardex.pages.dev/
url: http://easybank-landing-page-master-lime.vercel.app/
url: http://eclipse-decipher.pages.dev/
url: http://f.digitalmaillane.com/igit/4/c44val3y16h930hs82yltjyp0kzec2yid7y54wyfsy8y1
url: http://incandescent-panda-e4a44a.netlify.app/
url: http://instagram-clone-brown-seven.vercel.app/
url: http://instagram-clone-gray-eight.vercel.app/
url: http://instagram-clone-lime-ten.vercel.app/
url: http://instagram-clone-teal-eight.vercel.app/
url: http://instagram-login-page-eight.vercel.app/
url: http://instagram-login-page-seven.vercel.app/
url: http://kucoinnlgoin.godaddysites.com/
url: http://kuconilogi-us.godaddysites.com/
url: http://m-mettamusklo.godaddysites.com/
url: http://meta-balir-syvon.pages.dev/
url: http://meta-borlivex.pages.dev/
url: http://meta-bralvistol.pages.dev/
url: http://meta-brysol-deron.pages.dev/
url: http://meta-cernivor.pages.dev/
url: http://meta-deepwell.pages.dev/
url: http://meta-delvindor.pages.dev/
url: http://meta-dyvox-belon.pages.dev/
url: http://meta-gornivex.pages.dev/
url: http://meta-hervinton.pages.dev/
url: http://meta-ilvixonar.pages.dev/
url: http://meta-jarin-melon.pages.dev/
url: http://meta-jonox-myral.pages.dev/
url: http://meta-juren-kryso.pages.dev/
url: http://meta-kornidex.pages.dev/
url: http://meta-kornivax.pages.dev/
url: http://meta-lirvandon.pages.dev/
url: http://meta-morvandar.pages.dev/
url: http://meta-nirvaxon.pages.dev/
url: http://meta-olrendix.pages.dev/
url: http://meta-olstavir.pages.dev/
url: http://meta-rosvinar.pages.dev/
url: http://meta-ulmarix.pages.dev/
url: http://meta-vornivon.pages.dev/
url: http://meta-xorvitel.pages.dev/
url: http://meta-yervaxin.pages.dev/
url: http://meta-yorvindal.pages.dev/
url: http://meta-zervalon.pages.dev/
url: http://methamskkloggeys.godaddysites.com/
url: http://mxx123.net/
url: http://mxx66.net/
url: http://opensea-six.vercel.app/
url: http://pay.mojdpd.si/payment/dpd2001/16952010327078
url: http://pay.mojdpd.si/payment/dpd2001/16962031288646
url: http://pay.mojdpd.si/payment/dpd2001/16962035153501
url: http://pay.mojdpd.si/payment/dpd2001/16992002029937
url: http://portal-smec.cloudevents.ai/
url: http://pub-4f9d90fc7af3453b8b1d803589a070ff.r2.dev/index.html
url: http://sage-node.pages.dev/
url: http://stellar-grove-guardian-signal-haven.pages.dev/
url: http://stone-brook.pages.dev/
url: http://tokevpocket.com/
url: http://vortex-labs-6r0.pages.dev/
url: http://vpass-jp.wkahl.cn/
url: http://welcomed-guardrails.weebly.com/
url: http://www.913789161621147280198065376576ipjpsvqgzrmxyey.adelon.com.br/
url: http://www.amazon-clone-dhoblesakshi19-gmailcoms-projects.vercel.app/
url: http://www.avibnb-xi.vercel.app/
url: https://gnarlus.qpon/api
url: http://www.cn-live-five.vercel.app/
url: http://www.cnnectsfinity.weebly.com/
url: http://www.entcusecures.vercel.app/
url: http://www.facebook-one-psi.vercel.app/
url: http://www.instagramvoting.weebly.com/
url: http://www.mail-supporto-tiscali.weebly.com/
url: http://www.mjunhgedbs.weebly.com/
url: http://www.my-online-web-site-capitalone-app.vercel.app/
url: http://www.p365666.com/
url: http://www.rbxdedw.vercel.app/
url: http://www.spotify-clone-iota-ashen.vercel.app/
url: http://www.useryttnbtntt.weebly.com/
url: http://www.wallet-connector-main.vercel.app/
url: http://www.welcomed-guardrails.weebly.com/
url: http://www.www-fifa22.com/
url: http://www3-vpass.pkbvi.cn/
url: http://zora-hold-3ue.pages.dev/
url: https://ai-robust.github.io/edu-test/
url: https://amazon-clone-dhoblesakshi19-gmailcoms-projects.vercel.app/
url: https://avibnb-xi.vercel.app/
url: https://b-12312.github.io/facebook-homepage/
url: https://bdo-r5f.cc/ph/
url: https://beautyworkid.com/m/user/assets
url: https://biolinky.co/homebtee
url: https://booking-checkinarrivale2.com/bnubxp5b
url: https://booking-checkinarrivale2.com/too62wbm
url: https://booking-checkinarrivale4.com/vnub7u3z
url: https://booking-checkinarrivale5.com/ltk41g7f
url: https://booking-checkinarrivale6.com/orj0m33n
url: https://bookingverifycenter.com/259385603850
url: https://bookingverifycenter.com/450971646948
url: https://case36842.agency-partner-apply.com/
url: https://case36862.agency-partner-apply.com/
url: https://clam-clam-79999.netlify.app/
url: https://cn.1mebetx.com/home/register?code=39593
url: https://cn.mbx800.net/home/register
url: https://cn.plhhovyj.com/home/register
url: https://data-center-bullying-messenger.pages.dev/
url: https://data-center-standard-messenger.pages.dev/
url: https://data-center-trademark-policy.pages.dev/
url: https://data-center-violation-transparency.pages.dev/
url: https://derfla.eu/mobile.de
url: https://durgeshdhakar5282.github.io/amazon_clone/
url: https://dusk-stream.pages.dev/
url: https://echo-stream.pages.dev/
url: https://facebook-one-psi.vercel.app/
url: https://hotelreservationverify.com/231180426913
url: https://hotelreservationverify.com/480855227260
url: https://hotelreservationverify.com/517622059912
url: https://hotelreservationverify.com/622573773337
url: https://jayanthisennaiyan.github.io/airbnb
url: https://kautilya-bhatt.github.io/amazon-clone/
url: https://loginform.co.in/
url: https://lost-glen.pages.dev/
url: https://mayank1174.github.io/website-demo/
url: https://meta-cascade-a0n.pages.dev/
url: https://meta-cynor-527.pages.dev/
domain: rift.waveretch.ru
url: https://meta-dorin-xylav.pages.dev/
url: https://meta-feros-nalon.pages.dev/
url: https://meta-hyron-lisav.pages.dev/
url: https://meta-hyrox-ferin.pages.dev/
url: https://meta-hyroz-feral.pages.dev/
url: https://meta-hytek-loran.pages.dev/
url: https://meta-hyven-ravil.pages.dev/
url: https://meta-jyson-raliv.pages.dev/
url: https://meta-jyxen-ferlo.pages.dev/
url: https://meta-kavon-girax.pages.dev/
url: https://meta-keru-vilon.pages.dev/
url: https://meta-kreva-hyson.pages.dev/
url: https://meta-lavex-tiron.pages.dev/
url: https://meta-lavon-vyrox.pages.dev/
url: https://meta-lenor-vysal.pages.dev/
url: https://meta-linox-syren.pages.dev/
url: https://meta-lixon-gavis.pages.dev/
url: https://meta-luren-syval.pages.dev/
url: https://meta-melon-hyrex.pages.dev/
url: https://meta-menra.pages.dev/
url: https://meta-miron-vyzel.pages.dev/
url: https://meta-monar-zenil.pages.dev/
url: https://meta-navor-girin.pages.dev/
url: https://meta-navor-lyzen.pages.dev/
url: https://meta-nyrex-feral.pages.dev/
url: https://meta-prilo-hyvox.pages.dev/
url: https://meta-pyrox-laven.pages.dev/
url: https://meta-runnel.pages.dev/
url: https://meta-salir-dynek.pages.dev/
url: https://meta-savin-4ur.pages.dev/
url: https://meta-sorin-wylar.pages.dev/
url: https://meta-synor-dravek.pages.dev/
url: https://meta-syren-tyrox.pages.dev/
url: https://meta-syvar-jonex.pages.dev/
url: https://meta-syver-halix.pages.dev/
url: https://meta-syvo-trenil.pages.dev/
url: https://meta-syvon-jarix.pages.dev/
url: https://meta-syxel-laven.pages.dev/
url: https://meta-telon-syrov.pages.dev/
url: https://meta-tovin-keral.pages.dev/
url: https://meta-trava-jorin.pages.dev/
url: https://meta-trivo-hylen.pages.dev/
url: https://meta-tylos-ferna.pages.dev/
url: https://meta-valex-nyron.pages.dev/
url: https://meta-voran-fylis.pages.dev/
url: https://meta-wylen-zelor.pages.dev/
url: https://meta-wylyn-marex.pages.dev/
url: https://meta-wyra-denox.pages.dev/
url: https://meta-wyrox-delor.pages.dev/
url: https://meta-wyson-kirel.pages.dev/
url: https://meta-wyvan-delin.pages.dev/
url: https://meta-wyxel-tyron.pages.dev/
url: https://meta-xarin-gelon.pages.dev/
url: https://meta-xavox-silur.pages.dev/
url: https://meta-xyver-lanin.pages.dev/
url: https://meta-zerin-hyrox.pages.dev/
url: https://midnight-bay.pages.dev/
url: https://midnight-stream.pages.dev/
url: https://misty-stream.pages.dev/
url: https://nhhkl.blogspot.al/
url: https://pending-guestf81553.com/twiz5x6i
url: https://pending-guetsf3306.com/a9umz5t1
url: https://pending-guetsf3306.com/wmdahzz2
url: https://polybutyleneflorida.com/blonew.html
url: https://quiet-hollow.pages.dev/
url: https://quiet-shore.pages.dev/
url: https://rbfcu-star.azurewebsites.net/(s(0rbofb3ohekmaspmljtz4b5i))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(1fzsbumnhccslx10cjnwynpe))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(1hlh5nwtq0elual41zjmkptt))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(1la1pww1gk5wnctkh0dvcom4))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(1tlcip53j5vtcmuyjbrtqyx2))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(23hmcxie24ni2j3kyco2yfg1))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(2fhgtlx5seoh2lyjcyfinri4))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(3e44k04iw3brusu2403vbin3))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(3swpzsjbzsiweems0irg0k2u))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(41fkds3ukfh5zx4on2cgv2ha))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(4piv1nr4otfxfhxzzuroda5h))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(5frfnrybykpdrla0rw3ryzza))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(ae5gmdnagiscsag15vinhudg))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(avq2rriit3y2hmaufkv4ry5q))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(bnbyxmupomxoqpsz3ahimrfe))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(brefrzka25qdess4ogkjmh2e))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(c3uqaewfwzhvtehoovctskfh))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(c4bwkalw4nkm1bxthe3hnac4))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(ce5a235v102neg1zknsjj2gn))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(cg5wb5413bjco1ao54jimbpn))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(csfvbcakpmfsmenq3j0popow))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(dtzhqgf2vd4gwhazgmcdyqlm))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(e0hzd05n4clwsu5h4w2htgo5))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(fckxdbrw0b2oyfdvippwzk1z))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(gg5dfy0q5rxfp2rz50ruhu21))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(h2tuyfx5mj4hzjau3h2irzdd))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(hflmi2iwg5ub02dnwypvmusz))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(i0macwkjsn15v4lo2ezs2x2g))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(ifd4kq1d5u51arg2tojabfrw))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(iixdxoj43elhgr1z5omkxpi2))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(iwan3piuixrx0td0o5uzuo0y))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(jf51v4b5o2gtc1uc4h3vpx1r))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(joo1hcvva3slsowsu5upfoku))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(koapmn1nntn1tspjfocfuflb))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(lmbjs1v3xitrvkcdwipdjkt4))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(m3o4v4xbq5yc1jnzetfgzixk))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(m4twevmtbrfyaxsehe0f2fs5))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(npugcaao2qqilpl4alhqeddo))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(o30wa23bs3k4ejfi2w0kre5p))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(ohpplrvzboydkzubks52lmib))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(r5c5hwp4kicjprur0ogorsys))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(ts2wcvwvcsrngd2glncksg4x))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(u4kc33f5s2jjpzyjx01bzhdr))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(uevuwkovv5linwr4yfbdmae4))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(uql0ar1ylg5axckio1gvhqvr))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(veudvc3ghwn0v2e1pgruzxj4))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(w2bnk4jkbraeb3hyilglmtul))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(w554kmwssy3mg3givk2cgz0w))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(wajqa1j2spmze4gyhqauglpy))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(x5yhoigyci0byfmoprrgaziw))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(xvytimsgxgs2ybtcy55sjpya))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(yqrwx05isais24tbhwi5fhoi))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(z41okpc51grzf2mcrtfpwqjt))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(ziaekhg144rqr3lkfaucrsi0))/main/login
url: https://rbfcu-star.azurewebsites.net/(s(ztwvisgd1fmx3sgxi1esa2sp))/main/login
url: https://silver-bay.pages.dev/
url: https://site-h1gzufxrm.godaddysites.com/
url: https://site-q91z6r31h.godaddysites.com/
url: https://spotify-clone-iota-ashen.vercel.app/
url: https://timber-ridge.pages.dev/
url: https://v-vpass-jp.foryongroup.com/
url: https://vpass-jp.fnloa.cn/
url: https://vpass-jp.ifffz.cn/
url: https://vpass-jp.puqcf.cn/
url: https://vpass-jp.uuzuf.cn/
url: https://wallet-connector-main.vercel.app/
url: https://www.easy-bank-landing-page-pi.vercel.app/
url: https://www.rectification-service.vercel.app/
url: https://www.tutanakhukukdava.org/
url: https://www3-vpass.bpcot.cn/
url: https://www3-vpass.ernlp.cn/
url: https://www3-vpass.fpbrg.cn/
url: https://www3-vpass.fxxgh.cn/
url: https://www3-vpass.laihuikuaiche.com/
url: https://www3-vpass.pmllo.cn/
domain: wolke.stormlaterne.ru
domain: glanz.stormlaterne.ru
file: 43.173.118.80
hash: 443
file: 42.125.196.173
hash: 2404
file: 164.90.136.126
hash: 80
file: 64.176.179.199
hash: 7443
file: 8.215.50.80
hash: 7443
file: 160.178.221.129
hash: 2222
domain: bach.stormlaterne.ru
domain: tau.stormlaterne.ru
domain: moor.emberhochland.ru
domain: stern.emberhochland.ru
domain: rune.emberhochland.ru
domain: weald.emberhochland.ru
domain: korn.emberhochland.ru
domain: pfad.quartzfeder.ru
domain: kamm.quartzfeder.ru
domain: nebel.quartzfeder.ru
domain: nacht.midnightkiefer.ru
domain: wald.midnightkiefer.ru
domain: rune.midnightkiefer.ru
domain: falke.midnightkiefer.ru
domain: dorn.midnightkiefer.ru
domain: archive-medical.gl.at.ply.gg
file: 64.188.66.196
hash: 64769
domain: newssystemcopilotdrivertresmil.ydns.eu
url: http://196.251.107.23
domain: ak1.xingxings2.cc
domain: birch.aurorafels.ru
url: http://still-man.tk/aye/index.php
domain: grat.aurorafels.ru
domain: wind.aurorafels.ru
domain: glade.aurorafels.ru
file: 155.102.132.57
hash: 4506
file: 171.105.25.168
hash: 10250
file: 3.30.169.188
hash: 443
file: 5.189.147.128
hash: 4567
domain: moor.copperalpen.ru
file: 107.173.171.200
hash: 443
file: 107.173.171.200
hash: 80
domain: bach.copperalpen.ru
domain: stern.copperalpen.ru
domain: adler.ravenkloster.ru
domain: turm.ravenkloster.ru
domain: pfad.ravenkloster.ru
domain: weide.ravenkloster.ru
domain: fels.glaciertal.ru
file: 149.88.81.215
hash: 81
file: 95.181.175.140
hash: 8082
domain: moor.glaciertal.ru
domain: wind.glaciertal.ru
domain: bach.glaciertal.ru
domain: hafen.glaciertal.ru
domain: brook.willowsteg.ru
file: 128.241.225.47
hash: 8082
domain: dune.willowsteg.ru
url: http://gitavatika.com/app/pl341/index.php
domain: stern.willowsteg.ru
domain: wolke.granitekamm.ru
domain: zorn.granitekamm.ru
domain: fluss.granitekamm.ru
domain: hammer.granitekamm.ru
domain: trail3.brimhopper.ru
domain: ku3.brimhopper.ru
domain: nova.brimhopper.ru
domain: cwv2t.s0larbudge.ru
domain: phase0.s0larbudge.ru
domain: mesh.s0larbudge.ru
file: 113.250.188.15
hash: 8077
domain: wepe.j1gglestone.ru
domain: cap.j1gglestone.ru
domain: sparkle6.j1gglestone.ru
domain: forge4.cl0udvex.ru
domain: blink.cl0udvex.ru
domain: hover.cl0udvex.ru
domain: switch.ventrill.ru

Source: ThreatFox MISP Feed

Published: Sat Nov 15 2025

ThreatFox IOCs for 2025-11-15

Medium

Malwaretype:osint tlp:white

Published: Sat Nov 15 2025 (11/15/2025, 00:00:00 UTC)

Source: ThreatFox MISP Feed

Vendor/Project: type

Product: osint

Description

ThreatFox IOCs for 2025-11-15

AI-Powered Analysis

AILast updated: 11/16/2025, 00:10:10 UTC

Technical Analysis

Potential Impact

Mitigation Recommendations

Affected Countries

Need more detailed analysis?Get Pro

Pro Feature

For access to advanced analysis and higher rate limits, contact root@offseq.com

Technical Details

Threat Level: 2
Analysis: 1
Distribution: 3
Uuid: 5e928dad-e010-4d89-bffe-fca23356ec03
Original Timestamp: 1763251386

Indicators of Compromise

Url

Value	Description	Copy
urlhttp://194.38.20.95/mono	Phorpiex payload delivery URL (confidence level: 100%)
urlhttp://194.38.20.95/1	Phorpiex payload delivery URL (confidence level: 100%)
urlhttp://194.38.20.95/2	Phorpiex payload delivery URL (confidence level: 100%)
urlhttp://194.38.20.95/xmr.exe	Phorpiex payload delivery URL (confidence level: 100%)
urlhttps://aasdtvcvchcvhhhhh.com/ootot	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://ldasldalsd.com/asgg.js	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://sistemdetect.com/client32.wav	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://uploadclient32.com/client32.wav	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://bindlib.com/xss/buf.js	NetSupportManager RAT payload delivery URL (confidence level: 100%)
urlhttps://bindlib.com/xss/index.php	NetSupportManager RAT payload delivery URL (confidence level: 100%)
urlhttps://egyeditalpbetet.batz.hu/	Unknown malware payload delivery URL (confidence level: 90%)
urlhttps://verificationsbycapcha.center/	Unknown malware payload delivery URL (confidence level: 90%)
urlhttps://b.pendantkart.in/	Unknown malware payload delivery URL (confidence level: 90%)
urlhttps://91.212.166.51:443	GhostSocks botnet C2 (confidence level: 100%)
urlhttps://194.28.225.230:443	GhostSocks botnet C2 (confidence level: 100%)
urlhttps://147.45.197.92:443	GhostSocks botnet C2 (confidence level: 100%)
urlhttps://94.228.161.88:443	GhostSocks botnet C2 (confidence level: 100%)
urlhttps://77.239.121.3:443	GhostSocks botnet C2 (confidence level: 100%)
urlhttps://77.239.120.249:443	GhostSocks botnet C2 (confidence level: 100%)
urlhttps://84.201.4.120:443	GhostSocks botnet C2 (confidence level: 100%)
urlhttps://206.245.157.177:443	GhostSocks botnet C2 (confidence level: 100%)
urlhttps://172.245.112.202:443	GhostSocks botnet C2 (confidence level: 100%)
urlhttps://poochse.qpon/api	Lumma Stealer botnet C2 (confidence level: 75%)
urlhttps://digitalservice365cloud.com/richfamily/nfburmok45	Unknown Stealer botnet C2 (confidence level: 100%)
urlhttps://mceenzie.sbs/richfamily/nfburmok45	Unknown Stealer botnet C2 (confidence level: 100%)
urlhttp://62.60.178.163/ce369e7324834845.php	Stealc botnet C2 (confidence level: 100%)
urlhttp://62.60.226.248:5553/cb687a0a0c034c878a1d11f85d7e81d3_7065635553_build.bin	Stealc payload delivery URL (confidence level: 100%)
urlhttps://shift-art.com/123/cloudflare/verify/humanverfification/cloudflarechallenge/customerid37832738/	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://proproproaaa.fun	Stealc botnet C2 (confidence level: 100%)
urlhttp://124.71.229.16:8888/supershell/login/	Unknown malware botnet C2 (confidence level: 100%)
urlhttp://117.72.209.125:18888/supershell/login/	Unknown malware botnet C2 (confidence level: 100%)
urlhttp://8586.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttp://ads-signal-core-point.pages.dev/appeal_form	magecart payload delivery URL (confidence level: 50%)
urlhttp://ads-signal-core-point.pages.dev/welcome_to_meta_for_business	magecart payload delivery URL (confidence level: 50%)
urlhttp://amazon-clone-project-alpha.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttp://apollox-finance.gitbook.io/apollox-finance/welcome/trading-on-v1/wallet-connection	magecart payload delivery URL (confidence level: 50%)
urlhttp://asjaga.github.io/amazon-clone	magecart payload delivery URL (confidence level: 50%)
urlhttp://bdo-r5f.cc/ph	magecart payload delivery URL (confidence level: 50%)
urlhttp://bhagirathsinhrana378.github.io/amazon_landing_page_clone	magecart payload delivery URL (confidence level: 50%)
urlhttp://brandinless.com/admin/webmail/index2.html	magecart payload delivery URL (confidence level: 50%)
urlhttp://buslink-nodehold.pages.dev/welcome_to_meta_for_business	magecart payload delivery URL (confidence level: 50%)
urlhttp://campaign-data-control-hub.pages.dev/form_submit	magecart payload delivery URL (confidence level: 50%)
urlhttp://cn.mcdvdh.com/	magecart payload delivery URL (confidence level: 50%)
urlhttp://cvmsv.3656l.co/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-bullying-impersonation.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-compliance-harassment.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-compliance-impersonation.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-data-violation.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-disablement-copyright.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-disablement-strike.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-evaluation-bullying.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-evaluation-violence.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-guideline-claim.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-guideline-control.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-harassment-transparency.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-impersonation-privacy.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-quality-bullying.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-quality-compliance.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-quality-standard.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-quality-takedown.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-reporting-policy.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-reporting-takedown.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-restriction-violence.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-service-trademark.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-strike-customer.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-suspension-standard.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-trademark-data.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-transparency-support.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://data-center-violence-guideline.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://datashieldoz-cagid14z11-authguardex.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://easybank-landing-page-master-lime.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttp://eclipse-decipher.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://f.digitalmaillane.com/igit/4/c44val3y16h930hs82yltjyp0kzec2yid7y54wyfsy8y1	magecart payload delivery URL (confidence level: 50%)
urlhttp://incandescent-panda-e4a44a.netlify.app/	magecart payload delivery URL (confidence level: 50%)
urlhttp://instagram-clone-brown-seven.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttp://instagram-clone-gray-eight.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttp://instagram-clone-lime-ten.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttp://instagram-clone-teal-eight.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttp://instagram-login-page-eight.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttp://instagram-login-page-seven.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttp://kucoinnlgoin.godaddysites.com/	magecart payload delivery URL (confidence level: 50%)
urlhttp://kuconilogi-us.godaddysites.com/	magecart payload delivery URL (confidence level: 50%)
urlhttp://m-mettamusklo.godaddysites.com/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-balir-syvon.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-borlivex.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-bralvistol.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-brysol-deron.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-cernivor.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-deepwell.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-delvindor.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-dyvox-belon.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-gornivex.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-hervinton.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-ilvixonar.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-jarin-melon.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-jonox-myral.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-juren-kryso.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-kornidex.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-kornivax.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-lirvandon.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-morvandar.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-nirvaxon.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-olrendix.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-olstavir.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-rosvinar.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-ulmarix.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-vornivon.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-xorvitel.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-yervaxin.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-yorvindal.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://meta-zervalon.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://methamskkloggeys.godaddysites.com/	magecart payload delivery URL (confidence level: 50%)
urlhttp://mxx123.net/	magecart payload delivery URL (confidence level: 50%)
urlhttp://mxx66.net/	magecart payload delivery URL (confidence level: 50%)
urlhttp://opensea-six.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttp://pay.mojdpd.si/payment/dpd2001/16952010327078	magecart payload delivery URL (confidence level: 50%)
urlhttp://pay.mojdpd.si/payment/dpd2001/16962031288646	magecart payload delivery URL (confidence level: 50%)
urlhttp://pay.mojdpd.si/payment/dpd2001/16962035153501	magecart payload delivery URL (confidence level: 50%)
urlhttp://pay.mojdpd.si/payment/dpd2001/16992002029937	magecart payload delivery URL (confidence level: 50%)
urlhttp://portal-smec.cloudevents.ai/	magecart payload delivery URL (confidence level: 50%)
urlhttp://pub-4f9d90fc7af3453b8b1d803589a070ff.r2.dev/index.html	magecart payload delivery URL (confidence level: 50%)
urlhttp://sage-node.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://stellar-grove-guardian-signal-haven.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://stone-brook.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://tokevpocket.com/	magecart payload delivery URL (confidence level: 50%)
urlhttp://vortex-labs-6r0.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttp://vpass-jp.wkahl.cn/	magecart payload delivery URL (confidence level: 50%)
urlhttp://welcomed-guardrails.weebly.com/	magecart payload delivery URL (confidence level: 50%)
urlhttp://www.913789161621147280198065376576ipjpsvqgzrmxyey.adelon.com.br/	magecart payload delivery URL (confidence level: 50%)
urlhttp://www.amazon-clone-dhoblesakshi19-gmailcoms-projects.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttp://www.avibnb-xi.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttps://gnarlus.qpon/api	Lumma Stealer botnet C2 (confidence level: 75%)
urlhttp://www.cn-live-five.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttp://www.cnnectsfinity.weebly.com/	magecart payload delivery URL (confidence level: 50%)
urlhttp://www.entcusecures.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttp://www.facebook-one-psi.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttp://www.instagramvoting.weebly.com/	magecart payload delivery URL (confidence level: 50%)
urlhttp://www.mail-supporto-tiscali.weebly.com/	magecart payload delivery URL (confidence level: 50%)
urlhttp://www.mjunhgedbs.weebly.com/	magecart payload delivery URL (confidence level: 50%)
urlhttp://www.my-online-web-site-capitalone-app.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttp://www.p365666.com/	magecart payload delivery URL (confidence level: 50%)
urlhttp://www.rbxdedw.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttp://www.spotify-clone-iota-ashen.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttp://www.useryttnbtntt.weebly.com/	magecart payload delivery URL (confidence level: 50%)
urlhttp://www.wallet-connector-main.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttp://www.welcomed-guardrails.weebly.com/	magecart payload delivery URL (confidence level: 50%)
urlhttp://www.www-fifa22.com/	magecart payload delivery URL (confidence level: 50%)
urlhttp://www3-vpass.pkbvi.cn/	magecart payload delivery URL (confidence level: 50%)
urlhttp://zora-hold-3ue.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://ai-robust.github.io/edu-test/	magecart payload delivery URL (confidence level: 50%)
urlhttps://amazon-clone-dhoblesakshi19-gmailcoms-projects.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttps://avibnb-xi.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttps://b-12312.github.io/facebook-homepage/	magecart payload delivery URL (confidence level: 50%)
urlhttps://bdo-r5f.cc/ph/	magecart payload delivery URL (confidence level: 50%)
urlhttps://beautyworkid.com/m/user/assets	magecart payload delivery URL (confidence level: 50%)
urlhttps://biolinky.co/homebtee	magecart payload delivery URL (confidence level: 50%)
urlhttps://booking-checkinarrivale2.com/bnubxp5b	magecart payload delivery URL (confidence level: 50%)
urlhttps://booking-checkinarrivale2.com/too62wbm	magecart payload delivery URL (confidence level: 50%)
urlhttps://booking-checkinarrivale4.com/vnub7u3z	magecart payload delivery URL (confidence level: 50%)
urlhttps://booking-checkinarrivale5.com/ltk41g7f	magecart payload delivery URL (confidence level: 50%)
urlhttps://booking-checkinarrivale6.com/orj0m33n	magecart payload delivery URL (confidence level: 50%)
urlhttps://bookingverifycenter.com/259385603850	magecart payload delivery URL (confidence level: 50%)
urlhttps://bookingverifycenter.com/450971646948	magecart payload delivery URL (confidence level: 50%)
urlhttps://case36842.agency-partner-apply.com/	magecart payload delivery URL (confidence level: 50%)
urlhttps://case36862.agency-partner-apply.com/	magecart payload delivery URL (confidence level: 50%)
urlhttps://clam-clam-79999.netlify.app/	magecart payload delivery URL (confidence level: 50%)
urlhttps://cn.1mebetx.com/home/register?code=39593	magecart payload delivery URL (confidence level: 50%)
urlhttps://cn.mbx800.net/home/register	magecart payload delivery URL (confidence level: 50%)
urlhttps://cn.plhhovyj.com/home/register	magecart payload delivery URL (confidence level: 50%)
urlhttps://data-center-bullying-messenger.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://data-center-standard-messenger.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://data-center-trademark-policy.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://data-center-violation-transparency.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://derfla.eu/mobile.de	magecart payload delivery URL (confidence level: 50%)
urlhttps://durgeshdhakar5282.github.io/amazon_clone/	magecart payload delivery URL (confidence level: 50%)
urlhttps://dusk-stream.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://echo-stream.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://facebook-one-psi.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttps://hotelreservationverify.com/231180426913	magecart payload delivery URL (confidence level: 50%)
urlhttps://hotelreservationverify.com/480855227260	magecart payload delivery URL (confidence level: 50%)
urlhttps://hotelreservationverify.com/517622059912	magecart payload delivery URL (confidence level: 50%)
urlhttps://hotelreservationverify.com/622573773337	magecart payload delivery URL (confidence level: 50%)
urlhttps://jayanthisennaiyan.github.io/airbnb	magecart payload delivery URL (confidence level: 50%)
urlhttps://kautilya-bhatt.github.io/amazon-clone/	magecart payload delivery URL (confidence level: 50%)
urlhttps://loginform.co.in/	magecart payload delivery URL (confidence level: 50%)
urlhttps://lost-glen.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://mayank1174.github.io/website-demo/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-cascade-a0n.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-cynor-527.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-dorin-xylav.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-feros-nalon.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-hyron-lisav.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-hyrox-ferin.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-hyroz-feral.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-hytek-loran.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-hyven-ravil.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-jyson-raliv.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-jyxen-ferlo.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-kavon-girax.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-keru-vilon.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-kreva-hyson.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-lavex-tiron.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-lavon-vyrox.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-lenor-vysal.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-linox-syren.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-lixon-gavis.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-luren-syval.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-melon-hyrex.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-menra.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-miron-vyzel.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-monar-zenil.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-navor-girin.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-navor-lyzen.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-nyrex-feral.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-prilo-hyvox.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-pyrox-laven.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-runnel.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-salir-dynek.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-savin-4ur.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-sorin-wylar.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-synor-dravek.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-syren-tyrox.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-syvar-jonex.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-syver-halix.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-syvo-trenil.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-syvon-jarix.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-syxel-laven.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-telon-syrov.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-tovin-keral.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-trava-jorin.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-trivo-hylen.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-tylos-ferna.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-valex-nyron.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-voran-fylis.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-wylen-zelor.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-wylyn-marex.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-wyra-denox.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-wyrox-delor.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-wyson-kirel.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-wyvan-delin.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-wyxel-tyron.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-xarin-gelon.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-xavox-silur.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-xyver-lanin.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://meta-zerin-hyrox.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://midnight-bay.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://midnight-stream.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://misty-stream.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://nhhkl.blogspot.al/	magecart payload delivery URL (confidence level: 50%)
urlhttps://pending-guestf81553.com/twiz5x6i	magecart payload delivery URL (confidence level: 50%)
urlhttps://pending-guetsf3306.com/a9umz5t1	magecart payload delivery URL (confidence level: 50%)
urlhttps://pending-guetsf3306.com/wmdahzz2	magecart payload delivery URL (confidence level: 50%)
urlhttps://polybutyleneflorida.com/blonew.html	magecart payload delivery URL (confidence level: 50%)
urlhttps://quiet-hollow.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://quiet-shore.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(0rbofb3ohekmaspmljtz4b5i))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(1fzsbumnhccslx10cjnwynpe))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(1hlh5nwtq0elual41zjmkptt))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(1la1pww1gk5wnctkh0dvcom4))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(1tlcip53j5vtcmuyjbrtqyx2))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(23hmcxie24ni2j3kyco2yfg1))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(2fhgtlx5seoh2lyjcyfinri4))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(3e44k04iw3brusu2403vbin3))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(3swpzsjbzsiweems0irg0k2u))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(41fkds3ukfh5zx4on2cgv2ha))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(4piv1nr4otfxfhxzzuroda5h))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(5frfnrybykpdrla0rw3ryzza))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(ae5gmdnagiscsag15vinhudg))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(avq2rriit3y2hmaufkv4ry5q))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(bnbyxmupomxoqpsz3ahimrfe))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(brefrzka25qdess4ogkjmh2e))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(c3uqaewfwzhvtehoovctskfh))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(c4bwkalw4nkm1bxthe3hnac4))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(ce5a235v102neg1zknsjj2gn))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(cg5wb5413bjco1ao54jimbpn))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(csfvbcakpmfsmenq3j0popow))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(dtzhqgf2vd4gwhazgmcdyqlm))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(e0hzd05n4clwsu5h4w2htgo5))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(fckxdbrw0b2oyfdvippwzk1z))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(gg5dfy0q5rxfp2rz50ruhu21))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(h2tuyfx5mj4hzjau3h2irzdd))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(hflmi2iwg5ub02dnwypvmusz))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(i0macwkjsn15v4lo2ezs2x2g))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(ifd4kq1d5u51arg2tojabfrw))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(iixdxoj43elhgr1z5omkxpi2))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(iwan3piuixrx0td0o5uzuo0y))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(jf51v4b5o2gtc1uc4h3vpx1r))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(joo1hcvva3slsowsu5upfoku))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(koapmn1nntn1tspjfocfuflb))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(lmbjs1v3xitrvkcdwipdjkt4))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(m3o4v4xbq5yc1jnzetfgzixk))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(m4twevmtbrfyaxsehe0f2fs5))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(npugcaao2qqilpl4alhqeddo))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(o30wa23bs3k4ejfi2w0kre5p))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(ohpplrvzboydkzubks52lmib))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(r5c5hwp4kicjprur0ogorsys))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(ts2wcvwvcsrngd2glncksg4x))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(u4kc33f5s2jjpzyjx01bzhdr))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(uevuwkovv5linwr4yfbdmae4))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(uql0ar1ylg5axckio1gvhqvr))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(veudvc3ghwn0v2e1pgruzxj4))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(w2bnk4jkbraeb3hyilglmtul))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(w554kmwssy3mg3givk2cgz0w))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(wajqa1j2spmze4gyhqauglpy))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(x5yhoigyci0byfmoprrgaziw))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(xvytimsgxgs2ybtcy55sjpya))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(yqrwx05isais24tbhwi5fhoi))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(z41okpc51grzf2mcrtfpwqjt))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(ziaekhg144rqr3lkfaucrsi0))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://rbfcu-star.azurewebsites.net/(s(ztwvisgd1fmx3sgxi1esa2sp))/main/login	magecart payload delivery URL (confidence level: 50%)
urlhttps://silver-bay.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://site-h1gzufxrm.godaddysites.com/	magecart payload delivery URL (confidence level: 50%)
urlhttps://site-q91z6r31h.godaddysites.com/	magecart payload delivery URL (confidence level: 50%)
urlhttps://spotify-clone-iota-ashen.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttps://timber-ridge.pages.dev/	magecart payload delivery URL (confidence level: 50%)
urlhttps://v-vpass-jp.foryongroup.com/	magecart payload delivery URL (confidence level: 50%)
urlhttps://vpass-jp.fnloa.cn/	magecart payload delivery URL (confidence level: 50%)
urlhttps://vpass-jp.ifffz.cn/	magecart payload delivery URL (confidence level: 50%)
urlhttps://vpass-jp.puqcf.cn/	magecart payload delivery URL (confidence level: 50%)
urlhttps://vpass-jp.uuzuf.cn/	magecart payload delivery URL (confidence level: 50%)
urlhttps://wallet-connector-main.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttps://www.easy-bank-landing-page-pi.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttps://www.rectification-service.vercel.app/	magecart payload delivery URL (confidence level: 50%)
urlhttps://www.tutanakhukukdava.org/	magecart payload delivery URL (confidence level: 50%)
urlhttps://www3-vpass.bpcot.cn/	magecart payload delivery URL (confidence level: 50%)
urlhttps://www3-vpass.ernlp.cn/	magecart payload delivery URL (confidence level: 50%)
urlhttps://www3-vpass.fpbrg.cn/	magecart payload delivery URL (confidence level: 50%)
urlhttps://www3-vpass.fxxgh.cn/	magecart payload delivery URL (confidence level: 50%)
urlhttps://www3-vpass.laihuikuaiche.com/	magecart payload delivery URL (confidence level: 50%)
urlhttps://www3-vpass.pmllo.cn/	magecart payload delivery URL (confidence level: 50%)
urlhttp://196.251.107.23	Stealc botnet C2 (confidence level: 100%)
urlhttp://still-man.tk/aye/index.php	Azorult botnet C2 (confidence level: 100%)
urlhttp://gitavatika.com/app/pl341/index.php	Azorult botnet C2 (confidence level: 100%)

Domain

Value	Description	Copy
domainleathes.qpon	Lumma Stealer botnet C2 domain (confidence level: 100%)
domaindrugtrh.qpon	Lumma Stealer botnet C2 domain (confidence level: 100%)
domainaasdtvcvchcvhhhhh.com	Unknown malware payload delivery domain (confidence level: 100%)
domainldasldalsd.com	Unknown malware payload delivery domain (confidence level: 100%)
domainsistemdetect.com	Unknown malware payload delivery domain (confidence level: 100%)
domainuploadclient32.com	Unknown malware payload delivery domain (confidence level: 100%)
domainbindlib.com	NetSupportManager RAT payload delivery domain (confidence level: 100%)
domainmoor.saffronhafen.ru	ClearFake payload delivery domain (confidence level: 100%)
domainklee.saffronhafen.ru	ClearFake payload delivery domain (confidence level: 100%)
domainglut.saffronhafen.ru	ClearFake payload delivery domain (confidence level: 100%)
domainweald.saffronhafen.ru	ClearFake payload delivery domain (confidence level: 100%)
domainberg.graniteweide.ru	ClearFake payload delivery domain (confidence level: 100%)
domainstrom.graniteweide.ru	ClearFake payload delivery domain (confidence level: 100%)
domainadler.graniteweide.ru	ClearFake payload delivery domain (confidence level: 100%)
domainpfad.onyxkamm.ru	ClearFake payload delivery domain (confidence level: 100%)
domainufer.onyxkamm.ru	ClearFake payload delivery domain (confidence level: 100%)
domainlicht.onyxkamm.ru	ClearFake payload delivery domain (confidence level: 100%)
domainschild.onyxkamm.ru	ClearFake payload delivery domain (confidence level: 100%)
domaindorn.onyxkamm.ru	ClearFake payload delivery domain (confidence level: 100%)
domainwald.quillgipfel.ru	ClearFake payload delivery domain (confidence level: 100%)
domaintau.quillgipfel.ru	ClearFake payload delivery domain (confidence level: 100%)
domainstein.quillgipfel.ru	ClearFake payload delivery domain (confidence level: 100%)
domainfluss.quillgipfel.ru	ClearFake payload delivery domain (confidence level: 100%)
domainfarn.quillgipfel.ru	ClearFake payload delivery domain (confidence level: 100%)
domainrune.zephyrquelle.ru	ClearFake payload delivery domain (confidence level: 100%)
domainbach.zephyrquelle.ru	ClearFake payload delivery domain (confidence level: 100%)
domainnebel.zephyrquelle.ru	ClearFake payload delivery domain (confidence level: 100%)
domainfjord.maplerand.ru	ClearFake payload delivery domain (confidence level: 100%)
domainkraut.maplerand.ru	ClearFake payload delivery domain (confidence level: 100%)
domainstern.maplerand.ru	ClearFake payload delivery domain (confidence level: 100%)
domainhain.maplerand.ru	ClearFake payload delivery domain (confidence level: 100%)
domaingleis.auroralinde.ru	ClearFake payload delivery domain (confidence level: 100%)
domainmoos.auroralinde.ru	ClearFake payload delivery domain (confidence level: 100%)
domainweald.auroralinde.ru	ClearFake payload delivery domain (confidence level: 100%)
domainklee.tundragrund.ru	ClearFake payload delivery domain (confidence level: 100%)
domainlicht.tundragrund.ru	ClearFake payload delivery domain (confidence level: 100%)
domainufer.tundragrund.ru	ClearFake payload delivery domain (confidence level: 100%)
domaintau.tundragrund.ru	ClearFake payload delivery domain (confidence level: 100%)
domainkreis.tundragrund.ru	ClearFake payload delivery domain (confidence level: 100%)
domainfalke.silvanbruch.ru	ClearFake payload delivery domain (confidence level: 100%)
domainzorn.silvanbruch.ru	ClearFake payload delivery domain (confidence level: 100%)
domaintal.silvanbruch.ru	ClearFake payload delivery domain (confidence level: 100%)
domainglanz.silvanbruch.ru	ClearFake payload delivery domain (confidence level: 100%)
domaineg-buzz.gl.at.ply.gg	XWorm botnet C2 domain (confidence level: 100%)
domainagosto13.con-ip.com	Remcos botnet C2 domain (confidence level: 100%)
domainxsud.idealbros.com	ClearFake payload delivery domain (confidence level: 100%)
domainjet.idealbros.com	ClearFake payload delivery domain (confidence level: 100%)
domainmvu5.idealbros.com	ClearFake payload delivery domain (confidence level: 100%)
domaintap6.bestffriend.com	ClearFake payload delivery domain (confidence level: 100%)
domainpn.bestffriend.com	ClearFake payload delivery domain (confidence level: 100%)
domainecho5.bestffriend.com	ClearFake payload delivery domain (confidence level: 100%)
domainsimmexcontrol.com	Unknown malware payload delivery domain (confidence level: 100%)
domainx2n.bestffriend.com	ClearFake payload delivery domain (confidence level: 100%)
domainabstractoffieldtrialofblackgram.com	Unknown malware payload delivery domain (confidence level: 100%)
domainadultgamesps4.com	Unknown malware payload delivery domain (confidence level: 100%)
domaintsutsuifujiko.com	Unknown malware payload delivery domain (confidence level: 100%)
domaindelix.misecretaria.com.ar	Unknown malware payload delivery domain (confidence level: 100%)
domaintap6.bestffriend.digital	ClearFake payload delivery domain (confidence level: 100%)
domainxshby.com	Unknown malware payload delivery domain (confidence level: 100%)
domainbestmoneytree.com	Unknown malware payload delivery domain (confidence level: 100%)
domainconqueringtheland.com	Unknown malware payload delivery domain (confidence level: 100%)
domainbeasteadyhand.org	Unknown malware payload delivery domain (confidence level: 100%)
domainurbannewsnow.com	Unknown malware payload delivery domain (confidence level: 100%)
domainpn.bestffriend.digital	ClearFake payload delivery domain (confidence level: 100%)
domainsamleapp.com	Unknown malware payload delivery domain (confidence level: 100%)
domainmondotalk.co.uk	Unknown malware payload delivery domain (confidence level: 100%)
domaindnss.pro	Unknown malware payload delivery domain (confidence level: 100%)
domainegao25.com	Unknown malware payload delivery domain (confidence level: 100%)
domaingameofbones.net	Unknown malware payload delivery domain (confidence level: 100%)
domaindiamondmusicent.com.ng	Unknown malware payload delivery domain (confidence level: 100%)
domainecho5.bestffriend.digital	ClearFake payload delivery domain (confidence level: 100%)
domainepfindiauan.com	Unknown malware payload delivery domain (confidence level: 100%)
domaincargo.aquafex.in	Unknown malware payload delivery domain (confidence level: 100%)
domainfuckrabbit.com	Unknown malware payload delivery domain (confidence level: 100%)
domainflavorista.branding-bar.com	Unknown malware payload delivery domain (confidence level: 100%)
domaintildotsignatures.com	Unknown malware payload delivery domain (confidence level: 100%)
domainvibe.bestffriend.digital	ClearFake payload delivery domain (confidence level: 100%)
domaincptchdm.icu	Unknown malware payload delivery domain (confidence level: 100%)
domainsleepkids.app	Unknown malware payload delivery domain (confidence level: 100%)
domainarchilabdesigns.com	Unknown malware payload delivery domain (confidence level: 100%)
domainsuper.namatin.com	Unknown malware payload delivery domain (confidence level: 100%)
domainpokkaloh.com	Unknown malware payload delivery domain (confidence level: 100%)
domainx2n.bestffriend.digital	ClearFake payload delivery domain (confidence level: 100%)
domainq0ck.dripanchor.ru	ClearFake payload delivery domain (confidence level: 100%)
domainanchor.dripanchor.ru	ClearFake payload delivery domain (confidence level: 100%)
domainac3d0ee370745f757.awsglobalaccelerator.com	Cobalt Strike botnet C2 domain (confidence level: 75%)
domainobte.dripanchor.ru	ClearFake payload delivery domain (confidence level: 100%)
domainkans.s1nkflare.ru	ClearFake payload delivery domain (confidence level: 100%)
domainchromiumgo.bond	Unknown malware payload delivery domain (confidence level: 100%)
domaindrip2.s1nkflare.ru	ClearFake payload delivery domain (confidence level: 100%)
domainchroeminstant.com	Unknown malware payload delivery domain (confidence level: 100%)
domainchromeupdate.download	Unknown malware payload delivery domain (confidence level: 100%)
domaintrace.s1nkflare.ru	ClearFake payload delivery domain (confidence level: 100%)
domainscramble3.orbitling.ru	ClearFake payload delivery domain (confidence level: 100%)
domainf3.orbitling.ru	ClearFake payload delivery domain (confidence level: 100%)
domainyspm.orbitling.ru	ClearFake payload delivery domain (confidence level: 100%)
domain7uo.g0sslamp.ru	ClearFake payload delivery domain (confidence level: 100%)
domaintuesday-gamma.gl.at.ply.gg	XWorm botnet C2 domain (confidence level: 100%)
domainsource-gtk.gl.at.ply.gg	XWorm botnet C2 domain (confidence level: 100%)
domainkamazec-35137.portmap.host	XWorm botnet C2 domain (confidence level: 100%)
domainezpz1.xyz	Remcos botnet C2 domain (confidence level: 100%)
domaincenter-lost.gl.at.ply.gg	Quasar RAT botnet C2 domain (confidence level: 100%)
domaindebt-apartment.gl.at.ply.gg	Quasar RAT botnet C2 domain (confidence level: 100%)
domainlj.g0sslamp.ru	ClearFake payload delivery domain (confidence level: 100%)
domain1ojva.g0sslamp.ru	ClearFake payload delivery domain (confidence level: 100%)
domainbeacon1.kn1fecast.ru	ClearFake payload delivery domain (confidence level: 100%)
domain35k.kn1fecast.ru	ClearFake payload delivery domain (confidence level: 100%)
domainkpow.kn1fecast.ru	ClearFake payload delivery domain (confidence level: 100%)
domainwww.acd852.me	Cobalt Strike botnet C2 domain (confidence level: 75%)
domainhover3.g-0-ss-lamp.ru	ClearFake payload delivery domain (confidence level: 100%)
domainylr.g-0-ss-lamp.ru	ClearFake payload delivery domain (confidence level: 100%)
domainhe2.g-0-ss-lamp.ru	ClearFake payload delivery domain (confidence level: 100%)
domainq9p4.meltquark.ru	ClearFake payload delivery domain (confidence level: 100%)
domainfvfsf.meltquark.ru	ClearFake payload delivery domain (confidence level: 100%)
domaine0.meltquark.ru	ClearFake payload delivery domain (confidence level: 100%)
domainye.scramblehub.ru	ClearFake payload delivery domain (confidence level: 100%)
domainrah.scramblehub.ru	ClearFake payload delivery domain (confidence level: 100%)
domainpulse.scramblehub.ru	ClearFake payload delivery domain (confidence level: 100%)
domain98.drip-anchor.ru	ClearFake payload delivery domain (confidence level: 100%)
domainly.drip-anchor.ru	ClearFake payload delivery domain (confidence level: 100%)
domainflux.drip-anchor.ru	ClearFake payload delivery domain (confidence level: 100%)
domainewgmd.patchvine.ru	ClearFake payload delivery domain (confidence level: 100%)
domainvale.patchvine.ru	ClearFake payload delivery domain (confidence level: 100%)
domaindrs.patchvine.ru	ClearFake payload delivery domain (confidence level: 100%)
domainnd9eh.kn-1-fecast.ru	ClearFake payload delivery domain (confidence level: 100%)
domainl8lp.kn-1-fecast.ru	ClearFake payload delivery domain (confidence level: 100%)
domainspark8.kn-1-fecast.ru	ClearFake payload delivery domain (confidence level: 100%)
domainquark.waveretch.ru	ClearFake payload delivery domain (confidence level: 100%)
domainieqs.waveretch.ru	ClearFake payload delivery domain (confidence level: 100%)
domainrift.waveretch.ru	ClearFake payload delivery domain (confidence level: 100%)
domainwolke.stormlaterne.ru	ClearFake payload delivery domain (confidence level: 100%)
domainglanz.stormlaterne.ru	ClearFake payload delivery domain (confidence level: 100%)
domainbach.stormlaterne.ru	ClearFake payload delivery domain (confidence level: 100%)
domaintau.stormlaterne.ru	ClearFake payload delivery domain (confidence level: 100%)
domainmoor.emberhochland.ru	ClearFake payload delivery domain (confidence level: 100%)
domainstern.emberhochland.ru	ClearFake payload delivery domain (confidence level: 100%)
domainrune.emberhochland.ru	ClearFake payload delivery domain (confidence level: 100%)
domainweald.emberhochland.ru	ClearFake payload delivery domain (confidence level: 100%)
domainkorn.emberhochland.ru	ClearFake payload delivery domain (confidence level: 100%)
domainpfad.quartzfeder.ru	ClearFake payload delivery domain (confidence level: 100%)
domainkamm.quartzfeder.ru	ClearFake payload delivery domain (confidence level: 100%)
domainnebel.quartzfeder.ru	ClearFake payload delivery domain (confidence level: 100%)
domainnacht.midnightkiefer.ru	ClearFake payload delivery domain (confidence level: 100%)
domainwald.midnightkiefer.ru	ClearFake payload delivery domain (confidence level: 100%)
domainrune.midnightkiefer.ru	ClearFake payload delivery domain (confidence level: 100%)
domainfalke.midnightkiefer.ru	ClearFake payload delivery domain (confidence level: 100%)
domaindorn.midnightkiefer.ru	ClearFake payload delivery domain (confidence level: 100%)
domainarchive-medical.gl.at.ply.gg	XWorm botnet C2 domain (confidence level: 100%)
domainnewssystemcopilotdrivertresmil.ydns.eu	Remcos botnet C2 domain (confidence level: 100%)
domainak1.xingxings2.cc	ValleyRAT botnet C2 domain (confidence level: 100%)
domainbirch.aurorafels.ru	ClearFake payload delivery domain (confidence level: 100%)
domaingrat.aurorafels.ru	ClearFake payload delivery domain (confidence level: 100%)
domainwind.aurorafels.ru	ClearFake payload delivery domain (confidence level: 100%)
domainglade.aurorafels.ru	ClearFake payload delivery domain (confidence level: 100%)
domainmoor.copperalpen.ru	ClearFake payload delivery domain (confidence level: 100%)
domainbach.copperalpen.ru	ClearFake payload delivery domain (confidence level: 100%)
domainstern.copperalpen.ru	ClearFake payload delivery domain (confidence level: 100%)
domainadler.ravenkloster.ru	ClearFake payload delivery domain (confidence level: 100%)
domainturm.ravenkloster.ru	ClearFake payload delivery domain (confidence level: 100%)
domainpfad.ravenkloster.ru	ClearFake payload delivery domain (confidence level: 100%)
domainweide.ravenkloster.ru	ClearFake payload delivery domain (confidence level: 100%)
domainfels.glaciertal.ru	ClearFake payload delivery domain (confidence level: 100%)
domainmoor.glaciertal.ru	ClearFake payload delivery domain (confidence level: 100%)
domainwind.glaciertal.ru	ClearFake payload delivery domain (confidence level: 100%)
domainbach.glaciertal.ru	ClearFake payload delivery domain (confidence level: 100%)
domainhafen.glaciertal.ru	ClearFake payload delivery domain (confidence level: 100%)
domainbrook.willowsteg.ru	ClearFake payload delivery domain (confidence level: 100%)
domaindune.willowsteg.ru	ClearFake payload delivery domain (confidence level: 100%)
domainstern.willowsteg.ru	ClearFake payload delivery domain (confidence level: 100%)
domainwolke.granitekamm.ru	ClearFake payload delivery domain (confidence level: 100%)
domainzorn.granitekamm.ru	ClearFake payload delivery domain (confidence level: 100%)
domainfluss.granitekamm.ru	ClearFake payload delivery domain (confidence level: 100%)
domainhammer.granitekamm.ru	ClearFake payload delivery domain (confidence level: 100%)
domaintrail3.brimhopper.ru	ClearFake payload delivery domain (confidence level: 100%)
domainku3.brimhopper.ru	ClearFake payload delivery domain (confidence level: 100%)
domainnova.brimhopper.ru	ClearFake payload delivery domain (confidence level: 100%)
domaincwv2t.s0larbudge.ru	ClearFake payload delivery domain (confidence level: 100%)
domainphase0.s0larbudge.ru	ClearFake payload delivery domain (confidence level: 100%)
domainmesh.s0larbudge.ru	ClearFake payload delivery domain (confidence level: 100%)
domainwepe.j1gglestone.ru	ClearFake payload delivery domain (confidence level: 100%)
domaincap.j1gglestone.ru	ClearFake payload delivery domain (confidence level: 100%)
domainsparkle6.j1gglestone.ru	ClearFake payload delivery domain (confidence level: 100%)
domainforge4.cl0udvex.ru	ClearFake payload delivery domain (confidence level: 100%)
domainblink.cl0udvex.ru	ClearFake payload delivery domain (confidence level: 100%)
domainhover.cl0udvex.ru	ClearFake payload delivery domain (confidence level: 100%)
domainswitch.ventrill.ru	ClearFake payload delivery domain (confidence level: 100%)

File

Value	Description	Copy
file213.209.143.34	Mirai botnet C2 server (confidence level: 80%)
file103.133.178.24	Quasar RAT botnet C2 server (confidence level: 100%)
file3.101.56.242	NetSupportManager RAT botnet C2 server (confidence level: 100%)
file5.22.214.179	MimiKatz botnet C2 server (confidence level: 100%)
file4.209.183.220	AdaptixC2 botnet C2 server (confidence level: 100%)
file175.24.73.192	AdaptixC2 botnet C2 server (confidence level: 100%)
file87.120.93.66	Cobalt Strike botnet C2 server (confidence level: 100%)
file82.223.101.63	AsyncRAT botnet C2 server (confidence level: 100%)
file37.221.66.166	SectopRAT botnet C2 server (confidence level: 100%)
file188.225.73.201	Chaos botnet C2 server (confidence level: 100%)
file70.176.154.122	Remcos botnet C2 server (confidence level: 100%)
file166.117.156.6	Cobalt Strike botnet C2 server (confidence level: 100%)
file91.92.243.183	AsyncRAT botnet C2 server (confidence level: 100%)
file68.183.159.114	Unknown malware botnet C2 server (confidence level: 100%)
file47.104.237.103	Cobalt Strike botnet C2 server (confidence level: 100%)
file137.220.194.49	Cobalt Strike botnet C2 server (confidence level: 100%)
file39.96.163.78	Cobalt Strike botnet C2 server (confidence level: 100%)
file64.188.66.7	XWorm botnet C2 server (confidence level: 75%)
file195.200.17.158	Sliver botnet C2 server (confidence level: 75%)
file198.98.51.203	Sliver botnet C2 server (confidence level: 75%)
file62.4.0.66	Unknown malware botnet C2 server (confidence level: 75%)
file79.107.136.166	QakBot botnet C2 server (confidence level: 75%)
file94.49.199.72	QakBot botnet C2 server (confidence level: 75%)
file82.156.235.177	Cobalt Strike botnet C2 server (confidence level: 100%)
file77.90.185.30	Hook botnet C2 server (confidence level: 100%)
file90.58.26.10	Quasar RAT botnet C2 server (confidence level: 100%)
file52.59.255.232	Havoc botnet C2 server (confidence level: 100%)
file164.90.131.243	Unknown malware botnet C2 server (confidence level: 100%)
file71.71.132.141	Unknown malware botnet C2 server (confidence level: 100%)
file142.90.219.232	Unknown malware botnet C2 server (confidence level: 100%)
file138.197.58.180	Unknown malware botnet C2 server (confidence level: 100%)
file198.211.102.142	Unknown malware botnet C2 server (confidence level: 100%)
file209.97.133.115	Unknown malware botnet C2 server (confidence level: 100%)
file72.60.76.73	Unknown malware botnet C2 server (confidence level: 100%)
file141.98.10.11	Mirai botnet C2 server (confidence level: 80%)
file47.118.83.147	Cobalt Strike botnet C2 server (confidence level: 100%)
file174.138.24.216	Cobalt Strike botnet C2 server (confidence level: 100%)
file185.243.96.19	Remcos botnet C2 server (confidence level: 100%)
file144.31.90.139	SectopRAT botnet C2 server (confidence level: 100%)
file102.117.163.144	Unknown malware botnet C2 server (confidence level: 100%)
file45.200.17.43	Cobalt Strike botnet C2 server (confidence level: 75%)
file45.200.17.43	Cobalt Strike botnet C2 server (confidence level: 75%)
file87.120.93.66	Cobalt Strike botnet C2 server (confidence level: 75%)
file117.72.209.125	Unknown malware botnet C2 server (confidence level: 100%)
file43.173.118.80	Remcos botnet C2 server (confidence level: 100%)
file42.125.196.173	Remcos botnet C2 server (confidence level: 100%)
file164.90.136.126	Sliver botnet C2 server (confidence level: 100%)
file64.176.179.199	Unknown malware botnet C2 server (confidence level: 100%)
file8.215.50.80	Unknown malware botnet C2 server (confidence level: 100%)
file160.178.221.129	Meterpreter botnet C2 server (confidence level: 100%)
file64.188.66.196	XWorm botnet C2 server (confidence level: 100%)
file155.102.132.57	DeimosC2 botnet C2 server (confidence level: 75%)
file171.105.25.168	DeimosC2 botnet C2 server (confidence level: 75%)
file3.30.169.188	DeimosC2 botnet C2 server (confidence level: 75%)
file5.189.147.128	Sliver botnet C2 server (confidence level: 75%)
file107.173.171.200	Cobalt Strike botnet C2 server (confidence level: 75%)
file107.173.171.200	Cobalt Strike botnet C2 server (confidence level: 75%)
file149.88.81.215	Cobalt Strike botnet C2 server (confidence level: 100%)
file95.181.175.140	Hook botnet C2 server (confidence level: 100%)
file128.241.225.47	ValleyRAT botnet C2 server (confidence level: 100%)
file113.250.188.15	Cobalt Strike botnet C2 server (confidence level: 75%)

Hash

Value	Description	Copy
hash3778	Mirai botnet C2 server (confidence level: 80%)
hash4782	Quasar RAT botnet C2 server (confidence level: 100%)
hash10002	NetSupportManager RAT botnet C2 server (confidence level: 100%)
hash8000	MimiKatz botnet C2 server (confidence level: 100%)
hash4321	AdaptixC2 botnet C2 server (confidence level: 100%)
hash4321	AdaptixC2 botnet C2 server (confidence level: 100%)
hash443	Cobalt Strike botnet C2 server (confidence level: 100%)
hash8808	AsyncRAT botnet C2 server (confidence level: 100%)
hash9000	SectopRAT botnet C2 server (confidence level: 100%)
hash80	Chaos botnet C2 server (confidence level: 100%)
hash49971	Remcos botnet C2 server (confidence level: 100%)
hash21666	Cobalt Strike botnet C2 server (confidence level: 100%)
hash1000	AsyncRAT botnet C2 server (confidence level: 100%)
hash443	Unknown malware botnet C2 server (confidence level: 100%)
hash7777	Cobalt Strike botnet C2 server (confidence level: 100%)
hash5555	Cobalt Strike botnet C2 server (confidence level: 100%)
hash9999	Cobalt Strike botnet C2 server (confidence level: 100%)
hash25565	XWorm botnet C2 server (confidence level: 75%)
hash8080	Sliver botnet C2 server (confidence level: 75%)
hash8888	Sliver botnet C2 server (confidence level: 75%)
hash7443	Unknown malware botnet C2 server (confidence level: 75%)
hash995	QakBot botnet C2 server (confidence level: 75%)
hash443	QakBot botnet C2 server (confidence level: 75%)
hash8089	Cobalt Strike botnet C2 server (confidence level: 100%)
hash80	Hook botnet C2 server (confidence level: 100%)
hash4040	Quasar RAT botnet C2 server (confidence level: 100%)
hash443	Havoc botnet C2 server (confidence level: 100%)
hash7443	Unknown malware botnet C2 server (confidence level: 100%)
hash8443	Unknown malware botnet C2 server (confidence level: 100%)
hash8443	Unknown malware botnet C2 server (confidence level: 100%)
hash3333	Unknown malware botnet C2 server (confidence level: 100%)
hash443	Unknown malware botnet C2 server (confidence level: 100%)
hash3333	Unknown malware botnet C2 server (confidence level: 100%)
hash8443	Unknown malware botnet C2 server (confidence level: 100%)
hash2113	Mirai botnet C2 server (confidence level: 80%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)
hash443	Remcos botnet C2 server (confidence level: 100%)
hash9000	SectopRAT botnet C2 server (confidence level: 100%)
hash7443	Unknown malware botnet C2 server (confidence level: 100%)
hash8080	Cobalt Strike botnet C2 server (confidence level: 75%)
hash8443	Cobalt Strike botnet C2 server (confidence level: 75%)
hash80	Cobalt Strike botnet C2 server (confidence level: 75%)
hash18888	Unknown malware botnet C2 server (confidence level: 100%)
hash443	Remcos botnet C2 server (confidence level: 100%)
hash2404	Remcos botnet C2 server (confidence level: 100%)
hash80	Sliver botnet C2 server (confidence level: 100%)
hash7443	Unknown malware botnet C2 server (confidence level: 100%)
hash7443	Unknown malware botnet C2 server (confidence level: 100%)
hash2222	Meterpreter botnet C2 server (confidence level: 100%)
hash64769	XWorm botnet C2 server (confidence level: 100%)
hash4506	DeimosC2 botnet C2 server (confidence level: 75%)
hash10250	DeimosC2 botnet C2 server (confidence level: 75%)
hash443	DeimosC2 botnet C2 server (confidence level: 75%)
hash4567	Sliver botnet C2 server (confidence level: 75%)
hash443	Cobalt Strike botnet C2 server (confidence level: 75%)
hash80	Cobalt Strike botnet C2 server (confidence level: 75%)
hash81	Cobalt Strike botnet C2 server (confidence level: 100%)
hash8082	Hook botnet C2 server (confidence level: 100%)
hash8082	ValleyRAT botnet C2 server (confidence level: 100%)
hash8077	Cobalt Strike botnet C2 server (confidence level: 75%)

Threat ID: 6919165309545414a9be561f

Added to database: 11/16/2025, 12:09:56 AM

Last enriched: 11/16/2025, 12:10:10 AM

Last updated: 11/16/2025, 4:11:22 AM

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by

Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.