Reconnecting to live updates…
ThreatFox IOCs for 2026-01-14
Severity: mediumType: malware
ThreatFox IOCs for 2026-01-14
AI Analysis
Technical Summary
This threat report from ThreatFox MISP Feed dated January 14, 2026, provides a set of Indicators of Compromise (IOCs) related to malware activities, specifically focusing on OSINT, network activity, and payload delivery. The data lacks detailed technical specifics such as affected software versions, concrete indicators, or exploit mechanisms, which limits the ability to perform a deep technical analysis. The threat is classified with a medium severity level and a threat level of 2 on an internal scale, indicating moderate concern. No patches or known exploits in the wild are reported, suggesting that the threat may be emerging or not yet widely exploited. The absence of CWE identifiers and patch information implies that this is not tied to a specific vulnerability but rather to general malware activity detected through OSINT sources. The threat involves network-based payload delivery, which could be used to infiltrate systems or exfiltrate data. The lack of authentication or user interaction requirements suggests that exploitation could be automated or opportunistic. The medium severity rating reflects a balance between potential impact and current evidence of exploitation. This report serves as an early warning to monitor network traffic and payload delivery mechanisms closely, integrating threat intelligence feeds to detect and respond to emerging malware threats.
Potential Impact
For European organizations, the impact of this threat could manifest as unauthorized network intrusions, data exfiltration, or disruption of services due to malware payload delivery. Sectors with critical network infrastructure, such as finance, telecommunications, and government, may face increased risk if the malware payloads are designed to exploit network vulnerabilities or deliver ransomware or spyware. The lack of specific exploit details means the threat could be broad and opportunistic, potentially affecting any organization with exposed network services or insufficient monitoring. The medium severity suggests that while immediate catastrophic impact is unlikely, persistent infections or data breaches could occur if the threat is not detected early. Additionally, the absence of patches indicates that mitigation relies heavily on detection and response capabilities rather than vulnerability remediation. European organizations with mature cybersecurity frameworks may mitigate risks better, but those with less developed defenses could experience operational disruptions or data loss.
Mitigation Recommendations
1. Integrate ThreatFox and other OSINT feeds into Security Information and Event Management (SIEM) systems to enhance detection of emerging IOCs related to malware payload delivery. 2. Implement advanced network monitoring solutions capable of identifying anomalous traffic patterns indicative of payload delivery or command-and-control communications. 3. Conduct regular threat hunting exercises focusing on network activity anomalies and suspicious payloads, even in the absence of known signatures. 4. Harden network perimeter defenses, including segmentation and strict access controls, to limit lateral movement if payload delivery occurs. 5. Employ endpoint detection and response (EDR) tools to identify and isolate malware infections promptly. 6. Maintain up-to-date incident response plans that incorporate OSINT-derived threat intelligence for rapid containment. 7. Educate security teams on interpreting OSINT data and integrating it into operational workflows to improve proactive defense. 8. Collaborate with national and European cybersecurity centers to share intelligence and coordinate responses to emerging threats. These measures go beyond generic advice by emphasizing the operational integration of OSINT data and proactive network behavior analysis.
Affected Countries
Germany, France, United Kingdom, Netherlands, Italy, Spain
Indicators of Compromise
- file: 41.216.188.162
- hash: 1312
- domain: flowerphase.in
- file: 23.94.126.157
- hash: 56001
- file: 23.94.126.157
- hash: 56002
- file: 23.94.126.157
- hash: 56003
- file: 154.6.197.41
- hash: 1999
- file: 144.124.251.175
- hash: 80
- url: http://185.132.53.174/maybe.exe
- url: https://www.sgardenchild.com/
- file: 120.48.168.57
- hash: 8080
- file: 54.180.141.230
- hash: 8888
- file: 212.162.149.216
- hash: 443
- file: 198.23.177.222
- hash: 5000
- file: 102.117.174.234
- hash: 7443
- file: 142.93.173.58
- hash: 443
- file: 49.235.43.89
- hash: 4321
- file: 23.227.202.4
- hash: 8443
- url: http://165.154.224.129:8888/supershell/login/
- file: 194.164.34.182
- hash: 80
- file: 8.210.255.100
- hash: 8443
- file: 178.16.54.17
- hash: 65521
- file: 70.52.170.106
- hash: 6769
- domain: danocore.ddns.net
- file: 103.236.77.184
- hash: 36349
- file: 176.65.132.225
- hash: 6666
- file: 185.11.61.225
- hash: 15647
- file: 144.124.227.246
- hash: 9000
- file: 27.124.2.48
- hash: 443
- file: 211.159.149.97
- hash: 9001
- file: 31.220.44.44
- hash: 2222
- file: 188.166.223.122
- hash: 4444
- file: 52.5.18.208
- hash: 443
- file: 45.156.87.224
- hash: 443
- file: 45.153.34.123
- hash: 443
- file: 176.65.132.20
- hash: 443
- file: 176.65.132.20
- hash: 80
- file: 176.65.132.6
- hash: 443
- file: 130.12.182.91
- hash: 80
- file: 199.101.111.196
- hash: 3790
- file: 199.101.111.195
- hash: 3790
- file: 103.177.47.60
- hash: 3790
- file: 54.198.113.27
- hash: 3389
- file: 54.198.113.27
- hash: 4839
- file: 203.150.107.102
- hash: 5000
- file: 147.45.45.170
- hash: 20000
- file: 91.92.240.192
- hash: 8001
- file: 91.92.240.142
- hash: 8001
- file: 91.92.240.128
- hash: 8001
- url: https://cdn.jsdelivr.net/gh/routing78-fabric43-euw3/csz54-hrt8-s43-g984-gsdf555/ruckusbox
- domain: bleededer-41468.portmap.host
- domain: rss-august.at.playit.gg
- file: 8.210.255.100
- hash: 443
- file: 1.94.135.115
- hash: 6666
- file: 1.94.135.115
- hash: 6667
- file: 1.94.135.115
- hash: 6668
- url: https://cdn.jsdelivr.net/gh/browse-fb-clock/octo-carnival/bukket
- url: https://cdn.jsdelivr.net/gh/clock-cheking/expert-barnacle/brand
- url: https://spectrumtechconsulting.com/
- url: https://sprueche-wuensche-gruesse.com/
- url: https://standart-uk.kz/
- url: https://totobi.top/
- url: https://rdipartners.com.au/
- url: https://tinidevs.com/
- url: https://truetech.ninetysix.in/
- url: https://tv.rapigra.co.id/
- url: https://thenewestthing.com/
- url: https://thiruvallur.in/
- url: https://ukrhelp.sam-sebe-columb.com/
- url: https://test4.kusherp.com/
- url: https://thekeyfactor.org/
- url: https://test.admin.topliefer.com/
- url: https://testsite.wholearmormedia.com/
- url: https://vimo.ddsis.com.mx/
- url: https://wave-n.com/
- url: https://taro.xagrosa.com/
- url: https://test.organia.lk/
- url: https://vyborg.logomebel.ru/
- url: https://webanga.com.nascentedocantao.com/
- url: https://valuelinkltd.com/
- url: https://tomtomu27.com/
- url: https://vereindaheim.at/
- url: https://uk-yakutsk.ru/
- url: https://website-cb9a3496.strategy.vision/
- url: https://timwinders.retirevillage.com/
- url: https://view-point.co.jp/
- url: https://vallealto.unocode.dev/
- url: https://xgr.pmc.mybluehost.me/
- url: https://wifi-dengen.com/
- url: https://volarfab.ru/
- url: https://zimoveyskaya.ru/
- url: https://weenme.com/
- url: https://walta.zergaw.et/
- url: https://westcoastwine.co.za/
- url: https://wrike.os.ogilvy.africa/
- url: https://yatagarasu1123.com/
- url: https://yoshika.co.jp/
- url: https://twitws.com/archives/63
- url: https://yomogi-2203.com/
- url: https://si-co.jp/
- url: https://web135.140.hosttech.eu/
- file: 101.201.180.191
- hash: 443
- file: 186.169.49.139
- hash: 5061
- file: 144.126.149.104
- hash: 111
- file: 202.95.8.6
- hash: 443
- file: 202.95.8.18
- hash: 443
- file: 116.102.228.216
- hash: 9999
- file: 98.89.171.225
- hash: 443
- file: 45.156.87.124
- hash: 443
- file: 45.153.34.117
- hash: 80
- file: 176.65.132.11
- hash: 80
- file: 45.156.87.143
- hash: 443
- file: 45.156.87.19
- hash: 80
- file: 45.156.87.60
- hash: 443
- file: 45.153.34.174
- hash: 80
- file: 45.153.34.174
- hash: 443
- url: https://xrx.erom-e.com/
- url: https://xrx.zeronoiseclassroom.com/
- url: https://65.109.240.131/
- url: https://138.226.237.200/
- url: https://138.226.236.140/
- url: https://95.85.230.160/
- url: https://46.62.237.55/
- url: https://138.226.237.203/
- url: https://95.217.27.5/
- file: 34.229.61.130
- hash: 38576
- file: 103.177.47.93
- hash: 3790
- file: 18.199.237.31
- hash: 443
- domain: xrx.erom-e.com
- domain: xrx.zeronoiseclassroom.com
- file: 65.109.240.131
- hash: 443
- file: 138.226.237.200
- hash: 443
- file: 138.226.236.140
- hash: 443
- file: 95.85.230.160
- hash: 443
- file: 46.62.237.55
- hash: 443
- file: 138.226.237.203
- hash: 443
- file: 95.217.27.5
- hash: 443
- domain: newpappernews211.ru.com
- domain: xhsq.sa.com
- url: http://179.43.186.214:7889/zek3
- file: 148.178.112.89
- hash: 443
- file: 148.178.33.42
- hash: 443
- file: 182.30.67.43
- hash: 443
- file: 72.62.182.2
- hash: 443
- file: 104.223.8.71
- hash: 5782
- file: 216.250.249.178
- hash: 7705
- url: https://dre.erom-e.com/
- url: https://dre.zeronoiseclassroom.com/
- domain: dre.erom-e.com
- domain: dre.zeronoiseclassroom.com
- url: https://cdn.jsdelivr.net/gh/clock-cheking/expert-barnacle/load
- file: 18.135.242.140
- hash: 443
- file: 138.124.66.8
- hash: 8443
- file: 174.138.53.32
- hash: 443
- file: 3.124.174.152
- hash: 443
- file: 117.72.121.210
- hash: 3333
- file: 157.230.156.136
- hash: 3333
- file: 24.144.95.71
- hash: 26736
- file: 3.7.254.146
- hash: 4444
- file: 137.184.0.179
- hash: 443
- file: 38.60.249.226
- hash: 443
- file: 165.232.84.105
- hash: 443
- file: 43.134.101.238
- hash: 3333
- domain: burger-cx-free-work.fun
- file: 46.151.182.40
- hash: 2404
- file: 18.163.183.136
- hash: 80
- file: 176.65.132.17
- hash: 80
- file: 176.65.132.7
- hash: 80
- file: 45.153.34.246
- hash: 443
- file: 45.156.87.143
- hash: 80
- file: 45.156.87.224
- hash: 80
- file: 176.65.132.3
- hash: 80
- file: 185.196.9.60
- hash: 5555
- file: 106.75.141.126
- hash: 8000
- file: 199.101.111.232
- hash: 3790
- url: https://possuhb.cyou/api
- domain: starnt80-46282.portmap.host
- file: 91.92.251.105
- hash: 12004
- file: 20.162.108.7
- hash: 7778
- file: 16.16.25.233
- hash: 9004
- domain: sprinqp.cyou
- domain: actomil.cyou
- domain: neutewj.cyou
- domain: pierrhp.cyou
- domain: possuhb.cyou
- domain: jailqjm.cyou
- domain: bimonwz.cyou
- domain: antliafo.cyou
- domain: inconzy.cyou
- file: 110.42.67.208
- hash: 8088
- file: 195.24.237.79
- hash: 8443
- domain: dashboard2-cqhtfds57-cihan-katircis-projects.vercel.app
- url: https://zabaikalsk.logomebel.ru/
- file: 103.121.93.78
- hash: 8668
- file: 62.164.177.43
- hash: 5850
- url: https://bechtellr.com/6o9p.js
- domain: bechtellr.com
- url: https://bechtellr.com/js.php
- domain: midnight-forge.cc
- file: 86.54.42.197
- hash: 8888
- file: 185.74.222.237
- hash: 443
- file: 23.26.76.39
- hash: 2404
- file: 129.212.181.175
- hash: 443
- file: 27.124.2.52
- hash: 443
- file: 27.124.2.46
- hash: 443
- file: 1.13.253.103
- hash: 4782
- file: 144.172.108.128
- hash: 443
- file: 172.201.216.161
- hash: 445
- file: 45.156.87.57
- hash: 443
- file: 45.153.34.117
- hash: 443
- file: 176.65.132.11
- hash: 443
- url: http://116.202.213.222
- domain: atopain.ru.com
- domain: madebycraft.in.net
- domain: tourne.eu.com
- domain: allclean.jp.net
- domain: davidwilliam.uk.com
- domain: f8bet-atq.com
- domain: 8xx.ru.com
- domain: hanehi6623-51611.portmap.host
- domain: eco.sa.com
- domain: promole5.ddnsfree.com
- domain: cezamail.com.localto.net
- domain: cezamail.com.cezamail.com
- file: 20.82.176.195
- hash: 7771
- domain: wq4x0gt8l.localto.net
- file: 47.237.82.191
- hash: 9521
- file: 140.0.222.24
- hash: 7345
- file: 142.247.214.105
- hash: 443
- file: 216.238.81.174
- hash: 80
- file: 23.20.198.77
- hash: 443
- file: 39.130.158.143
- hash: 10250
- file: 54.82.171.65
- hash: 443
- file: 38.76.194.131
- hash: 10000
- file: 151.243.18.176
- hash: 80
- file: 68.64.178.130
- hash: 80
- file: 198.176.63.214
- hash: 80
- file: 172.111.225.108
- hash: 2404
- file: 217.60.62.204
- hash: 443
- file: 78.40.194.123
- hash: 9000
- file: 69.167.10.106
- hash: 443
- file: 46.151.182.4
- hash: 8080
- file: 5.59.248.100
- hash: 80
- file: 107.21.77.200
- hash: 5205
- file: 107.21.77.200
- hash: 54155
- file: 217.60.62.204
- hash: 8443
- domain: fbnmoon.shop
- domain: fbnmoon.today
- file: 8.219.82.235
- hash: 18888
- file: 8.137.155.113
- hash: 8888
- file: 47.80.8.175
- hash: 60000
- file: 217.154.153.155
- hash: 3333
- file: 52.58.187.167
- hash: 80
- file: 52.58.187.167
- hash: 443
- file: 184.82.111.71
- hash: 3333
- file: 13.205.78.47
- hash: 8080
- file: 43.142.242.216
- hash: 3333
- domain: drfdm.za.com
- domain: mozammilhayatt.in.net
- domain: xpch.sa.com
ThreatFox IOCs for 2026-01-14
0
MediumPublished: Wed Jan 14 2026 (01/14/2026, 00:00:00 UTC)
Source: ThreatFox MISP Feed
Vendor/Project: type
Product: osint
Description
ThreatFox IOCs for 2026-01-14
AI-Powered Analysis
AILast updated: 01/15/2026, 00:08:05 UTC
Technical Analysis
This threat report from ThreatFox MISP Feed dated January 14, 2026, provides a set of Indicators of Compromise (IOCs) related to malware activities, specifically focusing on OSINT, network activity, and payload delivery. The data lacks detailed technical specifics such as affected software versions, concrete indicators, or exploit mechanisms, which limits the ability to perform a deep technical analysis. The threat is classified with a medium severity level and a threat level of 2 on an internal scale, indicating moderate concern. No patches or known exploits in the wild are reported, suggesting that the threat may be emerging or not yet widely exploited. The absence of CWE identifiers and patch information implies that this is not tied to a specific vulnerability but rather to general malware activity detected through OSINT sources. The threat involves network-based payload delivery, which could be used to infiltrate systems or exfiltrate data. The lack of authentication or user interaction requirements suggests that exploitation could be automated or opportunistic. The medium severity rating reflects a balance between potential impact and current evidence of exploitation. This report serves as an early warning to monitor network traffic and payload delivery mechanisms closely, integrating threat intelligence feeds to detect and respond to emerging malware threats.
Potential Impact
For European organizations, the impact of this threat could manifest as unauthorized network intrusions, data exfiltration, or disruption of services due to malware payload delivery. Sectors with critical network infrastructure, such as finance, telecommunications, and government, may face increased risk if the malware payloads are designed to exploit network vulnerabilities or deliver ransomware or spyware. The lack of specific exploit details means the threat could be broad and opportunistic, potentially affecting any organization with exposed network services or insufficient monitoring. The medium severity suggests that while immediate catastrophic impact is unlikely, persistent infections or data breaches could occur if the threat is not detected early. Additionally, the absence of patches indicates that mitigation relies heavily on detection and response capabilities rather than vulnerability remediation. European organizations with mature cybersecurity frameworks may mitigate risks better, but those with less developed defenses could experience operational disruptions or data loss.
Mitigation Recommendations
1. Integrate ThreatFox and other OSINT feeds into Security Information and Event Management (SIEM) systems to enhance detection of emerging IOCs related to malware payload delivery. 2. Implement advanced network monitoring solutions capable of identifying anomalous traffic patterns indicative of payload delivery or command-and-control communications. 3. Conduct regular threat hunting exercises focusing on network activity anomalies and suspicious payloads, even in the absence of known signatures. 4. Harden network perimeter defenses, including segmentation and strict access controls, to limit lateral movement if payload delivery occurs. 5. Employ endpoint detection and response (EDR) tools to identify and isolate malware infections promptly. 6. Maintain up-to-date incident response plans that incorporate OSINT-derived threat intelligence for rapid containment. 7. Educate security teams on interpreting OSINT data and integrating it into operational workflows to improve proactive defense. 8. Collaborate with national and European cybersecurity centers to share intelligence and coordinate responses to emerging threats. These measures go beyond generic advice by emphasizing the operational integration of OSINT data and proactive network behavior analysis.
Affected Countries
Need more detailed analysis?Upgrade to Pro Console
Technical Details
- Threat Level
- 2
- Analysis
- 1
- Distribution
- 3
- Uuid
- 9a221dff-1d04-4174-a17c-1d1ea1f70764
- Original Timestamp
- 1768435387
Indicators of Compromise
File
| Value | Description | Copy |
|---|---|---|
file41.216.188.162 | Mirai botnet C2 server (confidence level: 80%) | |
file23.94.126.157 | PureRAT botnet C2 server (confidence level: 75%) | |
file23.94.126.157 | PureRAT botnet C2 server (confidence level: 75%) | |
file23.94.126.157 | PureRAT botnet C2 server (confidence level: 75%) | |
file154.6.197.41 | Mirai botnet C2 server (confidence level: 80%) | |
file144.124.251.175 | Stealc botnet C2 server (confidence level: 100%) | |
file120.48.168.57 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file54.180.141.230 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file212.162.149.216 | Remcos botnet C2 server (confidence level: 100%) | |
file198.23.177.222 | Remcos botnet C2 server (confidence level: 100%) | |
file102.117.174.234 | Unknown malware botnet C2 server (confidence level: 100%) | |
file142.93.173.58 | Unknown malware botnet C2 server (confidence level: 100%) | |
file49.235.43.89 | AdaptixC2 botnet C2 server (confidence level: 100%) | |
file23.227.202.4 | AdaptixC2 botnet C2 server (confidence level: 100%) | |
file194.164.34.182 | Stealc botnet C2 server (confidence level: 100%) | |
file8.210.255.100 | ValleyRAT botnet C2 server (confidence level: 100%) | |
file178.16.54.17 | Mirai botnet C2 server (confidence level: 80%) | |
file70.52.170.106 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file103.236.77.184 | Unknown malware botnet C2 server (confidence level: 100%) | |
file176.65.132.225 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file185.11.61.225 | SectopRAT botnet C2 server (confidence level: 100%) | |
file144.124.227.246 | SectopRAT botnet C2 server (confidence level: 100%) | |
file27.124.2.48 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file211.159.149.97 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file31.220.44.44 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file188.166.223.122 | Venom RAT botnet C2 server (confidence level: 100%) | |
file52.5.18.208 | Nimplant botnet C2 server (confidence level: 100%) | |
file45.156.87.224 | Stealc botnet C2 server (confidence level: 100%) | |
file45.153.34.123 | Stealc botnet C2 server (confidence level: 100%) | |
file176.65.132.20 | Stealc botnet C2 server (confidence level: 100%) | |
file176.65.132.20 | Stealc botnet C2 server (confidence level: 100%) | |
file176.65.132.6 | Stealc botnet C2 server (confidence level: 100%) | |
file130.12.182.91 | Unknown malware botnet C2 server (confidence level: 100%) | |
file199.101.111.196 | Meterpreter botnet C2 server (confidence level: 100%) | |
file199.101.111.195 | Meterpreter botnet C2 server (confidence level: 100%) | |
file103.177.47.60 | Meterpreter botnet C2 server (confidence level: 100%) | |
file54.198.113.27 | Meterpreter botnet C2 server (confidence level: 100%) | |
file54.198.113.27 | Meterpreter botnet C2 server (confidence level: 100%) | |
file203.150.107.102 | Empire Downloader botnet C2 server (confidence level: 100%) | |
file147.45.45.170 | BianLian botnet C2 server (confidence level: 100%) | |
file91.92.240.192 | Aisuru botnet C2 server (confidence level: 75%) | |
file91.92.240.142 | Aisuru botnet C2 server (confidence level: 75%) | |
file91.92.240.128 | Aisuru botnet C2 server (confidence level: 75%) | |
file8.210.255.100 | ValleyRAT botnet C2 server (confidence level: 100%) | |
file1.94.135.115 | ValleyRAT botnet C2 server (confidence level: 100%) | |
file1.94.135.115 | ValleyRAT botnet C2 server (confidence level: 100%) | |
file1.94.135.115 | ValleyRAT botnet C2 server (confidence level: 100%) | |
file101.201.180.191 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file186.169.49.139 | Remcos botnet C2 server (confidence level: 100%) | |
file144.126.149.104 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file202.95.8.6 | Venom RAT botnet C2 server (confidence level: 100%) | |
file202.95.8.18 | Venom RAT botnet C2 server (confidence level: 100%) | |
file116.102.228.216 | Venom RAT botnet C2 server (confidence level: 100%) | |
file98.89.171.225 | Nimplant botnet C2 server (confidence level: 100%) | |
file45.156.87.124 | Stealc botnet C2 server (confidence level: 100%) | |
file45.153.34.117 | Stealc botnet C2 server (confidence level: 100%) | |
file176.65.132.11 | Stealc botnet C2 server (confidence level: 100%) | |
file45.156.87.143 | Stealc botnet C2 server (confidence level: 100%) | |
file45.156.87.19 | Stealc botnet C2 server (confidence level: 100%) | |
file45.156.87.60 | Stealc botnet C2 server (confidence level: 100%) | |
file45.153.34.174 | Stealc botnet C2 server (confidence level: 100%) | |
file45.153.34.174 | Stealc botnet C2 server (confidence level: 100%) | |
file34.229.61.130 | Meterpreter botnet C2 server (confidence level: 100%) | |
file103.177.47.93 | Meterpreter botnet C2 server (confidence level: 100%) | |
file18.199.237.31 | Empire Downloader botnet C2 server (confidence level: 100%) | |
file65.109.240.131 | Vidar botnet C2 server (confidence level: 100%) | |
file138.226.237.200 | Vidar botnet C2 server (confidence level: 100%) | |
file138.226.236.140 | Vidar botnet C2 server (confidence level: 100%) | |
file95.85.230.160 | Vidar botnet C2 server (confidence level: 100%) | |
file46.62.237.55 | Vidar botnet C2 server (confidence level: 100%) | |
file138.226.237.203 | Vidar botnet C2 server (confidence level: 100%) | |
file95.217.27.5 | Vidar botnet C2 server (confidence level: 100%) | |
file148.178.112.89 | DeimosC2 botnet C2 server (confidence level: 75%) | |
file148.178.33.42 | DeimosC2 botnet C2 server (confidence level: 75%) | |
file182.30.67.43 | DeimosC2 botnet C2 server (confidence level: 75%) | |
file72.62.182.2 | Havoc botnet C2 server (confidence level: 75%) | |
file104.223.8.71 | N-W0rm botnet C2 server (confidence level: 100%) | |
file216.250.249.178 | PureLogs Stealer botnet C2 server (confidence level: 100%) | |
file18.135.242.140 | Unknown malware botnet C2 server (confidence level: 100%) | |
file138.124.66.8 | Unknown malware botnet C2 server (confidence level: 100%) | |
file174.138.53.32 | Unknown malware botnet C2 server (confidence level: 100%) | |
file3.124.174.152 | Unknown malware botnet C2 server (confidence level: 100%) | |
file117.72.121.210 | Unknown malware botnet C2 server (confidence level: 100%) | |
file157.230.156.136 | Unknown malware botnet C2 server (confidence level: 100%) | |
file24.144.95.71 | Unknown malware botnet C2 server (confidence level: 100%) | |
file3.7.254.146 | Unknown malware botnet C2 server (confidence level: 100%) | |
file137.184.0.179 | Unknown malware botnet C2 server (confidence level: 100%) | |
file38.60.249.226 | Unknown malware botnet C2 server (confidence level: 100%) | |
file165.232.84.105 | Unknown malware botnet C2 server (confidence level: 100%) | |
file43.134.101.238 | Unknown malware botnet C2 server (confidence level: 100%) | |
file46.151.182.40 | Remcos botnet C2 server (confidence level: 100%) | |
file18.163.183.136 | Nimplant botnet C2 server (confidence level: 100%) | |
file176.65.132.17 | Stealc botnet C2 server (confidence level: 100%) | |
file176.65.132.7 | Stealc botnet C2 server (confidence level: 100%) | |
file45.153.34.246 | Stealc botnet C2 server (confidence level: 100%) | |
file45.156.87.143 | Stealc botnet C2 server (confidence level: 100%) | |
file45.156.87.224 | Stealc botnet C2 server (confidence level: 100%) | |
file176.65.132.3 | Stealc botnet C2 server (confidence level: 100%) | |
file185.196.9.60 | Unknown malware botnet C2 server (confidence level: 100%) | |
file106.75.141.126 | MimiKatz botnet C2 server (confidence level: 100%) | |
file199.101.111.232 | Meterpreter botnet C2 server (confidence level: 100%) | |
file91.92.251.105 | SpyNote botnet C2 server (confidence level: 100%) | |
file20.162.108.7 | SpyNote botnet C2 server (confidence level: 100%) | |
file16.16.25.233 | SpyNote botnet C2 server (confidence level: 100%) | |
file110.42.67.208 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file195.24.237.79 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file103.121.93.78 | ValleyRAT botnet C2 server (confidence level: 100%) | |
file62.164.177.43 | Quasar RAT botnet C2 server (confidence level: 75%) | |
file86.54.42.197 | Unknown Stealer botnet C2 server (confidence level: 100%) | |
file185.74.222.237 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file23.26.76.39 | Remcos botnet C2 server (confidence level: 100%) | |
file129.212.181.175 | Unknown malware botnet C2 server (confidence level: 100%) | |
file27.124.2.52 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file27.124.2.46 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file1.13.253.103 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file144.172.108.128 | Havoc botnet C2 server (confidence level: 100%) | |
file172.201.216.161 | Havoc botnet C2 server (confidence level: 100%) | |
file45.156.87.57 | Stealc botnet C2 server (confidence level: 100%) | |
file45.153.34.117 | Stealc botnet C2 server (confidence level: 100%) | |
file176.65.132.11 | Stealc botnet C2 server (confidence level: 100%) | |
file20.82.176.195 | SpyNote botnet C2 server (confidence level: 100%) | |
file47.237.82.191 | ValleyRAT botnet C2 server (confidence level: 100%) | |
file140.0.222.24 | DeimosC2 botnet C2 server (confidence level: 75%) | |
file142.247.214.105 | QakBot botnet C2 server (confidence level: 75%) | |
file216.238.81.174 | BianLian botnet C2 server (confidence level: 75%) | |
file23.20.198.77 | DeimosC2 botnet C2 server (confidence level: 75%) | |
file39.130.158.143 | DeimosC2 botnet C2 server (confidence level: 75%) | |
file54.82.171.65 | DeimosC2 botnet C2 server (confidence level: 75%) | |
file38.76.194.131 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file151.243.18.176 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file68.64.178.130 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file198.176.63.214 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file172.111.225.108 | Remcos botnet C2 server (confidence level: 100%) | |
file217.60.62.204 | Sliver botnet C2 server (confidence level: 100%) | |
file78.40.194.123 | SectopRAT botnet C2 server (confidence level: 100%) | |
file69.167.10.106 | DCRat botnet C2 server (confidence level: 100%) | |
file46.151.182.4 | MooBot botnet C2 server (confidence level: 100%) | |
file5.59.248.100 | Bashlite botnet C2 server (confidence level: 100%) | |
file107.21.77.200 | Meterpreter botnet C2 server (confidence level: 100%) | |
file107.21.77.200 | Meterpreter botnet C2 server (confidence level: 100%) | |
file217.60.62.204 | Sliver botnet C2 server (confidence level: 75%) | |
file8.219.82.235 | ValleyRAT botnet C2 server (confidence level: 100%) | |
file8.137.155.113 | Unknown malware botnet C2 server (confidence level: 100%) | |
file47.80.8.175 | Unknown malware botnet C2 server (confidence level: 100%) | |
file217.154.153.155 | Unknown malware botnet C2 server (confidence level: 100%) | |
file52.58.187.167 | Unknown malware botnet C2 server (confidence level: 100%) | |
file52.58.187.167 | Unknown malware botnet C2 server (confidence level: 100%) | |
file184.82.111.71 | Unknown malware botnet C2 server (confidence level: 100%) | |
file13.205.78.47 | Unknown malware botnet C2 server (confidence level: 100%) | |
file43.142.242.216 | Unknown malware botnet C2 server (confidence level: 100%) |
Hash
| Value | Description | Copy |
|---|---|---|
hash1312 | Mirai botnet C2 server (confidence level: 80%) | |
hash56001 | PureRAT botnet C2 server (confidence level: 75%) | |
hash56002 | PureRAT botnet C2 server (confidence level: 75%) | |
hash56003 | PureRAT botnet C2 server (confidence level: 75%) | |
hash1999 | Mirai botnet C2 server (confidence level: 80%) | |
hash80 | Stealc botnet C2 server (confidence level: 100%) | |
hash8080 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8888 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Remcos botnet C2 server (confidence level: 100%) | |
hash5000 | Remcos botnet C2 server (confidence level: 100%) | |
hash7443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash4321 | AdaptixC2 botnet C2 server (confidence level: 100%) | |
hash8443 | AdaptixC2 botnet C2 server (confidence level: 100%) | |
hash80 | Stealc botnet C2 server (confidence level: 100%) | |
hash8443 | ValleyRAT botnet C2 server (confidence level: 100%) | |
hash65521 | Mirai botnet C2 server (confidence level: 80%) | |
hash6769 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash36349 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash6666 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash15647 | SectopRAT botnet C2 server (confidence level: 100%) | |
hash9000 | SectopRAT botnet C2 server (confidence level: 100%) | |
hash443 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash9001 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash2222 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash4444 | Venom RAT botnet C2 server (confidence level: 100%) | |
hash443 | Nimplant botnet C2 server (confidence level: 100%) | |
hash443 | Stealc botnet C2 server (confidence level: 100%) | |
hash443 | Stealc botnet C2 server (confidence level: 100%) | |
hash443 | Stealc botnet C2 server (confidence level: 100%) | |
hash80 | Stealc botnet C2 server (confidence level: 100%) | |
hash443 | Stealc botnet C2 server (confidence level: 100%) | |
hash80 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3790 | Meterpreter botnet C2 server (confidence level: 100%) | |
hash3790 | Meterpreter botnet C2 server (confidence level: 100%) | |
hash3790 | Meterpreter botnet C2 server (confidence level: 100%) | |
hash3389 | Meterpreter botnet C2 server (confidence level: 100%) | |
hash4839 | Meterpreter botnet C2 server (confidence level: 100%) | |
hash5000 | Empire Downloader botnet C2 server (confidence level: 100%) | |
hash20000 | BianLian botnet C2 server (confidence level: 100%) | |
hash8001 | Aisuru botnet C2 server (confidence level: 75%) | |
hash8001 | Aisuru botnet C2 server (confidence level: 75%) | |
hash8001 | Aisuru botnet C2 server (confidence level: 75%) | |
hash443 | ValleyRAT botnet C2 server (confidence level: 100%) | |
hash6666 | ValleyRAT botnet C2 server (confidence level: 100%) | |
hash6667 | ValleyRAT botnet C2 server (confidence level: 100%) | |
hash6668 | ValleyRAT botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash5061 | Remcos botnet C2 server (confidence level: 100%) | |
hash111 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash443 | Venom RAT botnet C2 server (confidence level: 100%) | |
hash443 | Venom RAT botnet C2 server (confidence level: 100%) | |
hash9999 | Venom RAT botnet C2 server (confidence level: 100%) | |
hash443 | Nimplant botnet C2 server (confidence level: 100%) | |
hash443 | Stealc botnet C2 server (confidence level: 100%) | |
hash80 | Stealc botnet C2 server (confidence level: 100%) | |
hash80 | Stealc botnet C2 server (confidence level: 100%) | |
hash443 | Stealc botnet C2 server (confidence level: 100%) | |
hash80 | Stealc botnet C2 server (confidence level: 100%) | |
hash443 | Stealc botnet C2 server (confidence level: 100%) | |
hash80 | Stealc botnet C2 server (confidence level: 100%) | |
hash443 | Stealc botnet C2 server (confidence level: 100%) | |
hash38576 | Meterpreter botnet C2 server (confidence level: 100%) | |
hash3790 | Meterpreter botnet C2 server (confidence level: 100%) | |
hash443 | Empire Downloader botnet C2 server (confidence level: 100%) | |
hash443 | Vidar botnet C2 server (confidence level: 100%) | |
hash443 | Vidar botnet C2 server (confidence level: 100%) | |
hash443 | Vidar botnet C2 server (confidence level: 100%) | |
hash443 | Vidar botnet C2 server (confidence level: 100%) | |
hash443 | Vidar botnet C2 server (confidence level: 100%) | |
hash443 | Vidar botnet C2 server (confidence level: 100%) | |
hash443 | Vidar botnet C2 server (confidence level: 100%) | |
hash443 | DeimosC2 botnet C2 server (confidence level: 75%) | |
hash443 | DeimosC2 botnet C2 server (confidence level: 75%) | |
hash443 | DeimosC2 botnet C2 server (confidence level: 75%) | |
hash443 | Havoc botnet C2 server (confidence level: 75%) | |
hash5782 | N-W0rm botnet C2 server (confidence level: 100%) | |
hash7705 | PureLogs Stealer botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash26736 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash4444 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash80 | Nimplant botnet C2 server (confidence level: 100%) | |
hash80 | Stealc botnet C2 server (confidence level: 100%) | |
hash80 | Stealc botnet C2 server (confidence level: 100%) | |
hash443 | Stealc botnet C2 server (confidence level: 100%) | |
hash80 | Stealc botnet C2 server (confidence level: 100%) | |
hash80 | Stealc botnet C2 server (confidence level: 100%) | |
hash80 | Stealc botnet C2 server (confidence level: 100%) | |
hash5555 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8000 | MimiKatz botnet C2 server (confidence level: 100%) | |
hash3790 | Meterpreter botnet C2 server (confidence level: 100%) | |
hash12004 | SpyNote botnet C2 server (confidence level: 100%) | |
hash7778 | SpyNote botnet C2 server (confidence level: 100%) | |
hash9004 | SpyNote botnet C2 server (confidence level: 100%) | |
hash8088 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash8443 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash8668 | ValleyRAT botnet C2 server (confidence level: 100%) | |
hash5850 | Quasar RAT botnet C2 server (confidence level: 75%) | |
hash8888 | Unknown Stealer botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash443 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash4782 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash443 | Havoc botnet C2 server (confidence level: 100%) | |
hash445 | Havoc botnet C2 server (confidence level: 100%) | |
hash443 | Stealc botnet C2 server (confidence level: 100%) | |
hash443 | Stealc botnet C2 server (confidence level: 100%) | |
hash443 | Stealc botnet C2 server (confidence level: 100%) | |
hash7771 | SpyNote botnet C2 server (confidence level: 100%) | |
hash9521 | ValleyRAT botnet C2 server (confidence level: 100%) | |
hash7345 | DeimosC2 botnet C2 server (confidence level: 75%) | |
hash443 | QakBot botnet C2 server (confidence level: 75%) | |
hash80 | BianLian botnet C2 server (confidence level: 75%) | |
hash443 | DeimosC2 botnet C2 server (confidence level: 75%) | |
hash10250 | DeimosC2 botnet C2 server (confidence level: 75%) | |
hash443 | DeimosC2 botnet C2 server (confidence level: 75%) | |
hash10000 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash2404 | Remcos botnet C2 server (confidence level: 100%) | |
hash443 | Sliver botnet C2 server (confidence level: 100%) | |
hash9000 | SectopRAT botnet C2 server (confidence level: 100%) | |
hash443 | DCRat botnet C2 server (confidence level: 100%) | |
hash8080 | MooBot botnet C2 server (confidence level: 100%) | |
hash80 | Bashlite botnet C2 server (confidence level: 100%) | |
hash5205 | Meterpreter botnet C2 server (confidence level: 100%) | |
hash54155 | Meterpreter botnet C2 server (confidence level: 100%) | |
hash8443 | Sliver botnet C2 server (confidence level: 75%) | |
hash18888 | ValleyRAT botnet C2 server (confidence level: 100%) | |
hash8888 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash60000 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash80 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8080 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) |
Domain
| Value | Description | Copy |
|---|---|---|
domainflowerphase.in | Unknown RAT botnet C2 domain (confidence level: 100%) | |
domaindanocore.ddns.net | Quasar RAT botnet C2 domain (confidence level: 75%) | |
domainbleededer-41468.portmap.host | XWorm botnet C2 domain (confidence level: 100%) | |
domainrss-august.at.playit.gg | NjRAT botnet C2 domain (confidence level: 100%) | |
domainxrx.erom-e.com | Vidar botnet C2 domain (confidence level: 100%) | |
domainxrx.zeronoiseclassroom.com | Vidar botnet C2 domain (confidence level: 100%) | |
domainnewpappernews211.ru.com | AsyncRAT botnet C2 domain (confidence level: 75%) | |
domainxhsq.sa.com | AsyncRAT botnet C2 domain (confidence level: 75%) | |
domaindre.erom-e.com | Vidar botnet C2 domain (confidence level: 100%) | |
domaindre.zeronoiseclassroom.com | Vidar botnet C2 domain (confidence level: 100%) | |
domainburger-cx-free-work.fun | Unknown RAT botnet C2 domain (confidence level: 100%) | |
domainstarnt80-46282.portmap.host | NjRAT botnet C2 domain (confidence level: 100%) | |
domainsprinqp.cyou | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainactomil.cyou | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainneutewj.cyou | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainpierrhp.cyou | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainpossuhb.cyou | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainjailqjm.cyou | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainbimonwz.cyou | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainantliafo.cyou | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domaininconzy.cyou | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domaindashboard2-cqhtfds57-cihan-katircis-projects.vercel.app | Unknown Stealer botnet C2 domain (confidence level: 100%) | |
domainbechtellr.com | KongTuke payload delivery domain (confidence level: 100%) | |
domainmidnight-forge.cc | Unknown Stealer botnet C2 domain (confidence level: 100%) | |
domainatopain.ru.com | Quasar RAT botnet C2 domain (confidence level: 75%) | |
domainmadebycraft.in.net | Quasar RAT botnet C2 domain (confidence level: 75%) | |
domaintourne.eu.com | AsyncRAT botnet C2 domain (confidence level: 75%) | |
domainallclean.jp.net | AsyncRAT botnet C2 domain (confidence level: 75%) | |
domaindavidwilliam.uk.com | AsyncRAT botnet C2 domain (confidence level: 75%) | |
domainf8bet-atq.com | AsyncRAT botnet C2 domain (confidence level: 75%) | |
domain8xx.ru.com | AsyncRAT botnet C2 domain (confidence level: 75%) | |
domainhanehi6623-51611.portmap.host | Quasar RAT botnet C2 domain (confidence level: 100%) | |
domaineco.sa.com | AsyncRAT botnet C2 domain (confidence level: 75%) | |
domainpromole5.ddnsfree.com | Unknown RAT botnet C2 domain (confidence level: 100%) | |
domaincezamail.com.localto.net | SpyNote botnet C2 domain (confidence level: 100%) | |
domaincezamail.com.cezamail.com | SpyNote botnet C2 domain (confidence level: 100%) | |
domainwq4x0gt8l.localto.net | SpyNote botnet C2 domain (confidence level: 100%) | |
domainfbnmoon.shop | Unknown Stealer botnet C2 domain (confidence level: 100%) | |
domainfbnmoon.today | Unknown Stealer botnet C2 domain (confidence level: 100%) | |
domaindrfdm.za.com | AsyncRAT botnet C2 domain (confidence level: 75%) | |
domainmozammilhayatt.in.net | AsyncRAT botnet C2 domain (confidence level: 75%) | |
domainxpch.sa.com | AsyncRAT botnet C2 domain (confidence level: 75%) |
Url
| Value | Description | Copy |
|---|---|---|
urlhttp://185.132.53.174/maybe.exe | SalatStealer payload delivery URL (confidence level: 100%) | |
urlhttps://www.sgardenchild.com/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttp://165.154.224.129:8888/supershell/login/ | Unknown malware botnet C2 (confidence level: 100%) | |
urlhttps://cdn.jsdelivr.net/gh/routing78-fabric43-euw3/csz54-hrt8-s43-g984-gsdf555/ruckusbox | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://cdn.jsdelivr.net/gh/browse-fb-clock/octo-carnival/bukket | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://cdn.jsdelivr.net/gh/clock-cheking/expert-barnacle/brand | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://spectrumtechconsulting.com/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://sprueche-wuensche-gruesse.com/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://standart-uk.kz/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://totobi.top/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://rdipartners.com.au/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://tinidevs.com/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://truetech.ninetysix.in/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://tv.rapigra.co.id/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://thenewestthing.com/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://thiruvallur.in/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://ukrhelp.sam-sebe-columb.com/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://test4.kusherp.com/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://thekeyfactor.org/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://test.admin.topliefer.com/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://testsite.wholearmormedia.com/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://vimo.ddsis.com.mx/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://wave-n.com/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://taro.xagrosa.com/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://test.organia.lk/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://vyborg.logomebel.ru/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://webanga.com.nascentedocantao.com/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://valuelinkltd.com/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://tomtomu27.com/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://vereindaheim.at/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://uk-yakutsk.ru/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://website-cb9a3496.strategy.vision/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://timwinders.retirevillage.com/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://view-point.co.jp/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://vallealto.unocode.dev/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://xgr.pmc.mybluehost.me/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://wifi-dengen.com/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://volarfab.ru/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://zimoveyskaya.ru/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://weenme.com/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://walta.zergaw.et/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://westcoastwine.co.za/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://wrike.os.ogilvy.africa/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://yatagarasu1123.com/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://yoshika.co.jp/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://twitws.com/archives/63 | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://yomogi-2203.com/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://si-co.jp/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://web135.140.hosttech.eu/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://xrx.erom-e.com/ | Vidar botnet C2 (confidence level: 100%) | |
urlhttps://xrx.zeronoiseclassroom.com/ | Vidar botnet C2 (confidence level: 100%) | |
urlhttps://65.109.240.131/ | Vidar botnet C2 (confidence level: 100%) | |
urlhttps://138.226.237.200/ | Vidar botnet C2 (confidence level: 100%) | |
urlhttps://138.226.236.140/ | Vidar botnet C2 (confidence level: 100%) | |
urlhttps://95.85.230.160/ | Vidar botnet C2 (confidence level: 100%) | |
urlhttps://46.62.237.55/ | Vidar botnet C2 (confidence level: 100%) | |
urlhttps://138.226.237.203/ | Vidar botnet C2 (confidence level: 100%) | |
urlhttps://95.217.27.5/ | Vidar botnet C2 (confidence level: 100%) | |
urlhttp://179.43.186.214:7889/zek3 | Cobalt Strike botnet C2 (confidence level: 75%) | |
urlhttps://dre.erom-e.com/ | Vidar botnet C2 (confidence level: 100%) | |
urlhttps://dre.zeronoiseclassroom.com/ | Vidar botnet C2 (confidence level: 100%) | |
urlhttps://cdn.jsdelivr.net/gh/clock-cheking/expert-barnacle/load | ClearFake payload delivery URL (confidence level: 100%) | |
urlhttps://possuhb.cyou/api | Lumma Stealer botnet C2 (confidence level: 100%) | |
urlhttps://zabaikalsk.logomebel.ru/ | Unknown malware payload delivery URL (confidence level: 90%) | |
urlhttps://bechtellr.com/6o9p.js | KongTuke payload delivery URL (confidence level: 100%) | |
urlhttps://bechtellr.com/js.php | KongTuke payload delivery URL (confidence level: 100%) | |
urlhttp://116.202.213.222 | Stealc botnet C2 (confidence level: 75%) |
Threat ID: 69682fce09a911886913344a
Added to database: 1/15/2026, 12:07:42 AM
Last enriched: 1/15/2026, 12:08:05 AM
Last updated: 1/15/2026, 4:02:57 AM
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Sort by
Loading community insights…
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Related Threats
PLUGGYAPE Malware Uses Signal and WhatsApp to Target Ukrainian Defense Forces
MediumMalwareWed Jan 14 2026
Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware
MediumMalwareWed Jan 14 2026
KRVTZ IDS alerts for 2026-01-14
LowUnknownWed Jan 14 2026
New Advanced Linux VoidLink Malware Targets Cloud and container Environments
MediumMalwareWed Jan 14 2026
ThreatFox IOCs for 2026-01-13
MediumMalwareWed Jan 14 2026
Actions
PRO
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Please log in to the Console to use AI analysis features.
External Links
Need more coverage?
Upgrade to Pro Console in Console -> Billing for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.