Reconnecting to live updates…

ThreatFox IOCs for 2026-03-29

Severity: mediumType: malware

AI Analysis

Technical Summary

This entry from the ThreatFox MISP feed dated March 29, 2026, provides Indicators of Compromise (IOCs) related to malware activity, specifically focusing on OSINT, network activity, and payload delivery. ThreatFox is a platform that aggregates threat intelligence data, and this feed is used to share IOCs to help organizations detect and respond to threats. The information lacks specific affected software versions or detailed technical exploit data, indicating that this is a general intelligence update rather than a report on a newly discovered vulnerability or active exploit. The threat level is rated as medium, reflecting moderate concern but no immediate critical risk. No patches or mitigations are listed, and there are no known exploits in the wild, suggesting that this intelligence is either preliminary or related to low-scale or emerging threats. The technical metadata shows limited analysis and distribution, implying that the threat is not widespread or fully understood yet. The absence of concrete indicators in the provided data limits the ability to perform detailed forensic or defensive actions. Overall, this threat intelligence serves as a situational awareness tool for security teams monitoring malware and network-based payload delivery mechanisms.

Potential Impact

The potential impact of this threat is currently limited due to the lack of detailed exploit information and absence of known active attacks. However, as it involves malware and payload delivery, organizations could face risks such as unauthorized access, data exfiltration, or service disruption if the threat evolves or is leveraged in targeted attacks. The medium severity rating suggests that while immediate widespread damage is unlikely, the threat could be a precursor to more significant attacks or part of a broader campaign. Organizations relying on OSINT and network monitoring tools may need to update their detection capabilities to identify related malicious activity. The lack of patches means that if this threat exploits unknown vulnerabilities, organizations must rely on network defenses and monitoring rather than software fixes. Overall, the impact is moderate but could escalate if further details emerge or if attackers develop active exploits based on this intelligence.

Mitigation Recommendations

Given the absence of specific patches or detailed exploit information, mitigation should focus on enhancing detection and response capabilities. Organizations should integrate the latest ThreatFox IOCs into their security information and event management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to improve visibility of potential malicious network activity and payload delivery attempts. Regularly updating threat intelligence feeds and correlating them with internal logs can help identify early signs of compromise. Network segmentation and strict access controls can limit the spread of malware if an infection occurs. Employing endpoint detection and response (EDR) solutions with behavioral analysis can detect suspicious payload execution. Security teams should also conduct regular threat hunting exercises using the provided IOCs and monitor for unusual OSINT-related network traffic. User awareness training about phishing and social engineering remains important, as payload delivery often involves user interaction. Finally, maintaining robust backup and recovery procedures ensures resilience against potential malware impacts.

Affected Countries

United States, Germany, United Kingdom, France, Japan, South Korea, Australia, Canada, Netherlands, India

Indicators of Compromise

file: 24.152.36.243
hash: 3000
domain: amoboobs.com
file: 64.89.163.230
hash: 80
hash: fb3e6d6bb2781c8a737c38f4d31beed93a89cc2ff9b8c00e7682f04c72fd9a60
hash: ab78edbfdaebc11a34625d71709113cbb3f8e10d4699bc8dbddb966ea2efff03
hash: c22d94a2652a4689a73d845e127157de986b72669aabf1c4fefc0f789646895b
hash: 371d72144e3862bbb3ce66821e47232c8a08eba166f13cade5bfaad1e1a6ab7d
hash: 563ae5a1263eaa065b1a193870343637cc7650ccf0d8f6ff75f47906f3e85c0f
hash: 6d140e07afb62c3fe9e60763993f1f0edf3e0c5421e693885b79a5fe5d91f14f
hash: 6e676252d9b29e1e9caa7b24cad834bc53a41c4d55ed466a9fdebc30a74322b3
domain: trueforceteam.ru
domain: easytrueforce.shop
url: http://91.92.243.119/git.ps1
url: http://91.92.243.119/stlr/git.exe
url: http://91.92.243.119/steam/lemon.exe
url: http://91.92.243.119/rat/global.exe
file: 91.92.243.119
hash: 80
file: 5.45.74.46
hash: 443
file: 24.248.236.7
hash: 8009
file: 45.156.87.17
hash: 80
file: 176.65.139.81
hash: 3778
file: 43.251.226.93
hash: 8089
file: 147.45.67.96
hash: 443
file: 178.236.252.123
hash: 443
file: 193.233.113.146
hash: 443
file: 80.89.224.162
hash: 443
file: 87.251.69.215
hash: 443
file: 45.89.60.96
hash: 443
file: 213.176.16.150
hash: 443
file: 193.221.200.80
hash: 443
file: 85.137.253.238
hash: 443
file: 147.45.67.154
hash: 443
file: 77.91.65.57
hash: 443
file: 185.107.74.93
hash: 443
file: 94.141.122.192
hash: 443
file: 91.84.107.67
hash: 443
file: 89.124.85.209
hash: 443
file: 178.236.252.130
hash: 443
file: 185.157.215.29
hash: 443
file: 144.124.230.251
hash: 443
file: 144.124.231.93
hash: 443
file: 147.45.67.29
hash: 443
file: 89.124.66.157
hash: 443
file: 89.124.77.219
hash: 443
file: 77.246.104.168
hash: 443
file: 144.124.245.176
hash: 443
file: 91.84.119.156
hash: 443
file: 146.103.113.32
hash: 443
file: 212.118.42.217
hash: 443
file: 46.149.76.165
hash: 443
file: 193.33.195.37
hash: 443
file: 89.110.64.191
hash: 443
file: 77.246.99.223
hash: 443
file: 89.110.115.9
hash: 443
file: 146.103.104.188
hash: 443
file: 195.26.227.103
hash: 443
file: 77.105.136.194
hash: 443
file: 154.36.188.20
hash: 443
domain: accounts.google.seclogistic.com
domain: workspaces.dynv6.net
domain: taxhelp6.dynv6.net
domain: nid.naver.courter.com
url: https://during.bong889.com/
url: https://dev.betway071.com/
domain: communicationfirewall-security.cc
domain: favourite-guide.cc
domain: geo-foundation.vg
domain: sentinel1-endpoint-security.cc
file: 85.121.148.13
hash: 443
file: 94.26.106.134
hash: 443
domain: cl2point.vectorpatronage.in.net
url: https://suaracitizen.com/
url: https://question-climatisation.com/
domain: cl3view.vectorpatronage.in.net
domain: cl4path.vectorpatronage.in.net
domain: dev1proc.nexusprospera.in.net
domain: escofiringbijou.com
domain: elizabethquinncmclibrary.com
domain: disp-graphics.com
file: 91.236.230.154
hash: 443
hash: b7ef4985662625c45955db295d949e04fd0a9fd5c8ce0c6a3bcb68e4a06c16e4
domain: dev2outer.nexusprospera.in.net
domain: dev3field.nexusprospera.in.net
domain: dev4space.nexusprospera.in.net
domain: svc1proc.quantumventurex.in.net
domain: svc2steel.quantumventurex.in.net
domain: ms365-team.com
domain: florida-grower.com
domain: endpointmapperprocess.com
domain: wmds946t.life
domain: pepedrop.yachts
file: 91.236.230.17
hash: 443
file: 91.236.230.220
hash: 443
domain: svc3core.quantumventurex.in.net
domain: svc4sat.quantumventurex.in.net
url: http://45.205.2.53:8888/supershell/login/
file: 45.205.2.53
hash: 8888
domain: ext1infra.paragonharbinger.in.net
domain: ext2proxy.paragonharbinger.in.net
domain: ext3data.paragonharbinger.in.net
domain: ext4point.paragonharbinger.in.net
domain: cl1sync.spectrumprospera.in.net
domain: cl2data.spectrumprospera.in.net
domain: cl3edge.spectrumprospera.in.net
domain: cl4static.spectrumprospera.in.net
domain: ext1meta.keystonepatronage.in.net
domain: ext2proc.keystonepatronage.in.net
domain: ext3gate.keystonepatronage.in.net
domain: ext4sync.keystonepatronage.in.net
domain: cl1store.luminousventurex.in.net
domain: cl2remote.luminousventurex.in.net
domain: cl3dev.luminousventurex.in.net
domain: cl4link.luminousventurex.in.net
domain: dev1proc.echelonprospera.in.net
domain: dev2power.echelonprospera.in.net
domain: dev3local.echelonprospera.in.net
domain: dev4work.echelonprospera.in.net
domain: svc1infra.vertexharbinger.in.net
domain: svc2base.vertexharbinger.in.net
domain: svc3user.vertexharbinger.in.net
domain: svc4link.vertexharbinger.in.net
file: 91.236.230.17
hash: 993
file: 91.236.230.220
hash: 443
file: 91.236.230.229
hash: 5000
domain: ms365-team.com
domain: florida-grower.com
domain: tmegramapps.com
domain: endpointmapperprocess.com
domain: pepedrop.yachts
domain: proto-wi1d.zenithprospera.in.net
domain: binarydelive.zenithprospera.in.net
file: 54.172.72.215
hash: 4443
file: 213.139.205.131
hash: 80
domain: cliencampa.radiantpatronage.in.net
domain: rende-trig.radiantpatronage.in.net
domain: lfgs.latticeharbinger.in.net
domain: apgjh.latticeharbinger.in.net
domain: reviewglyph.covenantprospera.in.net
domain: compi-vault.covenantprospera.in.net
domain: pitchreed.apexventurex.in.net
domain: loadmatr.apexventurex.in.net
domain: hyper-opt1.momentumprospera.in.net
domain: grasand.momentumprospera.in.net
domain: 1ukqsofb.vectorpatronage.in.net
domain: wgnh.vectorpatronage.in.net
domain: spk77w.nexusprospera.in.net
domain: sol-lithos.nexusprospera.in.net
domain: du5k-cast.quantumventurex.in.net
domain: islelaunch.quantumventurex.in.net
domain: rave-branch.paragonharbinger.in.net
domain: tensor-line.paragonharbinger.in.net
domain: dr80gbyv.spectrumprospera.in.net
url: https://movinty.digital/
domain: cap1ta-flow.spectrumprospera.in.net
domain: 1nsight-route.keystonepatronage.in.net
file: 45.221.118.180
hash: 8443
file: 47.86.32.50
hash: 7777
file: 80.94.95.26
hash: 8443
file: 117.72.242.9
hash: 50050
file: 8.134.60.248
hash: 50050
file: 37.120.239.48
hash: 443
file: 193.26.115.72
hash: 31337
file: 104.129.51.142
hash: 31337
file: 107.173.12.94
hash: 31337
file: 47.121.136.51
hash: 31337
file: 158.220.121.73
hash: 31337
file: 152.228.129.105
hash: 31337
file: 194.163.132.140
hash: 31337
file: 145.239.71.119
hash: 31337
file: 170.64.254.183
hash: 31337
file: 85.192.27.126
hash: 31337
file: 185.225.226.125
hash: 31337
file: 103.207.68.46
hash: 31337
file: 62.204.35.57
hash: 31337
file: 165.227.148.132
hash: 31337
file: 216.203.20.29
hash: 31337
file: 192.169.7.17
hash: 31337
file: 167.148.183.75
hash: 31337
file: 61.184.8.207
hash: 443
file: 39.96.188.70
hash: 443
file: 47.112.6.30
hash: 443
file: 4.224.18.187
hash: 3333
file: 122.170.96.200
hash: 3333
file: 49.235.85.108
hash: 3333
file: 135.125.53.28
hash: 80
file: 135.125.53.28
hash: 443
file: 80.71.224.121
hash: 3333
file: 67.253.162.122
hash: 8080
file: 20.123.89.181
hash: 8080
file: 18.118.39.18
hash: 443
file: 176.111.220.168
hash: 443
file: 118.194.248.158
hash: 443
file: 167.179.76.179
hash: 4433
file: 190.100.187.183
hash: 81
file: 178.16.55.99
hash: 7443
file: 173.211.46.116
hash: 2850
file: 178.16.52.58
hash: 1337
file: 151.59.122.136
hash: 8080
file: 110.38.217.97
hash: 54545
domain: icfsj.keystonepatronage.in.net
url: https://der03.top/
url: https://kke03.top/
url: https://ysp06.top/
url: https://ppio10.top/
url: https://47.243.157.232/
url: https://8.217.163.200/
url: https://134.122.194.187/
url: https://67.209.176.243/
url: https://64.188.30.169/
url: https://8.218.245.128/
url: https://47.243.154.43/
url: https://47.242.218.25/
url: https://47.83.238.253/
url: https://104.168.148.210/
url: https://47.242.207.99/
url: https://47.242.179.21/
url: https://104.233.246.210/
url: https://jrv.gaga3.top/
url: https://luanluan821.top/
url: https://host.vasslli.top/
url: https://liux16.top/
url: https://mecurry.top/
url: https://47.243.157.77/
url: https://47.83.208.201/
url: https://decorator.top/
url: https://2.56.255.159/
url: https://47.239.244.75/
url: https://shitongyao.site/
url: https://docviews34.dynv6.net/
url: https://elecviews56.dynv6.net/
url: https://nids25.dynv6.net/
url: https://docviews37.dynv6.net/
url: https://nids67.dynv6.net/
url: https://elecviews90.dynv6.net/
url: https://elecviews69.dynv6.net/
url: https://elecviews67.dynv6.net/
url: https://nids33.dynv6.net/
url: https://elecviews43.dynv6.net/
url: https://nids30.dynv6.net/
url: https://myblog87s.dynv6.net/
url: https://elecviews92.dynv6.net/
url: https://edocview15.dynv6.net/
url: https://search38s.dynv6.net/
url: https://edocview14.dynv6.net/
url: https://elecviews23.dynv6.net/
url: https://com-login.dns.army/
url: https://kakao.com-login.dns.army/
url: https://elecviews44.dynv6.net/
url: https://nids59.dynv6.net/
url: https://join54s.dynv6.net/
url: https://elecviews21.dynv6.net/
url: https://myblog57s.dynv6.net/
url: https://elecviews33.dynv6.net/
url: https://elecviews37.dynv6.net/
url: https://nids7.dynv6.net/
url: https://police84s.dynv6.net/
url: https://edocview20.dynv6.net/
url: https://elecviews51.dynv6.net/
url: https://nids10.dynv6.net/
url: https://fetch81s.dynv6.net/
url: http://638807774991052514.athens-shledrc-acaz.info/login
url: http://638808705259632794.budapest-shledrc-acba.info/login
url: http://638800814946931618.berlin-shledrc-acap.info/login
url: http://638799693262986204.madrid-shledrc-acan.info/login
url: http://638808279286809264.malayer-shledrc-acaz.info/login
url: http://638799976464357707.lahijan-shledrc-acan.info/login
url: http://638800616981987041.dublin-shledrc-acao.info/login
url: http://638809434544857586.dublin-shledrc-acbb.info/login
url: http://638798112751129792.warsaw-shledrc-acak.info/login
url: http://638809712977746654.athens-shledrc-acbc.info/login
url: http://638798250265338711.kerman-shledrc-acak.info/login
url: http://638810089169181655.shiraz-shledrc-acbc.info/login
url: http://638808983049892586.birjand-shledrc-acba.info/login
url: http://638808714689308402.dublin-shledrc-acba.info/login
url: https://cgf.facturastbs.shop/a/08/150822/au/gerauto.php
url: https://cgf.facturastbs.shop/a/08/150822/au/gerapdf/blqs1
url: https://actisolution.com/
url: http://31.57.216.126/
url: http://docviews12.dynv6.net/
url: http://fetch33s.dynv6.net/
url: http://elecviews20.dynv6.net/
domain: jk6kmhz.luminousventurex.in.net
domain: 29dsasprosnowmeprona.za.com
domain: agaoutofoffice.com
domain: artsomewhere.com
domain: ashfordbathroomcentre.co.uk
domain: chriswhelan.co.uk
domain: classofcovid.org
domain: clsbellevaux.com
domain: condaoseatravel.com
domain: congngheanhsang.com
domain: dengedenetleme.org
domain: dreamroblox.com
domain: easystyle.it.com
domain: gatex.classofcovid.org
domain: gatex.www.dengedenetleme.org
domain: gurunanaknamkeen.in.net
domain: hxwatertreatment.com
domain: iepbritanico.com
domain: internetowa.tv
domain: kingbillydrinks.co.uk
domain: lanterna.ru.com
domain: lioisanigger-38893.portmap.host
domain: malware.29dsasprosnowmeprona.za.com
domain: malware.agaoutofoffice.com
domain: malware.artsomewhere.com
domain: malware.ashfordbathroomcentre.co.uk
domain: malware.chriswhelan.co.uk
domain: malware.clsbellevaux.com
domain: malware.condaoseatravel.com
domain: malware.congngheanhsang.com
domain: malware.easystyle.it.com
domain: malware.gurunanaknamkeen.in.net
domain: malware.hxwatertreatment.com
domain: malware.iepbritanico.com
domain: malware.internetowa.tv
domain: malware.kingbillydrinks.co.uk
domain: malware.lanterna.ru.com
domain: malware.newshop1.com
domain: malware.ochsenhuette.ch
domain: malware.phimsexhayvno.com
domain: malware.sacduc.net
domain: malware.skprojects.it.com
domain: malware.supersportsgifts.com
domain: malware.sweetshenanigansbakeshop.com
domain: malware.tuc.co.com
domain: malware.zonamaluku.com
domain: net10.webredirect.org
domain: rophim.fwh.is
domain: www.dengedwww.dengedenetleme.orgenetleme.org
file: 156.214.248.253
hash: 7771
file: 172.105.180.51
hash: 10831
file: 172.105.180.51
hash: 12350
file: 172.105.180.51
hash: 6767
domain: anonymous5007.duckdns.org
domain: v2.www.dengedenetleme.org
domain: v3.www.dengedenetleme.org
file: 193.179.33.247
hash: 8848
domain: barodh2ckerr-36722.portmap.host
domain: gtsavedatmustafa.ddns.net
domain: reversemalokin.ddns.net
domain: sc88.ad
domain: cleards.uk.com
domain: biomolecular-archaeology.com
domain: malware.biomolecular-archaeology.com
domain: parhazart.org
domain: malware.parhazart.org
domain: xoilacxyh.tv
domain: malware.xoilacxyh.tv
domain: saturnexplorer.4nmn.com
domain: davidwinkle-32841.portmap.host
domain: nrlo.net
file: 104.37.175.60
hash: 40164
url: http://91.214.78.81
url: https://pastebin.com/raw/bukerxvj
url: http://37.1.213.84
domain: lixcerxo0x-61297.portmap.host
file: 113.44.44.102
hash: 6666
file: 113.44.44.102
hash: 8888
file: 113.44.44.102
hash: 8012
domain: batdunya.com
file: 82.26.74.215
hash: 964
domain: mail-srv.com
domain: harnivo.cfd
domain: k3rne8-phase.luminousventurex.in.net
domain: syntgrani.echelonprospera.in.net
domain: densrunw.vertexharbinger.in.net
domain: petalshoal.skyl1neoak.in.net
domain: deltblend.skyl1neoak.in.net
domain: merfluxen2.si1vermuse.in.net
domain: silve-scale.si1vermuse.in.net
domain: solarcres.si1vermuse.in.net
domain: gzcj.silvermuse.in.net
domain: my07cfit.silvermuse.in.net
domain: arkvenum2.silvermuse.in.net
domain: torren5-plate.quillridge.in.net
domain: manif-graph.quillridge.in.net
domain: processblo.quillridge.in.net
domain: shadowdispatch.quillridge.in.net
domain: r9y47.quillridge.in.net
domain: trustedotter.n1ghtbloom.in.net
domain: wlikkfq.n1ghtbloom.in.net
domain: geyserclient.n1ghtbloom.in.net
domain: import-loop.n1ghtbloom.in.net
domain: arnb3r-line.n1ghtbloom.in.net
url: https://web-security.beer/api/css.js
domain: betaworkercf.org
url: https://betaworkercf.org/api/css.js
domain: woodspeci.stormcove.in.net
domain: quorfluxet.stormcove.in.net
url: https://microblob.bond/cf.js
url: https://productionmaza.bond/cf.js
url: https://productionmaza.cfd/cf.js
domain: ahbn5c.stormcove.in.net
domain: qu1c-mesh.stormcove.in.net
domain: entreprise-docs-secure.online
url: https://entreprise-docs-secure.online
url: http://46.165.215.116/032.txt
url: http://46.165.215.116/031.txt
domain: norspireen5.stormcove.in.net
domain: raven-core.foxwhirl.in.net
domain: 0dxtenvl.foxwhirl.in.net
file: 193.222.99.18
hash: 3000
url: https://filesand.lol
domain: oohdvj.foxwhirl.in.net
domain: bot.pay-portal.pro
url: https://bot.pay-portal.pro
domain: azuregrowth.foxwhirl.in.net
domain: wint-node.foxwhirl.in.net
domain: icegri.mosslark.in.net
domain: fly888z.com
domain: inspiration.ru.com
domain: malware.xoilaczzzzk.tv
domain: rophims.net
domain: loikks.za.com
domain: hydroflask.sa.com
domain: authcraft.mosslark.in.net
domain: security-check-291.pages.dev
url: https://security-check-291.pages.dev
domain: brigh-orche.mosslark.in.net
url: https://files-oss-cdn.oss-ap-southeast-1.aliyuncs.com/readme.gz
domain: fabv2b.mosslark.in.net
domain: alignaudio.mosslark.in.net
domain: storefield.cr0wnfern.in.net
domain: spruc39-dock.cr0wnfern.in.net
domain: dynmarkon.cr0wnfern.in.net
domain: mof4x8.cr0wnfern.in.net
url: http://8.217.174.149:8888/supershell/login/
domain: nor-lithor.cr0wnfern.in.net
domain: 0colppvc.ironvale.in.net
domain: brandpale.ironvale.in.net
domain: vor-crestex.ironvale.in.net
domain: arkspireix.zenithventurex.in.net
domain: tri-crestar.zenithventurex.in.net
domain: smesharik.bond
url: https://smesharik.bond/cf.js
domain: lumvale4en.zenithventurex.in.net
url: https://smesharik.bond/api/index.php
url: https://smesharik.bond/log.php
file: 193.233.19.97
hash: 5485
file: 87.120.117.209
hash: 7000
domain: microbecip.zenithventurex.in.net
url: http://185.208.156.151
domain: xoilac86kb.tv
domain: malware.xoilac86kb.tv
url: http://195.3.223.218/blob/owner.api
domain: p4yl-phase.zenithventurex.in.net
domain: 1earn-scope.zenithventurex.in.net
domain: 8aij4a.radiantharbinger.in.net
domain: gloscarrie.radiantharbinger.in.net
domain: sparr04-path.radiantharbinger.in.net
url: https://klikshop.buzz/kibo.txt
domain: klikshop.buzz
url: https://klikshop.buzz/ygropryn.msi
domain: hyper-tr4cke.radiantharbinger.in.net
domain: plassplit.radiantharbinger.in.net
domain: rybfb.radiantharbinger.in.net
domain: binsap.latticeprospera.in.net
domain: warm-grid.latticeprospera.in.net
domain: vzf6.latticeprospera.in.net
domain: pingla.latticeprospera.in.net
domain: massivepatte.latticeprospera.in.net
domain: ss86rj.latticeprospera.in.net
domain: 794kd31.covenantpatronage.in.net
file: 47.104.214.32
hash: 1234
domain: darkholocron.viewdns.net
domain: 2020business.uk.com
file: 185.73.126.186
hash: 8808
domain: fzotnmreqj.localto.net
domain: otzv.covenantpatronage.in.net
domain: 362fon24.covenantpatronage.in.net
domain: gpkvcvl.covenantpatronage.in.net
domain: velmarkon.covenantpatronage.in.net
domain: 019a.covenantpatronage.in.net
file: 89.163.135.20
hash: 8428
domain: ytun75fm.momentumventurex.in.net
domain: nnwjaigh1h.localto.net
domain: hlhni.momentumventurex.in.net
file: 66.85.26.91
hash: 3132
domain: hpi496.momentumventurex.in.net
domain: fierter.momentumventurex.in.net
domain: visu-line.momentumventurex.in.net
url: http://167.179.66.31:8888/supershell/login/
file: 167.179.66.31
hash: 8888
domain: sfjgv.momentumventurex.in.net
domain: quorvale2or.quantumpatronage.in.net
domain: gidwwlm.quantumpatronage.in.net
domain: br0o-wave.quantumpatronage.in.net
domain: vorcoreen8.quantumpatronage.in.net
domain: impor-hinge.quantumpatronage.in.net
domain: dz0ly973.quantumpatronage.in.net
domain: b7vwxeo.paragonprospera.in.net
domain: noblebalan.paragonprospera.in.net
domain: blenddense.paragonprospera.in.net
domain: solvale4a.paragonprospera.in.net
domain: g51vxer.paragonprospera.in.net
domain: lgwdtq.paragonprospera.in.net
domain: sparrowpine.apexharbinger.in.net
domain: pcep.apexharbinger.in.net
domain: uishg.apexharbinger.in.net
domain: evpsbokvqh.localto.net
domain: zrsexetk0.localto.net
domain: merfluxar8.apexharbinger.in.net
domain: 69hjs0.apexharbinger.in.net
domain: mz48d.apexharbinger.in.net
domain: vor-lineet.latticeharbora.in.net
file: 158.94.211.65
hash: 9000
file: 81.91.176.231
hash: 443
domain: drawvall.latticeharbora.in.net
domain: wswzw.latticeharbora.in.net
url: https://optimize.lat/ginhwymuhputzohnzl
domain: travelwes.latticeharbora.in.net
domain: sampl-cav.latticeharbora.in.net
domain: adapterlog.latticeharbora.in.net
file: 45.146.130.131
hash: 443
domain: sabet7.cfd
domain: exposedsnow.buzz
domain: warsaw-shleprx-aaae.info
domain: hamedan-shleprx-aaaf.info
domain: bandar-shleprx-aaag.info
domain: amsterdam-shleprx-aaah.info
domain: yasuj-shleprx-aaaf.info
domain: qazvin-shleprx-aaam.info
domain: paris-shleprx-aaal.info
domain: london-shleprx-aaae.info
domain: neyshabur-shleprx-aaai.info
domain: stockholm-shleprx-aaaj.info
domain: curiousdrift.radiantventurex.in.net
domain: soli-cast.radiantventurex.in.net
domain: qhsgsm.radiantventurex.in.net
domain: snbz.radiantventurex.in.net
domain: opt1-chain.radiantventurex.in.net
domain: hruckb.radiantventurex.in.net
domain: auth-secure.structuralgridhub.in.net
domain: malware.xoilaczzzze.tv
domain: api-cluster.structuralgridhub.in.net
domain: 17prosnowmeprona.za.com
domain: egroup.uk.net
domain: stp.ru.com
domain: backstreet.uk.com
domain: 2267.cn.com
domain: xixixisad-37873.portmap.host
url: https://patrmpf.cyou
file: 206.238.180.6
hash: 5555
url: https://95.217.10.109:7820/c5c0e9148d35f/xk3mtjn3.cur1k
domain: data-vault.structuralgridhub.in.net
domain: cdn-static.structuralgridhub.in.net
domain: log-monitor.structuralgridhub.in.net
domain: edge-proxy.structuralgridhub.in.net
domain: waypoint-alfa.navigationalpath.in.net
file: 23.94.145.120
hash: 9999
domain: route-engine.navigationalpath.in.net
domain: geo-spatial.navigationalpath.in.net
domain: trace-beacon.navigationalpath.in.net
domain: vector-base.navigationalpath.in.net
domain: mapping-svc.navigationalpath.in.net
domain: core-lattice.reinforcedmatrix.in.net
domain: fiber-optic.reinforcedmatrix.in.net
domain: mesh-gateway.reinforcedmatrix.in.net
domain: shield-relay.reinforcedmatrix.in.net
domain: tensor-unit.reinforcedmatrix.in.net
url: https://optimize.lat/assets/landings/bsod/js/loader.js
url: https://optimize.lat/assets/landings/cloudflare/js/loader.js
domain: grid-backbone.reinforcedmatrix.in.net
url: https://optimize.lat/assets/landings/cloudflare2/js/loader.js
url: https://optimize.lat/assets/landings/recaptcha/js/loader.js
url: https://optimize.lat/assets/landings/recaptcha2/
domain: base-logic.foundationmetric.in.net
domain: root-access.foundationmetric.in.net
url: https://www.giulioterrinoni.it/wps.lic
domain: audit-trail.foundationmetric.in.net
domain: atex.xoilaczzzze.tv
domain: backup.xoilaczzzze.tv
domain: data.xoilaczzzze.tv
domain: ddos.xoilaczzzze.tv
domain: phishing.xoilaczzzze.tv
domain: quantri.xoilaczzzze.tv
domain: v2.xoilaczzzze.tv
domain: v3.xoilaczzzze.tv
domain: stat-collector.foundationmetric.in.net
domain: legacy-bridge.foundationmetric.in.net
domain: index-master.foundationmetric.in.net
domain: sync-portal.alignmentstorage.in.net
domain: block-storage.alignmentstorage.in.net
domain: file-share.alignmentstorage.in.net
domain: cache-node.alignmentstorage.in.net
domain: backup-hub.alignmentstorage.in.net
domain: archive-site.alignmentstorage.in.net
domain: span-control.cantileverbridge.in.net
domain: load-balancer.cantileverbridge.in.net
domain: stress-test.cantileverbridge.in.net
domain: beam-handler.cantileverbridge.in.net
domain: truss-api.cantileverbridge.in.net
domain: arch-tunnel.cantileverbridge.in.net
domain: high-point.elevationnodebox.in.net
domain: top-tier.elevationnodebox.in.net
domain: peak-traffic.elevationnodebox.in.net
domain: level-check.elevationnodebox.in.net
domain: summit-dev.elevationnodebox.in.net
domain: alt-server.elevationnodebox.in.net
domain: balanced-io.symmetricalflow.in.net
domain: mirror-sync.symmetricalflow.in.net
domain: sendfiletiahforem.duckdns.org
domain: dremom2.duckdns.org
domain: cavps7.duckdns.org
domain: goodab.duckdns.org
domain: dual-stream.symmetricalflow.in.net
domain: malware.qatarhandball2015.com
domain: sigmaboy1234567-46132.portmap.host
domain: acannaaaaa-46963.portmap.host
file: 217.43.209.189
hash: 6666
domain: equal-logic.symmetricalflow.in.net
domain: match-point.symmetricalflow.in.net
domain: pair-connect.symmetricalflow.in.net
domain: main-conduit.integratedduct.in.net
domain: flow-sensor.integratedduct.in.net
domain: vent-access.integratedduct.in.net
domain: pipe-line.integratedduct.in.net
domain: drain-gate.integratedduct.in.net
domain: core-tunnel.integratedduct.in.net
domain: map-overlay.topographictrace.in.net
domain: chart-plotter.topographictrace.in.net
domain: point-cloud.topographictrace.in.net
domain: relief-view.topographictrace.in.net
domain: contour-api.topographictrace.in.net
domain: survey-data.topographictrace.in.net
domain: dense-pack.compressionlayer.in.net
domain: zip-archive.compressionlayer.in.net
domain: shrink-node.compressionlayer.in.net
domain: flat-buffer.compressionlayer.in.net
domain: codec-proxy.compressionlayer.in.net
domain: raw-stream.compressionlayer.in.net
domain: fast-track.velocityterminal.in.net
domain: rapid-fire.velocityterminal.in.net
domain: boost-engine.velocityterminal.in.net
domain: shift-ctrl.velocityterminal.in.net
domain: quick-step.velocityterminal.in.net

ThreatFox IOCs for 2026-03-29

Severity: medium

Type: malware

ThreatFox IOCs for 2026-03-29

Technical Summary

Potential Impact

Mitigation Recommendations

Affected Countries

United States, Germany, United Kingdom, France, Japan, South Korea, Australia, Canada, Netherlands, India

Indicators of Compromise

file: 24.152.36.243
hash: 3000
domain: amoboobs.com
file: 64.89.163.230
hash: 80
hash: fb3e6d6bb2781c8a737c38f4d31beed93a89cc2ff9b8c00e7682f04c72fd9a60
hash: ab78edbfdaebc11a34625d71709113cbb3f8e10d4699bc8dbddb966ea2efff03
hash: c22d94a2652a4689a73d845e127157de986b72669aabf1c4fefc0f789646895b
hash: 371d72144e3862bbb3ce66821e47232c8a08eba166f13cade5bfaad1e1a6ab7d
hash: 563ae5a1263eaa065b1a193870343637cc7650ccf0d8f6ff75f47906f3e85c0f
hash: 6d140e07afb62c3fe9e60763993f1f0edf3e0c5421e693885b79a5fe5d91f14f
hash: 6e676252d9b29e1e9caa7b24cad834bc53a41c4d55ed466a9fdebc30a74322b3
domain: trueforceteam.ru
domain: easytrueforce.shop
url: http://91.92.243.119/git.ps1
url: http://91.92.243.119/stlr/git.exe
url: http://91.92.243.119/steam/lemon.exe
url: http://91.92.243.119/rat/global.exe
file: 91.92.243.119
hash: 80
file: 5.45.74.46
hash: 443
file: 24.248.236.7
hash: 8009
file: 45.156.87.17
hash: 80
file: 176.65.139.81
hash: 3778
file: 43.251.226.93
hash: 8089
file: 147.45.67.96
hash: 443
file: 178.236.252.123
hash: 443
file: 193.233.113.146
hash: 443
file: 80.89.224.162
hash: 443
file: 87.251.69.215
hash: 443
file: 45.89.60.96
hash: 443
file: 213.176.16.150
hash: 443
file: 193.221.200.80
hash: 443
file: 85.137.253.238
hash: 443
file: 147.45.67.154
hash: 443
file: 77.91.65.57
hash: 443
file: 185.107.74.93
hash: 443
file: 94.141.122.192
hash: 443
file: 91.84.107.67
hash: 443
file: 89.124.85.209
hash: 443
file: 178.236.252.130
hash: 443
file: 185.157.215.29
hash: 443
file: 144.124.230.251
hash: 443
file: 144.124.231.93
hash: 443
file: 147.45.67.29
hash: 443
file: 89.124.66.157
hash: 443
file: 89.124.77.219
hash: 443
file: 77.246.104.168
hash: 443
file: 144.124.245.176
hash: 443
file: 91.84.119.156
hash: 443
file: 146.103.113.32
hash: 443
file: 212.118.42.217
hash: 443
file: 46.149.76.165
hash: 443
file: 193.33.195.37
hash: 443
file: 89.110.64.191
hash: 443
file: 77.246.99.223
hash: 443
file: 89.110.115.9
hash: 443
file: 146.103.104.188
hash: 443
file: 195.26.227.103
hash: 443
file: 77.105.136.194
hash: 443
file: 154.36.188.20
hash: 443
domain: accounts.google.seclogistic.com
domain: workspaces.dynv6.net
domain: taxhelp6.dynv6.net
domain: nid.naver.courter.com
url: https://during.bong889.com/
url: https://dev.betway071.com/
domain: communicationfirewall-security.cc
domain: favourite-guide.cc
domain: geo-foundation.vg
domain: sentinel1-endpoint-security.cc
file: 85.121.148.13
hash: 443
file: 94.26.106.134
hash: 443
domain: cl2point.vectorpatronage.in.net
url: https://suaracitizen.com/
url: https://question-climatisation.com/
domain: cl3view.vectorpatronage.in.net
domain: cl4path.vectorpatronage.in.net
domain: dev1proc.nexusprospera.in.net
domain: escofiringbijou.com
domain: elizabethquinncmclibrary.com
domain: disp-graphics.com
file: 91.236.230.154
hash: 443
hash: b7ef4985662625c45955db295d949e04fd0a9fd5c8ce0c6a3bcb68e4a06c16e4
domain: dev2outer.nexusprospera.in.net
domain: dev3field.nexusprospera.in.net
domain: dev4space.nexusprospera.in.net
domain: svc1proc.quantumventurex.in.net
domain: svc2steel.quantumventurex.in.net
domain: ms365-team.com
domain: florida-grower.com
domain: endpointmapperprocess.com
domain: wmds946t.life
domain: pepedrop.yachts
file: 91.236.230.17
hash: 443
file: 91.236.230.220
hash: 443
domain: svc3core.quantumventurex.in.net
domain: svc4sat.quantumventurex.in.net
url: http://45.205.2.53:8888/supershell/login/
file: 45.205.2.53
hash: 8888
domain: ext1infra.paragonharbinger.in.net
domain: ext2proxy.paragonharbinger.in.net
domain: ext3data.paragonharbinger.in.net
domain: ext4point.paragonharbinger.in.net
domain: cl1sync.spectrumprospera.in.net
domain: cl2data.spectrumprospera.in.net
domain: cl3edge.spectrumprospera.in.net
domain: cl4static.spectrumprospera.in.net
domain: ext1meta.keystonepatronage.in.net
domain: ext2proc.keystonepatronage.in.net
domain: ext3gate.keystonepatronage.in.net
domain: ext4sync.keystonepatronage.in.net
domain: cl1store.luminousventurex.in.net
domain: cl2remote.luminousventurex.in.net
domain: cl3dev.luminousventurex.in.net
domain: cl4link.luminousventurex.in.net
domain: dev1proc.echelonprospera.in.net
domain: dev2power.echelonprospera.in.net
domain: dev3local.echelonprospera.in.net
domain: dev4work.echelonprospera.in.net
domain: svc1infra.vertexharbinger.in.net
domain: svc2base.vertexharbinger.in.net
domain: svc3user.vertexharbinger.in.net
domain: svc4link.vertexharbinger.in.net
file: 91.236.230.17
hash: 993
file: 91.236.230.220
hash: 443
file: 91.236.230.229
hash: 5000
domain: ms365-team.com
domain: florida-grower.com
domain: tmegramapps.com
domain: endpointmapperprocess.com
domain: pepedrop.yachts
domain: proto-wi1d.zenithprospera.in.net
domain: binarydelive.zenithprospera.in.net
file: 54.172.72.215
hash: 4443
file: 213.139.205.131
hash: 80
domain: cliencampa.radiantpatronage.in.net
domain: rende-trig.radiantpatronage.in.net
domain: lfgs.latticeharbinger.in.net
domain: apgjh.latticeharbinger.in.net
domain: reviewglyph.covenantprospera.in.net
domain: compi-vault.covenantprospera.in.net
domain: pitchreed.apexventurex.in.net
domain: loadmatr.apexventurex.in.net
domain: hyper-opt1.momentumprospera.in.net
domain: grasand.momentumprospera.in.net
domain: 1ukqsofb.vectorpatronage.in.net
domain: wgnh.vectorpatronage.in.net
domain: spk77w.nexusprospera.in.net
domain: sol-lithos.nexusprospera.in.net
domain: du5k-cast.quantumventurex.in.net
domain: islelaunch.quantumventurex.in.net
domain: rave-branch.paragonharbinger.in.net
domain: tensor-line.paragonharbinger.in.net
domain: dr80gbyv.spectrumprospera.in.net
url: https://movinty.digital/
domain: cap1ta-flow.spectrumprospera.in.net
domain: 1nsight-route.keystonepatronage.in.net
file: 45.221.118.180
hash: 8443
file: 47.86.32.50
hash: 7777
file: 80.94.95.26
hash: 8443
file: 117.72.242.9
hash: 50050
file: 8.134.60.248
hash: 50050
file: 37.120.239.48
hash: 443
file: 193.26.115.72
hash: 31337
file: 104.129.51.142
hash: 31337
file: 107.173.12.94
hash: 31337
file: 47.121.136.51
hash: 31337
file: 158.220.121.73
hash: 31337
file: 152.228.129.105
hash: 31337
file: 194.163.132.140
hash: 31337
file: 145.239.71.119
hash: 31337
file: 170.64.254.183
hash: 31337
file: 85.192.27.126
hash: 31337
file: 185.225.226.125
hash: 31337
file: 103.207.68.46
hash: 31337
file: 62.204.35.57
hash: 31337
file: 165.227.148.132
hash: 31337
file: 216.203.20.29
hash: 31337
file: 192.169.7.17
hash: 31337
file: 167.148.183.75
hash: 31337
file: 61.184.8.207
hash: 443
file: 39.96.188.70
hash: 443
file: 47.112.6.30
hash: 443
file: 4.224.18.187
hash: 3333
file: 122.170.96.200
hash: 3333
file: 49.235.85.108
hash: 3333
file: 135.125.53.28
hash: 80
file: 135.125.53.28
hash: 443
file: 80.71.224.121
hash: 3333
file: 67.253.162.122
hash: 8080
file: 20.123.89.181
hash: 8080
file: 18.118.39.18
hash: 443
file: 176.111.220.168
hash: 443
file: 118.194.248.158
hash: 443
file: 167.179.76.179
hash: 4433
file: 190.100.187.183
hash: 81
file: 178.16.55.99
hash: 7443
file: 173.211.46.116
hash: 2850
file: 178.16.52.58
hash: 1337
file: 151.59.122.136
hash: 8080
file: 110.38.217.97
hash: 54545
domain: icfsj.keystonepatronage.in.net
url: https://der03.top/
url: https://kke03.top/
url: https://ysp06.top/
url: https://ppio10.top/
url: https://47.243.157.232/
url: https://8.217.163.200/
url: https://134.122.194.187/
url: https://67.209.176.243/
url: https://64.188.30.169/
url: https://8.218.245.128/
url: https://47.243.154.43/
url: https://47.242.218.25/
url: https://47.83.238.253/
url: https://104.168.148.210/
url: https://47.242.207.99/
url: https://47.242.179.21/
url: https://104.233.246.210/
url: https://jrv.gaga3.top/
url: https://luanluan821.top/
url: https://host.vasslli.top/
url: https://liux16.top/
url: https://mecurry.top/
url: https://47.243.157.77/
url: https://47.83.208.201/
url: https://decorator.top/
url: https://2.56.255.159/
url: https://47.239.244.75/
url: https://shitongyao.site/
url: https://docviews34.dynv6.net/
url: https://elecviews56.dynv6.net/
url: https://nids25.dynv6.net/
url: https://docviews37.dynv6.net/
url: https://nids67.dynv6.net/
url: https://elecviews90.dynv6.net/
url: https://elecviews69.dynv6.net/
url: https://elecviews67.dynv6.net/
url: https://nids33.dynv6.net/
url: https://elecviews43.dynv6.net/
url: https://nids30.dynv6.net/
url: https://myblog87s.dynv6.net/
url: https://elecviews92.dynv6.net/
url: https://edocview15.dynv6.net/
url: https://search38s.dynv6.net/
url: https://edocview14.dynv6.net/
url: https://elecviews23.dynv6.net/
url: https://com-login.dns.army/
url: https://kakao.com-login.dns.army/
url: https://elecviews44.dynv6.net/
url: https://nids59.dynv6.net/
url: https://join54s.dynv6.net/
url: https://elecviews21.dynv6.net/
url: https://myblog57s.dynv6.net/
url: https://elecviews33.dynv6.net/
url: https://elecviews37.dynv6.net/
url: https://nids7.dynv6.net/
url: https://police84s.dynv6.net/
url: https://edocview20.dynv6.net/
url: https://elecviews51.dynv6.net/
url: https://nids10.dynv6.net/
url: https://fetch81s.dynv6.net/
url: http://638807774991052514.athens-shledrc-acaz.info/login
url: http://638808705259632794.budapest-shledrc-acba.info/login
url: http://638800814946931618.berlin-shledrc-acap.info/login
url: http://638799693262986204.madrid-shledrc-acan.info/login
url: http://638808279286809264.malayer-shledrc-acaz.info/login
url: http://638799976464357707.lahijan-shledrc-acan.info/login
url: http://638800616981987041.dublin-shledrc-acao.info/login
url: http://638809434544857586.dublin-shledrc-acbb.info/login
url: http://638798112751129792.warsaw-shledrc-acak.info/login
url: http://638809712977746654.athens-shledrc-acbc.info/login
url: http://638798250265338711.kerman-shledrc-acak.info/login
url: http://638810089169181655.shiraz-shledrc-acbc.info/login
url: http://638808983049892586.birjand-shledrc-acba.info/login
url: http://638808714689308402.dublin-shledrc-acba.info/login
url: https://cgf.facturastbs.shop/a/08/150822/au/gerauto.php
url: https://cgf.facturastbs.shop/a/08/150822/au/gerapdf/blqs1
url: https://actisolution.com/
url: http://31.57.216.126/
url: http://docviews12.dynv6.net/
url: http://fetch33s.dynv6.net/
url: http://elecviews20.dynv6.net/
domain: jk6kmhz.luminousventurex.in.net
domain: 29dsasprosnowmeprona.za.com
domain: agaoutofoffice.com
domain: artsomewhere.com
domain: ashfordbathroomcentre.co.uk
domain: chriswhelan.co.uk
domain: classofcovid.org
domain: clsbellevaux.com
domain: condaoseatravel.com
domain: congngheanhsang.com
domain: dengedenetleme.org
domain: dreamroblox.com
domain: easystyle.it.com
domain: gatex.classofcovid.org
domain: gatex.www.dengedenetleme.org
domain: gurunanaknamkeen.in.net
domain: hxwatertreatment.com
domain: iepbritanico.com
domain: internetowa.tv
domain: kingbillydrinks.co.uk
domain: lanterna.ru.com
domain: lioisanigger-38893.portmap.host
domain: malware.29dsasprosnowmeprona.za.com
domain: malware.agaoutofoffice.com
domain: malware.artsomewhere.com
domain: malware.ashfordbathroomcentre.co.uk
domain: malware.chriswhelan.co.uk
domain: malware.clsbellevaux.com
domain: malware.condaoseatravel.com
domain: malware.congngheanhsang.com
domain: malware.easystyle.it.com
domain: malware.gurunanaknamkeen.in.net
domain: malware.hxwatertreatment.com
domain: malware.iepbritanico.com
domain: malware.internetowa.tv
domain: malware.kingbillydrinks.co.uk
domain: malware.lanterna.ru.com
domain: malware.newshop1.com
domain: malware.ochsenhuette.ch
domain: malware.phimsexhayvno.com
domain: malware.sacduc.net
domain: malware.skprojects.it.com
domain: malware.supersportsgifts.com
domain: malware.sweetshenanigansbakeshop.com
domain: malware.tuc.co.com
domain: malware.zonamaluku.com
domain: net10.webredirect.org
domain: rophim.fwh.is
domain: www.dengedwww.dengedenetleme.orgenetleme.org
file: 156.214.248.253
hash: 7771
file: 172.105.180.51
hash: 10831
file: 172.105.180.51
hash: 12350
file: 172.105.180.51
hash: 6767
domain: anonymous5007.duckdns.org
domain: v2.www.dengedenetleme.org
domain: v3.www.dengedenetleme.org
file: 193.179.33.247
hash: 8848
domain: barodh2ckerr-36722.portmap.host
domain: gtsavedatmustafa.ddns.net
domain: reversemalokin.ddns.net
domain: sc88.ad
domain: cleards.uk.com
domain: biomolecular-archaeology.com
domain: malware.biomolecular-archaeology.com
domain: parhazart.org
domain: malware.parhazart.org
domain: xoilacxyh.tv
domain: malware.xoilacxyh.tv
domain: saturnexplorer.4nmn.com
domain: davidwinkle-32841.portmap.host
domain: nrlo.net
file: 104.37.175.60
hash: 40164
url: http://91.214.78.81
url: https://pastebin.com/raw/bukerxvj
url: http://37.1.213.84
domain: lixcerxo0x-61297.portmap.host
file: 113.44.44.102
hash: 6666
file: 113.44.44.102
hash: 8888
file: 113.44.44.102
hash: 8012
domain: batdunya.com
file: 82.26.74.215
hash: 964
domain: mail-srv.com
domain: harnivo.cfd
domain: k3rne8-phase.luminousventurex.in.net
domain: syntgrani.echelonprospera.in.net
domain: densrunw.vertexharbinger.in.net
domain: petalshoal.skyl1neoak.in.net
domain: deltblend.skyl1neoak.in.net
domain: merfluxen2.si1vermuse.in.net
domain: silve-scale.si1vermuse.in.net
domain: solarcres.si1vermuse.in.net
domain: gzcj.silvermuse.in.net
domain: my07cfit.silvermuse.in.net
domain: arkvenum2.silvermuse.in.net
domain: torren5-plate.quillridge.in.net
domain: manif-graph.quillridge.in.net
domain: processblo.quillridge.in.net
domain: shadowdispatch.quillridge.in.net
domain: r9y47.quillridge.in.net
domain: trustedotter.n1ghtbloom.in.net
domain: wlikkfq.n1ghtbloom.in.net
domain: geyserclient.n1ghtbloom.in.net
domain: import-loop.n1ghtbloom.in.net
domain: arnb3r-line.n1ghtbloom.in.net
url: https://web-security.beer/api/css.js
domain: betaworkercf.org
url: https://betaworkercf.org/api/css.js
domain: woodspeci.stormcove.in.net
domain: quorfluxet.stormcove.in.net
url: https://microblob.bond/cf.js
url: https://productionmaza.bond/cf.js
url: https://productionmaza.cfd/cf.js
domain: ahbn5c.stormcove.in.net
domain: qu1c-mesh.stormcove.in.net
domain: entreprise-docs-secure.online
url: https://entreprise-docs-secure.online
url: http://46.165.215.116/032.txt
url: http://46.165.215.116/031.txt
domain: norspireen5.stormcove.in.net
domain: raven-core.foxwhirl.in.net
domain: 0dxtenvl.foxwhirl.in.net
file: 193.222.99.18
hash: 3000
url: https://filesand.lol
domain: oohdvj.foxwhirl.in.net
domain: bot.pay-portal.pro
url: https://bot.pay-portal.pro
domain: azuregrowth.foxwhirl.in.net
domain: wint-node.foxwhirl.in.net
domain: icegri.mosslark.in.net
domain: fly888z.com
domain: inspiration.ru.com
domain: malware.xoilaczzzzk.tv
domain: rophims.net
domain: loikks.za.com
domain: hydroflask.sa.com
domain: authcraft.mosslark.in.net
domain: security-check-291.pages.dev
url: https://security-check-291.pages.dev
domain: brigh-orche.mosslark.in.net
url: https://files-oss-cdn.oss-ap-southeast-1.aliyuncs.com/readme.gz
domain: fabv2b.mosslark.in.net
domain: alignaudio.mosslark.in.net
domain: storefield.cr0wnfern.in.net
domain: spruc39-dock.cr0wnfern.in.net
domain: dynmarkon.cr0wnfern.in.net
domain: mof4x8.cr0wnfern.in.net
url: http://8.217.174.149:8888/supershell/login/
domain: nor-lithor.cr0wnfern.in.net
domain: 0colppvc.ironvale.in.net
domain: brandpale.ironvale.in.net
domain: vor-crestex.ironvale.in.net
domain: arkspireix.zenithventurex.in.net
domain: tri-crestar.zenithventurex.in.net
domain: smesharik.bond
url: https://smesharik.bond/cf.js
domain: lumvale4en.zenithventurex.in.net
url: https://smesharik.bond/api/index.php
url: https://smesharik.bond/log.php
file: 193.233.19.97
hash: 5485
file: 87.120.117.209
hash: 7000
domain: microbecip.zenithventurex.in.net
url: http://185.208.156.151
domain: xoilac86kb.tv
domain: malware.xoilac86kb.tv
url: http://195.3.223.218/blob/owner.api
domain: p4yl-phase.zenithventurex.in.net
domain: 1earn-scope.zenithventurex.in.net
domain: 8aij4a.radiantharbinger.in.net
domain: gloscarrie.radiantharbinger.in.net
domain: sparr04-path.radiantharbinger.in.net
url: https://klikshop.buzz/kibo.txt
domain: klikshop.buzz
url: https://klikshop.buzz/ygropryn.msi
domain: hyper-tr4cke.radiantharbinger.in.net
domain: plassplit.radiantharbinger.in.net
domain: rybfb.radiantharbinger.in.net
domain: binsap.latticeprospera.in.net
domain: warm-grid.latticeprospera.in.net
domain: vzf6.latticeprospera.in.net
domain: pingla.latticeprospera.in.net
domain: massivepatte.latticeprospera.in.net
domain: ss86rj.latticeprospera.in.net
domain: 794kd31.covenantpatronage.in.net
file: 47.104.214.32
hash: 1234
domain: darkholocron.viewdns.net
domain: 2020business.uk.com
file: 185.73.126.186
hash: 8808
domain: fzotnmreqj.localto.net
domain: otzv.covenantpatronage.in.net
domain: 362fon24.covenantpatronage.in.net
domain: gpkvcvl.covenantpatronage.in.net
domain: velmarkon.covenantpatronage.in.net
domain: 019a.covenantpatronage.in.net
file: 89.163.135.20
hash: 8428
domain: ytun75fm.momentumventurex.in.net
domain: nnwjaigh1h.localto.net
domain: hlhni.momentumventurex.in.net
file: 66.85.26.91
hash: 3132
domain: hpi496.momentumventurex.in.net
domain: fierter.momentumventurex.in.net
domain: visu-line.momentumventurex.in.net
url: http://167.179.66.31:8888/supershell/login/
file: 167.179.66.31
hash: 8888
domain: sfjgv.momentumventurex.in.net
domain: quorvale2or.quantumpatronage.in.net
domain: gidwwlm.quantumpatronage.in.net
domain: br0o-wave.quantumpatronage.in.net
domain: vorcoreen8.quantumpatronage.in.net
domain: impor-hinge.quantumpatronage.in.net
domain: dz0ly973.quantumpatronage.in.net
domain: b7vwxeo.paragonprospera.in.net
domain: noblebalan.paragonprospera.in.net
domain: blenddense.paragonprospera.in.net
domain: solvale4a.paragonprospera.in.net
domain: g51vxer.paragonprospera.in.net
domain: lgwdtq.paragonprospera.in.net
domain: sparrowpine.apexharbinger.in.net
domain: pcep.apexharbinger.in.net
domain: uishg.apexharbinger.in.net
domain: evpsbokvqh.localto.net
domain: zrsexetk0.localto.net
domain: merfluxar8.apexharbinger.in.net
domain: 69hjs0.apexharbinger.in.net
domain: mz48d.apexharbinger.in.net
domain: vor-lineet.latticeharbora.in.net
file: 158.94.211.65
hash: 9000
file: 81.91.176.231
hash: 443
domain: drawvall.latticeharbora.in.net
domain: wswzw.latticeharbora.in.net
url: https://optimize.lat/ginhwymuhputzohnzl
domain: travelwes.latticeharbora.in.net
domain: sampl-cav.latticeharbora.in.net
domain: adapterlog.latticeharbora.in.net
file: 45.146.130.131
hash: 443
domain: sabet7.cfd
domain: exposedsnow.buzz
domain: warsaw-shleprx-aaae.info
domain: hamedan-shleprx-aaaf.info
domain: bandar-shleprx-aaag.info
domain: amsterdam-shleprx-aaah.info
domain: yasuj-shleprx-aaaf.info
domain: qazvin-shleprx-aaam.info
domain: paris-shleprx-aaal.info
domain: london-shleprx-aaae.info
domain: neyshabur-shleprx-aaai.info
domain: stockholm-shleprx-aaaj.info
domain: curiousdrift.radiantventurex.in.net
domain: soli-cast.radiantventurex.in.net
domain: qhsgsm.radiantventurex.in.net
domain: snbz.radiantventurex.in.net
domain: opt1-chain.radiantventurex.in.net
domain: hruckb.radiantventurex.in.net
domain: auth-secure.structuralgridhub.in.net
domain: malware.xoilaczzzze.tv
domain: api-cluster.structuralgridhub.in.net
domain: 17prosnowmeprona.za.com
domain: egroup.uk.net
domain: stp.ru.com
domain: backstreet.uk.com
domain: 2267.cn.com
domain: xixixisad-37873.portmap.host
url: https://patrmpf.cyou
file: 206.238.180.6
hash: 5555
url: https://95.217.10.109:7820/c5c0e9148d35f/xk3mtjn3.cur1k
domain: data-vault.structuralgridhub.in.net
domain: cdn-static.structuralgridhub.in.net
domain: log-monitor.structuralgridhub.in.net
domain: edge-proxy.structuralgridhub.in.net
domain: waypoint-alfa.navigationalpath.in.net
file: 23.94.145.120
hash: 9999
domain: route-engine.navigationalpath.in.net
domain: geo-spatial.navigationalpath.in.net
domain: trace-beacon.navigationalpath.in.net
domain: vector-base.navigationalpath.in.net
domain: mapping-svc.navigationalpath.in.net
domain: core-lattice.reinforcedmatrix.in.net
domain: fiber-optic.reinforcedmatrix.in.net
domain: mesh-gateway.reinforcedmatrix.in.net
domain: shield-relay.reinforcedmatrix.in.net
domain: tensor-unit.reinforcedmatrix.in.net
url: https://optimize.lat/assets/landings/bsod/js/loader.js
url: https://optimize.lat/assets/landings/cloudflare/js/loader.js
domain: grid-backbone.reinforcedmatrix.in.net
url: https://optimize.lat/assets/landings/cloudflare2/js/loader.js
url: https://optimize.lat/assets/landings/recaptcha/js/loader.js
url: https://optimize.lat/assets/landings/recaptcha2/
domain: base-logic.foundationmetric.in.net
domain: root-access.foundationmetric.in.net
url: https://www.giulioterrinoni.it/wps.lic
domain: audit-trail.foundationmetric.in.net
domain: atex.xoilaczzzze.tv
domain: backup.xoilaczzzze.tv
domain: data.xoilaczzzze.tv
domain: ddos.xoilaczzzze.tv
domain: phishing.xoilaczzzze.tv
domain: quantri.xoilaczzzze.tv
domain: v2.xoilaczzzze.tv
domain: v3.xoilaczzzze.tv
domain: stat-collector.foundationmetric.in.net
domain: legacy-bridge.foundationmetric.in.net
domain: index-master.foundationmetric.in.net
domain: sync-portal.alignmentstorage.in.net
domain: block-storage.alignmentstorage.in.net
domain: file-share.alignmentstorage.in.net
domain: cache-node.alignmentstorage.in.net
domain: backup-hub.alignmentstorage.in.net
domain: archive-site.alignmentstorage.in.net
domain: span-control.cantileverbridge.in.net
domain: load-balancer.cantileverbridge.in.net
domain: stress-test.cantileverbridge.in.net
domain: beam-handler.cantileverbridge.in.net
domain: truss-api.cantileverbridge.in.net
domain: arch-tunnel.cantileverbridge.in.net
domain: high-point.elevationnodebox.in.net
domain: top-tier.elevationnodebox.in.net
domain: peak-traffic.elevationnodebox.in.net
domain: level-check.elevationnodebox.in.net
domain: summit-dev.elevationnodebox.in.net
domain: alt-server.elevationnodebox.in.net
domain: balanced-io.symmetricalflow.in.net
domain: mirror-sync.symmetricalflow.in.net
domain: sendfiletiahforem.duckdns.org
domain: dremom2.duckdns.org
domain: cavps7.duckdns.org
domain: goodab.duckdns.org
domain: dual-stream.symmetricalflow.in.net
domain: malware.qatarhandball2015.com
domain: sigmaboy1234567-46132.portmap.host
domain: acannaaaaa-46963.portmap.host
file: 217.43.209.189
hash: 6666
domain: equal-logic.symmetricalflow.in.net
domain: match-point.symmetricalflow.in.net
domain: pair-connect.symmetricalflow.in.net
domain: main-conduit.integratedduct.in.net
domain: flow-sensor.integratedduct.in.net
domain: vent-access.integratedduct.in.net
domain: pipe-line.integratedduct.in.net
domain: drain-gate.integratedduct.in.net
domain: core-tunnel.integratedduct.in.net
domain: map-overlay.topographictrace.in.net
domain: chart-plotter.topographictrace.in.net
domain: point-cloud.topographictrace.in.net
domain: relief-view.topographictrace.in.net
domain: contour-api.topographictrace.in.net
domain: survey-data.topographictrace.in.net
domain: dense-pack.compressionlayer.in.net
domain: zip-archive.compressionlayer.in.net
domain: shrink-node.compressionlayer.in.net
domain: flat-buffer.compressionlayer.in.net
domain: codec-proxy.compressionlayer.in.net
domain: raw-stream.compressionlayer.in.net
domain: fast-track.velocityterminal.in.net
domain: rapid-fire.velocityterminal.in.net
domain: boost-engine.velocityterminal.in.net
domain: shift-ctrl.velocityterminal.in.net
domain: quick-step.velocityterminal.in.net

Source: ThreatFox MISP Feed

Published: Sun Mar 29 2026

ThreatFox IOCs for 2026-03-29

Medium

Malwaretype:osint tlp:white

Published: Sun Mar 29 2026 (03/29/2026, 00:00:00 UTC)

Source: ThreatFox MISP Feed

Vendor/Project: type

Product: osint

Description

ThreatFox IOCs for 2026-03-29

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 03/30/2026, 00:08:17 UTC

Technical Analysis

Potential Impact

Mitigation Recommendations

Affected Countries

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Threat Level: 2
Analysis: 1
Distribution: 3
Uuid: d1731cc2-341c-4351-b975-f358887bfc81
Original Timestamp: 1774828987

Indicators of Compromise

File

Value	Description	Copy
file24.152.36.243	Winos botnet C2 server (confidence level: 75%)
file64.89.163.230	Stealc botnet C2 server (confidence level: 100%)
file91.92.243.119	Unknown Stealer payload delivery server (confidence level: 100%)
file5.45.74.46	Unknown malware botnet C2 server (confidence level: 50%)
file24.248.236.7	Xtreme RAT botnet C2 server (confidence level: 100%)
file45.156.87.17	Cobalt Strike payload delivery server (confidence level: 100%)
file176.65.139.81	Mirai botnet C2 server (confidence level: 80%)
file43.251.226.93	Cobalt Strike botnet C2 server (confidence level: 100%)
file147.45.67.96	ACR Stealer botnet C2 server (confidence level: 100%)
file178.236.252.123	ACR Stealer botnet C2 server (confidence level: 100%)
file193.233.113.146	ACR Stealer botnet C2 server (confidence level: 100%)
file80.89.224.162	ACR Stealer botnet C2 server (confidence level: 100%)
file87.251.69.215	ACR Stealer botnet C2 server (confidence level: 100%)
file45.89.60.96	ACR Stealer botnet C2 server (confidence level: 100%)
file213.176.16.150	ACR Stealer botnet C2 server (confidence level: 100%)
file193.221.200.80	ACR Stealer botnet C2 server (confidence level: 100%)
file85.137.253.238	ACR Stealer botnet C2 server (confidence level: 100%)
file147.45.67.154	ACR Stealer botnet C2 server (confidence level: 100%)
file77.91.65.57	ACR Stealer botnet C2 server (confidence level: 100%)
file185.107.74.93	ACR Stealer botnet C2 server (confidence level: 100%)
file94.141.122.192	ACR Stealer botnet C2 server (confidence level: 100%)
file91.84.107.67	ACR Stealer botnet C2 server (confidence level: 100%)
file89.124.85.209	ACR Stealer botnet C2 server (confidence level: 100%)
file178.236.252.130	ACR Stealer botnet C2 server (confidence level: 100%)
file185.157.215.29	ACR Stealer botnet C2 server (confidence level: 100%)
file144.124.230.251	ACR Stealer botnet C2 server (confidence level: 100%)
file144.124.231.93	ACR Stealer botnet C2 server (confidence level: 100%)
file147.45.67.29	ACR Stealer botnet C2 server (confidence level: 100%)
file89.124.66.157	ACR Stealer botnet C2 server (confidence level: 100%)
file89.124.77.219	ACR Stealer botnet C2 server (confidence level: 100%)
file77.246.104.168	ACR Stealer botnet C2 server (confidence level: 100%)
file144.124.245.176	ACR Stealer botnet C2 server (confidence level: 100%)
file91.84.119.156	ACR Stealer botnet C2 server (confidence level: 100%)
file146.103.113.32	ACR Stealer botnet C2 server (confidence level: 100%)
file212.118.42.217	ACR Stealer botnet C2 server (confidence level: 100%)
file46.149.76.165	ACR Stealer botnet C2 server (confidence level: 100%)
file193.33.195.37	ACR Stealer botnet C2 server (confidence level: 100%)
file89.110.64.191	ACR Stealer botnet C2 server (confidence level: 100%)
file77.246.99.223	ACR Stealer botnet C2 server (confidence level: 100%)
file89.110.115.9	ACR Stealer botnet C2 server (confidence level: 100%)
file146.103.104.188	ACR Stealer botnet C2 server (confidence level: 100%)
file195.26.227.103	ACR Stealer botnet C2 server (confidence level: 100%)
file77.105.136.194	ACR Stealer botnet C2 server (confidence level: 100%)
file154.36.188.20	Cobalt Strike botnet C2 server (confidence level: 100%)
file85.121.148.13	CountLoader botnet C2 server (confidence level: 75%)
file94.26.106.134	CountLoader botnet C2 server (confidence level: 75%)
file91.236.230.154	Unknown malware botnet C2 server (confidence level: 90%)
file91.236.230.17	BumbleBee payload delivery server (confidence level: 75%)
file91.236.230.220	BumbleBee payload delivery server (confidence level: 75%)
file45.205.2.53	Unknown malware botnet C2 server (confidence level: 100%)
file91.236.230.17	BumbleBee botnet C2 server (confidence level: 75%)
file91.236.230.220	BumbleBee botnet C2 server (confidence level: 75%)
file91.236.230.229	BumbleBee botnet C2 server (confidence level: 75%)
file54.172.72.215	Quasar RAT botnet C2 server (confidence level: 100%)
file213.139.205.131	BumbleBee botnet C2 server (confidence level: 90%)
file45.221.118.180	Cobalt Strike botnet C2 server (confidence level: 50%)
file47.86.32.50	Cobalt Strike botnet C2 server (confidence level: 50%)
file80.94.95.26	Cobalt Strike botnet C2 server (confidence level: 50%)
file117.72.242.9	Cobalt Strike botnet C2 server (confidence level: 50%)
file8.134.60.248	Cobalt Strike botnet C2 server (confidence level: 50%)
file37.120.239.48	Cobalt Strike botnet C2 server (confidence level: 50%)
file193.26.115.72	Sliver botnet C2 server (confidence level: 50%)
file104.129.51.142	Sliver botnet C2 server (confidence level: 50%)
file107.173.12.94	Sliver botnet C2 server (confidence level: 50%)
file47.121.136.51	Sliver botnet C2 server (confidence level: 50%)
file158.220.121.73	Sliver botnet C2 server (confidence level: 50%)
file152.228.129.105	Sliver botnet C2 server (confidence level: 50%)
file194.163.132.140	Sliver botnet C2 server (confidence level: 50%)
file145.239.71.119	Sliver botnet C2 server (confidence level: 50%)
file170.64.254.183	Sliver botnet C2 server (confidence level: 50%)
file85.192.27.126	Sliver botnet C2 server (confidence level: 50%)
file185.225.226.125	Sliver botnet C2 server (confidence level: 50%)
file103.207.68.46	Sliver botnet C2 server (confidence level: 50%)
file62.204.35.57	Sliver botnet C2 server (confidence level: 50%)
file165.227.148.132	Sliver botnet C2 server (confidence level: 50%)
file216.203.20.29	Sliver botnet C2 server (confidence level: 50%)
file192.169.7.17	Sliver botnet C2 server (confidence level: 50%)
file167.148.183.75	Sliver botnet C2 server (confidence level: 50%)
file61.184.8.207	Unknown malware botnet C2 server (confidence level: 50%)
file39.96.188.70	Unknown malware botnet C2 server (confidence level: 50%)
file47.112.6.30	Unknown malware botnet C2 server (confidence level: 50%)
file4.224.18.187	Unknown malware botnet C2 server (confidence level: 50%)
file122.170.96.200	Unknown malware botnet C2 server (confidence level: 50%)
file49.235.85.108	Unknown malware botnet C2 server (confidence level: 50%)
file135.125.53.28	Unknown malware botnet C2 server (confidence level: 50%)
file135.125.53.28	Unknown malware botnet C2 server (confidence level: 50%)
file80.71.224.121	Unknown malware botnet C2 server (confidence level: 50%)
file67.253.162.122	Unknown malware botnet C2 server (confidence level: 50%)
file20.123.89.181	Unknown malware botnet C2 server (confidence level: 50%)
file18.118.39.18	Unknown malware botnet C2 server (confidence level: 50%)
file176.111.220.168	Kimsuky botnet C2 server (confidence level: 50%)
file118.194.248.158	Kimsuky botnet C2 server (confidence level: 50%)
file167.179.76.179	Havoc botnet C2 server (confidence level: 50%)
file190.100.187.183	Xtreme RAT botnet C2 server (confidence level: 50%)
file178.16.55.99	Unknown malware botnet C2 server (confidence level: 50%)
file173.211.46.116	Unknown malware botnet C2 server (confidence level: 50%)
file178.16.52.58	AsyncRAT botnet C2 server (confidence level: 50%)
file151.59.122.136	SectopRAT botnet C2 server (confidence level: 50%)
file110.38.217.97	Mozi botnet C2 server (confidence level: 50%)
file156.214.248.253	AsyncRAT botnet C2 server (confidence level: 50%)
file172.105.180.51	AsyncRAT botnet C2 server (confidence level: 50%)
file172.105.180.51	AsyncRAT botnet C2 server (confidence level: 50%)
file172.105.180.51	AsyncRAT botnet C2 server (confidence level: 50%)
file193.179.33.247	DCRat botnet C2 server (confidence level: 50%)
file104.37.175.60	Remcos botnet C2 server (confidence level: 50%)
file113.44.44.102	ValleyRAT botnet C2 server (confidence level: 100%)
file113.44.44.102	ValleyRAT botnet C2 server (confidence level: 100%)
file113.44.44.102	ValleyRAT botnet C2 server (confidence level: 100%)
file82.26.74.215	Unknown RAT botnet C2 server (confidence level: 100%)
file193.222.99.18	Unknown Stealer botnet C2 server (confidence level: 100%)
file193.233.19.97	XWorm botnet C2 server (confidence level: 100%)
file87.120.117.209	XWorm botnet C2 server (confidence level: 100%)
file47.104.214.32	Cobalt Strike botnet C2 server (confidence level: 100%)
file185.73.126.186	XWorm botnet C2 server (confidence level: 100%)
file89.163.135.20	Quasar RAT botnet C2 server (confidence level: 100%)
file66.85.26.91	RatonRAT botnet C2 server (confidence level: 100%)
file167.179.66.31	Unknown malware botnet C2 server (confidence level: 100%)
file158.94.211.65	SectopRAT botnet C2 server (confidence level: 100%)
file81.91.176.231	ACR Stealer botnet C2 server (confidence level: 100%)
file45.146.130.131	Odyssey Stealer botnet C2 server (confidence level: 75%)
file206.238.180.6	ValleyRAT botnet C2 server (confidence level: 100%)
file23.94.145.120	CastleRAT botnet C2 server (confidence level: 75%)
file217.43.209.189	XWorm botnet C2 server (confidence level: 100%)

Hash

Value	Description	Copy
hash3000	Winos botnet C2 server (confidence level: 75%)
hash80	Stealc botnet C2 server (confidence level: 100%)
hashfb3e6d6bb2781c8a737c38f4d31beed93a89cc2ff9b8c00e7682f04c72fd9a60	Unknown Stealer payload (confidence level: 100%)
hashab78edbfdaebc11a34625d71709113cbb3f8e10d4699bc8dbddb966ea2efff03	Unknown Stealer payload (confidence level: 100%)
hashc22d94a2652a4689a73d845e127157de986b72669aabf1c4fefc0f789646895b	Unknown Stealer payload (confidence level: 100%)
hash371d72144e3862bbb3ce66821e47232c8a08eba166f13cade5bfaad1e1a6ab7d	Unknown Stealer payload (confidence level: 100%)
hash563ae5a1263eaa065b1a193870343637cc7650ccf0d8f6ff75f47906f3e85c0f	Unknown Stealer payload (confidence level: 100%)
hash6d140e07afb62c3fe9e60763993f1f0edf3e0c5421e693885b79a5fe5d91f14f	Unknown Stealer payload (confidence level: 100%)
hash6e676252d9b29e1e9caa7b24cad834bc53a41c4d55ed466a9fdebc30a74322b3	Unknown Stealer payload (confidence level: 100%)
hash80	Unknown Stealer payload delivery server (confidence level: 100%)
hash443	Unknown malware botnet C2 server (confidence level: 50%)
hash8009	Xtreme RAT botnet C2 server (confidence level: 100%)
hash80	Cobalt Strike payload delivery server (confidence level: 100%)
hash3778	Mirai botnet C2 server (confidence level: 80%)
hash8089	Cobalt Strike botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	Cobalt Strike botnet C2 server (confidence level: 100%)
hash443	CountLoader botnet C2 server (confidence level: 75%)
hash443	CountLoader botnet C2 server (confidence level: 75%)
hash443	Unknown malware botnet C2 server (confidence level: 90%)
hashb7ef4985662625c45955db295d949e04fd0a9fd5c8ce0c6a3bcb68e4a06c16e4	Unknown malware payload (confidence level: 90%)
hash443	BumbleBee payload delivery server (confidence level: 75%)
hash443	BumbleBee payload delivery server (confidence level: 75%)
hash8888	Unknown malware botnet C2 server (confidence level: 100%)
hash993	BumbleBee botnet C2 server (confidence level: 75%)
hash443	BumbleBee botnet C2 server (confidence level: 75%)
hash5000	BumbleBee botnet C2 server (confidence level: 75%)
hash4443	Quasar RAT botnet C2 server (confidence level: 100%)
hash80	BumbleBee botnet C2 server (confidence level: 90%)
hash8443	Cobalt Strike botnet C2 server (confidence level: 50%)
hash7777	Cobalt Strike botnet C2 server (confidence level: 50%)
hash8443	Cobalt Strike botnet C2 server (confidence level: 50%)
hash50050	Cobalt Strike botnet C2 server (confidence level: 50%)
hash50050	Cobalt Strike botnet C2 server (confidence level: 50%)
hash443	Cobalt Strike botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash31337	Sliver botnet C2 server (confidence level: 50%)
hash443	Unknown malware botnet C2 server (confidence level: 50%)
hash443	Unknown malware botnet C2 server (confidence level: 50%)
hash443	Unknown malware botnet C2 server (confidence level: 50%)
hash3333	Unknown malware botnet C2 server (confidence level: 50%)
hash3333	Unknown malware botnet C2 server (confidence level: 50%)
hash3333	Unknown malware botnet C2 server (confidence level: 50%)
hash80	Unknown malware botnet C2 server (confidence level: 50%)
hash443	Unknown malware botnet C2 server (confidence level: 50%)
hash3333	Unknown malware botnet C2 server (confidence level: 50%)
hash8080	Unknown malware botnet C2 server (confidence level: 50%)
hash8080	Unknown malware botnet C2 server (confidence level: 50%)
hash443	Unknown malware botnet C2 server (confidence level: 50%)
hash443	Kimsuky botnet C2 server (confidence level: 50%)
hash443	Kimsuky botnet C2 server (confidence level: 50%)
hash4433	Havoc botnet C2 server (confidence level: 50%)
hash81	Xtreme RAT botnet C2 server (confidence level: 50%)
hash7443	Unknown malware botnet C2 server (confidence level: 50%)
hash2850	Unknown malware botnet C2 server (confidence level: 50%)
hash1337	AsyncRAT botnet C2 server (confidence level: 50%)
hash8080	SectopRAT botnet C2 server (confidence level: 50%)
hash54545	Mozi botnet C2 server (confidence level: 50%)
hash7771	AsyncRAT botnet C2 server (confidence level: 50%)
hash10831	AsyncRAT botnet C2 server (confidence level: 50%)
hash12350	AsyncRAT botnet C2 server (confidence level: 50%)
hash6767	AsyncRAT botnet C2 server (confidence level: 50%)
hash8848	DCRat botnet C2 server (confidence level: 50%)
hash40164	Remcos botnet C2 server (confidence level: 50%)
hash6666	ValleyRAT botnet C2 server (confidence level: 100%)
hash8888	ValleyRAT botnet C2 server (confidence level: 100%)
hash8012	ValleyRAT botnet C2 server (confidence level: 100%)
hash964	Unknown RAT botnet C2 server (confidence level: 100%)
hash3000	Unknown Stealer botnet C2 server (confidence level: 100%)
hash5485	XWorm botnet C2 server (confidence level: 100%)
hash7000	XWorm botnet C2 server (confidence level: 100%)
hash1234	Cobalt Strike botnet C2 server (confidence level: 100%)
hash8808	XWorm botnet C2 server (confidence level: 100%)
hash8428	Quasar RAT botnet C2 server (confidence level: 100%)
hash3132	RatonRAT botnet C2 server (confidence level: 100%)
hash8888	Unknown malware botnet C2 server (confidence level: 100%)
hash9000	SectopRAT botnet C2 server (confidence level: 100%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash443	Odyssey Stealer botnet C2 server (confidence level: 75%)
hash5555	ValleyRAT botnet C2 server (confidence level: 100%)
hash9999	CastleRAT botnet C2 server (confidence level: 75%)
hash6666	XWorm botnet C2 server (confidence level: 100%)

Domain

Value	Description	Copy
domainamoboobs.com	Winos payload delivery domain (confidence level: 75%)
domaintrueforceteam.ru	Unknown Stealer payload delivery domain (confidence level: 100%)
domaineasytrueforce.shop	Unknown Stealer payload delivery domain (confidence level: 100%)
domainaccounts.google.seclogistic.com	Kimsuky botnet C2 domain (confidence level: 75%)
domainworkspaces.dynv6.net	Kimsuky botnet C2 domain (confidence level: 75%)
domaintaxhelp6.dynv6.net	Kimsuky botnet C2 domain (confidence level: 75%)
domainnid.naver.courter.com	Kimsuky botnet C2 domain (confidence level: 75%)
domaincommunicationfirewall-security.cc	CountLoader botnet C2 domain (confidence level: 75%)
domainfavourite-guide.cc	CountLoader botnet C2 domain (confidence level: 75%)
domaingeo-foundation.vg	CountLoader botnet C2 domain (confidence level: 75%)
domainsentinel1-endpoint-security.cc	CountLoader botnet C2 domain (confidence level: 75%)
domaincl2point.vectorpatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaincl3view.vectorpatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaincl4path.vectorpatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaindev1proc.nexusprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainescofiringbijou.com	Unknown malware botnet C2 domain (confidence level: 90%)
domainelizabethquinncmclibrary.com	Unknown malware botnet C2 domain (confidence level: 90%)
domaindisp-graphics.com	Unknown malware botnet C2 domain (confidence level: 90%)
domaindev2outer.nexusprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaindev3field.nexusprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaindev4space.nexusprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsvc1proc.quantumventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsvc2steel.quantumventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainms365-team.com	BumbleBee payload delivery domain (confidence level: 75%)
domainflorida-grower.com	BumbleBee payload delivery domain (confidence level: 75%)
domainendpointmapperprocess.com	BumbleBee payload delivery domain (confidence level: 75%)
domainwmds946t.life	BumbleBee payload delivery domain (confidence level: 90%)
domainpepedrop.yachts	BumbleBee payload delivery domain (confidence level: 50%)
domainsvc3core.quantumventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsvc4sat.quantumventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainext1infra.paragonharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainext2proxy.paragonharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainext3data.paragonharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainext4point.paragonharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaincl1sync.spectrumprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaincl2data.spectrumprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaincl3edge.spectrumprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaincl4static.spectrumprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainext1meta.keystonepatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainext2proc.keystonepatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainext3gate.keystonepatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainext4sync.keystonepatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaincl1store.luminousventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaincl2remote.luminousventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaincl3dev.luminousventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaincl4link.luminousventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaindev1proc.echelonprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaindev2power.echelonprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaindev3local.echelonprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaindev4work.echelonprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsvc1infra.vertexharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsvc2base.vertexharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsvc3user.vertexharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsvc4link.vertexharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainms365-team.com	BumbleBee botnet C2 domain (confidence level: 75%)
domainflorida-grower.com	BumbleBee botnet C2 domain (confidence level: 75%)
domaintmegramapps.com	BumbleBee botnet C2 domain (confidence level: 75%)
domainendpointmapperprocess.com	BumbleBee botnet C2 domain (confidence level: 75%)
domainpepedrop.yachts	BumbleBee botnet C2 domain (confidence level: 75%)
domainproto-wi1d.zenithprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainbinarydelive.zenithprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaincliencampa.radiantpatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainrende-trig.radiantpatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainlfgs.latticeharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainapgjh.latticeharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainreviewglyph.covenantprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaincompi-vault.covenantprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainpitchreed.apexventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainloadmatr.apexventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainhyper-opt1.momentumprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaingrasand.momentumprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domain1ukqsofb.vectorpatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainwgnh.vectorpatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainspk77w.nexusprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsol-lithos.nexusprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaindu5k-cast.quantumventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainislelaunch.quantumventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainrave-branch.paragonharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaintensor-line.paragonharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaindr80gbyv.spectrumprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaincap1ta-flow.spectrumprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domain1nsight-route.keystonepatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainicfsj.keystonepatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainjk6kmhz.luminousventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domain29dsasprosnowmeprona.za.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainagaoutofoffice.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainartsomewhere.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainashfordbathroomcentre.co.uk	AsyncRAT botnet C2 domain (confidence level: 50%)
domainchriswhelan.co.uk	AsyncRAT botnet C2 domain (confidence level: 50%)
domainclassofcovid.org	AsyncRAT botnet C2 domain (confidence level: 50%)
domainclsbellevaux.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domaincondaoseatravel.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domaincongngheanhsang.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domaindengedenetleme.org	AsyncRAT botnet C2 domain (confidence level: 50%)
domaindreamroblox.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domaineasystyle.it.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domaingatex.classofcovid.org	AsyncRAT botnet C2 domain (confidence level: 50%)
domaingatex.www.dengedenetleme.org	AsyncRAT botnet C2 domain (confidence level: 50%)
domaingurunanaknamkeen.in.net	AsyncRAT botnet C2 domain (confidence level: 50%)
domainhxwatertreatment.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainiepbritanico.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domaininternetowa.tv	AsyncRAT botnet C2 domain (confidence level: 50%)
domainkingbillydrinks.co.uk	AsyncRAT botnet C2 domain (confidence level: 50%)
domainlanterna.ru.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainlioisanigger-38893.portmap.host	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.29dsasprosnowmeprona.za.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.agaoutofoffice.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.artsomewhere.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.ashfordbathroomcentre.co.uk	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.chriswhelan.co.uk	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.clsbellevaux.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.condaoseatravel.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.congngheanhsang.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.easystyle.it.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.gurunanaknamkeen.in.net	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.hxwatertreatment.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.iepbritanico.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.internetowa.tv	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.kingbillydrinks.co.uk	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.lanterna.ru.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.newshop1.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.ochsenhuette.ch	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.phimsexhayvno.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.sacduc.net	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.skprojects.it.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.supersportsgifts.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.sweetshenanigansbakeshop.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.tuc.co.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainmalware.zonamaluku.com	AsyncRAT botnet C2 domain (confidence level: 50%)
domainnet10.webredirect.org	AsyncRAT botnet C2 domain (confidence level: 50%)
domainrophim.fwh.is	AsyncRAT botnet C2 domain (confidence level: 50%)
domainwww.dengedwww.dengedenetleme.orgenetleme.org	AsyncRAT botnet C2 domain (confidence level: 50%)
domainanonymous5007.duckdns.org	DarkComet botnet C2 domain (confidence level: 50%)
domainv2.www.dengedenetleme.org	DCRat botnet C2 domain (confidence level: 50%)
domainv3.www.dengedenetleme.org	DCRat botnet C2 domain (confidence level: 50%)
domainbarodh2ckerr-36722.portmap.host	XWorm botnet C2 domain (confidence level: 100%)
domaingtsavedatmustafa.ddns.net	Nanocore RAT botnet C2 domain (confidence level: 50%)
domainreversemalokin.ddns.net	NjRAT botnet C2 domain (confidence level: 50%)
domainsc88.ad	Quasar RAT botnet C2 domain (confidence level: 50%)
domaincleards.uk.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domainbiomolecular-archaeology.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domainmalware.biomolecular-archaeology.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domainparhazart.org	Quasar RAT botnet C2 domain (confidence level: 100%)
domainmalware.parhazart.org	Quasar RAT botnet C2 domain (confidence level: 100%)
domainxoilacxyh.tv	Quasar RAT botnet C2 domain (confidence level: 100%)
domainmalware.xoilacxyh.tv	Quasar RAT botnet C2 domain (confidence level: 100%)
domainsaturnexplorer.4nmn.com	Remcos botnet C2 domain (confidence level: 50%)
domaindavidwinkle-32841.portmap.host	Quasar RAT botnet C2 domain (confidence level: 100%)
domainnrlo.net	Quasar RAT botnet C2 domain (confidence level: 100%)
domainlixcerxo0x-61297.portmap.host	XWorm botnet C2 domain (confidence level: 50%)
domainbatdunya.com	FAKEUPDATES payload delivery domain (confidence level: 50%)
domainmail-srv.com	Unknown RAT payload delivery domain (confidence level: 50%)
domainharnivo.cfd	Unknown RAT payload delivery domain (confidence level: 50%)
domaink3rne8-phase.luminousventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsyntgrani.echelonprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaindensrunw.vertexharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainpetalshoal.skyl1neoak.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaindeltblend.skyl1neoak.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainmerfluxen2.si1vermuse.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsilve-scale.si1vermuse.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsolarcres.si1vermuse.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaingzcj.silvermuse.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainmy07cfit.silvermuse.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainarkvenum2.silvermuse.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaintorren5-plate.quillridge.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainmanif-graph.quillridge.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainprocessblo.quillridge.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainshadowdispatch.quillridge.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainr9y47.quillridge.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaintrustedotter.n1ghtbloom.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainwlikkfq.n1ghtbloom.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaingeyserclient.n1ghtbloom.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainimport-loop.n1ghtbloom.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainarnb3r-line.n1ghtbloom.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainbetaworkercf.org	Unknown malware payload delivery domain (confidence level: 100%)
domainwoodspeci.stormcove.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainquorfluxet.stormcove.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainahbn5c.stormcove.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainqu1c-mesh.stormcove.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainentreprise-docs-secure.online	Unknown malware payload delivery domain (confidence level: 100%)
domainnorspireen5.stormcove.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainraven-core.foxwhirl.in.net	ClearFake payload delivery domain (confidence level: 100%)
domain0dxtenvl.foxwhirl.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainoohdvj.foxwhirl.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainbot.pay-portal.pro	Unknown malware payload delivery domain (confidence level: 100%)
domainazuregrowth.foxwhirl.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainwint-node.foxwhirl.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainicegri.mosslark.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainfly888z.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domaininspiration.ru.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domainmalware.xoilaczzzzk.tv	Quasar RAT botnet C2 domain (confidence level: 100%)
domainrophims.net	Quasar RAT botnet C2 domain (confidence level: 100%)
domainloikks.za.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domainhydroflask.sa.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domainauthcraft.mosslark.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsecurity-check-291.pages.dev	Unknown malware payload delivery domain (confidence level: 100%)
domainbrigh-orche.mosslark.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainfabv2b.mosslark.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainalignaudio.mosslark.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainstorefield.cr0wnfern.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainspruc39-dock.cr0wnfern.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaindynmarkon.cr0wnfern.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainmof4x8.cr0wnfern.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainnor-lithor.cr0wnfern.in.net	ClearFake payload delivery domain (confidence level: 100%)
domain0colppvc.ironvale.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainbrandpale.ironvale.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainvor-crestex.ironvale.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainarkspireix.zenithventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaintri-crestar.zenithventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsmesharik.bond	Unknown malware payload delivery domain (confidence level: 100%)
domainlumvale4en.zenithventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainmicrobecip.zenithventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainxoilac86kb.tv	Quasar RAT botnet C2 domain (confidence level: 100%)
domainmalware.xoilac86kb.tv	Quasar RAT botnet C2 domain (confidence level: 100%)
domainp4yl-phase.zenithventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domain1earn-scope.zenithventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domain8aij4a.radiantharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaingloscarrie.radiantharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsparr04-path.radiantharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainklikshop.buzz	Unknown malware payload delivery domain (confidence level: 100%)
domainhyper-tr4cke.radiantharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainplassplit.radiantharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainrybfb.radiantharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainbinsap.latticeprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainwarm-grid.latticeprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainvzf6.latticeprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainpingla.latticeprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainmassivepatte.latticeprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainss86rj.latticeprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domain794kd31.covenantpatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaindarkholocron.viewdns.net	Remcos botnet C2 domain (confidence level: 100%)
domain2020business.uk.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domainfzotnmreqj.localto.net	XWorm botnet C2 domain (confidence level: 100%)
domainotzv.covenantpatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domain362fon24.covenantpatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaingpkvcvl.covenantpatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainvelmarkon.covenantpatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domain019a.covenantpatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainytun75fm.momentumventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainnnwjaigh1h.localto.net	Quasar RAT botnet C2 domain (confidence level: 75%)
domainhlhni.momentumventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainhpi496.momentumventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainfierter.momentumventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainvisu-line.momentumventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsfjgv.momentumventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainquorvale2or.quantumpatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaingidwwlm.quantumpatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainbr0o-wave.quantumpatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainvorcoreen8.quantumpatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainimpor-hinge.quantumpatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaindz0ly973.quantumpatronage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainb7vwxeo.paragonprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainnoblebalan.paragonprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainblenddense.paragonprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsolvale4a.paragonprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaing51vxer.paragonprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainlgwdtq.paragonprospera.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsparrowpine.apexharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainpcep.apexharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainuishg.apexharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainevpsbokvqh.localto.net	XWorm botnet C2 domain (confidence level: 75%)
domainzrsexetk0.localto.net	XWorm botnet C2 domain (confidence level: 75%)
domainmerfluxar8.apexharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domain69hjs0.apexharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainmz48d.apexharbinger.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainvor-lineet.latticeharbora.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaindrawvall.latticeharbora.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainwswzw.latticeharbora.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaintravelwes.latticeharbora.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsampl-cav.latticeharbora.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainadapterlog.latticeharbora.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsabet7.cfd	Odyssey Stealer botnet C2 domain (confidence level: 75%)
domainexposedsnow.buzz	Odyssey Stealer botnet C2 domain (confidence level: 75%)
domainwarsaw-shleprx-aaae.info	Odyssey Stealer botnet C2 domain (confidence level: 75%)
domainhamedan-shleprx-aaaf.info	Odyssey Stealer botnet C2 domain (confidence level: 75%)
domainbandar-shleprx-aaag.info	Odyssey Stealer botnet C2 domain (confidence level: 75%)
domainamsterdam-shleprx-aaah.info	Odyssey Stealer botnet C2 domain (confidence level: 75%)
domainyasuj-shleprx-aaaf.info	Odyssey Stealer botnet C2 domain (confidence level: 75%)
domainqazvin-shleprx-aaam.info	Odyssey Stealer botnet C2 domain (confidence level: 75%)
domainparis-shleprx-aaal.info	Odyssey Stealer botnet C2 domain (confidence level: 75%)
domainlondon-shleprx-aaae.info	Odyssey Stealer botnet C2 domain (confidence level: 75%)
domainneyshabur-shleprx-aaai.info	Odyssey Stealer botnet C2 domain (confidence level: 75%)
domainstockholm-shleprx-aaaj.info	Odyssey Stealer botnet C2 domain (confidence level: 75%)
domaincuriousdrift.radiantventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsoli-cast.radiantventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainqhsgsm.radiantventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsnbz.radiantventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainopt1-chain.radiantventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainhruckb.radiantventurex.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainauth-secure.structuralgridhub.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainmalware.xoilaczzzze.tv	Quasar RAT botnet C2 domain (confidence level: 100%)
domainapi-cluster.structuralgridhub.in.net	ClearFake payload delivery domain (confidence level: 100%)
domain17prosnowmeprona.za.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domainegroup.uk.net	Quasar RAT botnet C2 domain (confidence level: 100%)
domainstp.ru.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domainbackstreet.uk.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domain2267.cn.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domainxixixisad-37873.portmap.host	XWorm botnet C2 domain (confidence level: 100%)
domaindata-vault.structuralgridhub.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaincdn-static.structuralgridhub.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainlog-monitor.structuralgridhub.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainedge-proxy.structuralgridhub.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainwaypoint-alfa.navigationalpath.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainroute-engine.navigationalpath.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaingeo-spatial.navigationalpath.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaintrace-beacon.navigationalpath.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainvector-base.navigationalpath.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainmapping-svc.navigationalpath.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaincore-lattice.reinforcedmatrix.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainfiber-optic.reinforcedmatrix.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainmesh-gateway.reinforcedmatrix.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainshield-relay.reinforcedmatrix.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaintensor-unit.reinforcedmatrix.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaingrid-backbone.reinforcedmatrix.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainbase-logic.foundationmetric.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainroot-access.foundationmetric.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainaudit-trail.foundationmetric.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainatex.xoilaczzzze.tv	AsyncRAT botnet C2 domain (confidence level: 75%)
domainbackup.xoilaczzzze.tv	AsyncRAT botnet C2 domain (confidence level: 75%)
domaindata.xoilaczzzze.tv	AsyncRAT botnet C2 domain (confidence level: 75%)
domainddos.xoilaczzzze.tv	AsyncRAT botnet C2 domain (confidence level: 75%)
domainphishing.xoilaczzzze.tv	AsyncRAT botnet C2 domain (confidence level: 75%)
domainquantri.xoilaczzzze.tv	AsyncRAT botnet C2 domain (confidence level: 75%)
domainv2.xoilaczzzze.tv	AsyncRAT botnet C2 domain (confidence level: 75%)
domainv3.xoilaczzzze.tv	AsyncRAT botnet C2 domain (confidence level: 75%)
domainstat-collector.foundationmetric.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainlegacy-bridge.foundationmetric.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainindex-master.foundationmetric.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsync-portal.alignmentstorage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainblock-storage.alignmentstorage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainfile-share.alignmentstorage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaincache-node.alignmentstorage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainbackup-hub.alignmentstorage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainarchive-site.alignmentstorage.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainspan-control.cantileverbridge.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainload-balancer.cantileverbridge.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainstress-test.cantileverbridge.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainbeam-handler.cantileverbridge.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaintruss-api.cantileverbridge.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainarch-tunnel.cantileverbridge.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainhigh-point.elevationnodebox.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaintop-tier.elevationnodebox.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainpeak-traffic.elevationnodebox.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainlevel-check.elevationnodebox.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsummit-dev.elevationnodebox.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainalt-server.elevationnodebox.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainbalanced-io.symmetricalflow.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainmirror-sync.symmetricalflow.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsendfiletiahforem.duckdns.org	Remcos botnet C2 domain (confidence level: 100%)
domaindremom2.duckdns.org	Remcos botnet C2 domain (confidence level: 100%)
domaincavps7.duckdns.org	Remcos botnet C2 domain (confidence level: 100%)
domaingoodab.duckdns.org	Remcos botnet C2 domain (confidence level: 100%)
domaindual-stream.symmetricalflow.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainmalware.qatarhandball2015.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domainsigmaboy1234567-46132.portmap.host	XWorm botnet C2 domain (confidence level: 100%)
domainacannaaaaa-46963.portmap.host	XWorm botnet C2 domain (confidence level: 100%)
domainequal-logic.symmetricalflow.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainmatch-point.symmetricalflow.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainpair-connect.symmetricalflow.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainmain-conduit.integratedduct.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainflow-sensor.integratedduct.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainvent-access.integratedduct.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainpipe-line.integratedduct.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaindrain-gate.integratedduct.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaincore-tunnel.integratedduct.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainmap-overlay.topographictrace.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainchart-plotter.topographictrace.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainpoint-cloud.topographictrace.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainrelief-view.topographictrace.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaincontour-api.topographictrace.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainsurvey-data.topographictrace.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaindense-pack.compressionlayer.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainzip-archive.compressionlayer.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainshrink-node.compressionlayer.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainflat-buffer.compressionlayer.in.net	ClearFake payload delivery domain (confidence level: 100%)
domaincodec-proxy.compressionlayer.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainraw-stream.compressionlayer.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainfast-track.velocityterminal.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainrapid-fire.velocityterminal.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainboost-engine.velocityterminal.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainshift-ctrl.velocityterminal.in.net	ClearFake payload delivery domain (confidence level: 100%)
domainquick-step.velocityterminal.in.net	ClearFake payload delivery domain (confidence level: 100%)

Url

Value	Description	Copy
urlhttp://91.92.243.119/git.ps1	Unknown Stealer payload delivery URL (confidence level: 100%)
urlhttp://91.92.243.119/stlr/git.exe	Unknown Stealer payload delivery URL (confidence level: 100%)
urlhttp://91.92.243.119/steam/lemon.exe	Unknown Stealer payload delivery URL (confidence level: 100%)
urlhttp://91.92.243.119/rat/global.exe	Unknown Stealer payload delivery URL (confidence level: 100%)
urlhttps://during.bong889.com/	Unknown malware payload delivery URL (confidence level: 90%)
urlhttps://dev.betway071.com/	Unknown malware payload delivery URL (confidence level: 90%)
urlhttps://suaracitizen.com/	Unknown malware payload delivery URL (confidence level: 90%)
urlhttps://question-climatisation.com/	Unknown malware payload delivery URL (confidence level: 90%)
urlhttp://45.205.2.53:8888/supershell/login/	Unknown malware botnet C2 (confidence level: 100%)
urlhttps://movinty.digital/	Unknown malware payload delivery URL (confidence level: 90%)
urlhttps://der03.top/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://kke03.top/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://ysp06.top/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://ppio10.top/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://47.243.157.232/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://8.217.163.200/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://134.122.194.187/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://67.209.176.243/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://64.188.30.169/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://8.218.245.128/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://47.243.154.43/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://47.242.218.25/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://47.83.238.253/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://104.168.148.210/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://47.242.207.99/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://47.242.179.21/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://104.233.246.210/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://jrv.gaga3.top/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://luanluan821.top/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://host.vasslli.top/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://liux16.top/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://mecurry.top/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://47.243.157.77/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://47.83.208.201/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://decorator.top/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://2.56.255.159/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://47.239.244.75/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://shitongyao.site/	SpyNote botnet C2 (confidence level: 50%)
urlhttps://docviews34.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://elecviews56.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://nids25.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://docviews37.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://nids67.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://elecviews90.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://elecviews69.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://elecviews67.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://nids33.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://elecviews43.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://nids30.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://myblog87s.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://elecviews92.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://edocview15.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://search38s.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://edocview14.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://elecviews23.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://com-login.dns.army/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://kakao.com-login.dns.army/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://elecviews44.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://nids59.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://join54s.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://elecviews21.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://myblog57s.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://elecviews33.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://elecviews37.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://nids7.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://police84s.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://edocview20.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://elecviews51.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://nids10.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttps://fetch81s.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttp://638807774991052514.athens-shledrc-acaz.info/login	Odyssey Stealer botnet C2 (confidence level: 50%)
urlhttp://638808705259632794.budapest-shledrc-acba.info/login	Odyssey Stealer botnet C2 (confidence level: 50%)
urlhttp://638800814946931618.berlin-shledrc-acap.info/login	Odyssey Stealer botnet C2 (confidence level: 50%)
urlhttp://638799693262986204.madrid-shledrc-acan.info/login	Odyssey Stealer botnet C2 (confidence level: 50%)
urlhttp://638808279286809264.malayer-shledrc-acaz.info/login	Odyssey Stealer botnet C2 (confidence level: 50%)
urlhttp://638799976464357707.lahijan-shledrc-acan.info/login	Odyssey Stealer botnet C2 (confidence level: 50%)
urlhttp://638800616981987041.dublin-shledrc-acao.info/login	Odyssey Stealer botnet C2 (confidence level: 50%)
urlhttp://638809434544857586.dublin-shledrc-acbb.info/login	Odyssey Stealer botnet C2 (confidence level: 50%)
urlhttp://638798112751129792.warsaw-shledrc-acak.info/login	Odyssey Stealer botnet C2 (confidence level: 50%)
urlhttp://638809712977746654.athens-shledrc-acbc.info/login	Odyssey Stealer botnet C2 (confidence level: 50%)
urlhttp://638798250265338711.kerman-shledrc-acak.info/login	Odyssey Stealer botnet C2 (confidence level: 50%)
urlhttp://638810089169181655.shiraz-shledrc-acbc.info/login	Odyssey Stealer botnet C2 (confidence level: 50%)
urlhttp://638808983049892586.birjand-shledrc-acba.info/login	Odyssey Stealer botnet C2 (confidence level: 50%)
urlhttp://638808714689308402.dublin-shledrc-acba.info/login	Odyssey Stealer botnet C2 (confidence level: 50%)
urlhttps://cgf.facturastbs.shop/a/08/150822/au/gerauto.php	Unknown malware botnet C2 (confidence level: 50%)
urlhttps://cgf.facturastbs.shop/a/08/150822/au/gerapdf/blqs1	Unknown malware botnet C2 (confidence level: 50%)
urlhttps://actisolution.com/	Unknown malware botnet C2 (confidence level: 50%)
urlhttp://31.57.216.126/	Hook botnet C2 (confidence level: 50%)
urlhttp://docviews12.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttp://fetch33s.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttp://elecviews20.dynv6.net/	Kimsuky botnet C2 (confidence level: 50%)
urlhttp://91.214.78.81	Stealc botnet C2 (confidence level: 100%)
urlhttps://pastebin.com/raw/bukerxvj	XWorm botnet C2 (confidence level: 50%)
urlhttp://37.1.213.84	Stealc botnet C2 (confidence level: 100%)
urlhttps://web-security.beer/api/css.js	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://betaworkercf.org/api/css.js	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://microblob.bond/cf.js	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://productionmaza.bond/cf.js	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://productionmaza.cfd/cf.js	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://entreprise-docs-secure.online	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://46.165.215.116/032.txt	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://46.165.215.116/031.txt	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://filesand.lol	Unknown Stealer payload delivery URL (confidence level: 100%)
urlhttps://bot.pay-portal.pro	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://security-check-291.pages.dev	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://files-oss-cdn.oss-ap-southeast-1.aliyuncs.com/readme.gz	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://8.217.174.149:8888/supershell/login/	Unknown malware botnet C2 (confidence level: 100%)
urlhttps://smesharik.bond/cf.js	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://smesharik.bond/api/index.php	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://smesharik.bond/log.php	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://185.208.156.151	Amadey botnet C2 (confidence level: 100%)
urlhttp://195.3.223.218/blob/owner.api	Rhadamanthys botnet C2 (confidence level: 100%)
urlhttps://klikshop.buzz/kibo.txt	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://klikshop.buzz/ygropryn.msi	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://167.179.66.31:8888/supershell/login/	Unknown malware botnet C2 (confidence level: 100%)
urlhttps://optimize.lat/ginhwymuhputzohnzl	Unknown malware payload delivery URL (confidence level: 90%)
urlhttps://patrmpf.cyou	Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://95.217.10.109:7820/c5c0e9148d35f/xk3mtjn3.cur1k	Rhadamanthys botnet C2 (confidence level: 100%)
urlhttps://optimize.lat/assets/landings/bsod/js/loader.js	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://optimize.lat/assets/landings/cloudflare/js/loader.js	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://optimize.lat/assets/landings/cloudflare2/js/loader.js	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://optimize.lat/assets/landings/recaptcha/js/loader.js	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://optimize.lat/assets/landings/recaptcha2/	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://www.giulioterrinoni.it/wps.lic	Unknown malware payload delivery URL (confidence level: 100%)

Threat ID: 69c9bee8e6bfc5ba1d520a8c

Added to database: 3/30/2026, 12:08:08 AM

Last enriched: 3/30/2026, 12:08:17 AM

Last updated: 3/30/2026, 3:00:29 AM

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by

Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

External Links

Search on Google

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now

OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited

View courses

ThreatFox IOCs for 2026-03-29

AI Analysis

Technical Summary

Potential Impact

Mitigation Recommendations

Affected Countries

Indicators of Compromise

ThreatFox IOCs for 2026-03-29

Description

AI-Powered Analysis

Technical Analysis

Potential Impact

Mitigation Recommendations

Affected Countries

Technical Details

Indicators of Compromise

File

Hash

Domain

Url

Community Reviews

Actions

External Links

Need more coverage?

Latest Threats

Check if your credentials are on the dark web

Lead Pen Test Professional

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility

ThreatFox IOCs for 2026-03-29

AI Analysis

Technical Summary

Potential Impact

Mitigation Recommendations

Affected Countries

Indicators of Compromise

ThreatFox IOCs for 2026-03-29

Description

AI-Powered Analysis

Technical Analysis

Potential Impact

Mitigation Recommendations

Affected Countries

Technical Details

Indicators of Compromise

File

Hash

Domain

Url

Community Reviews

Related Threats

Maltrail IOC for 2026-03-29

AI Threat Landscape Digest January-February 2026

ThreatFox IOCs for 2026-03-28

Maltrail IOC for 2026-03-28

AitM Phishing Targets TikTok Business Accounts Using Cloudflare Turnstile Evasion

Actions

External Links

Need more coverage?

Latest Threats

Check if your credentials are on the dark web

Lead Pen Test Professional

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility