IndicatorPublished 2 Apr 2026Updated 3 Apr 2026

type osint · ThreatFox IOCs for 2026-04-02

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 132

mode14-node.coddlcaught.in.netClearFake payload delivery domain (confidence level: 100%)
floridacambolashop.comDeerStealer payload delivery domain (confidence level: 75%)
level-check.datacascade.in.netClearFake payload delivery domain (confidence level: 100%)
solstice-line-drift.proDeerStealer payload delivery domain (confidence level: 75%)
finger.teamss.netClearFake payload delivery domain (confidence level: 100%)
zone-portal.cyberlattice.in.netClearFake payload delivery domain (confidence level: 100%)
ping-gate.signalvector.in.netClearFake payload delivery domain (confidence level: 100%)
sfrclak.comContagiousDrop payload delivery domain (confidence level: 100%)
acemyonlineclasses.comQuasar RAT botnet C2 domain (confidence level: 100%)
malware.acemyonlineclasses.comQuasar RAT botnet C2 domain (confidence level: 100%)

URLs 115

https://floridacambolashop.com/fc3411f3-e43a-51ab-a00d-f6cd430fa334/stock4DeerStealer payload delivery URL (confidence level: 75%)
https://princeitltd.com/Unknown malware payload delivery URL (confidence level: 90%)
https://salkunet.com/v1/user/pySmartApeSG payload delivery URL (confidence level: 100%)
http://sfrclak.com:8000/6202033ContagiousDrop payload delivery URL (confidence level: 100%)
http://217.119.129.99/api/nte3yjdjnwu1njyznju2yta1n2y=SmartLoader botnet C2 (confidence level: 75%)
https://ibostonlimo.com/Unknown malware payload delivery URL (confidence level: 90%)
https://gripsmonga.sbs:443/Unknown RAT payload delivery URL (confidence level: 75%)
https://ssastatment.com:443/Unknown RAT payload delivery URL (confidence level: 75%)
https://shopifycourses.store:443/Unknown RAT payload delivery URL (confidence level: 75%)
https://ckrfinancialservic.cfd:443/Unknown RAT payload delivery URL (confidence level: 75%)

IP addresses 67

149.33.8.86DeerStealer payload delivery server (confidence level: 75%)
38.54.56.84Cobalt Strike botnet C2 server (confidence level: 100%)
158.94.211.162Stealc botnet C2 server (confidence level: 100%)
206.123.137.67AsyncRAT botnet C2 server (confidence level: 100%)
217.119.129.99SmartLoader botnet C2 server (confidence level: 75%)
141.255.161.122HijackLoader botnet C2 server (confidence level: 75%)
154.213.177.2HijackLoader botnet C2 server (confidence level: 75%)
179.43.139.10HijackLoader botnet C2 server (confidence level: 75%)
179.43.166.242HijackLoader botnet C2 server (confidence level: 75%)
193.233.112.188HijackLoader botnet C2 server (confidence level: 75%)

Hashes 21

58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668ContagiousDrop payload (confidence level: 100%)
e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09ContagiousDrop payload (confidence level: 100%)
d26c41e162e2a578a85ed5695810c7891cf2ca03e92e85c8ecace955f860f646ContagiousDrop payload (confidence level: 100%)
59336a964f110c25c112bcc5adca7090296b54ab33fa95c0744b94f8a0d80c0fContagiousDrop payload (confidence level: 100%)
92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645aContagiousDrop payload (confidence level: 100%)
fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cfContagiousDrop payload (confidence level: 100%)
ed8560c1ac7ceb6983ba995124d5917dc1a00288912387a6389296637d5f815cContagiousDrop payload (confidence level: 100%)
db7f4c82c732e8b107492cae419740abContagiousDrop payload (confidence level: 100%)
7658962ae060a222c0058cd4e979bfa1ContagiousDrop payload (confidence level: 100%)
8db3b6a1d230e5e221702ef1f405585dContagiousDrop payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-04-02

Impact

The potential impact of this threat is currently limited due to the lack of known exploits and absence of detailed attack vectors. However, organizations utilizing OSINT tools or relying heavily on network-based payload delivery mechanisms could face risks if attackers leverage this threat to conduct reconnaissance or deliver malware payloads. The medium severity rating suggests a moderate risk of confidentiality, integrity, or availability compromise, primarily through network activity and payload delivery. Without patches or specific mitigations, organizations might experience targeted attacks that could lead to data breaches, unauthorized access, or service disruptions if the threat evolves. The lack of authentication or user interaction details implies that exploitation might require some level of attacker sophistication or network access. Overall, the threat could facilitate initial access or lateral movement within networks, impacting organizations' security posture if not addressed proactively.

Defensive guidance

Given the limited technical details, mitigation should focus on strengthening network security and OSINT-related defenses. Organizations should implement advanced network monitoring and anomaly detection to identify unusual payload delivery or network activity patterns. Integrating threat intelligence feeds, including ThreatFox IOCs when available, into security information and event management (SIEM) systems can enhance detection capabilities. Employing strict network segmentation and access controls can limit the potential spread of payloads. Regularly updating and hardening OSINT tools and platforms reduces exposure to exploitation. Conducting employee training on recognizing social engineering or OSINT-based reconnaissance attempts can further reduce risk. Additionally, organizations should maintain up-to-date incident response plans to quickly address any suspicious activity. Since no patches are available, proactive threat hunting and continuous monitoring are critical to mitigating potential impacts.

Community reviews

Loading reviews…