Reconnecting to live updates…

ThreatFox IOCs for 2026-04-03

Severity: mediumType: malware

AI Analysis

Technical Summary

The ThreatFox IOCs for 2026-04-03 describe malware-related network activity and payload delivery indicators collected via OSINT sources. The information lacks detailed technical indicators or specific affected software versions. No patches or fixes are available, and no active exploitation has been reported. The threat is classified with a medium severity level and a threat level score of 2 out of an unspecified scale.

Potential Impact

The impact is currently limited to the presence of malware-related network activity and payload delivery as indicated by the IOCs. No direct exploitation or vulnerabilities are reported, and no affected software versions are identified. Without known exploits or patches, the immediate risk appears moderate but not critical.

Mitigation Recommendations

No patches or official fixes are available for this threat. Since this is an OSINT report of IOCs without specific actionable remediation, defenders should integrate these IOCs into their detection and monitoring systems where applicable. No vendor advisory or specific mitigation guidance is provided.

Indicators of Compromise

domain: windowscreenrepairnearme.com
url: https://revolaudit.cz/
domain: test-invalid-domain.invalid
domain: dakatawebstick.com
domain: ashpaltlonpro.com
domain: uehfks.digital
file: 94.26.90.100
hash: 80
hash: e062e0dcb4c27c0f87a81b4e4c954f753a53bab6b1a29f40e27f22d1f7f88359
hash: 671cdd8942f0adb97637d35fc277f007e8c0d901ac98415b1b6a42a54931af6b
hash: 1480dabe89af53f798ac93d4606d37ad8a1e6938dc054460ed4d8548f5e18d70
hash: 3c9be2f3981c57d9ad05be1467be4523bc419f4073f2670b5e7a8ef1f2e47e7a
hash: 81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee
url: http://162.215.170.152/hiddenbin/main_mips
domain: groceryhomerecipes.com
url: https://tirqavem.top/session/version-header.js
domain: eqp.is
domain: blz.is
url: https://blitomra.top/scope/realm-html.js
domain: blitomra.top
url: https://blitomra.top/scope/callback-fetch.php
url: https://blitomra.top/scope/admin-controller.js
domain: ratted.localto.net
domain: parky.pics
domain: bill-proof.cc
domain: 1.tcp.us-cal-1.ngrok.io
domain: shilajat.duckdns.org
file: 2.56.165.69
hash: 911
domain: limpios.con-ip.com
file: 104.193.255.40
hash: 7070
domain: liveos.zapto.org
file: 147.185.221.26
hash: 43608
url: https://widdensmoywi.sbs/api
file: 47.236.241.97
hash: 1011
file: 83.168.107.189
hash: 59004
domain: epsteinrapeniggers.duckdns.org
file: 141.98.234.20
hash: 443
file: 38.124.86.9
hash: 445
file: 149.12.67.154
hash: 6379
file: 61.3.31.99
hash: 60644
url: https://xar.japan365.co/
url: https://xar.scarletmc.ru/
url: https://plh.japan365.co/
url: https://plh.scarletmc.ru/
url: https://plh.bespokedigital.au/
url: https://plh.kaitorinihon.jp/
url: https://xar.bespokedigital.au/
url: https://xar.kaitorinihon.jp/
domain: plh.japan365.co
domain: plh.scarletmc.ru
domain: xar.japan365.co
domain: xar.scarletmc.ru
domain: plh.bespokedigital.au
domain: plh.kaitorinihon.jp
domain: xar.bespokedigital.au
domain: xar.kaitorinihon.jp
url: https://jellumlaw.com/
domain: kittyinaz.com
domain: mymicroblog.lat
url: https://mymicroblog.lat/cf.js
url: https://mymicroblog.lat/api/index.php
url: https://mymicroblog.lat/log.php
url: https://135.181.233.228/
url: https://rex.codetohaven.com/
url: https://xar.skfilmsint.com/
domain: xar.skfilmsint.com
domain: rex.codetohaven.com
file: 135.181.233.228
hash: 443
file: 156.234.202.148
hash: 5916
file: 171.80.4.222
hash: 4488
domain: www.zt9398net.online
domain: israelpalestineconflict.in.net
domain: shivatelecom.in.net
domain: shrikhatushyamtourtravels.in.net
domain: digitalexpressmart.sa.com
domain: pandoraksa.sa.com
domain: ztronicsmdem.in.net
domain: gdx.uk.com
domain: rku.uk.com
domain: 4dsasprosnowmeprona.ru.com
domain: fucku-spamhause.lol
domain: xn--xmqs7r0ud1q7d.in.net
file: 194.156.79.122
hash: 55615
domain: alm72rb-37531.portmap.host
domain: cxoljbb9p0.localto.net
domain: widely-revenue.gl.at.ply.gg
domain: doz6060xwo.duckdns.org
domain: fpzmgxdblu.localto.net
file: 192.99.190.119
hash: 7000
file: 150.158.107.234
hash: 8000
domain: davidchong01.camdvr.org
domain: bluntdavid38.kozow.com
file: 124.223.29.230
hash: 80
file: 43.135.73.54
hash: 7777
file: 141.98.11.205
hash: 80
file: 47.92.66.81
hash: 80
file: 43.129.209.7
hash: 2095
file: 45.152.65.167
hash: 2095
file: 43.143.242.10
hash: 5555
file: 202.95.11.194
hash: 6666
url: https://fdy.japan365.co/
url: https://fdy.scarletmc.ru/
url: https://fdy.kaitorinihon.jp/
url: https://fdy.bespokedigital.au/
domain: fdy.japan365.co
domain: fdy.scarletmc.ru
domain: fdy.kaitorinihon.jp
domain: fdy.bespokedigital.au
file: 46.151.182.19
hash: 422
file: 46.151.182.245
hash: 422
file: 31.57.216.27
hash: 422
file: 130.12.182.175
hash: 422
file: 31.57.216.28
hash: 422
file: 204.76.203.165
hash: 422
file: 130.12.180.119
hash: 422
domain: luuuma.duckdns.org
domain: luuumabk.duckdns.org
domain: cm-88.com
domain: open88.co.za
domain: contatopacn-56157.portmap.host
domain: febxworm39090.duckdns.org
domain: kristianbolanos.com
file: 200.25.78.71
hash: 1177
url: https://hor.japan365.co/
url: https://hor.scarletmc.ru/
url: https://hor.kaitorinihon.jp/
url: https://hor.bespokedigital.au/
domain: hor.japan365.co
domain: hor.scarletmc.ru
domain: hor.kaitorinihon.jp
domain: hor.bespokedigital.au
url: http://cz05897.tw1.ru/a7c99643.php
domain: dot.sa.com
domain: tasawoq.it.com
domain: cm88chuan.com
domain: fortiscreditunion.com
file: 144.31.237.190
hash: 1498
domain: dola789uaf.com
domain: dola789upn.com
domain: ug88vn.pro
domain: burb-34671.portmap.host
file: 178.16.52.78
hash: 7777
url: https://podiat.cyou
domain: ali19951995.ddns.net
url: https://steamcommunity.com/profiles/76561198719385745
url: https://telegram.me/nwwfh8
file: 5.188.87.49
hash: 443
domain: biggestchlen.lol
url: https://biggestchlen.lol/cf.js
url: https://biggestchlen.lol/api/index.php
url: https://biggestchlen.lol/log.php
domain: vnmdnns.beer
url: https://vnmdnns.beer/api/css.js
domain: sssndns.beer
url: https://sssndns.beer/api/css.js
domain: smnsdns.beer
domain: xx.kak.is
url: https://xx.kak.is/_clkfx/lnk1.txt
url: http://xx.kak.is/_clkfx/oficio_5201042026.exe
domain: ntdnewtds.shop
url: https://ntdnewtds.shop/jsrepo
domain: dnsnewtds.shop
url: https://dnsnewtds.shop/jsrepo
file: 106.54.219.219
hash: 6666
domain: dntds.shop
url: https://dntds.shop/jsrepo
domain: nttdss.shop
url: https://nttdss.shop/jsrepo
domain: sdntds.shop
url: https://sdntds.shop/jsrepo
file: 106.54.219.219
hash: 80
file: 106.54.219.219
hash: 8888
domain: tdsio.shop
url: https://tdsio.shop/jsrepo
file: 158.94.208.86
hash: 80
url: http://158.94.208.86
file: 158.94.208.92
hash: 80
url: http://158.94.208.92
file: 158.94.208.104
hash: 80
url: http://158.94.208.104/x7gkp2mq9zl4/my_l.bin
url: http://158.94.208.104/x7gkp2mq9zl4/my_downloader.bin
url: http://158.94.208.104/x7gkp2mq9zl4/my_s.bin
url: http://158.94.208.104/x7gkp2mq9zl4/student_downloader.bin
url: http://158.94.208.104/x7gkp2mq9zl4/student_l.bin
url: http://158.94.208.104/x7gkp2mq9zl4/student_s.bin
file: 192.241.134.241
hash: 2404
domain: vrtuall-42047.portmap.host
domain: geralnewlong.com
url: http://geralnewlong.com/3c736f7304ddeadb.js
domain: hngfbgfbfb.cyou
url: http://hngfbgfbfb.cyou/3c736f7304ddeadb.js
domain: logicalnewrestore.com
url: http://logicalnewrestore.com/3c736f7304ddeadb.js
url: http://192.168.159.136:80/jquery-3.3.2.slim.min.js
domain: agilemast3r.duckdns.org
url: http://agilemast3r.duckdns.org/3c736f7304ddeadb.js
domain: karlovackacrtackaskola.org
file: 194.182.64.133
hash: 5778
domain: f4lmbzwznn.localto.net
url: https://lightef.cyou

ThreatFox IOCs for 2026-04-03

Severity: medium

Type: malware

ThreatFox IOCs for 2026-04-03

Technical Summary

Potential Impact

Mitigation Recommendations

Indicators of Compromise

domain: windowscreenrepairnearme.com
url: https://revolaudit.cz/
domain: test-invalid-domain.invalid
domain: dakatawebstick.com
domain: ashpaltlonpro.com
domain: uehfks.digital
file: 94.26.90.100
hash: 80
hash: e062e0dcb4c27c0f87a81b4e4c954f753a53bab6b1a29f40e27f22d1f7f88359
hash: 671cdd8942f0adb97637d35fc277f007e8c0d901ac98415b1b6a42a54931af6b
hash: 1480dabe89af53f798ac93d4606d37ad8a1e6938dc054460ed4d8548f5e18d70
hash: 3c9be2f3981c57d9ad05be1467be4523bc419f4073f2670b5e7a8ef1f2e47e7a
hash: 81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee
url: http://162.215.170.152/hiddenbin/main_mips
domain: groceryhomerecipes.com
url: https://tirqavem.top/session/version-header.js
domain: eqp.is
domain: blz.is
url: https://blitomra.top/scope/realm-html.js
domain: blitomra.top
url: https://blitomra.top/scope/callback-fetch.php
url: https://blitomra.top/scope/admin-controller.js
domain: ratted.localto.net
domain: parky.pics
domain: bill-proof.cc
domain: 1.tcp.us-cal-1.ngrok.io
domain: shilajat.duckdns.org
file: 2.56.165.69
hash: 911
domain: limpios.con-ip.com
file: 104.193.255.40
hash: 7070
domain: liveos.zapto.org
file: 147.185.221.26
hash: 43608
url: https://widdensmoywi.sbs/api
file: 47.236.241.97
hash: 1011
file: 83.168.107.189
hash: 59004
domain: epsteinrapeniggers.duckdns.org
file: 141.98.234.20
hash: 443
file: 38.124.86.9
hash: 445
file: 149.12.67.154
hash: 6379
file: 61.3.31.99
hash: 60644
url: https://xar.japan365.co/
url: https://xar.scarletmc.ru/
url: https://plh.japan365.co/
url: https://plh.scarletmc.ru/
url: https://plh.bespokedigital.au/
url: https://plh.kaitorinihon.jp/
url: https://xar.bespokedigital.au/
url: https://xar.kaitorinihon.jp/
domain: plh.japan365.co
domain: plh.scarletmc.ru
domain: xar.japan365.co
domain: xar.scarletmc.ru
domain: plh.bespokedigital.au
domain: plh.kaitorinihon.jp
domain: xar.bespokedigital.au
domain: xar.kaitorinihon.jp
url: https://jellumlaw.com/
domain: kittyinaz.com
domain: mymicroblog.lat
url: https://mymicroblog.lat/cf.js
url: https://mymicroblog.lat/api/index.php
url: https://mymicroblog.lat/log.php
url: https://135.181.233.228/
url: https://rex.codetohaven.com/
url: https://xar.skfilmsint.com/
domain: xar.skfilmsint.com
domain: rex.codetohaven.com
file: 135.181.233.228
hash: 443
file: 156.234.202.148
hash: 5916
file: 171.80.4.222
hash: 4488
domain: www.zt9398net.online
domain: israelpalestineconflict.in.net
domain: shivatelecom.in.net
domain: shrikhatushyamtourtravels.in.net
domain: digitalexpressmart.sa.com
domain: pandoraksa.sa.com
domain: ztronicsmdem.in.net
domain: gdx.uk.com
domain: rku.uk.com
domain: 4dsasprosnowmeprona.ru.com
domain: fucku-spamhause.lol
domain: xn--xmqs7r0ud1q7d.in.net
file: 194.156.79.122
hash: 55615
domain: alm72rb-37531.portmap.host
domain: cxoljbb9p0.localto.net
domain: widely-revenue.gl.at.ply.gg
domain: doz6060xwo.duckdns.org
domain: fpzmgxdblu.localto.net
file: 192.99.190.119
hash: 7000
file: 150.158.107.234
hash: 8000
domain: davidchong01.camdvr.org
domain: bluntdavid38.kozow.com
file: 124.223.29.230
hash: 80
file: 43.135.73.54
hash: 7777
file: 141.98.11.205
hash: 80
file: 47.92.66.81
hash: 80
file: 43.129.209.7
hash: 2095
file: 45.152.65.167
hash: 2095
file: 43.143.242.10
hash: 5555
file: 202.95.11.194
hash: 6666
url: https://fdy.japan365.co/
url: https://fdy.scarletmc.ru/
url: https://fdy.kaitorinihon.jp/
url: https://fdy.bespokedigital.au/
domain: fdy.japan365.co
domain: fdy.scarletmc.ru
domain: fdy.kaitorinihon.jp
domain: fdy.bespokedigital.au
file: 46.151.182.19
hash: 422
file: 46.151.182.245
hash: 422
file: 31.57.216.27
hash: 422
file: 130.12.182.175
hash: 422
file: 31.57.216.28
hash: 422
file: 204.76.203.165
hash: 422
file: 130.12.180.119
hash: 422
domain: luuuma.duckdns.org
domain: luuumabk.duckdns.org
domain: cm-88.com
domain: open88.co.za
domain: contatopacn-56157.portmap.host
domain: febxworm39090.duckdns.org
domain: kristianbolanos.com
file: 200.25.78.71
hash: 1177
url: https://hor.japan365.co/
url: https://hor.scarletmc.ru/
url: https://hor.kaitorinihon.jp/
url: https://hor.bespokedigital.au/
domain: hor.japan365.co
domain: hor.scarletmc.ru
domain: hor.kaitorinihon.jp
domain: hor.bespokedigital.au
url: http://cz05897.tw1.ru/a7c99643.php
domain: dot.sa.com
domain: tasawoq.it.com
domain: cm88chuan.com
domain: fortiscreditunion.com
file: 144.31.237.190
hash: 1498
domain: dola789uaf.com
domain: dola789upn.com
domain: ug88vn.pro
domain: burb-34671.portmap.host
file: 178.16.52.78
hash: 7777
url: https://podiat.cyou
domain: ali19951995.ddns.net
url: https://steamcommunity.com/profiles/76561198719385745
url: https://telegram.me/nwwfh8
file: 5.188.87.49
hash: 443
domain: biggestchlen.lol
url: https://biggestchlen.lol/cf.js
url: https://biggestchlen.lol/api/index.php
url: https://biggestchlen.lol/log.php
domain: vnmdnns.beer
url: https://vnmdnns.beer/api/css.js
domain: sssndns.beer
url: https://sssndns.beer/api/css.js
domain: smnsdns.beer
domain: xx.kak.is
url: https://xx.kak.is/_clkfx/lnk1.txt
url: http://xx.kak.is/_clkfx/oficio_5201042026.exe
domain: ntdnewtds.shop
url: https://ntdnewtds.shop/jsrepo
domain: dnsnewtds.shop
url: https://dnsnewtds.shop/jsrepo
file: 106.54.219.219
hash: 6666
domain: dntds.shop
url: https://dntds.shop/jsrepo
domain: nttdss.shop
url: https://nttdss.shop/jsrepo
domain: sdntds.shop
url: https://sdntds.shop/jsrepo
file: 106.54.219.219
hash: 80
file: 106.54.219.219
hash: 8888
domain: tdsio.shop
url: https://tdsio.shop/jsrepo
file: 158.94.208.86
hash: 80
url: http://158.94.208.86
file: 158.94.208.92
hash: 80
url: http://158.94.208.92
file: 158.94.208.104
hash: 80
url: http://158.94.208.104/x7gkp2mq9zl4/my_l.bin
url: http://158.94.208.104/x7gkp2mq9zl4/my_downloader.bin
url: http://158.94.208.104/x7gkp2mq9zl4/my_s.bin
url: http://158.94.208.104/x7gkp2mq9zl4/student_downloader.bin
url: http://158.94.208.104/x7gkp2mq9zl4/student_l.bin
url: http://158.94.208.104/x7gkp2mq9zl4/student_s.bin
file: 192.241.134.241
hash: 2404
domain: vrtuall-42047.portmap.host
domain: geralnewlong.com
url: http://geralnewlong.com/3c736f7304ddeadb.js
domain: hngfbgfbfb.cyou
url: http://hngfbgfbfb.cyou/3c736f7304ddeadb.js
domain: logicalnewrestore.com
url: http://logicalnewrestore.com/3c736f7304ddeadb.js
url: http://192.168.159.136:80/jquery-3.3.2.slim.min.js
domain: agilemast3r.duckdns.org
url: http://agilemast3r.duckdns.org/3c736f7304ddeadb.js
domain: karlovackacrtackaskola.org
file: 194.182.64.133
hash: 5778
domain: f4lmbzwznn.localto.net
url: https://lightef.cyou

Source: ThreatFox MISP Feed

Published: Fri Apr 03 2026

ThreatFox IOCs for 2026-04-03

Medium

Malwaretype:osint tlp:white

Published: Fri Apr 03 2026 (04/03/2026, 00:00:00 UTC)

Source: ThreatFox MISP Feed

Vendor/Project: type

Product: osint

Description

ThreatFox IOCs for 2026-04-03

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 04/04/2026, 00:30:26 UTC

Technical Analysis

Potential Impact

Mitigation Recommendations

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Threat Level: 2
Analysis: 1
Distribution: 3
Uuid: 87a06885-5e1d-4448-b430-1e9898e81e96
Original Timestamp: 1775260988

Indicators of Compromise

Domain

Value	Description	Copy
domainwindowscreenrepairnearme.com	Unknown RAT botnet C2 domain (confidence level: 50%)
domaintest-invalid-domain.invalid	Vidar botnet C2 domain (confidence level: 100%)
domaindakatawebstick.com	Stealc botnet C2 domain (confidence level: 100%)
domainashpaltlonpro.com	Stealc botnet C2 domain (confidence level: 100%)
domainuehfks.digital	Stealc botnet C2 domain (confidence level: 100%)
domaingroceryhomerecipes.com	SmartApeSG payload delivery domain (confidence level: 50%)
domaineqp.is	magecart credit card skimming domain (confidence level: 100%)
domainblz.is	magecart credit card skimming domain (confidence level: 100%)
domainblitomra.top	SmartApeSG payload delivery domain (confidence level: 100%)
domainratted.localto.net	Quasar RAT botnet C2 domain (confidence level: 100%)
domainparky.pics	Unknown malware botnet C2 domain (confidence level: 100%)
domainbill-proof.cc	SantaStealer botnet C2 domain (confidence level: 100%)
domain1.tcp.us-cal-1.ngrok.io	Remcos botnet C2 domain (confidence level: 100%)
domainshilajat.duckdns.org	Remcos botnet C2 domain (confidence level: 100%)
domainlimpios.con-ip.com	Remcos botnet C2 domain (confidence level: 100%)
domainliveos.zapto.org	Remcos botnet C2 domain (confidence level: 100%)
domainepsteinrapeniggers.duckdns.org	Mirai botnet C2 domain (confidence level: 50%)
domainplh.japan365.co	Vidar botnet C2 domain (confidence level: 100%)
domainplh.scarletmc.ru	Vidar botnet C2 domain (confidence level: 100%)
domainxar.japan365.co	Vidar botnet C2 domain (confidence level: 100%)
domainxar.scarletmc.ru	Vidar botnet C2 domain (confidence level: 100%)
domainplh.bespokedigital.au	Vidar botnet C2 domain (confidence level: 100%)
domainplh.kaitorinihon.jp	Vidar botnet C2 domain (confidence level: 100%)
domainxar.bespokedigital.au	Vidar botnet C2 domain (confidence level: 100%)
domainxar.kaitorinihon.jp	Vidar botnet C2 domain (confidence level: 100%)
domainkittyinaz.com	StrelaStealer payload delivery domain (confidence level: 100%)
domainmymicroblog.lat	Unknown malware payload delivery domain (confidence level: 100%)
domainxar.skfilmsint.com	Vidar botnet C2 domain (confidence level: 100%)
domainrex.codetohaven.com	Vidar botnet C2 domain (confidence level: 100%)
domainwww.zt9398net.online	Quasar RAT botnet C2 domain (confidence level: 100%)
domainisraelpalestineconflict.in.net	Quasar RAT botnet C2 domain (confidence level: 100%)
domainshivatelecom.in.net	Quasar RAT botnet C2 domain (confidence level: 100%)
domainshrikhatushyamtourtravels.in.net	Quasar RAT botnet C2 domain (confidence level: 100%)
domaindigitalexpressmart.sa.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domainpandoraksa.sa.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domainztronicsmdem.in.net	Quasar RAT botnet C2 domain (confidence level: 100%)
domaingdx.uk.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domainrku.uk.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domain4dsasprosnowmeprona.ru.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domainfucku-spamhause.lol	Quasar RAT botnet C2 domain (confidence level: 100%)
domainxn--xmqs7r0ud1q7d.in.net	Quasar RAT botnet C2 domain (confidence level: 100%)
domainalm72rb-37531.portmap.host	XWorm botnet C2 domain (confidence level: 100%)
domaincxoljbb9p0.localto.net	XWorm botnet C2 domain (confidence level: 100%)
domainwidely-revenue.gl.at.ply.gg	XWorm botnet C2 domain (confidence level: 100%)
domaindoz6060xwo.duckdns.org	XWorm botnet C2 domain (confidence level: 100%)
domainfpzmgxdblu.localto.net	XWorm botnet C2 domain (confidence level: 100%)
domaindavidchong01.camdvr.org	Remcos botnet C2 domain (confidence level: 100%)
domainbluntdavid38.kozow.com	Remcos botnet C2 domain (confidence level: 100%)
domainfdy.japan365.co	Vidar botnet C2 domain (confidence level: 100%)
domainfdy.scarletmc.ru	Vidar botnet C2 domain (confidence level: 100%)
domainfdy.kaitorinihon.jp	Vidar botnet C2 domain (confidence level: 100%)
domainfdy.bespokedigital.au	Vidar botnet C2 domain (confidence level: 100%)
domainluuuma.duckdns.org	Remcos botnet C2 domain (confidence level: 100%)
domainluuumabk.duckdns.org	Remcos botnet C2 domain (confidence level: 100%)
domaincm-88.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domainopen88.co.za	Quasar RAT botnet C2 domain (confidence level: 100%)
domaincontatopacn-56157.portmap.host	XWorm botnet C2 domain (confidence level: 100%)
domainfebxworm39090.duckdns.org	XWorm botnet C2 domain (confidence level: 100%)
domainkristianbolanos.com	StrelaStealer payload delivery domain (confidence level: 100%)
domainhor.japan365.co	Vidar botnet C2 domain (confidence level: 100%)
domainhor.scarletmc.ru	Vidar botnet C2 domain (confidence level: 100%)
domainhor.kaitorinihon.jp	Vidar botnet C2 domain (confidence level: 100%)
domainhor.bespokedigital.au	Vidar botnet C2 domain (confidence level: 100%)
domaindot.sa.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domaintasawoq.it.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domaincm88chuan.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domainfortiscreditunion.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domaindola789uaf.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domaindola789upn.com	Quasar RAT botnet C2 domain (confidence level: 100%)
domainug88vn.pro	Quasar RAT botnet C2 domain (confidence level: 100%)
domainburb-34671.portmap.host	XWorm botnet C2 domain (confidence level: 100%)
domainali19951995.ddns.net	NjRAT botnet C2 domain (confidence level: 100%)
domainbiggestchlen.lol	Unknown malware payload delivery domain (confidence level: 100%)
domainvnmdnns.beer	Unknown malware payload delivery domain (confidence level: 100%)
domainsssndns.beer	Unknown malware payload delivery domain (confidence level: 100%)
domainsmnsdns.beer	Unknown malware payload delivery domain (confidence level: 100%)
domainxx.kak.is	Unknown malware payload delivery domain (confidence level: 100%)
domainntdnewtds.shop	Unknown malware payload delivery domain (confidence level: 100%)
domaindnsnewtds.shop	Unknown malware payload delivery domain (confidence level: 100%)
domaindntds.shop	Unknown malware payload delivery domain (confidence level: 100%)
domainnttdss.shop	Unknown malware payload delivery domain (confidence level: 100%)
domainsdntds.shop	Unknown malware payload delivery domain (confidence level: 100%)
domaintdsio.shop	Unknown malware payload delivery domain (confidence level: 100%)
domainvrtuall-42047.portmap.host	XWorm botnet C2 domain (confidence level: 100%)
domaingeralnewlong.com	Unknown malware payload delivery domain (confidence level: 100%)
domainhngfbgfbfb.cyou	Unknown malware payload delivery domain (confidence level: 100%)
domainlogicalnewrestore.com	Unknown malware payload delivery domain (confidence level: 100%)
domainagilemast3r.duckdns.org	Unknown malware payload delivery domain (confidence level: 100%)
domainkarlovackacrtackaskola.org	StrelaStealer payload delivery domain (confidence level: 100%)
domainf4lmbzwznn.localto.net	AsyncRAT botnet C2 domain (confidence level: 75%)

Url

Value	Description	Copy
urlhttps://revolaudit.cz/	Unknown malware payload delivery URL (confidence level: 90%)
urlhttp://162.215.170.152/hiddenbin/main_mips	Unknown malware payload delivery URL (confidence level: 75%)
urlhttps://tirqavem.top/session/version-header.js	SmartApeSG payload delivery URL (confidence level: 100%)
urlhttps://blitomra.top/scope/realm-html.js	SmartApeSG payload delivery URL (confidence level: 100%)
urlhttps://blitomra.top/scope/callback-fetch.php	SmartApeSG payload delivery URL (confidence level: 100%)
urlhttps://blitomra.top/scope/admin-controller.js	SmartApeSG payload delivery URL (confidence level: 100%)
urlhttps://widdensmoywi.sbs/api	Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://xar.japan365.co/	Vidar botnet C2 (confidence level: 100%)
urlhttps://xar.scarletmc.ru/	Vidar botnet C2 (confidence level: 100%)
urlhttps://plh.japan365.co/	Vidar botnet C2 (confidence level: 100%)
urlhttps://plh.scarletmc.ru/	Vidar botnet C2 (confidence level: 100%)
urlhttps://plh.bespokedigital.au/	Vidar botnet C2 (confidence level: 100%)
urlhttps://plh.kaitorinihon.jp/	Vidar botnet C2 (confidence level: 100%)
urlhttps://xar.bespokedigital.au/	Vidar botnet C2 (confidence level: 100%)
urlhttps://xar.kaitorinihon.jp/	Vidar botnet C2 (confidence level: 100%)
urlhttps://jellumlaw.com/	Unknown malware payload delivery URL (confidence level: 90%)
urlhttps://mymicroblog.lat/cf.js	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://mymicroblog.lat/api/index.php	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://mymicroblog.lat/log.php	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://135.181.233.228/	Vidar botnet C2 (confidence level: 100%)
urlhttps://rex.codetohaven.com/	Vidar botnet C2 (confidence level: 100%)
urlhttps://xar.skfilmsint.com/	Vidar botnet C2 (confidence level: 100%)
urlhttps://fdy.japan365.co/	Vidar botnet C2 (confidence level: 100%)
urlhttps://fdy.scarletmc.ru/	Vidar botnet C2 (confidence level: 100%)
urlhttps://fdy.kaitorinihon.jp/	Vidar botnet C2 (confidence level: 100%)
urlhttps://fdy.bespokedigital.au/	Vidar botnet C2 (confidence level: 100%)
urlhttps://hor.japan365.co/	Vidar botnet C2 (confidence level: 100%)
urlhttps://hor.scarletmc.ru/	Vidar botnet C2 (confidence level: 100%)
urlhttps://hor.kaitorinihon.jp/	Vidar botnet C2 (confidence level: 100%)
urlhttps://hor.bespokedigital.au/	Vidar botnet C2 (confidence level: 100%)
urlhttp://cz05897.tw1.ru/a7c99643.php	DCRat botnet C2 (confidence level: 100%)
urlhttps://podiat.cyou	Lumma Stealer botnet C2 (confidence level: 100%)
urlhttps://steamcommunity.com/profiles/76561198719385745	Vidar botnet C2 (confidence level: 75%)
urlhttps://telegram.me/nwwfh8	Vidar botnet C2 (confidence level: 75%)
urlhttps://biggestchlen.lol/cf.js	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://biggestchlen.lol/api/index.php	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://biggestchlen.lol/log.php	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://vnmdnns.beer/api/css.js	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://sssndns.beer/api/css.js	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://xx.kak.is/_clkfx/lnk1.txt	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://xx.kak.is/_clkfx/oficio_5201042026.exe	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://ntdnewtds.shop/jsrepo	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://dnsnewtds.shop/jsrepo	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://dntds.shop/jsrepo	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://nttdss.shop/jsrepo	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://sdntds.shop/jsrepo	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://tdsio.shop/jsrepo	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://158.94.208.86	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://158.94.208.92	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://158.94.208.104/x7gkp2mq9zl4/my_l.bin	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://158.94.208.104/x7gkp2mq9zl4/my_downloader.bin	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://158.94.208.104/x7gkp2mq9zl4/my_s.bin	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://158.94.208.104/x7gkp2mq9zl4/student_downloader.bin	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://158.94.208.104/x7gkp2mq9zl4/student_l.bin	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://158.94.208.104/x7gkp2mq9zl4/student_s.bin	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://geralnewlong.com/3c736f7304ddeadb.js	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://hngfbgfbfb.cyou/3c736f7304ddeadb.js	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://logicalnewrestore.com/3c736f7304ddeadb.js	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://192.168.159.136:80/jquery-3.3.2.slim.min.js	Cobalt Strike botnet C2 (confidence level: 75%)
urlhttp://agilemast3r.duckdns.org/3c736f7304ddeadb.js	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://lightef.cyou	Lumma Stealer botnet C2 (confidence level: 75%)

File

Value	Description	Copy
file94.26.90.100	Stealc botnet C2 server (confidence level: 100%)
file2.56.165.69	XWorm botnet C2 server (confidence level: 100%)
file104.193.255.40	XWorm botnet C2 server (confidence level: 100%)
file147.185.221.26	XWorm botnet C2 server (confidence level: 100%)
file47.236.241.97	ValleyRAT botnet C2 server (confidence level: 100%)
file83.168.107.189	Mirai botnet C2 server (confidence level: 50%)
file141.98.234.20	ACR Stealer botnet C2 server (confidence level: 100%)
file38.124.86.9	Xtreme RAT botnet C2 server (confidence level: 100%)
file149.12.67.154	Xtreme RAT botnet C2 server (confidence level: 100%)
file61.3.31.99	Mozi botnet C2 server (confidence level: 100%)
file135.181.233.228	Vidar botnet C2 server (confidence level: 100%)
file156.234.202.148	Cobalt Strike botnet C2 server (confidence level: 100%)
file171.80.4.222	Cobalt Strike botnet C2 server (confidence level: 100%)
file194.156.79.122	RedLine Stealer botnet C2 server (confidence level: 100%)
file192.99.190.119	XWorm botnet C2 server (confidence level: 100%)
file150.158.107.234	Cobalt Strike botnet C2 server (confidence level: 100%)
file124.223.29.230	Cobalt Strike botnet C2 server (confidence level: 100%)
file43.135.73.54	Cobalt Strike botnet C2 server (confidence level: 100%)
file141.98.11.205	Cobalt Strike botnet C2 server (confidence level: 100%)
file47.92.66.81	Cobalt Strike botnet C2 server (confidence level: 100%)
file43.129.209.7	Cobalt Strike botnet C2 server (confidence level: 100%)
file45.152.65.167	Cobalt Strike botnet C2 server (confidence level: 100%)
file43.143.242.10	Cobalt Strike botnet C2 server (confidence level: 100%)
file202.95.11.194	ValleyRAT botnet C2 server (confidence level: 100%)
file46.151.182.19	Tofsee botnet C2 server (confidence level: 75%)
file46.151.182.245	Tofsee botnet C2 server (confidence level: 75%)
file31.57.216.27	Tofsee botnet C2 server (confidence level: 75%)
file130.12.182.175	Tofsee botnet C2 server (confidence level: 75%)
file31.57.216.28	Tofsee botnet C2 server (confidence level: 75%)
file204.76.203.165	Tofsee botnet C2 server (confidence level: 75%)
file130.12.180.119	Tofsee botnet C2 server (confidence level: 75%)
file200.25.78.71	NjRAT botnet C2 server (confidence level: 100%)
file144.31.237.190	XWorm botnet C2 server (confidence level: 100%)
file178.16.52.78	XWorm botnet C2 server (confidence level: 100%)
file5.188.87.49	NetSupportManager RAT botnet C2 server (confidence level: 100%)
file106.54.219.219	ValleyRAT botnet C2 server (confidence level: 100%)
file106.54.219.219	ValleyRAT botnet C2 server (confidence level: 75%)
file106.54.219.219	ValleyRAT botnet C2 server (confidence level: 75%)
file158.94.208.86	Unknown malware payload delivery server (confidence level: 100%)
file158.94.208.92	Unknown malware payload delivery server (confidence level: 100%)
file158.94.208.104	Unknown malware payload delivery server (confidence level: 100%)
file192.241.134.241	Remcos botnet C2 server (confidence level: 100%)
file194.182.64.133	AsyncRAT botnet C2 server (confidence level: 100%)

Hash

Value	Description	Copy
hash80	Stealc botnet C2 server (confidence level: 100%)
hashe062e0dcb4c27c0f87a81b4e4c954f753a53bab6b1a29f40e27f22d1f7f88359	Stealc payload (confidence level: 100%)
hash671cdd8942f0adb97637d35fc277f007e8c0d901ac98415b1b6a42a54931af6b	Stealc payload (confidence level: 100%)
hash1480dabe89af53f798ac93d4606d37ad8a1e6938dc054460ed4d8548f5e18d70	Stealc payload (confidence level: 100%)
hash3c9be2f3981c57d9ad05be1467be4523bc419f4073f2670b5e7a8ef1f2e47e7a	Stealc payload (confidence level: 100%)
hash81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee	Vidar payload (confidence level: 100%)
hash911	XWorm botnet C2 server (confidence level: 100%)
hash7070	XWorm botnet C2 server (confidence level: 100%)
hash43608	XWorm botnet C2 server (confidence level: 100%)
hash1011	ValleyRAT botnet C2 server (confidence level: 100%)
hash59004	Mirai botnet C2 server (confidence level: 50%)
hash443	ACR Stealer botnet C2 server (confidence level: 100%)
hash445	Xtreme RAT botnet C2 server (confidence level: 100%)
hash6379	Xtreme RAT botnet C2 server (confidence level: 100%)
hash60644	Mozi botnet C2 server (confidence level: 100%)
hash443	Vidar botnet C2 server (confidence level: 100%)
hash5916	Cobalt Strike botnet C2 server (confidence level: 100%)
hash4488	Cobalt Strike botnet C2 server (confidence level: 100%)
hash55615	RedLine Stealer botnet C2 server (confidence level: 100%)
hash7000	XWorm botnet C2 server (confidence level: 100%)
hash8000	Cobalt Strike botnet C2 server (confidence level: 100%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)
hash7777	Cobalt Strike botnet C2 server (confidence level: 100%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)
hash2095	Cobalt Strike botnet C2 server (confidence level: 100%)
hash2095	Cobalt Strike botnet C2 server (confidence level: 100%)
hash5555	Cobalt Strike botnet C2 server (confidence level: 100%)
hash6666	ValleyRAT botnet C2 server (confidence level: 100%)
hash422	Tofsee botnet C2 server (confidence level: 75%)
hash422	Tofsee botnet C2 server (confidence level: 75%)
hash422	Tofsee botnet C2 server (confidence level: 75%)
hash422	Tofsee botnet C2 server (confidence level: 75%)
hash422	Tofsee botnet C2 server (confidence level: 75%)
hash422	Tofsee botnet C2 server (confidence level: 75%)
hash422	Tofsee botnet C2 server (confidence level: 75%)
hash1177	NjRAT botnet C2 server (confidence level: 100%)
hash1498	XWorm botnet C2 server (confidence level: 100%)
hash7777	XWorm botnet C2 server (confidence level: 100%)
hash443	NetSupportManager RAT botnet C2 server (confidence level: 100%)
hash6666	ValleyRAT botnet C2 server (confidence level: 100%)
hash80	ValleyRAT botnet C2 server (confidence level: 75%)
hash8888	ValleyRAT botnet C2 server (confidence level: 75%)
hash80	Unknown malware payload delivery server (confidence level: 100%)
hash80	Unknown malware payload delivery server (confidence level: 100%)
hash80	Unknown malware payload delivery server (confidence level: 100%)
hash2404	Remcos botnet C2 server (confidence level: 100%)
hash5778	AsyncRAT botnet C2 server (confidence level: 100%)

Threat ID: 69d058190a160ebd9267d399

Added to database: 4/4/2026, 12:15:21 AM

Last enriched: 4/4/2026, 12:30:26 AM

Last updated: 4/4/2026, 5:32:47 AM

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by

Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

External Links

Search on Google

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now

OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited

View courses

ThreatFox IOCs for 2026-04-03

AI Analysis

Technical Summary

Potential Impact

Mitigation Recommendations

Indicators of Compromise

ThreatFox IOCs for 2026-04-03

Description

AI-Powered Analysis

Technical Analysis

Potential Impact

Mitigation Recommendations

Technical Details

Indicators of Compromise

Domain

Url

File

Hash

Community Reviews

Actions

External Links

Need more coverage?

Latest Threats

Check if your credentials are on the dark web

Lead Pen Test Professional

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility

ThreatFox IOCs for 2026-04-03

AI Analysis

Technical Summary

Potential Impact

Mitigation Recommendations

Indicators of Compromise

ThreatFox IOCs for 2026-04-03

Description

AI-Powered Analysis

Technical Analysis

Potential Impact

Mitigation Recommendations

Technical Details

Indicators of Compromise

Domain

Url

File

Hash

Community Reviews

Related Threats

Maltrail IOC for 2026-04-03

A Technique-Based Approach to Hunting Web-Delivered Malware

Maltrail IOC for 2026-04-02

ThreatFox IOCs for 2026-04-02

Blurred Lines: AdTech Abuse Delivers Browser Hijackers Through the Microsoft Store

Actions

External Links

Need more coverage?

Latest Threats

Check if your credentials are on the dark web

Lead Pen Test Professional

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility