Skip to main content
IndicatorPublished Updated

type osint · ThreatFox IOCs for 2026-04-04

Affects type osintSource ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 219

  • zorpelix.topSmartApeSG payload delivery domain (confidence level: 100%)
  • qerunvax.topSmartApeSG payload delivery domain (confidence level: 100%)
  • wildishadventure.comUnidentified 001 botnet C2 domain (confidence level: 75%)
  • editor.fileviewer.blogUnidentified 001 botnet C2 domain (confidence level: 75%)
  • present.pcohenlaw.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
  • veggiehomrecipe.comClearFake payload delivery domain (confidence level: 100%)
  • tridontoq.comClearFake payload delivery domain (confidence level: 100%)
  • baadeckyarns.comNetSupportManager RAT botnet C2 domain (confidence level: 100%)
  • atozcleen.comNetSupportManager RAT botnet C2 domain (confidence level: 100%)
  • thats.theywaytowin.siteDollyWay payload delivery domain (confidence level: 75%)

URLs 140

  • https://zorpelix.top/endpoint/private-sessionstore.jsSmartApeSG payload delivery URL (confidence level: 100%)
  • https://zorpelix.top/endpoint/redirect-cookie.phpSmartApeSG payload delivery URL (confidence level: 100%)
  • https://zorpelix.top/endpoint/admin-bundle.jsSmartApeSG payload delivery URL (confidence level: 100%)
  • https://kaventur.com/angularSmartApeSG payload delivery URL (confidence level: 100%)
  • https://qerunvax.top/endpoint/redirect-cookie.phpSmartApeSG payload delivery URL (confidence level: 100%)
  • https://qerunvax.top/endpoint/admin-bundle.jsSmartApeSG payload delivery URL (confidence level: 100%)
  • http://217.69.2.135/czw8qtplzobjpuskagebra%3d%3dGlassWorm payload delivery URL (confidence level: 100%)
  • http://217.69.3.51/k6iopyyvkypx6r2fd5c6%2fg%3d%3dGlassWorm payload delivery URL (confidence level: 100%)
  • http://217.69.2.135/get_arhive_npm/noquvjrpcd%2fsadyfqegqtq%3d%3dGlassWorm payload delivery URL (confidence level: 100%)
  • http://217.69.3.51/get_arhive_npm/ymlauac6b7gljurhk4vxha%3d%3dGlassWorm payload delivery URL (confidence level: 100%)

IP addresses 68

  • 166.88.182.64FAKEUPDATES botnet C2 server (confidence level: 75%)
  • 216.151.165.201FAKEUPDATES botnet C2 server (confidence level: 75%)
  • 212.64.201.57Mirai botnet C2 server (confidence level: 100%)
  • 171.22.182.231Unidentified 001 botnet C2 server (confidence level: 75%)
  • 46.246.99.110Unidentified 001 botnet C2 server (confidence level: 50%)
  • 176.65.139.102Mirai botnet C2 server (confidence level: 100%)
  • 91.218.183.177AsyncRAT botnet C2 server (confidence level: 100%)
  • 213.21.222.241Unknown malware botnet C2 server (confidence level: 100%)
  • 123.30.48.175Cobalt Strike botnet C2 server (confidence level: 100%)
  • 151.247.22.77Nanocore RAT botnet C2 server (confidence level: 100%)

Hashes 14

  • f36542b449e0b164bf0927d48bd934aa0e66bd2fab483f532cf2010f3fc9d02bUnidentified 001 payload (confidence level: 75%)
  • 42533fbb40fe274c96a31c948ae6e84b6c103f9da6f27c9d1dc5c011f7b719d0Unidentified 001 payload (confidence level: 75%)
  • 9b00ce3b72371c12f93d50eba473241e0a5c8cc1050e3d9ab9fe4ec21e2f5841Unidentified 001 payload (confidence level: 75%)
  • 575cb7f119c0f8a403ec0db3fff8bb7f2a651c5f2501ae51ec7b6241ecdd8a72Unidentified 001 payload (confidence level: 75%)
  • 048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7RedTail payload (confidence level: 100%)
  • 3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6fRedTail payload (confidence level: 100%)
  • 4ac3e3b1f0d054a4ed682a1d6a53ddb3Unknown malware payload (confidence level: 100%)
  • d761a6a7ae9f2254bd81ac234033a8b8Unknown malware payload (confidence level: 100%)
  • 30767275ca828ec1c9d62baccbb0cdf1Unknown malware payload (confidence level: 100%)
  • 7e521bb895d7329b7fb2b2a8736f4b19Unknown malware payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-04-04

Community reviews

Loading reviews…