Skip to main content
IndicatorPublished Updated

type osint · ThreatFox IOCs for 2026-04-05

Affects type osintSource ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 87

  • tfxgjy8d4r.localto.netQuasar RAT botnet C2 domain (confidence level: 75%)
  • sost1213.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
  • ghfjfgj57765r67ghght-56660.portmap.hostXWorm botnet C2 domain (confidence level: 100%)
  • livewithrelief.comStrelaStealer payload delivery domain (confidence level: 100%)
  • snack-api.balkarbelyashi.in.netClearFake payload delivery domain (confidence level: 100%)
  • hot-belyash.balkarbelyashi.in.netClearFake payload delivery domain (confidence level: 100%)
  • chhidden.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
  • hiddenhost.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
  • scdoorco.co.ukQuasar RAT botnet C2 domain (confidence level: 100%)
  • drink-sync.okiselwhiten.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 46

  • http://196.251.107.130/h84jjfar/index.phpAmadey botnet C2 (confidence level: 100%)
  • https://project-stor51092.pages.devUnknown Stealer payload delivery URL (confidence level: 100%)
  • https://ftduk.com/curl/34979832a7c24b00a2bf21f5aa53a5025b08c497a9400c403602ac08e434d033Unknown Stealer payload delivery URL (confidence level: 100%)
  • https://ftduk.com/cleaner3/updateUnknown Stealer payload delivery URL (confidence level: 100%)
  • http://178.16.52.29Stealc botnet C2 (confidence level: 100%)
  • https://claude-docs.comUnknown Stealer payload delivery URL (confidence level: 100%)
  • https://lowtrap.mom/loader.shUnknown Stealer payload delivery URL (confidence level: 100%)
  • https://lowtrap.mom/payload.applescriptUnknown Stealer payload delivery URL (confidence level: 100%)
  • https://lowtrap.mom/api/bot/heartbeatUnknown Stealer payload delivery URL (confidence level: 100%)
  • https://ftduk.com/curl/59b62772b3fd5584013342c0d9741befd73af0701ae0409d3cc7c3546680906cUnknown Stealer payload delivery URL (confidence level: 100%)

IP addresses 7

  • 116.193.134.6RedLine Stealer botnet C2 server (confidence level: 100%)
  • 172.65.185.109Ghost RAT botnet C2 server (confidence level: 100%)
  • 95.70.183.89XWorm botnet C2 server (confidence level: 100%)
  • 213.165.45.120Unknown Stealer payload delivery server (confidence level: 100%)
  • 8.148.5.193XWorm botnet C2 server (confidence level: 75%)
  • 179.118.199.252XWorm botnet C2 server (confidence level: 100%)
  • 5.42.92.37XWorm botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-04-05

Community reviews

Loading reviews…