Skip to main content
IndicatorPublished Updated

type osint · ThreatFox IOCs for 2026-04-06

Affects type osintSource ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 349

  • dowindexsp.comTransferLoader payload delivery domain (confidence level: 100%)
  • bulbous-bouffant.metalseed.netUnknown malware botnet C2 domain (confidence level: 90%)
  • bottube.aiUnknown malware botnet C2 domain (confidence level: 90%)
  • rustchain.orgUnknown malware botnet C2 domain (confidence level: 90%)
  • r3v13wd0s.comUnknown RAT botnet C2 domain (confidence level: 100%)
  • a55doc6.comUnknown RAT botnet C2 domain (confidence level: 100%)
  • zleishitestttg.storeUnknown RAT botnet C2 domain (confidence level: 100%)
  • extended-king-tone-polar.trycloudflare.comEtherRAT botnet C2 domain (confidence level: 100%)
  • fluxnet.lifeEtherRAT botnet C2 domain (confidence level: 100%)
  • cerumo.shopEtherRAT botnet C2 domain (confidence level: 100%)

URLs 153

  • https://h4captcha.sbs/Unknown malware payload delivery URL (confidence level: 90%)
  • https://bulbous-bouffant.metalseed.net/api/minersUnknown malware botnet C2 (confidence level: 90%)
  • https://bulbous-bouffant.metalseed.net/attest/challengeUnknown malware botnet C2 (confidence level: 90%)
  • https://bulbous-bouffant.metalseed.net/attest/submitUnknown malware botnet C2 (confidence level: 90%)
  • https://bulbous-bouffant.metalseed.net/epoch/enrollUnknown malware botnet C2 (confidence level: 90%)
  • https://bottube.ai/api/telemetry/installUnknown malware botnet C2 (confidence level: 90%)
  • https://50.28.86.131/api/minersUnknown malware botnet C2 (confidence level: 90%)
  • https://rustchain.org/attest/challengeUnknown malware botnet C2 (confidence level: 90%)
  • https://rustchain.org/attest/submitUnknown malware botnet C2 (confidence level: 90%)
  • https://rustchain.org/epoch/enrollUnknown malware botnet C2 (confidence level: 90%)

IP addresses 75

  • 39.105.213.45Cobalt Strike botnet C2 server (confidence level: 100%)
  • 50.28.86.131Unknown malware botnet C2 server (confidence level: 90%)
  • 171.233.27.46Venom RAT botnet C2 server (confidence level: 100%)
  • 176.65.139.81Mirai botnet C2 server (confidence level: 80%)
  • 193.46.218.171magecart botnet C2 server (confidence level: 100%)
  • 185.218.16.112magecart botnet C2 server (confidence level: 100%)
  • 194.87.238.14magecart botnet C2 server (confidence level: 100%)
  • 176.65.139.25Mirai botnet C2 server (confidence level: 80%)
  • 103.130.214.71Mirai botnet C2 server (confidence level: 80%)
  • 193.233.19.233XWorm botnet C2 server (confidence level: 100%)

Hashes 6

  • 0f95f1168d151dcea5aa2a5dc2de5721984d10fc2c5095d7e2ea8d46f0496510magecart payload (confidence level: 100%)
  • 0ad7daf901779b5b9639c77662e21a97dc029c125dffd992fbf1419e1e38b464magecart payload (confidence level: 100%)
  • 7e715c846f7ec6f892450fc5e6c36ce030da130defd7d6545358c291ec1145a3magecart payload (confidence level: 100%)
  • 2ba01d4141fce7342a7f0cc330e6c08da83cfe5d4bfd1a79b69f20d2b1f4f7e5GlassWorm payload (confidence level: 100%)
  • cf0eed666d4a468cec802c3cd8289dce3d4b318c17233c3b40370ce2ded75ec7Unknown malware payload (confidence level: 100%)
  • 2d3d236f5f2a41f8e00d2c4545b501406e98ce66ba013e177c496df540d12e3bUnknown malware payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-04-06

Community reviews

Loading reviews…