Skip to main content
IndicatorPublished Updated

type osint · ThreatFox IOCs for 2026-04-07

Affects type osintSource ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 374

  • pure-node.bactergreat.in.netClearFake payload delivery domain (confidence level: 100%)
  • lab-access.bactergreat.in.netClearFake payload delivery domain (confidence level: 100%)
  • micro-svc.bactergreat.in.netClearFake payload delivery domain (confidence level: 100%)
  • fall-check.downpredict.in.netClearFake payload delivery domain (confidence level: 100%)
  • trend-api.downpredict.in.netClearFake payload delivery domain (confidence level: 100%)
  • stat-portal.downpredict.in.netClearFake payload delivery domain (confidence level: 100%)
  • floor-node.downpredict.in.netClearFake payload delivery domain (confidence level: 100%)
  • nodejs.co.comIClickFix payload delivery domain (confidence level: 100%)
  • chocolatey.netIClickFix payload delivery domain (confidence level: 100%)
  • nodejs-setup.co.comIClickFix payload delivery domain (confidence level: 100%)

URLs 85

  • https://www.formedia.co.il/Unknown malware payload delivery URL (confidence level: 90%)
  • https://qxazzilo.top/realm/session-header.jsSmartApeSG payload delivery URL (confidence level: 100%)
  • http://157.173.104.20/panel/admin/login.phpUnknown malware botnet C2 (confidence level: 100%)
  • https://ggd.japan365.co/Vidar botnet C2 (confidence level: 100%)
  • https://ggd.scarletmc.ru/Vidar botnet C2 (confidence level: 100%)
  • https://sts.japan365.co/Vidar botnet C2 (confidence level: 100%)
  • https://chi.japan365.co/Vidar botnet C2 (confidence level: 100%)
  • https://chi.scarletmc.ru/Vidar botnet C2 (confidence level: 100%)
  • https://dep.rapidphonebuyer.co.uk/Vidar botnet C2 (confidence level: 100%)
  • https://ggl.rapidphonebuyer.co.uk/Vidar botnet C2 (confidence level: 100%)

IP addresses 20

  • 45.138.25.150NetSupportManager RAT botnet C2 server (confidence level: 100%)
  • 178.64.226.21NetSupportManager RAT botnet C2 server (confidence level: 100%)
  • 167.148.195.179NetSupportManager RAT botnet C2 server (confidence level: 100%)
  • 192.227.135.226Remcos botnet C2 server (confidence level: 100%)
  • 64.81.30.152ValleyRAT botnet C2 server (confidence level: 100%)
  • 89.190.158.63Unknown RAT botnet C2 server (confidence level: 100%)
  • 1.15.76.39Cobalt Strike botnet C2 server (confidence level: 100%)
  • 74.0.42.211Vidar botnet C2 server (confidence level: 100%)
  • 151.245.121.90Vidar botnet C2 server (confidence level: 100%)
  • 31.57.201.12Vidar botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-04-07

Community reviews

Loading reviews…