Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-04-11

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 341

  • windlrr.comKongTuke payload delivery domain (confidence level: 100%)
  • sfu2.ontofabric.in.netClearFake payload delivery domain (confidence level: 100%)
  • mist-sub.ontofabric.in.netClearFake payload delivery domain (confidence level: 100%)
  • draft-ree.axiocorex.in.netClearFake payload delivery domain (confidence level: 100%)
  • geo-4zur.axiocorex.in.netClearFake payload delivery domain (confidence level: 100%)
  • maybedontbanplease.comCASTLELOADER payload delivery domain (confidence level: 100%)
  • googlemt.xyzUnknown malware payload delivery domain (confidence level: 75%)
  • googlemeets.usUnknown malware payload delivery domain (confidence level: 75%)
  • googlemeetingview.comUnknown malware payload delivery domain (confidence level: 75%)
  • googlemeetingginterview.liveUnknown malware payload delivery domain (confidence level: 75%)

URLs 71

  • hxxps://test-dummy-validation-99999.com/testLumma Stealer payload delivery URL (confidence level: 75%)
  • hxxps://download-version.1-5-8.com/claude.msixbundleDarkGate payload delivery URL (confidence level: 75%)
  • http://77.91.97.186/login.htmlUnknown malware botnet C2 (confidence level: 100%)
  • https://zellvaro.top/rate/gateway-xml.phpSmartApeSG payload delivery URL (confidence level: 100%)
  • https://zellvaro.top/rate/throttle-component.jsSmartApeSG payload delivery URL (confidence level: 100%)
  • http://147.45.42.200/ce3cbfc887?force=1Unknown malware payload delivery URL (confidence level: 100%)
  • https://windlrr.com/file.jsUnknown malware payload delivery URL (confidence level: 100%)
  • http://2.26.97.61/sayipemAMOS payload delivery URL (confidence level: 100%)
  • http://64.188.98.250/hevidaAMOS payload delivery URL (confidence level: 50%)
  • http://114.132.251.233:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)

IP addresses 90

  • 156.234.202.149Cobalt Strike botnet C2 server (confidence level: 100%)
  • 110.37.13.228Mozi botnet C2 server (confidence level: 100%)
  • 54.37.70.249Unknown malware botnet C2 server (confidence level: 75%)
  • 176.65.139.25Mirai botnet C2 server (confidence level: 80%)
  • 158.94.208.131Unknown malware botnet C2 server (confidence level: 100%)
  • 114.132.251.233Unknown malware botnet C2 server (confidence level: 100%)
  • 120.48.18.226Cobalt Strike botnet C2 server (confidence level: 100%)
  • 42.233.105.79Mozi botnet C2 server (confidence level: 100%)
  • 47.76.181.146GobRAT botnet C2 server (confidence level: 100%)
  • 118.122.8.220NetSupportManager RAT botnet C2 server (confidence level: 100%)

Hashes 1

IClickFix payload (confidence level: 100%)

  • 20977e3f485f2e39b6af9c472903651a09768d869d0f4e6fe068ac0b59c98bde

Description

ThreatFox IOCs for 2026-04-11

Community reviews

Loading reviews…