Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-04-12

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 327

  • poxzxin.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
  • peer1-link.zeq9lora.in.netClearFake payload delivery domain (confidence level: 100%)
  • 2hqc55jr.amb1ing-farm.digitalClearFake payload delivery domain (confidence level: 100%)
  • f13hwmuq.amb1ing-farm.digitalClearFake payload delivery domain (confidence level: 100%)
  • seed2-node.zeq9lora.in.netClearFake payload delivery domain (confidence level: 100%)
  • hash3-list.zeq9lora.in.netClearFake payload delivery domain (confidence level: 100%)
  • salt4-byte.zeq9lora.in.netClearFake payload delivery domain (confidence level: 100%)
  • ping5-test.zeq9lora.in.netClearFake payload delivery domain (confidence level: 100%)
  • hop6-route.zeq9lora.in.netClearFake payload delivery domain (confidence level: 100%)
  • zone1-dns.travexon.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 47

  • https://kurdishstudies.net/Unknown malware payload delivery URL (confidence level: 90%)
  • https://136.243.203.97Vidar botnet C2 (confidence level: 75%)
  • https://primetrace.cfd/t.js?site=Unknown malware payload delivery URL (confidence level: 100%)
  • https://primetrace.cfd/t.188cfd3975db.jsUnknown malware payload delivery URL (confidence level: 100%)
  • https://primetrace.cfd/ext-b.8ec365dfbab5.jsUnknown malware payload delivery URL (confidence level: 100%)
  • https://primetrace.cfd/ext.4ac6dedda6a5.jsUnknown malware payload delivery URL (confidence level: 100%)
  • https://shadowlink.cyou/t.js?site=Unknown malware payload delivery URL (confidence level: 100%)
  • https://shadowlink.cyou/t.188cfd3975db.jsUnknown malware payload delivery URL (confidence level: 100%)
  • https://shadowlink.cyou/ext-b.8ec365dfbab5.jsUnknown malware payload delivery URL (confidence level: 100%)
  • https://shadowlink.cyou/ext.4ac6dedda6a5.jsUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 75

  • 134.122.62.220Kimwolf botnet C2 server (confidence level: 100%)
  • 146.190.237.152Kimwolf botnet C2 server (confidence level: 100%)
  • 209.38.109.16Kimwolf botnet C2 server (confidence level: 100%)
  • 142.93.129.148Kimwolf botnet C2 server (confidence level: 100%)
  • 172.233.48.232Kimwolf botnet C2 server (confidence level: 100%)
  • 172.233.33.137Kimwolf botnet C2 server (confidence level: 100%)
  • 172.233.54.223Kimwolf botnet C2 server (confidence level: 100%)
  • 172.233.54.228Kimwolf botnet C2 server (confidence level: 100%)
  • 172.235.182.208Kimwolf botnet C2 server (confidence level: 100%)
  • 172.233.54.211Kimwolf botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-04-12

Community reviews

Loading reviews…