Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-04-14

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 571

  • notstorageapis.comUnknown malware payload delivery domain (confidence level: 90%)
  • claude-install.comIClickFix payload delivery domain (confidence level: 100%)
  • claudecode.gr.comIClickFix payload delivery domain (confidence level: 100%)
  • open-claw.gr.comIClickFix payload delivery domain (confidence level: 100%)
  • slack.gr.comIClickFix payload delivery domain (confidence level: 100%)
  • claude.gr.comIClickFix payload delivery domain (confidence level: 100%)
  • claudecode-download.co.comIClickFix payload delivery domain (confidence level: 100%)
  • gemini-cli.co.comIClickFix payload delivery domain (confidence level: 100%)
  • openclawcli.co.comIClickFix payload delivery domain (confidence level: 100%)
  • geminicli.co.comIClickFix payload delivery domain (confidence level: 100%)

URLs 4,432

  • https://t.me/hksudfgbskdfbotUnknown malware botnet C2 (confidence level: 100%)
  • https://fluxy-core.top/alias/login-ajax.phpSmartApeSG payload delivery URL (confidence level: 100%)
  • https://fluxy-core.top/alias/middleware-controller.jsSmartApeSG payload delivery URL (confidence level: 100%)
  • https://link9.prime-track.xyz/api/v2/sync/xpjuf.mpexUnknown malware botnet C2 (confidence level: 100%)
  • https://link9.prime-track.xyz/api/v2/statusUnknown malware botnet C2 (confidence level: 100%)
  • https://khaotixlab.top/alias/login-ajax.phpSmartApeSG payload delivery URL (confidence level: 100%)
  • https://khaotixlab.top/alias/middleware-controller.jsSmartApeSG payload delivery URL (confidence level: 100%)
  • https://azoria.ch/Unknown malware payload delivery URL (confidence level: 90%)
  • https://excellentbusinessplans.com/Unknown malware payload delivery URL (confidence level: 90%)
  • https://merkadoteknia.com/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 129

  • 45.157.232.130Venom RAT botnet C2 server (confidence level: 100%)
  • 106.12.4.244Cobalt Strike botnet C2 server (confidence level: 100%)
  • 134.209.248.158Cobalt Strike botnet C2 server (confidence level: 100%)
  • 140.143.207.166Unknown malware botnet C2 server (confidence level: 100%)
  • 36.67.234.41Chaos botnet C2 server (confidence level: 100%)
  • 95.216.125.140Vidar botnet C2 server (confidence level: 50%)
  • 95.216.125.142Vidar botnet C2 server (confidence level: 50%)
  • 77.42.48.99Vidar botnet C2 server (confidence level: 50%)
  • 5.9.170.138Vidar botnet C2 server (confidence level: 50%)
  • 5.9.170.140Vidar botnet C2 server (confidence level: 50%)

Hashes 662

  • eff5ece65fb30b21a3ebc1ceb738556b774b452d13e119d5a2bfb489459b4a46Unknown malware payload (confidence level: 100%)
  • 49685018878b9a65ced16730a1842281175476ee5c475f608cadf1cdcc2d9524Unknown malware payload (confidence level: 100%)
  • 8119f2ea89079ab7394bb4e8ff221a2f369bf236f95d6aa20f83dc7a98933d9aUnknown malware payload (confidence level: 100%)
  • f99dd1d54a35253968feaf595c780a56b08b4bb73e395449b6f201ef1a5a5ad6RedLine Stealer payload (confidence level: 75%)
  • eaa975b5e8f16b3ed49382517231e6439b5aff9d603c35d1ae682dd5f83ea110RedLine Stealer payload (confidence level: 75%)
  • dd95dd42a5dc9212db72ef97b4f891ac31ff21b2e52536392395cf760a08c067RedLine Stealer payload (confidence level: 75%)
  • 820077c9c5fe8efba6a41b83c7787397de4dc65aaed23e591e5439691921e590RedLine Stealer payload (confidence level: 75%)
  • 65c598eed6a29cf700e4fc5c4885db8616f86ab40af6ea00a7b7dec9eafd9b43RedLine Stealer payload (confidence level: 75%)
  • f64af31a6ef19a3825f1ca7bd747531befb4ffcd8647a324b7cb4362f76a425dRedLine Stealer payload (confidence level: 75%)
  • 27db224c47f6517f10bf21889c3ac8fdf35391aa6bf91ca04b34f1a02fdd2644RedLine Stealer payload (confidence level: 75%)

Description

ThreatFox IOCs for 2026-04-14

Community reviews

Loading reviews…