Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-04-15

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 470

  • cdn1-edge.xel7morax.in.netClearFake payload delivery domain (confidence level: 100%)
  • cfmn.us.comUnknown malware payload delivery domain (confidence level: 100%)
  • client1-zone.smart-logic-trade.in.netClearFake payload delivery domain (confidence level: 100%)
  • layer4-show.prime-sector-unit.in.netClearFake payload delivery domain (confidence level: 100%)
  • piece5-load.prime-sector-unit.in.netClearFake payload delivery domain (confidence level: 100%)
  • front6-gate.prime-sector-unit.in.netClearFake payload delivery domain (confidence level: 100%)
  • news1-wire.daily-report-flow.in.netClearFake payload delivery domain (confidence level: 100%)
  • event2-log.daily-report-flow.in.netClearFake payload delivery domain (confidence level: 100%)
  • topic3-base.daily-report-flow.in.netClearFake payload delivery domain (confidence level: 100%)
  • table4-data.daily-report-flow.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 418

  • https://thomphon.com/api/v1/telemetryHavoc botnet C2 (confidence level: 90%)
  • http://47.76.181.119:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
  • https://soilexcavating.com/Unknown malware payload delivery URL (confidence level: 90%)
  • https://opportunitiesforeveryone.net/Vidar payload delivery URL (confidence level: 75%)
  • https://goldnestresearch.com/Vidar payload delivery URL (confidence level: 75%)
  • https://pompiliomartinez.edu.co/Vidar payload delivery URL (confidence level: 75%)
  • https://typehuman.com/Vidar payload delivery URL (confidence level: 75%)
  • https://man2ska.sch.id/Vidar payload delivery URL (confidence level: 75%)
  • https://bayrestorationsct.com/Vidar payload delivery URL (confidence level: 75%)
  • https://radarr.africa/Vidar payload delivery URL (confidence level: 75%)

IP addresses 371

  • 91.92.243.79Unknown Loader botnet C2 server (confidence level: 50%)
  • 47.76.181.119Unknown malware botnet C2 server (confidence level: 100%)
  • 64.227.67.145Kimwolf botnet C2 server (confidence level: 100%)
  • 164.92.153.50Kimwolf botnet C2 server (confidence level: 100%)
  • 165.22.202.222Kimwolf botnet C2 server (confidence level: 100%)
  • 161.35.155.138Kimwolf botnet C2 server (confidence level: 100%)
  • 174.138.7.184Kimwolf botnet C2 server (confidence level: 100%)
  • 165.22.202.17Kimwolf botnet C2 server (confidence level: 100%)
  • 209.38.34.146Kimwolf botnet C2 server (confidence level: 100%)
  • 142.93.133.223Kimwolf botnet C2 server (confidence level: 100%)

Hashes 1

Lumma Stealer payload (confidence level: 50%)

  • 32cca9d78cffced8d31bd782b76f84e14926752d

Description

ThreatFox IOCs for 2026-04-15

Community reviews

Loading reviews…