Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-04-17

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 320

  • binarymod.vyr2dalen.in.netClearFake payload delivery domain (confidence level: 100%)
  • outdock.tix9sorel.in.netClearFake payload delivery domain (confidence level: 100%)
  • shapemoral.pyn6toral.in.netClearFake payload delivery domain (confidence level: 100%)
  • openclow.co.comIClickFix payload delivery domain (confidence level: 100%)
  • openclow.gr.comIClickFix payload delivery domain (confidence level: 100%)
  • geninicli.co.comIClickFix payload delivery domain (confidence level: 100%)
  • geninicli.gr.comIClickFix payload delivery domain (confidence level: 100%)
  • claubecode.gr.comIClickFix payload delivery domain (confidence level: 100%)
  • claubecode.co.comIClickFix payload delivery domain (confidence level: 100%)
  • gemini-console.comIClickFix payload delivery domain (confidence level: 100%)

URLs 348

  • https://install-claude.com/install.ps1IClickFix payload delivery URL (confidence level: 100%)
  • https://gemini-console.com/install.ps1IClickFix payload delivery URL (confidence level: 100%)
  • http://102.220.91.114:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
  • https://microservisetrue.vip/fwefwe324234234rgeffwehtrwyrhtrhtqwfqwd31443wefefwwfer3232fewwefwefwefqgrqwtherergqefwefqweqfwqf32fefwsda/uploads/efewefwewfew342234423234feweefwwefewefweffewwefewf.php?file=333.exeVidar payload delivery URL (confidence level: 75%)
  • https://nin.blogdospesados.com.br/Vidar botnet C2 (confidence level: 75%)
  • https://nin.shurimaster.com/Vidar botnet C2 (confidence level: 75%)
  • https://imagechest.info:8443/Unknown malware botnet C2 (confidence level: 100%)
  • https://internalwork.top:8443/Unknown malware botnet C2 (confidence level: 100%)
  • https://katpil.info:8443/Unknown malware botnet C2 (confidence level: 100%)
  • https://multiclus.info:8443/Unknown malware botnet C2 (confidence level: 100%)

IP addresses 99

  • 23.227.203.52Interlock RAT payload delivery server (confidence level: 100%)
  • 69.169.109.132Interlock RAT payload delivery server (confidence level: 100%)
  • 167.235.234.45Interlock RAT payload delivery server (confidence level: 100%)
  • 102.220.91.114Unknown malware botnet C2 server (confidence level: 100%)
  • 5.252.153.90Unknown malware botnet C2 server (confidence level: 100%)
  • 91.92.240.2Unknown malware botnet C2 server (confidence level: 100%)
  • 91.92.240.207Unknown malware botnet C2 server (confidence level: 100%)
  • 91.92.240.85Unknown malware botnet C2 server (confidence level: 100%)
  • 91.92.240.94Unknown malware botnet C2 server (confidence level: 100%)
  • 91.92.241.211Unknown malware botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-04-17

Community reviews

Loading reviews…