Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-04-19

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 290

  • sub-the0.8zorelin.in.netClearFake payload delivery domain (confidence level: 100%)
  • deployreed.po6vtaren.in.netClearFake payload delivery domain (confidence level: 100%)
  • portvelv.po6vtaren.in.netClearFake payload delivery domain (confidence level: 100%)
  • mediacata.po6vtaren.in.netClearFake payload delivery domain (confidence level: 100%)
  • 2mbdmbjd.po6vtaren.in.netClearFake payload delivery domain (confidence level: 100%)
  • ipghcn.po6vtaren.in.netClearFake payload delivery domain (confidence level: 100%)
  • vor-spireos.wi3msorel.in.netClearFake payload delivery domain (confidence level: 100%)
  • vialnoti.wi3msorel.in.netClearFake payload delivery domain (confidence level: 100%)
  • pix32-logic.wi3msorel.in.netClearFake payload delivery domain (confidence level: 100%)
  • dkkvkpl.wi3msorel.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 125

  • http://185.211.100.50:5000/loginUnknown malware botnet C2 (confidence level: 100%)
  • http://185.228.83.217:8443/loginUnknown malware botnet C2 (confidence level: 100%)
  • http://94.232.46.16:8081/loginUnknown malware botnet C2 (confidence level: 100%)
  • http://176.65.132.178/run.shUnknown malware payload delivery URL (confidence level: 75%)
  • https://i-like-boys.com/tree.vbsUnknown Loader payload delivery URL (confidence level: 100%)
  • https://ggsf.5zoramel.in.net/05fe317c-0981-4de2-bc8a-930d369db441/ck-3d80df5d12cdfe6450a782fc87bf66b444.googleClearFake payload delivery URL (confidence level: 75%)
  • https://temp-enc.5zoramel.in.net/05fe317c-0981-4de2-bc8a-930d369db441/ck-3d80df5d12cdfe6450a782fc87bf66b444.googleClearFake payload delivery URL (confidence level: 75%)
  • https://dynnex4on.5zoramel.in.net/05fe317c-0981-4de2-bc8a-930d369db441/ck-3d80df5d12cdfe6450a782fc87bf66b444.googleClearFake payload delivery URL (confidence level: 75%)
  • https://ledgerinn.5zoramel.in.net/05fe317c-0981-4de2-bc8a-930d369db441/ck-3d80df5d12cdfe6450a782fc87bf66b444.googleClearFake payload delivery URL (confidence level: 75%)
  • https://freightframe.5zoramel.in.net/05fe317c-0981-4de2-bc8a-930d369db441/ck-3d80df5d12cdfe6450a782fc87bf66b444.googleClearFake payload delivery URL (confidence level: 75%)

IP addresses 30

  • 218.244.142.4Cobalt Strike botnet C2 server (confidence level: 100%)
  • 27.71.186.244DCRat botnet C2 server (confidence level: 100%)
  • 185.211.100.50Unknown malware botnet C2 server (confidence level: 100%)
  • 185.228.83.217Unknown malware botnet C2 server (confidence level: 100%)
  • 94.232.46.16Unknown malware botnet C2 server (confidence level: 100%)
  • 91.92.241.160Unknown malware botnet C2 server (confidence level: 75%)
  • 158.94.210.248Unknown malware botnet C2 server (confidence level: 75%)
  • 152.136.159.25Cobalt Strike botnet C2 server (confidence level: 100%)
  • 124.71.25.92Cobalt Strike botnet C2 server (confidence level: 100%)
  • 20.166.18.164Cobalt Strike botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-04-19

Community reviews

Loading reviews…