Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-04-20

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 381

  • sweet-cake4.apoth-shopping.in.netClearFake payload delivery domain (confidence level: 100%)
  • hot-coffee5.apoth-shopping.in.netClearFake payload delivery domain (confidence level: 100%)
  • cool-drink6.apoth-shopping.in.netClearFake payload delivery domain (confidence level: 100%)
  • sky-view1.white5lave.in.netClearFake payload delivery domain (confidence level: 100%)
  • sun-light2.white5lave.in.netClearFake payload delivery domain (confidence level: 100%)
  • blue-cloud3.white5lave.in.netClearFake payload delivery domain (confidence level: 100%)
  • white-snow4.white5lave.in.netClearFake payload delivery domain (confidence level: 100%)
  • warm-wind5.white5lave.in.netClearFake payload delivery domain (confidence level: 100%)
  • soft-rain6.white5lave.in.netClearFake payload delivery domain (confidence level: 100%)
  • book-read1.art-tonsillitis.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 106

  • https://6p1anuri2.6xkmet.cc/dklzrhrb2m043ko5d87o85dt6/ldtkqtglibsfudtUnknown Loader payload delivery URL (confidence level: 100%)
  • https://htijv.66uc4x.cc/d6omfh97p50pldw5lf158ug81/dbqobfyasmyhnpfbvmUnknown Loader payload delivery URL (confidence level: 100%)
  • https://pdmh48ixc.6oxj9t.cc/d49wjhdt530afog5sebu8chz7/uuaeljxnxqxdUnknown Loader payload delivery URL (confidence level: 100%)
  • https://4qztty.66uc4x.cc/d6bfqh2bso0o71854a2v8hsyd/fpeixmdqwpipvcrhkhaUnknown Loader payload delivery URL (confidence level: 100%)
  • https://gzcawbchv.6i8htz.cc/dyag6h52kn0jiyd56rm38jh3w/fphpxarswycspgUnknown Loader payload delivery URL (confidence level: 100%)
  • https://j7m5m4k.627x9a.cc/djriphf63d095on5i3rb8vr3p/xfxmyhapjjabpnvdUnknown Loader payload delivery URL (confidence level: 100%)
  • https://3jkqc5j.69mcg8.cc/d2l9th2y6e0udga5q19m89thu/gfnqvlbndlmbmhjcexUnknown Loader payload delivery URL (confidence level: 100%)
  • https://70csneb2.6bqbxr.cc/da7u8halrm0emvf5p2rb8vpj4/fjvoqwttejoxdgjksbdUnknown Loader payload delivery URL (confidence level: 100%)
  • https://i6k.6p2s8s.cc/d4nh6hzxug0uvec5u4py8kit6/ehenfxlyvhujUnknown Loader payload delivery URL (confidence level: 100%)
  • https://bwib.6cvjua.cc/due43hs6z50r5su5jf1t88e9b/vtlqavffvirkhUnknown Loader payload delivery URL (confidence level: 100%)

IP addresses 78

  • 80.96.113.253Aisuru botnet C2 server (confidence level: 100%)
  • 104.21.43.40Nanocore RAT botnet C2 server (confidence level: 100%)
  • 172.67.144.104Nanocore RAT botnet C2 server (confidence level: 100%)
  • 172.67.218.225Nanocore RAT botnet C2 server (confidence level: 100%)
  • 104.21.55.33Nanocore RAT botnet C2 server (confidence level: 100%)
  • 172.67.220.51Nanocore RAT botnet C2 server (confidence level: 100%)
  • 57.158.24.51ValleyRAT botnet C2 server (confidence level: 100%)
  • 134.122.203.197ValleyRAT botnet C2 server (confidence level: 100%)
  • 202.95.8.221ValleyRAT botnet C2 server (confidence level: 100%)
  • 108.187.4.141ValleyRAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-04-20

Community reviews

Loading reviews…