Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-04-21

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 391

  • prototype3.thefinancialdatabase.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
  • outlastmods.comUnknown malware payload delivery domain (confidence level: 100%)
  • frostuploadv2.comUnknown Stealer botnet C2 domain (confidence level: 100%)
  • y5jcpyt1f2rgh0ig.frostapiv2.comUnknown Stealer botnet C2 domain (confidence level: 100%)
  • nxt8q5ekqgcimpwx.frostapiv2.comUnknown Stealer botnet C2 domain (confidence level: 100%)
  • downex.frostapiv2.comUnknown Stealer botnet C2 domain (confidence level: 100%)
  • justtalk5.qi8maren.in.netClearFake payload delivery domain (confidence level: 100%)
  • rainynight2.sylo8ren.in.netClearFake payload delivery domain (confidence level: 100%)
  • deepakenterpries1977.inStrelaStealer payload delivery domain (confidence level: 100%)
  • clear-sky3.sylo8ren.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 37

  • https://nenadopapa.cfd/cf.js?v=2Unknown malware payload delivery URL (confidence level: 75%)
  • https://nenadopapa.cfd/api/index.php?a=initUnknown malware payload delivery URL (confidence level: 75%)
  • https://kymli2ren.digital/script.shUnknown malware payload delivery URL (confidence level: 100%)
  • https://185.56.45.63/Vidar botnet C2 (confidence level: 100%)
  • http://irusl.atlastimber.shop/Vidar botnet C2 (confidence level: 100%)
  • https://hte.cebolinhaburger.com/Vidar botnet C2 (confidence level: 75%)
  • https://hte.aasscc.how/Vidar botnet C2 (confidence level: 75%)
  • https://sffdesigns.co.za/Vidar payload delivery URL (confidence level: 75%)
  • https://breakaway-tackle.co.uk/Vidar payload delivery URL (confidence level: 75%)
  • https://cadirsera.com/Vidar payload delivery URL (confidence level: 75%)

IP addresses 50

  • 152.42.142.122Kimwolf botnet C2 server (confidence level: 100%)
  • 172.235.163.136Kimwolf botnet C2 server (confidence level: 100%)
  • 172.235.163.116Kimwolf botnet C2 server (confidence level: 100%)
  • 172.235.163.157Kimwolf botnet C2 server (confidence level: 100%)
  • 172.235.163.141Kimwolf botnet C2 server (confidence level: 100%)
  • 172.235.163.119Kimwolf botnet C2 server (confidence level: 100%)
  • 176.65.139.141Mirai botnet C2 server (confidence level: 80%)
  • 95.211.165.137Remcos botnet C2 server (confidence level: 75%)
  • 185.56.45.63Vidar botnet C2 server (confidence level: 100%)
  • 104.143.39.243Cobalt Strike botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-04-21

Community reviews

Loading reviews…