Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-04-24

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 300

  • use-claude.comIClickFix payload delivery domain (confidence level: 100%)
  • cpanel.eastcoast-wealth.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
  • carrolc.comHavoc botnet C2 domain (confidence level: 90%)
  • cwrtwright.comHavoc botnet C2 domain (confidence level: 90%)
  • 176.65.148.212.ptr.pfcloud.networkMirai botnet C2 domain (confidence level: 80%)
  • afejoed.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
  • analipr.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
  • brorgma.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
  • coneogz.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
  • driplin.cyouLumma Stealer botnet C2 domain (confidence level: 75%)

URLs 53

  • https://use-claude.com/install.ps1Unknown Loader payload delivery URL (confidence level: 100%)
  • https://dhnsdns.beer/api/index.phpUnknown malware payload delivery URL (confidence level: 75%)
  • https://dhnsdns.beer/api/7z.exeUnknown malware payload delivery URL (confidence level: 75%)
  • http://206.82.6.110:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
  • https://awgwindowcleaning.com/Vidar payload delivery URL (confidence level: 75%)
  • https://dominion.pk/Vidar payload delivery URL (confidence level: 75%)
  • https://claude-desktop.gitlab.io/dev/Unknown malware payload delivery URL (confidence level: 100%)
  • https://clang-outrag.digital/script.shUnknown malware payload delivery URL (confidence level: 100%)
  • https://www.document-share-id382929992933.sisregcel.comUnknown malware payload delivery URL (confidence level: 100%)
  • http://172.94.9.44/2.txtUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 44

  • 45.61.136.30Havoc botnet C2 server (confidence level: 90%)
  • 176.65.148.212Mirai botnet C2 server (confidence level: 80%)
  • 104.248.200.241Kimwolf botnet C2 server (confidence level: 100%)
  • 167.172.34.157Kimwolf botnet C2 server (confidence level: 100%)
  • 165.232.91.237Kimwolf botnet C2 server (confidence level: 100%)
  • 45.61.186.36Aisuru botnet C2 server (confidence level: 100%)
  • 154.9.237.158Unknown malware payload delivery server (confidence level: 100%)
  • 178.16.52.101Unknown malware payload delivery server (confidence level: 75%)
  • 45.131.108.107Mirai botnet C2 server (confidence level: 80%)
  • 206.82.6.110Unknown malware botnet C2 server (confidence level: 100%)

Hashes 4

  • fb3630822b70bacb56aa4cec29b5a0e3e9acb3920809e70310a4003385a6d34aHavoc payload (confidence level: 90%)
  • 6316e735a026e0421e4ee274e36594bb510afbf8798e767f6a082d827b5082a0KongTuke payload (confidence level: 90%)
  • 59e3c4cb06331b4f2d78a9a0592f3747e573bd01c5a7650c26361d1e25520712Havoc payload (confidence level: 60%)
  • b25dedf5906840ddb19f96c27fae06abb08872b4b931466cc63ac1e9436b1270Unknown malware payload (confidence level: 75%)

Description

ThreatFox IOCs for 2026-04-24

Community reviews

Loading reviews…