IndicatorPublished 26 Apr 2026Updated 27 Apr 2026

ThreatFox IOCs for 2026-04-26

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 281

portalpitch.pav3lorex.in.netClearFake payload delivery domain (confidence level: 100%)
fund-ancho.pav3lorex.in.netClearFake payload delivery domain (confidence level: 100%)
crestsud.pav3lorex.in.netClearFake payload delivery domain (confidence level: 100%)
fast-zeit-4.miv6soren.in.netClearFake payload delivery domain (confidence level: 100%)
vert-5.miv6soren.in.netClearFake payload delivery domain (confidence level: 100%)
holz-baum-3.miv6soren.in.netClearFake payload delivery domain (confidence level: 100%)
fast-1.bexla8rin.in.netClearFake payload delivery domain (confidence level: 100%)
iron-land-1q.zex1liron.in.netClearFake payload delivery domain (confidence level: 100%)
dark-berg-2c.zex1liron.in.netClearFake payload delivery domain (confidence level: 100%)
zeit-2.rax7pavel.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 50

https://nxbrew.me/Vidar payload delivery URL (confidence level: 100%)
http://62.60.226.159/xvzpjyddlu/login.phpTinyLoader botnet C2 (confidence level: 100%)
https://tsc.gessoflex.com.br/Vidar botnet C2 (confidence level: 100%)
https://cloudo4meetup.com/auth/jj/joiningmeeting/gmeet/windows/invite.phpUnknown malware payload delivery URL (confidence level: 100%)
https://cloudo4meetup.com/auth/jj/joiningmeeting/gmeet/windows/microsoft-store.phpUnknown malware payload delivery URL (confidence level: 100%)
https://quantumsignaturecertificationgatewayhub.top/12/Unknown malware payload delivery URL (confidence level: 100%)
https://quantumsignaturecertificationgatewayhub.top/12/download.phpUnknown malware payload delivery URL (confidence level: 100%)
https://quantumsignaturecertificationgatewayhub.top/d/Unknown malware payload delivery URL (confidence level: 100%)
https://quantumsignaturecertificationgatewayhub.top/d/download.phpUnknown malware payload delivery URL (confidence level: 100%)
https://quantumsignaturecertificationgatewayhub.top/docusign/1/windows/invite.phpUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 54

64.118.135.172Cobalt Strike botnet C2 server (confidence level: 100%)
163.61.39.140Mirai botnet C2 server (confidence level: 80%)
77.110.117.201GhostSocks botnet C2 server (confidence level: 100%)
64.188.104.35GhostSocks botnet C2 server (confidence level: 100%)
77.110.117.174GhostSocks botnet C2 server (confidence level: 100%)
194.28.225.230GhostSocks botnet C2 server (confidence level: 100%)
64.188.104.2GhostSocks botnet C2 server (confidence level: 100%)
156.245.147.98Cobalt Strike botnet C2 server (confidence level: 75%)
37.107.161.214Xtreme RAT botnet C2 server (confidence level: 100%)
37.107.163.217Xtreme RAT botnet C2 server (confidence level: 100%)

Hashes 1

Empyrean payload (confidence level: 50%)

cbd34e6a8274c62f1d0e4f183dafc17b305e0988b2e5e46cd4a94ef680e7f405

Description

ThreatFox IOCs for 2026-04-26

Impact

The threat involves malware that could potentially deliver payloads and generate network activity indicative of compromise. However, no active exploitation or specific affected software versions have been identified, limiting the immediate impact. The medium severity suggests a moderate risk but without confirmed active exploitation or widespread impact at this time.

Defensive guidance

Security teams should monitor for related IOCs from ThreatFox and apply standard detection and response measures relevant to malware payload delivery and network activity. Since no vendor advisory or fixes exist, focus on detection and containment strategies.

Community reviews

Loading reviews…