Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-04-27

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 289

  • dibzyqjy.zun5larek.in.netClearFake payload delivery domain (confidence level: 100%)
  • trinexa.zun5larek.in.netClearFake payload delivery domain (confidence level: 100%)
  • creehid.rax3vomen.in.netClearFake payload delivery domain (confidence level: 100%)
  • kellithis.rax3vomen.in.netClearFake payload delivery domain (confidence level: 100%)
  • resolvercultur.rax3vomen.in.netClearFake payload delivery domain (confidence level: 100%)
  • warmcon.rax3vomen.in.netClearFake payload delivery domain (confidence level: 100%)
  • pixellowersoon.topmagecart payload delivery domain (confidence level: 100%)
  • networkhub.syke8liron.in.netClearFake payload delivery domain (confidence level: 100%)
  • pixel9-layer.syke8liron.in.netClearFake payload delivery domain (confidence level: 100%)
  • styledontcryyy.commagecart payload delivery domain (confidence level: 50%)

URLs 80

  • http://kingspy.dynv6.net:797/vreVjw0rm botnet C2 (confidence level: 100%)
  • http://196.199.55.26:7777/b367c5ea.phpDCRat botnet C2 (confidence level: 100%)
  • https://ns-claude-js.beer/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
  • https://awesomeisojs.beer/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
  • https://marketsnows.com/9cg0khIClickFix payload delivery URL (confidence level: 100%)
  • https://mdasnmitrot.com/ooaoll.jsIClickFix payload delivery URL (confidence level: 100%)
  • https://packetswitchings.com.ng/wp-blog-footer.php?fp=1IClickFix payload delivery URL (confidence level: 100%)
  • https://packetswitchings.com.ng/wp-blog-footer.php?data=IClickFix payload delivery URL (confidence level: 100%)
  • https://bbs.vi-ler.dk/Vidar botnet C2 (confidence level: 100%)
  • https://pillow.riverbridge.site/Vidar botnet C2 (confidence level: 100%)

IP addresses 48

  • 31.57.184.186Remcos botnet C2 server (confidence level: 75%)
  • 172.67.152.162Nanocore RAT botnet C2 server (confidence level: 100%)
  • 104.21.88.201Nanocore RAT botnet C2 server (confidence level: 100%)
  • 160.191.89.201Nanocore RAT botnet C2 server (confidence level: 100%)
  • 172.67.213.218Nanocore RAT botnet C2 server (confidence level: 100%)
  • 104.21.50.237Nanocore RAT botnet C2 server (confidence level: 100%)
  • 144.31.61.121Quasar RAT botnet C2 server (confidence level: 100%)
  • 175.24.201.23Meterpreter botnet C2 server (confidence level: 100%)
  • 103.12.148.79ValleyRAT botnet C2 server (confidence level: 100%)
  • 43.132.210.230ValleyRAT botnet C2 server (confidence level: 100%)

Hashes 1

Unknown malware payload (confidence level: 80%)

  • 08a474368a2f94f347ad9e1a0a08d4258fcf49c6b9373214f7901bb770bacca4

Description

ThreatFox IOCs for 2026-04-27

Community reviews

Loading reviews…