Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-04-28

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 322

  • zbh50.nol7sirex.in.netClearFake payload delivery domain (confidence level: 100%)
  • vordraor5.nol7sirex.in.netClearFake payload delivery domain (confidence level: 100%)
  • wwj2alum.pax4moren.in.netClearFake payload delivery domain (confidence level: 100%)
  • truebasecore.comUnknown malware payload delivery domain (confidence level: 80%)
  • zentideen.pax4moren.in.netClearFake payload delivery domain (confidence level: 100%)
  • stagesteril.pax4moren.in.netClearFake payload delivery domain (confidence level: 100%)
  • fast-zeit-1.tal4miren.in.netClearFake payload delivery domain (confidence level: 100%)
  • holz-baum-5.tal4miren.in.netClearFake payload delivery domain (confidence level: 100%)
  • open-7.tal4miren.in.netClearFake payload delivery domain (confidence level: 100%)
  • datanexlab.topSmartApeSG payload delivery domain (confidence level: 100%)

URLs 145

  • https://truebasecore.com/ioUnknown malware payload delivery URL (confidence level: 80%)
  • http://104.225.129.105/Unknown malware payload delivery URL (confidence level: 80%)
  • http://216.120.201.116/Unknown malware payload delivery URL (confidence level: 80%)
  • https://datanexlab.top/trace/refresh-css.phpSmartApeSG payload delivery URL (confidence level: 100%)
  • https://datanexlab.top/trace/alias-thread.jsSmartApeSG payload delivery URL (confidence level: 100%)
  • https://zentav.top/trace/refresh-css.phpSmartApeSG payload delivery URL (confidence level: 100%)
  • https://zentav.top/trace/alias-thread.jsSmartApeSG payload delivery URL (confidence level: 100%)
  • https://zentav.top/trace/audit-module.jsSmartApeSG payload delivery URL (confidence level: 100%)
  • https://isn.trbombom.com/Vidar botnet C2 (confidence level: 100%)
  • https://isn.jornaltribunadearaxa.com.br/Vidar botnet C2 (confidence level: 100%)

IP addresses 74

  • 167.99.35.20Kimwolf botnet C2 server (confidence level: 100%)
  • 161.35.144.223Kimwolf botnet C2 server (confidence level: 100%)
  • 142.93.128.30Kimwolf botnet C2 server (confidence level: 100%)
  • 64.89.161.70Kimwolf botnet C2 server (confidence level: 100%)
  • 5.175.215.42Kimwolf botnet C2 server (confidence level: 100%)
  • 83.142.209.252Kimwolf botnet C2 server (confidence level: 100%)
  • 64.89.160.214Kimwolf botnet C2 server (confidence level: 100%)
  • 64.89.161.72Kimwolf botnet C2 server (confidence level: 100%)
  • 83.142.209.248Kimwolf botnet C2 server (confidence level: 100%)
  • 146.71.81.232Unknown malware payload delivery server (confidence level: 80%)

Hashes 6

  • 9c1a60b1e67f071d7100ae8dfde9efb77cbf7688f8cbe6461b27319c9d7f8742Unknown malware payload (confidence level: 80%)
  • 3559ecb1e3c264bbc17b992b1d055bea42dbcb60e9397e24a33e9f09d5d307e2Unknown malware payload (confidence level: 80%)
  • d79e2990fa848ed9038f30dad65e30d6a3b335d78542d992de895a857e08351cUnknown malware payload (confidence level: 80%)
  • fb094867dcb3f56391ca8a60016c5cd9872b529814b0fe48e1e7ea4563ce24edUnknown malware payload (confidence level: 100%)
  • 20bf8267c60aeaafb90c224d865e163401a016b8568f95a6f1743fc74af62d9eUnknown malware payload (confidence level: 100%)
  • ba6d68bbb99c6237c983d491abf42245e8a0d7a993ca3d27e59907288fd836c5Unknown malware payload (confidence level: 90%)

Description

ThreatFox IOCs for 2026-04-28

Community reviews

Loading reviews…