Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-04-30

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 506

  • illumemedia.peta8mora.betClearFake payload delivery domain (confidence level: 100%)
  • rucbhks.grov3elia.betClearFake payload delivery domain (confidence level: 100%)
  • sol-crestor.grov3elia.betClearFake payload delivery domain (confidence level: 100%)
  • safecore.topSmartApeSG payload delivery domain (confidence level: 100%)
  • kevh.grov3elia.betClearFake payload delivery domain (confidence level: 100%)
  • c4rrie3-node.grov3elia.betClearFake payload delivery domain (confidence level: 100%)
  • kqwgc4.grov3elia.betClearFake payload delivery domain (confidence level: 100%)
  • imea.flo7ravia.betClearFake payload delivery domain (confidence level: 100%)
  • 6352.grov9essa.gardenClearFake payload delivery domain (confidence level: 100%)
  • solvenon4.flo7ravia.betClearFake payload delivery domain (confidence level: 100%)

URLs 77

  • https://safecore.top/trace/principal-core.phpSmartApeSG payload delivery URL (confidence level: 100%)
  • https://safecore.top/trace/rate-core.jsSmartApeSG payload delivery URL (confidence level: 100%)
  • https://satserfield.com/file.jsKongTuke payload delivery URL (confidence level: 100%)
  • https://satserfield.com/tKongTuke payload delivery URL (confidence level: 100%)
  • https://satserfield.com/gKongTuke payload delivery URL (confidence level: 100%)
  • https://satserfield.com/cKongTuke payload delivery URL (confidence level: 100%)
  • http://178.16.52.232/Unknown malware payload delivery URL (confidence level: 75%)
  • http://91.92.240.45/Unknown malware payload delivery URL (confidence level: 75%)
  • https://sandman.bond/api/index.php?a=dl&token=d0a5e3b511c293206448ac44451b87f717fbdfa0c2f97242082bd2f29748a486&src=sanfrancescos.com&mode=cloudflareVidar payload delivery URL (confidence level: 75%)
  • https://bbi.yutikeyu.com/Vidar botnet C2 (confidence level: 100%)

IP addresses 66

  • 103.211.219.238Remus botnet C2 server (confidence level: 100%)
  • 195.19.194.107Remus botnet C2 server (confidence level: 100%)
  • 62.72.32.156Remus botnet C2 server (confidence level: 100%)
  • 76.13.17.11Remus botnet C2 server (confidence level: 100%)
  • 85.31.234.218Remus botnet C2 server (confidence level: 100%)
  • 31.97.61.212Remus botnet C2 server (confidence level: 100%)
  • 72.61.25.108Remus botnet C2 server (confidence level: 100%)
  • 194.164.72.136Remus botnet C2 server (confidence level: 100%)
  • 168.231.114.49Remus botnet C2 server (confidence level: 100%)
  • 65.21.104.235Remus botnet C2 server (confidence level: 100%)

Hashes 30

  • 96e157a49e9b3667d9c0838743a5cff48803e7062357853d2cd3f430c05c181cUnknown malware payload (confidence level: 75%)
  • 230b693565c103966ab2e05691554765a434628d672b37d757ea130eff2c8e21Unknown malware payload (confidence level: 75%)
  • a24730b62777b46bf22b83c08d470b9a85e22dccebf23635de2ca8cb72267325Unknown malware payload (confidence level: 75%)
  • 207d964e8254633cff1059ed62c2cc9fe67cedd83094bb2b61b9a430f924749bUnknown malware payload (confidence level: 75%)
  • 5478d1fe4f979f6a9a456d50dd84d18b04294701c9128eabcef412f6779a39b4Unknown malware payload (confidence level: 75%)
  • 8e248505b6cd87d2e27ed40541c2b2933113380da27bc75458d62d419e732f8dUnknown malware payload (confidence level: 75%)
  • 1382fbfcc7691d404b2202838270efd4137d4a4964047b94f2ed1dfabb407741Unknown malware payload (confidence level: 75%)
  • c85d73b0dbe1a5ff6a25e8980b0639d7309d9a97d2f5d799fb337bb36f217744Unknown malware payload (confidence level: 75%)
  • b538e0e8a2add9ee49386771563804ec64f71cb592196c9cd415f535799db13dUnknown malware payload (confidence level: 75%)
  • 832326f3a377973a35cb465bd3510f5f6199c7454a0e0557e4f95b85313a76a5Unknown malware payload (confidence level: 75%)

Description

ThreatFox IOCs for 2026-04-30

Community reviews

Loading reviews…