IndicatorPublished 1 May 2026Updated 2 May 2026

ThreatFox IOCs for 2026-05-01

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 474

plotmeshsite.nelo2qir.betClearFake payload delivery domain (confidence level: 100%)
past6siteview.undo-wingless.betClearFake payload delivery domain (confidence level: 100%)
zone7taskhub.nelo2qir.betClearFake payload delivery domain (confidence level: 100%)
areahostunit.nelo2qir.betClearFake payload delivery domain (confidence level: 100%)
axis3pathgate.nelo2qir.betClearFake payload delivery domain (confidence level: 100%)
core8taskhub.technic2lweak.betClearFake payload delivery domain (confidence level: 100%)
mark8siteview.nelo2qir.betClearFake payload delivery domain (confidence level: 100%)
heat5logicnet.thora5ven.betClearFake payload delivery domain (confidence level: 100%)
glowmeshnode.thora5ven.betClearFake payload delivery domain (confidence level: 100%)
burn9taskhub.thora5ven.betClearFake payload delivery domain (confidence level: 100%)

URLs 95

https://mawenterprises.co/.april/a3.msiUnknown malware payload delivery URL (confidence level: 90%)
http://mawenterprises.co/.april/a1.mp4Unknown malware payload delivery URL (confidence level: 90%)
http://217.145.227.150/stealer/public/login.phpUnknown malware botnet C2 (confidence level: 100%)
https://tools.doxbin.cy/windowsUnknown malware payload delivery URL (confidence level: 90%)
https://www.edwinmsarmiento.com/Unknown malware payload delivery URL (confidence level: 90%)
https://snakcscornerbd.com/Unknown malware payload delivery URL (confidence level: 90%)
https://labo.univ-msila.dz/labs/Unknown malware payload delivery URL (confidence level: 90%)
https://www.drkonradrack.at/Unknown malware payload delivery URL (confidence level: 90%)
https://70.34.205.43/Unknown malware payload delivery URL (confidence level: 90%)
https://document-share-id382929992933.sisregcel.com/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 367

102.209.118.229AdaptixC2 botnet C2 server (confidence level: 75%)
103.151.52.35AsyncRAT botnet C2 server (confidence level: 75%)
103.57.250.99AdaptixC2 botnet C2 server (confidence level: 75%)
103.75.190.47DCRat botnet C2 server (confidence level: 75%)
104.234.174.93AdaptixC2 botnet C2 server (confidence level: 75%)
106.55.71.62AdaptixC2 botnet C2 server (confidence level: 75%)
114.132.133.191AdaptixC2 botnet C2 server (confidence level: 75%)
115.190.247.97AdaptixC2 botnet C2 server (confidence level: 75%)
115.42.60.122DCRat botnet C2 server (confidence level: 75%)
117.72.101.55Chaos botnet C2 server (confidence level: 75%)

Hashes 5

Unknown malware payload (confidence level: 90%)

2339fba9695ad25fcd79f232c4b635023f5621eb927a53601db84eb428b3116e
d19f88dc8c825614e4898d06c7eeb28bace5156344aed4d708bcdd25a970866d
bc17f0d2a9715c138f77b77eaf760e5f
52f84ca88409bddcbfc4dd7d6a048af9
5ed7708134d1da60c2376a3f89fe28d94c0f9db760b29ce1530e42757352c8bb

Description

ThreatFox IOCs for 2026-05-01

Impact

The impact is currently limited to the presence of malware-related indicators that could facilitate detection and response efforts. There are no known active exploits or specific vulnerable products affected. The threat may contribute to malware delivery and network compromise if leveraged, but no direct damage or exploitation has been confirmed.

Defensive guidance

Security teams should utilize the provided IOCs for detection and monitoring within their environments. Standard malware defense measures and network monitoring aligned with these indicators are recommended. Since no vendor advisory or patch exists, ongoing vigilance and threat intelligence updates are advised.

Community reviews

Loading reviews…