Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-05-02

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 986

  • 3xte-point.bnaumann87.workClearFake payload delivery domain (confidence level: 100%)
  • dev-node1.foersteron.workClearFake payload delivery domain (confidence level: 100%)
  • 3pb5.bnaumann87.workClearFake payload delivery domain (confidence level: 100%)
  • api-v12.foersteron.workClearFake payload delivery domain (confidence level: 100%)
  • mjsn.bnaumann87.workClearFake payload delivery domain (confidence level: 100%)
  • ehxa729h.bnaumann87.workClearFake payload delivery domain (confidence level: 100%)
  • web-access7.foersteron.workClearFake payload delivery domain (confidence level: 100%)
  • vnqvt9.crinkdimit.workClearFake payload delivery domain (confidence level: 100%)
  • solarcora.crinkdimit.workClearFake payload delivery domain (confidence level: 100%)
  • proxy-gate.foersteron.workClearFake payload delivery domain (confidence level: 100%)

URLs 35

  • https://willimsen.com/file.jsKongTuke payload delivery URL (confidence level: 100%)
  • https://willimsen.com/tKongTuke payload delivery URL (confidence level: 100%)
  • https://willimsen.com/gKongTuke payload delivery URL (confidence level: 100%)
  • https://willimsen.com/cKongTuke payload delivery URL (confidence level: 100%)
  • https://willimsen.com/iKongTuke payload delivery URL (confidence level: 100%)
  • https://arsimonopa.com/live/Latrodectus botnet C2 (confidence level: 100%)
  • https://lemonimonakio.com/live/Latrodectus botnet C2 (confidence level: 100%)
  • https://suenaconmusica.com/Vidar payload delivery URL (confidence level: 75%)
  • https://royal-renovation.com/Unknown malware payload delivery URL (confidence level: 90%)
  • https://dragabrielapalpebras.com.br/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 54

  • 47.239.222.85Cobalt Strike botnet C2 server (confidence level: 100%)
  • 176.65.139.59Mirai botnet C2 server (confidence level: 75%)
  • 147.93.81.142Remus botnet C2 server (confidence level: 75%)
  • 194.164.72.136Remus botnet C2 server (confidence level: 75%)
  • 38.14.248.232PureRAT botnet C2 server (confidence level: 75%)
  • 175.24.201.23Cobalt Strike botnet C2 server (confidence level: 100%)
  • 142.93.43.26Cobalt Strike botnet C2 server (confidence level: 100%)
  • 38.55.177.51Cobalt Strike botnet C2 server (confidence level: 100%)
  • 139.59.226.78Cobalt Strike botnet C2 server (confidence level: 100%)
  • 80.97.124.237Cobalt Strike botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-05-02

Community reviews

Loading reviews…