IndicatorPublished 3 May 2026Updated 4 May 2026

ThreatFox IOCs for 2026-05-03

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 429

260120.vercel.appUnknown malware botnet C2 domain (confidence level: 49%)
default-configuration.vercel.appUnknown malware botnet C2 domain (confidence level: 49%)
vscode-settings-bootstrap.vercel.appUnknown malware botnet C2 domain (confidence level: 49%)
vscode-settings-config.vercel.appUnknown malware botnet C2 domain (confidence level: 49%)
vscode-bootstrapper.vercel.appUnknown malware botnet C2 domain (confidence level: 49%)
vscode-load-config.vercel.appUnknown malware botnet C2 domain (confidence level: 49%)
abramo8a.rumagecart credit card skimming domain (confidence level: 50%)
acint.netmagecart credit card skimming domain (confidence level: 50%)
69sexy.duckdns.orgMirai botnet C2 domain (confidence level: 80%)
platform.isystemservices.comFAKEUPDATES payload delivery domain (confidence level: 75%)

URLs 42

https://zorbit.online/Unknown malware payload delivery URL (confidence level: 90%)
https://trophyburrita.com/Unknown malware payload delivery URL (confidence level: 90%)
https://trucybersec.com/Unknown malware payload delivery URL (confidence level: 90%)
https://www.vocearomilor.ro/Unknown malware payload delivery URL (confidence level: 90%)
https://viethuonggroup.com/Unknown malware payload delivery URL (confidence level: 90%)
https://www.vla.academy/Unknown malware payload delivery URL (confidence level: 90%)
https://waltonpalmeronline.com/Unknown malware payload delivery URL (confidence level: 90%)
https://www.wswarchitects.com/Unknown malware payload delivery URL (confidence level: 90%)
https://weppa.cloud/Unknown malware payload delivery URL (confidence level: 90%)
https://wpcentral.app/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 40

176.65.139.131Mirai botnet C2 server (confidence level: 80%)
203.96.177.124SmartApeSG payload delivery server (confidence level: 80%)
45.153.34.107Nanocore RAT botnet C2 server (confidence level: 75%)
192.109.200.124Nanocore RAT botnet C2 server (confidence level: 75%)
185.220.205.80Nanocore RAT botnet C2 server (confidence level: 75%)
120.221.87.198Xtreme RAT botnet C2 server (confidence level: 100%)
87.120.126.60Stealc botnet C2 server (confidence level: 75%)
170.64.177.194Sliver botnet C2 server (confidence level: 100%)
151.59.150.189SectopRAT botnet C2 server (confidence level: 75%)
172.245.195.206Remcos botnet C2 server (confidence level: 75%)

Hashes 1

SmartApeSG payload (confidence level: 90%)

0ae3916addf8682d9b571a8602b1936eb2afd095872246fa9417223edad697f8

Description

ThreatFox IOCs for 2026-05-03

Impact

The threat is classified as medium severity with no known exploits in the wild and no patches available. The impact is primarily related to potential malware payload delivery and network activity, but no direct compromise or damage details are provided.

Defensive guidance

Since it is an OSINT-based IOC collection, defenders should incorporate these IOCs into their detection and monitoring systems as appropriate. No urgent remediation actions are indicated by the vendor or source.

Summary

The data represents a collection of threat intelligence IOCs related to malware, focusing on OSINT and network-based payload delivery mechanisms. No detailed technical exploit or vulnerability information is provided, nor are there specific affected software versions. The threat level and distribution metrics indicate moderate concern but lack detailed exploitation or impact specifics.

Community reviews

Loading reviews…