Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-05-04

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 619

  • blue.brightreef.surfClearFake payload delivery domain (confidence level: 100%)
  • zeno.taro5lin.surfClearFake payload delivery domain (confidence level: 100%)
  • view.brightreef.surfClearFake payload delivery domain (confidence level: 100%)
  • proxy.gela1vor.surfClearFake payload delivery domain (confidence level: 100%)
  • airy.brightreef.surfClearFake payload delivery domain (confidence level: 100%)
  • bolt.gela1vor.surfClearFake payload delivery domain (confidence level: 100%)
  • axis.gela1vor.surfClearFake payload delivery domain (confidence level: 100%)
  • high.brightreef.surfClearFake payload delivery domain (confidence level: 100%)
  • core.gela1vor.surfClearFake payload delivery domain (confidence level: 100%)
  • link.gela1vor.surfClearFake payload delivery domain (confidence level: 100%)

URLs 206

  • https://login-microsoft-virtualpe.com/Unknown malware payload delivery URL (confidence level: 90%)
  • https://cp-studio.ch/Unknown malware payload delivery URL (confidence level: 90%)
  • https://bgczf55evwi7s3qddrsvw9.xyz/Unknown malware payload delivery URL (confidence level: 90%)
  • https://v-k.com.ua/Unknown malware payload delivery URL (confidence level: 90%)
  • https://carnaval-morat.ch/Unknown malware payload delivery URL (confidence level: 90%)
  • https://pure-sapphire-d1ytvv11gv-bf5ube4qq9.edgeone.app/Unknown malware payload delivery URL (confidence level: 90%)
  • http://43.156.175.5:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
  • https://perimeterteam.com/Unknown malware payload delivery URL (confidence level: 90%)
  • https://southernstarinvestments.com/Unknown malware payload delivery URL (confidence level: 90%)
  • https://rentuas.icu/Lumma Stealer payload delivery URL (confidence level: 100%)

IP addresses 68

  • 109.120.150.67Unknown malware botnet C2 server (confidence level: 50%)
  • 43.156.175.5Unknown malware botnet C2 server (confidence level: 100%)
  • 31.56.209.125Mirai botnet C2 server (confidence level: 80%)
  • 8.156.34.194Cobalt Strike botnet C2 server (confidence level: 100%)
  • 101.37.174.115Cobalt Strike botnet C2 server (confidence level: 100%)
  • 195.226.92.129Unknown RAT botnet C2 server (confidence level: 75%)
  • 136.243.87.130Vidar botnet C2 server (confidence level: 100%)
  • 135.181.124.118Vidar botnet C2 server (confidence level: 100%)
  • 65.109.111.164Vidar botnet C2 server (confidence level: 100%)
  • 65.108.21.176Vidar botnet C2 server (confidence level: 100%)

Hashes 1

RemoteAdmin payload (confidence level: 90%)

  • aae93e02546bea0074272d685155564cbd0a4120ddde41d5fc578dad563f22bf

Description

ThreatFox IOCs for 2026-05-04

Community reviews

Loading reviews…