Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-05-08

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 587

  • license.claude-pro.comPlugX botnet C2 domain (confidence level: 49%)
  • gouvvbo.topPlugX botnet C2 domain (confidence level: 49%)
  • update-trellix.comPlugX botnet C2 domain (confidence level: 49%)
  • call-history-7cda4-default-rtdb.firebaseio.comUnknown malware botnet C2 domain (confidence level: 49%)
  • call-history-ecc1e-default-rtdb.firebaseio.comUnknown malware botnet C2 domain (confidence level: 49%)
  • ch-ap-4-default-rtdb.firebaseio.comUnknown malware botnet C2 domain (confidence level: 49%)
  • chh1-ac0a3-default-rtdb.firebaseio.comUnknown malware botnet C2 domain (confidence level: 49%)
  • whatsappcenter.comUnknown malware botnet C2 domain (confidence level: 49%)
  • sharpfield.topSmartApeSG payload delivery domain (confidence level: 100%)
  • order.mkdaddy.comUnknown malware payload delivery domain (confidence level: 90%)

URLs 72

  • https://sharpfield.top/rate/principal-client.phpSmartApeSG payload delivery URL (confidence level: 100%)
  • https://sharpfield.top/rate/api-template.jsSmartApeSG payload delivery URL (confidence level: 100%)
  • https://re104.artcnb.com/downUnknown malware payload delivery URL (confidence level: 90%)
  • https://github.com/moonlightpumpkin/api_settingsUnknown malware payload delivery URL (confidence level: 90%)
  • http://158.94.211.95/kelly/five/pvqdq929bsx_a_d_m1n_a.phpLokiBot botnet C2 (confidence level: 100%)
  • https://r33.hidayahnetwork.com/Vidar botnet C2 (confidence level: 100%)
  • http://secure.controlpanel.asia/330311481fe14ab99814.phpStealc botnet C2 (confidence level: 100%)
  • https://m2interiordesign.net/Vidar payload delivery URL (confidence level: 75%)
  • https://pvp.hidayahnetwork.com/Vidar botnet C2 (confidence level: 100%)
  • https://superpooper.click/cf.jsUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 140

  • 157.245.74.9Kimwolf botnet C2 server (confidence level: 100%)
  • 45.86.162.238Unknown malware payload delivery server (confidence level: 90%)
  • 45.128.36.194Unknown malware payload delivery server (confidence level: 75%)
  • 91.211.251.245Cobalt Strike botnet C2 server (confidence level: 50%)
  • 40.176.56.217Meterpreter botnet C2 server (confidence level: 50%)
  • 3.129.64.160Meterpreter botnet C2 server (confidence level: 50%)
  • 45.133.180.130AsyncRAT botnet C2 server (confidence level: 50%)
  • 143.20.185.98Unknown malware botnet C2 server (confidence level: 50%)
  • 132.243.221.89Unknown malware botnet C2 server (confidence level: 50%)
  • 192.253.248.13Unknown malware botnet C2 server (confidence level: 50%)

Hashes 6

  • 7d1526c3d109fc9da176120ecb5209c4fde8b68a208584d2253cf116fd167eb6SmartApeSG payload (confidence level: 90%)
  • 7521203828dd16a0b4cc65f34c6ee5871f3200b43fa46917ece5f334e946885fUnknown malware payload (confidence level: 90%)
  • b95b53eff7f1dc4426ed60932910aeb66552083197048d31154f950eb32c65b8Unknown malware payload (confidence level: 90%)
  • 4aa3b4429eeaa8bf734dd6bb3527f8ee2454bd66f4649f7102ab179214d85dc4Unknown malware payload (confidence level: 90%)
  • f93918bae376298c7db3e377796057fb35733b38c59edb4a69f771e17b48deefUnknown malware payload (confidence level: 90%)
  • 72feb64186e4d4335512e637753ef63ec266b0c339f992c9f2ce76639d9a8a4eUnknown malware payload (confidence level: 90%)

Description

ThreatFox IOCs for 2026-05-08

Community reviews

Loading reviews…