Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-05-13

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 92

  • snooze-wontdrama.wikiClearFake payload delivery domain (confidence level: 100%)
  • quart-rantman.wikiClearFake payload delivery domain (confidence level: 100%)
  • contactdisrupwhite.wikiClearFake payload delivery domain (confidence level: 100%)
  • pro-architecture-engineering-vault-info.wikiClearFake payload delivery domain (confidence level: 100%)
  • cluster-module-deployment-standard-map.wikiClearFake payload delivery domain (confidence level: 100%)
  • root-directory-repository-process-vault.wikiClearFake payload delivery domain (confidence level: 100%)
  • enterprise-solution-buffer-utility-log.wikiClearFake payload delivery domain (confidence level: 100%)
  • distributed-source-element-package-site.wikiClearFake payload delivery domain (confidence level: 100%)
  • active-instance-registry-support-index.wikiClearFake payload delivery domain (confidence level: 100%)
  • backup-terminal-gateway-handle-list.wikiClearFake payload delivery domain (confidence level: 100%)

URLs 8

  • https://diospfj.cyouLumma Stealer botnet C2 (confidence level: 75%)
  • https://pts.chriskendall.media/Vidar botnet C2 (confidence level: 100%)
  • https://pts.loniluekegerman.com/Vidar botnet C2 (confidence level: 100%)
  • https://sil.chriskendall.media/Vidar botnet C2 (confidence level: 100%)
  • https://sil.loniluekegerman.com/Vidar botnet C2 (confidence level: 100%)
  • https://mme.chriskendallvo.com/Vidar botnet C2 (confidence level: 100%)
  • https://mme.dusapp.com.br/Vidar botnet C2 (confidence level: 100%)
  • https://ostatniaposlugarumia.pl/Vidar payload delivery URL (confidence level: 75%)

IP addresses 32

  • 3.121.139.82NjRAT botnet C2 server (confidence level: 100%)
  • 3.127.59.75NjRAT botnet C2 server (confidence level: 100%)
  • 3.127.253.86NjRAT botnet C2 server (confidence level: 100%)
  • 18.198.77.177NjRAT botnet C2 server (confidence level: 100%)
  • 52.28.112.211NjRAT botnet C2 server (confidence level: 100%)
  • 35.158.159.254NjRAT botnet C2 server (confidence level: 100%)
  • 172.241.164.247RMS botnet C2 server (confidence level: 100%)
  • 200.25.78.73NjRAT botnet C2 server (confidence level: 100%)
  • 101.109.237.93NetSupportManager RAT botnet C2 server (confidence level: 75%)
  • 147.124.216.58AsyncRAT botnet C2 server (confidence level: 75%)

Description

ThreatFox IOCs for 2026-05-13

Community reviews

Loading reviews…