ThreatFox IOCs for 2026-05-16
Source ThreatFox MISP Feed
0
TLP:WHITE, disclosure is not limited
Indicators of compromise
Domains 91
ClearFake payload delivery domain (confidence level: 100%)
- vertical-eco-farming.garden
- bibliosmirk.digital
- x1gwqsft.bibliosmirk.digital
- 55n7r46d.bibliosmirk.digital
- greenhouse-climate-control-sys.garden
- bio-soil-nutrients.garden
- automated-sprout-labs.garden
- natureoasisdesign.garden
- herbal-extract-processing.garden
- root-system-irrigation.garden
URLs 3
- https://timothy-miejan.client-demo-websites.com/Vidar payload delivery URL (confidence level: 75%)
- https://exclusivemodelcollective.com/Vidar payload delivery URL (confidence level: 75%)
- http://18.166.47.109/getinstall64ValleyRAT botnet C2 (confidence level: 100%)
IP addresses 21
- 192.169.69.25Nanocore RAT botnet C2 server (confidence level: 100%)
- 192.252.183.183ValleyRAT botnet C2 server (confidence level: 100%)
- 8.218.110.236ValleyRAT botnet C2 server (confidence level: 100%)
- 18.166.223.16ValleyRAT botnet C2 server (confidence level: 100%)
- 139.99.131.177AsyncRAT botnet C2 server (confidence level: 75%)
- 188.126.90.5DCRat botnet C2 server (confidence level: 75%)
- 193.169.194.51Remcos botnet C2 server (confidence level: 75%)
- 31.57.184.82AsyncRAT botnet C2 server (confidence level: 75%)
- 38.14.248.199Cobalt Strike botnet C2 server (confidence level: 75%)
- 34.92.160.93ValleyRAT botnet C2 server (confidence level: 100%)
Description
ThreatFox IOCs for 2026-05-16
Community reviews
Loading reviews…