Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-05-18

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 154

  • crackedsoftware.doxbin.cyUnknown malware payload delivery domain (confidence level: 100%)
  • interium.wtfUnknown malware botnet C2 domain (confidence level: 100%)
  • dl.interium.wtfUnknown malware payload delivery domain (confidence level: 100%)
  • voltrix.pwUnknown malware botnet C2 domain (confidence level: 100%)
  • bytearmor.netUnknown malware botnet C2 domain (confidence level: 100%)
  • cheapoca.bizRemus botnet C2 domain (confidence level: 100%)
  • yjs4ih2y.telemetry-vault.digitalClearFake payload delivery domain (confidence level: 100%)
  • 0q9bvoqh.telemetry-vault.digitalClearFake payload delivery domain (confidence level: 100%)
  • sicilian-defense-theory.gardenClearFake payload delivery domain (confidence level: 100%)
  • audio-attenuator-schematic.gardenClearFake payload delivery domain (confidence level: 100%)

URLs 53

  • https://linxiabeautyworks.com/Unknown malware payload delivery URL (confidence level: 90%)
  • https://www.womenincancer.com/Unknown malware payload delivery URL (confidence level: 90%)
  • https://worldrank.net/Unknown malware payload delivery URL (confidence level: 90%)
  • https://www.euroequipment.co.th/Unknown malware payload delivery URL (confidence level: 90%)
  • https://www.beltboutique.co.uk/Unknown malware payload delivery URL (confidence level: 90%)
  • https://www.angelphonerepair.com/Unknown malware payload delivery URL (confidence level: 90%)
  • http://194.33.61.179/7dc11e58e9124f1183dc.phpStealc botnet C2 (confidence level: 100%)
  • https://activityof.com/dateiUnknown Loader payload delivery URL (confidence level: 100%)
  • https://topnews.eu.cc/Unknown malware payload delivery URL (confidence level: 90%)
  • http://45.153.34.212:8181/.rupemnasa/.system3dXMRIG payload delivery URL (confidence level: 90%)

IP addresses 166

  • 174.138.12.239Kimwolf botnet C2 server (confidence level: 100%)
  • 164.90.205.39Kimwolf botnet C2 server (confidence level: 100%)
  • 106.75.252.66Cobalt Strike botnet C2 server (confidence level: 100%)
  • 81.172.90.197Cobalt Strike botnet C2 server (confidence level: 85%)
  • 172.216.54.73Cobalt Strike botnet C2 server (confidence level: 85%)
  • 172.216.116.64Cobalt Strike botnet C2 server (confidence level: 85%)
  • 192.200.220.100Cobalt Strike botnet C2 server (confidence level: 85%)
  • 106.75.252.66Cobalt Strike botnet C2 server (confidence level: 100%)
  • 172.252.232.23Cobalt Strike botnet C2 server (confidence level: 85%)
  • 185.234.157.185Cobalt Strike botnet C2 server (confidence level: 85%)

Hashes 7

  • 70da09d825ce21f1dd43e9f3654e087ccb6cedc6a659ee6f378c41aeb81ea5d8ClearFake payload (confidence level: 100%)
  • f581012ea6faaff213d79db7ea93194a423a419870d0db664b90a0db6ae4088bKongTuke payload (confidence level: 90%)
  • 3aaae158a84409dbc3202b174005ed9acf39ca7f3785dbff07c56be928ff011fKongTuke payload (confidence level: 90%)
  • 833a0e0ed8bc34a1af0fbb43c56f7bea2c73dde2295f4df2e2c27011d70f52faKongTuke payload (confidence level: 90%)
  • 6d11817f510e596bb9b739dd1fddb3b1c929831b81503a4e8d7129543bf899b9KongTuke payload (confidence level: 90%)
  • 4bbd11551bb42351fbaf7c5b9d0e8acd7f465bcb0c1eab04e054557e6daf12afUnknown malware payload (confidence level: 85%)
  • d2fc36eedc354152ab7bcb96436c54c45cdd8fda7212cdc1ddbe826f61acc457Amadey payload (confidence level: 85%)

Description

ThreatFox IOCs for 2026-05-18

Community reviews

Loading reviews…