Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-05-21

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 130

  • lolfler.lolKongTuke payload delivery domain (confidence level: 100%)
  • ackerkann.lolKongTuke payload delivery domain (confidence level: 100%)
  • finger.aulinked.orgUnknown malware payload delivery domain (confidence level: 75%)
  • dl.emergencepsychservices.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
  • shugol.comStrelaStealer payload delivery domain (confidence level: 100%)
  • orbital-velocity.fitClearFake payload delivery domain (confidence level: 100%)
  • bakingstonetheory.fitClearFake payload delivery domain (confidence level: 100%)
  • cyber-prosthetic.fitClearFake payload delivery domain (confidence level: 100%)
  • 3ldnpd9m.renaissancefrescorestoration.digitalClearFake payload delivery domain (confidence level: 100%)
  • ntm4xnw3.renaissancefrescorestoration.digitalClearFake payload delivery domain (confidence level: 100%)

URLs 27

  • https://www.dunebuggydubai.ae/Unknown malware payload delivery URL (confidence level: 90%)
  • https://platecrumbs.com/Unknown malware payload delivery URL (confidence level: 90%)
  • https://lolfler.lol/file.jsKongTuke payload delivery URL (confidence level: 100%)
  • https://lolfler.lol/api/v1/sessionKongTuke payload delivery URL (confidence level: 100%)
  • https://lolfler.lol/api/v1/verifyKongTuke payload delivery URL (confidence level: 100%)
  • https://ackerkann.lol/file.jsKongTuke payload delivery URL (confidence level: 100%)
  • https://ackerkann.lol/api/v1/sessionKongTuke payload delivery URL (confidence level: 100%)
  • https://ackerkann.lol/api/v1/verifyKongTuke payload delivery URL (confidence level: 100%)
  • http://aulinked.org/infos.php?fronts=1Unknown malware payload delivery URL (confidence level: 75%)
  • https://namlongland.net/ebd417db-979c-51f8-aedf-88a2bf8aa6c3/t9Unknown malware payload delivery URL (confidence level: 75%)

IP addresses 139

  • 159.223.223.37Kimwolf botnet C2 server (confidence level: 100%)
  • 178.62.247.141Kimwolf botnet C2 server (confidence level: 100%)
  • 206.189.97.111Kimwolf botnet C2 server (confidence level: 100%)
  • 103.149.93.107Cobalt Strike botnet C2 server (confidence level: 100%)
  • 103.149.93.107Cobalt Strike botnet C2 server (confidence level: 100%)
  • 38.76.160.155Venom RAT botnet C2 server (confidence level: 75%)
  • 89.124.111.28SectopRAT botnet C2 server (confidence level: 75%)
  • 5.181.2.113SectopRAT botnet C2 server (confidence level: 75%)
  • 2.26.75.142SectopRAT botnet C2 server (confidence level: 75%)
  • 188.137.178.24SectopRAT botnet C2 server (confidence level: 75%)

Hashes 4

  • 3b2f273bb402523c62608495108f9d3a771cfbd10f721e8f87076fee62edd4aeUnknown malware payload (confidence level: 75%)
  • c4277ff9fed179249daf8b8d76f6be7613bea7bd5e742950cfb77c20e0e0cca5Unknown malware payload (confidence level: 75%)
  • e746712a83e1a908e16c2495fd75dde22950b6e09c7ee9a8e148318d48950f5eUnknown malware payload (confidence level: 75%)
  • f01cac66a63b3bfd7409e4bceef30973a813f6ed4e99958313657449b1c7490fXMRIG payload (confidence level: 90%)

Description

ThreatFox IOCs for 2026-05-21

Community reviews

Loading reviews…