IndicatorPublished 22 May 2026Updated 23 May 2026

ThreatFox IOCs for 2026-05-22

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 92

linkedco.netClearFake payload delivery domain (confidence level: 100%)
finger.linkedco.netClearFake payload delivery domain (confidence level: 100%)
yujinp.xyzUnknown malware payload delivery domain (confidence level: 80%)
teams.livesweb.usUnknown malware payload delivery domain (confidence level: 80%)
konizia.comUnknown malware payload delivery domain (confidence level: 60%)
live05ms.usUnknown malware payload delivery domain (confidence level: 85%)
msonlive.usUnknown malware payload delivery domain (confidence level: 85%)
editorfxmedia.comUnknown malware payload delivery domain (confidence level: 85%)
techevent.usUnknown malware payload delivery domain (confidence level: 85%)
teams.live05ms.usUnknown malware payload delivery domain (confidence level: 85%)

URLs 111

https://biletors.cfd/Unknown malware payload delivery URL (confidence level: 90%)
https://maik-freudenberg.de/Unknown malware payload delivery URL (confidence level: 90%)
https://microsmeet.xyz/api/mn/6676097740/updateUnknown malware payload delivery URL (confidence level: 80%)
https://candipoker.net/ebd417db-979c-51f8-aedf-88a2bf8aa6c3/v10Unknown malware payload delivery URL (confidence level: 75%)
https://sam-sa.net/ebd417db-979c-51f8-aedf-88a2bf8aa6c3/v10Unknown malware payload delivery URL (confidence level: 75%)
https://namlongland.net/ebd417db-979c-51f8-aedf-88a2bf8aa6c3/v12Unknown malware payload delivery URL (confidence level: 75%)
https://namlongland.net/ebd417db-979c-51f8-aedf-88a2bf8aa6c3/v11Unknown malware payload delivery URL (confidence level: 75%)
https://namlongland.net/ebd417db-979c-51f8-aedf-88a2bf8aa6c3/v10Unknown malware payload delivery URL (confidence level: 75%)
https://namlongland.net/ebd417db-979c-51f8-aedf-88a2bf8aa6c3/v9Unknown malware payload delivery URL (confidence level: 75%)
https://namlongland.net/ebd417db-979c-51f8-aedf-88a2bf8aa6c3/v8Unknown malware payload delivery URL (confidence level: 75%)

IP addresses 103

123.57.135.130VShell botnet C2 server (confidence level: 100%)
170.106.199.68Cobalt Strike botnet C2 server (confidence level: 100%)
38.45.125.102VShell botnet C2 server (confidence level: 100%)
180.178.160.153Cobalt Strike botnet C2 server (confidence level: 100%)
43.173.248.150Cobalt Strike botnet C2 server (confidence level: 97%)
158.94.208.64VShell botnet C2 server (confidence level: 100%)
161.35.82.152Kimwolf botnet C2 server (confidence level: 100%)
209.38.34.201Kimwolf botnet C2 server (confidence level: 100%)
62.171.190.148Havoc botnet C2 server (confidence level: 100%)
85.155.151.85Quasar RAT botnet C2 server (confidence level: 100%)

Hashes 36

0759904c16ff6d1f25be53e218f7bb13668a13cf5bd328375bb37941c2c94ab2Unknown malware payload (confidence level: 75%)
d95bb7afd88d684dd99bb0c462fd7e0f81596baa2a2749263c7be4f09b4177ecUnknown malware payload (confidence level: 75%)
0ae0517a518f277c67ae6959e8fb1e75a67ce3c2d1a86af084326f9a6c3c2839Unknown malware payload (confidence level: 75%)
f630d779290a050dbc415863be303b8bb78dbe0bf4ff1ebae5fcbfddeace95b2Unknown malware payload (confidence level: 75%)
d72e75830ccb3a1bb80026081be1b775b3c2b18f91034277a27957a3a4e51632Unknown malware payload (confidence level: 75%)
4e71f0e1b1862492562f7ffada5c1d98e4d9c83cf63cd99636fb7f932d4cb4a7Unknown malware payload (confidence level: 75%)
475a074242f7c58f55fdaa7c2773b1aaf448ce826a8fc98ee76f0dc88eba72b2Unknown malware payload (confidence level: 75%)
d430141b6573335f2eaba7c9dad1729e182432f128c4311a962f77c12d48a82cUnknown malware payload (confidence level: 75%)
2c14abd6082ec4929d7f375f7c264741355e4b28a402c7cf89caac37627e2739Unknown malware payload (confidence level: 75%)
bf1c796dbb2b7d6d3b6820fccd6a5bcd127c0296754680f3f7d067bcca56b1b4Unknown malware payload (confidence level: 75%)

Description

ThreatFox IOCs for 2026-05-22

Impact

The impact is currently limited to the presence of malware-related IOCs that could assist in detection and response efforts. There is no evidence of active exploitation or direct compromise reported. The threat level is medium, indicating a moderate concern for security monitoring but no immediate critical risk.

Defensive guidance

No patches or official fixes are available for this threat. Security teams should incorporate the provided IOCs into their detection and monitoring systems to identify potential malicious activity. Since no active exploits are known, no urgent remediation actions are required beyond standard monitoring.

Summary

The data represents OSINT-derived IOCs associated with malware activity as of May 22, 2026. It includes information relevant to payload delivery and network activity but lacks detailed technical specifics, affected software versions, or exploit mechanisms.

Community reviews

Loading reviews…