Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-05-25

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 170

  • receipt-view.comUnknown malware payload delivery domain (confidence level: 75%)
  • coinbase.receipt-view.comUnknown malware payload delivery domain (confidence level: 75%)
  • bysjry.fusionize.orgClearFake payload delivery domain (confidence level: 100%)
  • wy809hmu.container-bridge.digitalClearFake payload delivery domain (confidence level: 100%)
  • m8fpbfz3.container-bridge.digitalClearFake payload delivery domain (confidence level: 100%)
  • ohowxc.gamesystem.huClearFake payload delivery domain (confidence level: 100%)
  • rapiny.gamesystem.huClearFake payload delivery domain (confidence level: 100%)
  • doigau.geokalk.huClearFake payload delivery domain (confidence level: 100%)
  • qcjqcd.geokalk.huClearFake payload delivery domain (confidence level: 100%)
  • ztwwcx.gerecseglamping.comClearFake payload delivery domain (confidence level: 100%)

URLs 36

  • http://209.99.186.230/69e263ad31aa46a5bc37.phpStealc botnet C2 (confidence level: 100%)
  • https://eletrosoldaitumbiara.com.br/Unknown malware payload delivery URL (confidence level: 90%)
  • https://imperialguard.icu:1672Antidot botnet C2 (confidence level: 100%)
  • https://catfoodeuro.shop:12655Antidot botnet C2 (confidence level: 100%)
  • https://fastconsulting.info:19586Antidot botnet C2 (confidence level: 100%)
  • https://fastdeliveryaservice.world:2468Antidot botnet C2 (confidence level: 100%)
  • https://sites.google.com/view/deutchbremacUnknown Stealer payload delivery URL (confidence level: 100%)
  • https://brezxcchec.com/Unknown Stealer payload delivery URL (confidence level: 100%)
  • http://premierrentalpurchase.com/curl/5b7250991558c1089d217b180d9418df77886996c22f8f319d7f640895e03381Unknown Stealer payload delivery URL (confidence level: 100%)
  • https://sites.google.com/view/clau-ver-un-24Unknown Stealer payload delivery URL (confidence level: 100%)

IP addresses 118

  • 89.23.108.134Unknown malware payload delivery server (confidence level: 80%)
  • 42.51.37.74VShell botnet C2 server (confidence level: 100%)
  • 178.154.253.119Cobalt Strike botnet C2 server (confidence level: 100%)
  • 178.154.202.18Sliver botnet C2 server (confidence level: 100%)
  • 178.154.224.141Cobalt Strike botnet C2 server (confidence level: 100%)
  • 43.138.192.16Cobalt Strike botnet C2 server (confidence level: 100%)
  • 43.138.192.16Cobalt Strike botnet C2 server (confidence level: 100%)
  • 8.148.72.173VShell botnet C2 server (confidence level: 100%)
  • 1.92.95.105Cobalt Strike botnet C2 server (confidence level: 50%)
  • 197.147.49.135AsyncRAT botnet C2 server (confidence level: 50%)

Hashes 11

  • 81deb32cde378e3886a7bfb6e0b9dff6dc34a5d0Unknown Stealer payload (confidence level: 100%)
  • f250b75677d5e944e5ab5fbba5e04b08f3ba9354Unknown Stealer payload (confidence level: 100%)
  • 4dc1958010564d8482320890ef4bdc35e1055e2023ce6cd7588a9044a221553fUnknown malware payload (confidence level: 90%)
  • ee01795618295e975dca07d025f20bbcaec559ecbcefc15dd813a3437c5bd989Unknown malware payload (confidence level: 90%)
  • bc6e0a5693e0b6bf2997a7c93c31d2ef2c351a35fdf81a02df33ff1df7bdf784Unknown malware payload (confidence level: 90%)
  • e96d103b7982cf988bffe33ce6eb066d25a830fb53e58da536a847ce2139d45bUnknown malware payload (confidence level: 90%)
  • 46c1a2426b2213b770cadb674591c8998b965273cadf1bc84ccfb5901d96e337Unknown malware payload (confidence level: 90%)
  • 316e131a04cc717d2912d371c80e016eb89cf2bb9b02eb42c2a53167422465e2Unknown malware payload (confidence level: 90%)
  • 9bb90d779fc12b6a10036b5477613d72a9da0612a677ae88843f79944d37801bUnknown malware payload (confidence level: 90%)
  • c6d9ba54fffc9c7638e04df63e0bdd7f99daecd6b7bdb347d05a30fe16d68c7dUnknown malware payload (confidence level: 90%)

Description

ThreatFox IOCs for 2026-05-25

Community reviews

Loading reviews…