IndicatorPublished 31 May 2026Updated 1 Jun 2026

ThreatFox IOCs for 2026-05-31

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 120

auth-captcha.clickUnknown malware payload delivery domain (confidence level: 75%)
chase-cvs.org.ukUnknown malware payload delivery domain (confidence level: 75%)
www.usaa-login-verify-usaa.chase-cvs.org.ukUnknown malware payload delivery domain (confidence level: 75%)
ppsecure-webssappenableconfirmation.horizontaltango.netUnknown malware payload delivery domain (confidence level: 75%)
frostapp.frBlankGrabber payload delivery domain (confidence level: 75%)
cafebabe.suMirai botnet C2 domain (confidence level: 100%)
codex.gr.comIClickFix botnet C2 domain (confidence level: 100%)
protonvpn.co.comIClickFix botnet C2 domain (confidence level: 100%)
notebooklm.gr.comIClickFix botnet C2 domain (confidence level: 100%)
deepseek.gr.comIClickFix botnet C2 domain (confidence level: 100%)

URLs 17

https://auth-captcha.click/Unknown malware payload delivery URL (confidence level: 75%)
http://35.231.74.47/meowUnknown malware payload delivery URL (confidence level: 75%)
https://www.abdgochizmetleri.com/Unknown malware payload delivery URL (confidence level: 90%)
http://34.11.136.102/meowUnknown malware payload delivery URL (confidence level: 75%)
http://34.11.136.102/meowarm64Unknown malware payload delivery URL (confidence level: 75%)
http://b.9-9-8.com/t.shMirai payload delivery URL (confidence level: 80%)
https://178.105.175.202/gate?mode=beaconUnknown Stealer botnet C2 (confidence level: 100%)
http://209.92.170.225/lmkjn.arm6Unknown malware payload delivery URL (confidence level: 75%)
http://209.92.170.225/lmkjn.arm5Unknown malware payload delivery URL (confidence level: 75%)
http://209.92.170.225/lmkjn.x86Unknown malware payload delivery URL (confidence level: 75%)

IP addresses 77

47.97.197.89VShell botnet C2 server (confidence level: 100%)
43.138.194.156VShell botnet C2 server (confidence level: 100%)
39.97.229.224VShell botnet C2 server (confidence level: 100%)
38.180.150.147VShell botnet C2 server (confidence level: 100%)
198.23.196.131VShell botnet C2 server (confidence level: 100%)
87.120.92.182Mirai botnet C2 server (confidence level: 80%)
193.233.198.61SectopRAT botnet C2 server (confidence level: 75%)
89.105.213.149SectopRAT botnet C2 server (confidence level: 75%)
163.172.51.194Stealc botnet C2 server (confidence level: 100%)
172.81.178.237Unknown malware botnet C2 server (confidence level: 100%)

Hashes 1

BeaverTail payload (confidence level: 100%)

c3921fef70e1895559fe0caea0ea678e8df4e4d3b65dcde33103379b4dbdf99a

Description

ThreatFox IOCs for 2026-05-31

Impact

The impact is currently assessed as medium severity based on the metadata provided. There are no known exploits in the wild, no affected software versions listed, and no specific vulnerabilities detailed. The threat primarily serves as intelligence for detection and monitoring rather than indicating an active exploit or vulnerability requiring immediate patching.

Defensive guidance

Since it is an intelligence report of IOCs without specific vulnerabilities or exploits, mitigation should focus on incorporating these IOCs into detection and monitoring tools as appropriate. No urgent action is indicated based on the current information.

Summary

The data represents a collection of threat intelligence indicators associated with malware activity as of May 31, 2026, sourced from the ThreatFox MISP feed. It is classified under OSINT and involves payload delivery and network activity. No specific vulnerable software versions or exploits are documented, and no patches exist. The threat level is assessed as medium based on available metadata, but detailed technical analysis or exploitation details are not included.

Community reviews

Loading reviews…