Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-06-13

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 95

  • frreliny.comUnidentified 001 botnet C2 domain (confidence level: 75%)
  • avexor.topSmartApeSG botnet C2 domain (confidence level: 75%)
  • divinenarratives.orgSmartApeSG payload delivery domain (confidence level: 100%)
  • cowhdabq.shartbandi.gamesClearFake payload delivery domain (confidence level: 100%)
  • edtmogyp.red90.casinoClearFake payload delivery domain (confidence level: 100%)
  • tkzvl.nagshekeshi.xyzClearFake payload delivery domain (confidence level: 100%)
  • fmhkmjyi.hugugtejarat4.xyzClearFake payload delivery domain (confidence level: 100%)
  • 9xt13o7k.moarefeslami.xyzClearFake payload delivery domain (confidence level: 100%)
  • wutgubeq.hugugtatbigi.xyzClearFake payload delivery domain (confidence level: 100%)
  • cdvmgdw.melbetkade.comClearFake payload delivery domain (confidence level: 100%)

URLs 12

  • https://bge-visa.com/Unknown malware payload delivery URL (confidence level: 90%)
  • https://divinenarratives.org/d.jsSmartApeSG payload delivery URL (confidence level: 100%)
  • http://mottla.shop:4190Remus botnet C2 (confidence level: 75%)
  • http://abscete.info/ret/two/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
  • http://verification-js-cdn.boats/5c89e36548466c44Unknown malware payload delivery URL (confidence level: 100%)
  • http://verification-js-cdn.boats/5c89e36548466c44?_=1Unknown malware payload delivery URL (confidence level: 100%)
  • http://verification-js-cdn.boats/5c89e36548466c44?ack=1Unknown malware payload delivery URL (confidence level: 100%)
  • http://verification-js-cdn.boats/67422f998296584824aa06c4066c9074457e4dd28a5a84cb209900f0c82a47f0Unknown malware payload delivery URL (confidence level: 100%)
  • https://devltd.us/flomos1.zipUnknown malware payload delivery URL (confidence level: 100%)
  • https://supertransfer.ch/Unknown malware payload delivery URL (confidence level: 75%)

IP addresses 91

  • 178.16.54.109Phorpiex botnet C2 server (confidence level: 75%)
  • 188.164.250.223Cobalt Strike botnet C2 server (confidence level: 100%)
  • 107.189.22.35Cobalt Strike botnet C2 server (confidence level: 100%)
  • 185.89.254.46Meterpreter botnet C2 server (confidence level: 100%)
  • 195.211.191.95Remus botnet C2 server (confidence level: 75%)
  • 103.39.235.194Meterpreter botnet C2 server (confidence level: 100%)
  • 43.156.218.130Cobalt Strike botnet C2 server (confidence level: 50%)
  • 157.230.248.213Cobalt Strike botnet C2 server (confidence level: 50%)
  • 103.245.27.100Mirai payload delivery server (confidence level: 100%)
  • 152.236.6.8Mirai botnet C2 server (confidence level: 100%)

Hashes 18

  • f2cbfb04c06d7a29349769b1c9b2c5c6b9b34f1d9f827d89b444016069f36656Loki Password Stealer (PWS) payload (confidence level: 95%)
  • 6eaf280a71db28b3557ebed4073412a6357f08c8Loki Password Stealer (PWS) payload (confidence level: 95%)
  • a1e49c1cf7db97c042a5e5403fed0c79Loki Password Stealer (PWS) payload (confidence level: 95%)
  • 24efe51c32a2017f5ad0aab43a2eb099eaf4379846f1b4e8a62093338ddae517Nanocore RAT payload (confidence level: 95%)
  • 1f81e5529c284ea4561fd49997d5beb395ee2aa4Nanocore RAT payload (confidence level: 95%)
  • e5cd97b309afed34383aff420333d831Nanocore RAT payload (confidence level: 95%)
  • e913c5f78dbe49989518ee50ee56cdb581a16a16b5ebb2ff567d526b238a0fc2Nanocore RAT payload (confidence level: 95%)
  • 7c1dc6b792df9cf72d40102b9daa1969ce88e5f5Nanocore RAT payload (confidence level: 95%)
  • 94d2ca3c409914ad4d42ea57ce4b36b1Nanocore RAT payload (confidence level: 95%)
  • 13a1587305880da5fbd956cf9a1353a336996a66735f887004e38ed65b2f7ff1Taurus Stealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-06-13

Community reviews

Loading reviews…