Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-06-18

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 96

  • metrics.demobunfiber.topAmatera botnet C2 domain (confidence level: 100%)
  • xeno.latUnknown malware payload delivery domain (confidence level: 100%)
  • luvioros-play.siteUnknown malware payload delivery domain (confidence level: 100%)
  • analyticstrack-pzh.clickHijackLoader botnet C2 domain (confidence level: 75%)
  • analyticstrack-api.clickHijackLoader botnet C2 domain (confidence level: 75%)
  • pixel.analyticstrack-pzh.clickHijackLoader botnet C2 domain (confidence level: 75%)
  • ambergallery.topSmartApeSG payload delivery domain (confidence level: 100%)
  • henriqueq.xyzKongTuke payload delivery domain (confidence level: 100%)
  • one-check.lolKongTuke payload delivery domain (confidence level: 100%)
  • phwy7fn6.betvarzeshkade.onlineClearFake payload delivery domain (confidence level: 100%)

URLs 41

  • https://trecoshop.com.br/Unknown malware payload delivery URL (confidence level: 90%)
  • https://one-confirm.lol/mUnknown malware botnet C2 (confidence level: 75%)
  • https://www.dropbox.com/scl/fi/5s7jeh4brmv6zttfswcd3/kkkkkk1.zip?rlkey=rddyt5s55ghjnv6rgtyzyes4p&dl=1Unknown malware payload delivery URL (confidence level: 75%)
  • https://chinarice.asia/Unknown malware payload delivery URL (confidence level: 90%)
  • https://ambergallery.top/auth/verify-cookie.jsSmartApeSG payload delivery URL (confidence level: 100%)
  • https://ambergallery.top/auth/status-partialSmartApeSG payload delivery URL (confidence level: 100%)
  • https://ambergallery.top/auth/rate-view.jsSmartApeSG payload delivery URL (confidence level: 100%)
  • https://henriqueq.xyz/file.jsKongTuke payload delivery URL (confidence level: 100%)
  • https://henriqueq.xyz/api/v1/sessionKongTuke payload delivery URL (confidence level: 100%)
  • https://henriqueq.xyz/api/v1/verifyKongTuke payload delivery URL (confidence level: 100%)

IP addresses 91

  • 45.32.132.194Unknown malware botnet C2 server (confidence level: 75%)
  • 47.95.223.86VShell botnet C2 server (confidence level: 100%)
  • 47.95.223.86VShell botnet C2 server (confidence level: 100%)
  • 43.143.7.85Unknown malware botnet C2 server (confidence level: 100%)
  • 43.143.7.85Unknown malware botnet C2 server (confidence level: 100%)
  • 118.193.36.203VShell botnet C2 server (confidence level: 100%)
  • 130.94.95.52VShell botnet C2 server (confidence level: 100%)
  • 109.248.150.234XWorm botnet C2 server (confidence level: 75%)
  • 106.14.65.169Cobalt Strike botnet C2 server (confidence level: 100%)
  • 84.252.139.94Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 32

  • 3d1d192e9879d33a954ea6e5eb0199cd3cb03622d88f2aebd50074eade956f61Unknown malware payload (confidence level: 75%)
  • a8fe7ea23ff20fb3ab2bcd122650e0fd0c6f9d384c11570a37290126f5cbef32Unknown malware payload (confidence level: 75%)
  • c263ac4338a05f8a8eac1a2eafb0ea4fac59c5c012a59b927c77dd41fd3536bbPhantom Stealer payload (confidence level: 95%)
  • 1805bcb1e9a621d73511e366ddc5a55bd96ec869Phantom Stealer payload (confidence level: 95%)
  • 48b039c349e726f4f63ccfd141273bbfPhantom Stealer payload (confidence level: 95%)
  • 202dd2a2a83208c237fcc87f2a077792b8e66815ce36d1dcd9de32a5f3ebab5bNanocore RAT payload (confidence level: 95%)
  • c7c3d905ed6cc0219417d83c60a708d9b031617aNanocore RAT payload (confidence level: 95%)
  • 3b7ccb4eb2ba5f3156526ec60cc3033bNanocore RAT payload (confidence level: 95%)
  • 48514edff1519f8be0c8a64511bf60ae8f847f90a6ac1381663c53646b77fb48Luca Stealer payload (confidence level: 95%)
  • 92a9fbdb50864fe117ee69511f8fdd21cd905469Luca Stealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-06-18

Community reviews

Loading reviews…