Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-06-29

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 392

  • xmsjdtn0.betbuf.liveClearFake payload delivery domain (confidence level: 100%)
  • 9lw19l8l.betbuf.liveClearFake payload delivery domain (confidence level: 100%)
  • 6xbjz1e7.1xfa.bioClearFake payload delivery domain (confidence level: 100%)
  • 4cfyhd61.fagaheestedlali.xyzClearFake payload delivery domain (confidence level: 100%)
  • settra5ldqwgtw5q7z5awbsvlksakyfojuc5slgrz5lvapune4fantqd.onionUnknown malware botnet C2 domain (confidence level: 100%)
  • pbxvml6h3wz35qlr5muy2cg5jvjsd4qhjlsztmxj4lqkyohnfdrntqyd.onionUnknown malware botnet C2 domain (confidence level: 100%)
  • 26z3gms2rshr2zzedxhw5fbucilmgt2inhmxzmuhteyztpxohoqplgyd.onionUnknown malware botnet C2 domain (confidence level: 100%)
  • ttfy4zmtiaywfkkmykpxiwtlxkcr5ofvrhqgxxyspgwzbxkc3uze7jid.onionUnknown malware botnet C2 domain (confidence level: 100%)
  • c3u3g7dz2yxkefci3x34jfvfa4gka4iogi4zfjkyxx2c536oqdld4kid.onionUnknown malware botnet C2 domain (confidence level: 100%)
  • 1xbet.sexClearFake botnet C2 domain (confidence level: 90%)

URLs 48

  • https://vacante-ieftine.ro/Unknown malware payload delivery URL (confidence level: 90%)
  • https://genova.com.vn/Unknown malware payload delivery URL (confidence level: 90%)
  • http://103.176.16.92:42446/mozi.aMozi payload delivery URL (confidence level: 75%)
  • https://3king.ai/Unknown malware payload delivery URL (confidence level: 90%)
  • https://3king.live/Unknown malware payload delivery URL (confidence level: 90%)
  • https://3king.app/Unknown malware payload delivery URL (confidence level: 90%)
  • http://103.26.86.217:52895/mozi.aMozi payload delivery URL (confidence level: 75%)
  • http://103.213.112.214:49082/mozi.mMozi payload delivery URL (confidence level: 75%)
  • https://aheadsupport.co.uk/Unknown malware payload delivery URL (confidence level: 90%)
  • https://rpc-cloud.beer/api/ClearFake botnet C2 (confidence level: 100%)

IP addresses 204

  • 147.182.217.141Aisuru botnet C2 server (confidence level: 100%)
  • 143.20.185.89Mirai botnet C2 server (confidence level: 100%)
  • 103.214.9.20XMRIG payload delivery server (confidence level: 80%)
  • 116.162.216.223XMRIG payload delivery server (confidence level: 80%)
  • 123.57.92.77XMRIG payload delivery server (confidence level: 80%)
  • 134.122.1.61XMRIG payload delivery server (confidence level: 80%)
  • 159.203.64.55XMRIG payload delivery server (confidence level: 80%)
  • 159.89.172.54XMRIG payload delivery server (confidence level: 80%)
  • 165.22.8.2XMRIG payload delivery server (confidence level: 80%)
  • 172.104.63.215XMRIG payload delivery server (confidence level: 80%)

Hashes 687

  • ffb966fce55f67726e7f8084a1dc21b80650e5c05373529b35d93eafcfcc7e26WannaCryptor payload (confidence level: 95%)
  • ed5bdffd8e51239effd147106709a026995deaeeWannaCryptor payload (confidence level: 95%)
  • 388ed6c8e9e5ba54c49209337f0a71a6WannaCryptor payload (confidence level: 95%)
  • cd1ab1369c5b2090a046e27574158e038fabdabc695623b3e85810246990e351NjRAT payload (confidence level: 95%)
  • 688f4b4ecfd26d2529d2c1b21a9d8be2f3245cc8NjRAT payload (confidence level: 95%)
  • 193177af43f8f24851b76d2866a11e1fNjRAT payload (confidence level: 95%)
  • e9c6dda67b1da1be30f8b0d4c7ff329c6b9831ae2c413742bbe59cc66690a630GCleaner payload (confidence level: 95%)
  • 1d0bf06fdc2505d6947d4b2825e888ab5148b68bGCleaner payload (confidence level: 95%)
  • 3cc6072eca86948127764f87d84baa85GCleaner payload (confidence level: 95%)
  • b435de3e50714d774f42cfdefd710519915e7f987f69da8d5fc1963961519844Luca Stealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-06-29

Community reviews

Loading reviews…