Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-06-30

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 88

  • php-panel.letsgoautomotive.comUnknown Stealer botnet C2 domain (confidence level: 100%)
  • code-beautify.comBeaverTail payload delivery domain (confidence level: 100%)
  • ipregionchecker.orgBeaverTail payload delivery domain (confidence level: 100%)
  • ackeamann.xyzKongTuke payload delivery domain (confidence level: 100%)
  • cleardig477.icuUnknown Loader payload delivery domain (confidence level: 100%)
  • superfirewallprotection.comUnknown Loader payload delivery domain (confidence level: 100%)
  • moderncloudprotection.comUnknown Loader payload delivery domain (confidence level: 100%)
  • publicwebprotection.comUnknown Loader payload delivery domain (confidence level: 100%)
  • api-v2.golfsignpro.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
  • cloud.api-middle-connect.commagecart credit card skimming domain (confidence level: 100%)

URLs 60

  • http://31.56.48.179:666/wUnknown malware payload delivery URL (confidence level: 75%)
  • http://31.56.48.179:666/.real_mndUnknown malware payload delivery URL (confidence level: 75%)
  • http://31.56.48.179:666/.mconfUnknown malware payload delivery URL (confidence level: 75%)
  • https://isabeladandaro.com.br/diagnostico-de-honorarios-convite/?src=org_site&utm_source=org&utm_medium=site&utm_content=&utm_campaign=&utm_term=Unknown malware payload delivery URL (confidence level: 90%)
  • https://www.ibogainerapiddetox.com/Unknown malware payload delivery URL (confidence level: 90%)
  • https://ackeamann.xyz/file.jsKongTuke payload delivery URL (confidence level: 100%)
  • https://ackeamann.xyz/api/v1/sessionKongTuke payload delivery URL (confidence level: 100%)
  • https://ackeamann.xyz/api/v1/verifyKongTuke payload delivery URL (confidence level: 100%)
  • https://ackeamann.xyz/api/v1/statusKongTuke payload delivery URL (confidence level: 100%)
  • https://datacrypt5840.top/update/packageKongTuke payload delivery URL (confidence level: 100%)

IP addresses 81

  • 172.86.123.37BeaverTail botnet C2 server (confidence level: 100%)
  • 172.86.123.37BeaverTail botnet C2 server (confidence level: 100%)
  • 178.128.253.253Kimwolf botnet C2 server (confidence level: 100%)
  • 157.245.65.67Kimwolf botnet C2 server (confidence level: 100%)
  • 159.223.5.30Kimwolf botnet C2 server (confidence level: 100%)
  • 206.189.7.4Kimwolf botnet C2 server (confidence level: 100%)
  • 167.71.7.92Kimwolf botnet C2 server (confidence level: 100%)
  • 178.128.243.177Kimwolf botnet C2 server (confidence level: 100%)
  • 188.166.24.139Kimwolf botnet C2 server (confidence level: 100%)
  • 152.42.129.15Kimwolf botnet C2 server (confidence level: 100%)

Hashes 73

  • 0f63bea320d768fb12bb53a287f210b8b9ccec563ac66dc80b7967628e455566Unknown malware payload (confidence level: 75%)
  • 27cc6cf232ba7ed8dc92dcb0795bdb7185197928ec3061a8d6de097f9efc5440Unknown malware payload (confidence level: 75%)
  • dff350f69d90cf8e6055054475b0c892b77610c734111c381dfbad8bb72b2b3dBumbleBee payload (confidence level: 50%)
  • fee27090c90ed20350a65616c658f158bef9443ada21279c11cc9dbd125d363eBumbleBee payload (confidence level: 50%)
  • 7c71f81b6e981eb71d442a7e26df9ebf199665e5460da3b35b43496b380840a8BumbleBee payload (confidence level: 50%)
  • 74009ad71c2f41ebfe6b76358f0224f814f8dca1167a858538b5e8df8a76b881BeaverTail payload (confidence level: 100%)
  • 0e1ae44c555c13b03bdbd72f66c456aaffcdd13887ebe9859d302a63e409c462BeaverTail payload (confidence level: 100%)
  • 017cb09cabd9c909e4fb06e8c668d2f89e472e103eda5230d98761a9f998bdb5BeaverTail payload (confidence level: 100%)
  • a5b42be0041bff5a4e521412014c2e7029ff08df7e9746fb4d923d40cee0e7d7Mirai payload (confidence level: 80%)
  • ce29b8c2576712a33aae06aee02486440c9268fcc19da1496a074feeee0a5178ClearFake payload (confidence level: 90%)

Description

ThreatFox IOCs for 2026-06-30

Community reviews

Loading reviews…