ThreatFox IOCs for 2026-07-28

• patrins.com5.t Downloader payload delivery domain (confidence level: 100%)
• lumafer.chUnknown malware payload delivery domain (confidence level: 75%)
• ucjuriquilla.mxUnknown malware payload delivery domain (confidence level: 75%)
• landlordsolutions.ukUnknown malware payload delivery domain (confidence level: 75%)
• bechisalbinoantenne.itUnknown malware payload delivery domain (confidence level: 75%)
• hastehair.comUnknown malware payload delivery domain (confidence level: 75%)
• stac.com.vnUnknown malware payload delivery domain (confidence level: 75%)
• cooldogshistory.comUnknown Loader botnet C2 domain (confidence level: 100%)
• godhelp-us.comUnknown Loader botnet C2 domain (confidence level: 100%)
• ilikegoodpersontoo.comUnknown Loader botnet C2 domain (confidence level: 100%)

• http://182.112.30.222:60319/mozi.mMozi payload delivery URL (confidence level: 75%)
• http://139.135.44.17:33905/mozi.mMozi payload delivery URL (confidence level: 75%)
• http://14.1.106.10:37095/mozi.mMozi payload delivery URL (confidence level: 75%)
• http://27.202.57.233:59905/mozi.mMozi payload delivery URL (confidence level: 75%)
• http://14.1.106.91:54093/mozi.mMozi payload delivery URL (confidence level: 75%)
• https://www.aostaimmobiliare.it/Unknown malware payload delivery URL (confidence level: 90%)
• https://www.aureliaboutique.com.au/Unknown malware payload delivery URL (confidence level: 90%)
• https://193.111.117.131Vidar botnet C2 (confidence level: 100%)
• https://ucjuriquilla.mx/Unknown malware payload delivery URL (confidence level: 90%)
• https://thecolorofcharacter.com/Unknown malware payload delivery URL (confidence level: 90%)

• 103.233.8.39Unknown malware botnet C2 server (confidence level: 100%)
• 117.72.72.254Unknown malware botnet C2 server (confidence level: 100%)
• 119.45.190.210Unknown malware botnet C2 server (confidence level: 100%)
• 119.45.190.210Unknown malware botnet C2 server (confidence level: 100%)
• 166.108.206.56Unknown malware botnet C2 server (confidence level: 100%)
• 115.191.18.57Unknown malware botnet C2 server (confidence level: 100%)
• 117.72.72.254Unknown malware botnet C2 server (confidence level: 100%)
• 4.230.24.119Unknown malware botnet C2 server (confidence level: 100%)
• 45.221.118.69Unknown malware botnet C2 server (confidence level: 100%)
• 82.158.88.41Unknown malware botnet C2 server (confidence level: 100%)

Unknown malware payload (confidence level: 100%)

• c1bedea261f325441fb9a75c50b11d0c8fb01ac6
• a3b9575897c16cbf6afe3af1aa8b55171ea6edf9
• 8db6c78533c176f13b61405cdc3f8fad703325f1
• 9c1716d770ea69e8e1418d96d52222396ecb4362
• 73651c02b29f1c07e3177e86c967fc45e9f30f0f
• 955ff909972958098f0d4a06bcc4d6b9eea90449
• 25081bdec05f64eb4f313420c82d8de957e30026
• dcea71b9ab9de8efca301de9e2f7bf11c7132364
• df510f6f69a5c149c216c7b3accc4f460d8cf363
• b0782a9d6eef2ce02f734a6e5e1d8e0f9a2b65be