ThreatFox IOCs for 2026-07-31

• angelapetrini.itIClickFix payload delivery domain (confidence level: 100%)
• js.galmabuna.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
• rbrkej.liberty--token.comClearFake payload delivery domain (confidence level: 100%)
• acbt8fx6.crownconnectpk.comClearFake payload delivery domain (confidence level: 100%)
• qsbkuna.ecryptobits.comClearFake payload delivery domain (confidence level: 100%)
• prpzlb.shedsofmarion.comClearFake payload delivery domain (confidence level: 100%)
• ycutbmi.jadoou.latClearFake payload delivery domain (confidence level: 100%)
• 2fcm3z03.simplyturfandgreenwall.comClearFake payload delivery domain (confidence level: 100%)
• plasticsurgeryprofessionals.comUnknown malware payload delivery domain (confidence level: 75%)
• qdxwvp.tashabeautystore.comClearFake payload delivery domain (confidence level: 100%)

• http://117.217.230.14:43596/mozi.mMozi payload delivery URL (confidence level: 75%)
• https://viewphotodocument.com/api/init/Unknown malware botnet C2 (confidence level: 100%)
• https://v-k.com.ua/reportv.phpUnknown malware botnet C2 (confidence level: 100%)
• https://mectcalcutta.com/report.phpUnknown malware botnet C2 (confidence level: 100%)

• 199.30.90.240Unknown malware botnet C2 server (confidence level: 100%)
• 101.43.56.143VShell botnet C2 server (confidence level: 100%)
• 64.7.199.177VShell botnet C2 server (confidence level: 100%)
• 81.70.21.248Cobalt Strike botnet C2 server (confidence level: 100%)
• 178.128.22.21Aisuru botnet C2 server (confidence level: 100%)
• 65.49.237.140Cobalt Strike botnet C2 server (confidence level: 50%)
• 35.90.23.90Cobalt Strike botnet C2 server (confidence level: 50%)
• 27.71.16.98Cobalt Strike botnet C2 server (confidence level: 50%)
• 114.132.155.197Unknown malware botnet C2 server (confidence level: 100%)
• 118.126.101.114VShell botnet C2 server (confidence level: 100%)

Unknown malware payload (confidence level: 100%)

• 1b3defa83a236edc7a4d1dc7547e2ae519c5d1de8c848f24da2aa903972da291