ThreatFox IOCs for 2026-09-10

Severity: mediumType: Malware

Indicators of Compromise

file: 167.172.71.91
hash: 9035
url: https://vexxuhq.site/paths
url: https://api.vexxuhq.site/send-embed
url: https://api.vexxuhq.site/send-embed-viewer
url: https://api.vexxuhq.site/download/
domain: api.vexxuhq.site
file: 45.138.16.54
hash: 8080
file: 45.138.16.54
hash: 80
file: 45.138.16.54
hash: 443
url: https://gunbuyerclub.com
url: https://notion-brown.com/4qx0lb/tm/oppe
url: http://178.198.246.24/photo.scr
url: http://177.70.102.232:8070/tmpftp/01/recep%c3%a7%c3%a3o/2022-09-05/info.zip
file: 161.35.166.196
hash: 12345
url: https://178.16.52.221/bin/screenconnect.clientsetup.exe
url: http://95.62.202.150:10071/sshd
url: http://103.20.213.34:8080/uploads/uploads/aryacorp%20delhi/backgrounds/info.zip
url: https://netstreamplus.com/get_verify
url: https://ssospace.net
url: https://netstreamplus.com/first_allow_host
domain: logm-justia.com
url: https://csswaytech.net/js/all.min.js
domain: ssospace.net
url: https://netstreamplus.com/js/all.min.js
url: https://csswaytech.net/get_verify
url: https://ssospace.net/first_allow_host
url: https://logm-justia.com
url: https://ssospace.net/js/all.min.js
domain: netstreamplus.com
url: https://csswaytech.net/first_allow_host
url: https://ssospace.net/get_verify
domain: csswaytech.net
url: https://thankful-cliff-01dfec010.7.azurestaticapps.net/adobe_updater%20.msi
url: https://toolshare.com.tr/files/jqqvlru0vaih3z.exe
file: 103.148.58.43
hash: 9034
file: 161.35.166.196
hash: 34567
domain: okuneva.sbs
url: https://okuneva.sbs/api/v1/session
url: https://okuneva.sbs/api/v1/verify
domain: regions.globalcargonetwork.com
url: https://small-union-7018.daoahueb.workers.dev/
domain: bociljp.uk.com
file: 154.91.60.113
hash: 8074
file: 154.91.60.112
hash: 8074
file: 154.91.61.99
hash: 8074
domain: digitaltechparis.com
domain: yzegs5gy.digitaltechparis.com
url: https://tweakz-dream-launcher.lovable.app/__l5e/assets-v1/f9eec8e0-95ce-4178-b709-6136c6e6321b/v4mp-tweakz-launcher.exe
url: https://cdn.jsdelivr.net/gh/anny11-34/progress-spoiling-dividable/overstay-derail-variety
file: 222.80.159.10
hash: 8443
file: 111.228.49.20
hash: 80
file: 154.91.60.117
hash: 8074
file: 128.90.136.65
hash: 4444
file: 152.32.133.192
hash: 135
file: 152.32.133.192
hash: 5986
domain: wiro88.blog
domain: ct692p3y.wiro88.blog
domain: kujoe31070.workers.dev
domain: fykecyjo.workers.dev
file: 91.200.14.203
hash: 80
domain: mi6.operationanonrecoil.ru
file: 176.65.139.206
hash: 80
domain: www.mandysmission.net
domain: mbarkitravel.com
domain: manupinc.org
file: 176.65.139.206
hash: 11121
file: 154.91.63.98
hash: 8074
file: 154.91.62.117
hash: 8074
file: 154.91.63.118
hash: 8074
file: 154.91.63.105
hash: 8074
file: 154.91.63.120
hash: 8074
url: http://gofkaxz.click:8137/tokens
url: http://smaring.shop:9895/comments
url: http://trencts.shop:8592/payments
url: http://91.92.242.236/files-129312398/files/file_c0d2eb6a8b73120b.exe
url: http://91.92.242.236/files-129312398/files/file_b584670f7ec2f317.exe
file: 102.220.161.94
hash: 80
file: 192.162.199.179
hash: 1912
url: http://uniqion.click:6929/events
url: http://bestals.shop:8592/settings
domain: imogenarmed.workers.dev
domain: la-fenetre.com
file: 154.91.63.126
hash: 8074
file: 20.218.121.193
hash: 8080
file: 37.114.46.118
hash: 8808
file: 154.91.58.99
hash: 8074
file: 154.91.58.122
hash: 8074
domain: jykivamo.workers.dev
domain: megamidiace.com
domain: medlabglobal.com
domain: modderguys.com
domain: wiro88game.it.com
domain: brandglobalbd.com
domain: mirhattire.com
domain: www.metallerie.paris
url: http://139.162.80.182/?h=139.162.80.182&p=80&t=tcp&a=l64&stage=true
url: https://pub-5590b15da27f4f219811312b19a8df05.r2.dev/screenconnect.clientsetup.msi
domain: mike-leder.de
domain: bestduilawyerva.com
domain: saidaco.com
domain: homestaycahayasikunir.com
domain: tqr5nttr.homestaycahayasikunir.com
file: 100.87.53.0
hash: 8443
file: 38.190.198.56
hash: 23251
url: https://104.253.74.209
domain: clinicadentalbroseta.com
domain: www.morvarid-plastic.com
domain: mookes.nl
domain: www.xn--90ai3bcalp.su
domain: www.mpcfoundation.nl
file: 154.91.58.113
hash: 8074
file: 154.91.58.110
hash: 8074
file: 154.91.58.118
hash: 8074
file: 154.91.58.107
hash: 8074
file: 199.47.241.52
hash: 7890
file: 167.172.71.91
hash: 8080
file: 49.233.190.64
hash: 13428
domain: mpotofoundation.org
domain: claudiosouza.com
domain: miraco.com.vn
domain: arcona.pl
domain: mijnvirtueelassistent.be
domain: gasgas.sagamoove.com.br
domain: elegantthemesflywheel.com
domain: luminica.com.mx
url: https://app.eduac.workers.dev/updateac
domain: blein.benoit.rodezinfocom.fr
domain: asteroidesproductions.com
domain: mainge.pe
domain: biorado.pro
domain: moralesmorvel.com
domain: msvoterguide.com
domain: morkshabitat.com
domain: kaystreasures.biz
domain: bookeyz.com
domain: mechasolusindo.com
domain: mezamie.com
domain: premierurgentcarela.com
domain: magnetyourevent.com
domain: cguuniforms.org
domain: locksmith-romo.com
domain: lr-blanchisserie-champenoise.fr
domain: livingwordpublications.in
domain: lucienebata.com
domain: e-rse.fit
domain: 74br4nt0.e-rse.fit
domain: warenwerk.ch
domain: dorfpraxis-rueschlikon.ch
domain: 5nrkm0ei2e.workers.dev
domain: xer0a002po.workers.dev
domain: brycecanyonlogcabins.com
domain: iocdesignconsulting.com
domain: multiespacio.es
domain: myfacts.eu
domain: deltacolo.com
domain: ojyh0s8b.brycecanyonlogcabins.com
file: 154.91.58.112
hash: 8074
file: 154.91.58.106
hash: 8074
file: 154.91.58.103
hash: 8074
file: 144.172.65.54
hash: 80
file: 154.91.57.101
hash: 8074
domain: multilocktiles.co.za
domain: www.mysteriesmusical.com
domain: dreamsstoriesbd.com
domain: ydns.shop
domain: 8otqtzmy.ydns.shop
url: http://209.145.51.44/keepon.exe
url: http://86.109.75.162:8080/api/v1/checkin
url: http://86.109.75.162:8080/api/v1/agent/ping
url: http://86.109.75.162:8080/api/v1/agent/tasks
file: 86.109.75.162
hash: 8080
file: 185.162.75.152
hash: 8041
domain: truspanel.com
domain: friendsstack.cfd
domain: escoladeemagrecimento.com
domain: natureelitehealth.online
domain: elimargomes.com.br
domain: equiscoperes.com
domain: enlineard.net
domain: www.navarriniarchitetti.it
file: 154.91.60.105
hash: 8074
file: 154.91.59.109
hash: 8074
file: 154.91.59.114
hash: 8074
file: 154.91.56.103
hash: 8074
file: 185.29.10.23
hash: 1012
url: http://neortal.click:8321/settings
file: 94.250.202.155
hash: 443
url: http://101.53.225.68:48653/mozi.7
file: 107.149.8.250
hash: 54321
domain: dinaly.workers.dev
url: http://31.220.3.140/ri/la.bot.mips
hash: cbabe6cb9fd822bb69b271c14952397b4d2a571d9e11e08c26312fad1b158163
hash: 638bb882ff0dba784ecc078c1792706983af0f91
hash: ee12bf94330dbbb5025aae8e1ec908a7
hash: eac635e113733a48d63427369c5456b94ffe8075f447eb6e465157f08ab4c87b
hash: dddcb764f3af1265392641bbade3632b2f319ab0
hash: 41c524a1390a872f207f17a08b443a72
hash: fc8f02c2dbb35322152f330c0b872bb71ea30d4a74472734531e60de9f2454ef
hash: ce147e4941248647e59168df4e92e0331416aa0d
hash: 7ea1ac9405b7ffcb6c087e3b65d1462a
hash: cc3417c2cdd3d0a9897528f1229f8649fa7313b348f887aba05173e6542b3e14
hash: 2078271033087b2eb6582ecebf7be4e57099fdaf
hash: b7d29e94613df7d42bd2f882e77a3f85
hash: 54fced67df11a75293cb6620d57101aca7dea30fcafe9ff40df3626388328d9e
hash: 9ec707497613b9efae6a7af45a01a597e23b831e
hash: 30f23cd8c071deac110bbaa70e4260cc
hash: f0ac5a212ee1e3acb68b27dfdd8e3b9f46be4d6d49ec0e843b2c0cb832145873
hash: f03f8bf1cab0a3772864c37678ec54d411fa1ff3
hash: 90606f943f0360cda289735b31ef836f
hash: 7e6c18d1f36ea881e2029160438efad994040e41376e9b664858725523b659cd
hash: 23a8e417188fa10923dce018a278f4abdecc139e
hash: 03ff2eb2b1d54c66b7b8ee7ad84f13c6
hash: c92f2e4f8ebfa4a61f3b17663076cb8513f26bc60fbdbe6faea232f621b6e802
hash: 96add574a522e59eadea6ee8355f74a43c46f742
hash: 29d87ed8ebc9b05426800ad3c13a8fcd
hash: 67f1a3186b9c1e826ab34fb4c18a6a9c85bd5986e1214f80004c07c57cbfaa49
hash: 39f1f47a0987b08dbd423eb5642163d97d541a66
hash: 2004d8d9525445445121fb47bbbf4b00
hash: e9951dbc13b4fb5a2fe7b26783d8495131edf77b4028a8bebf25ed02beaa8b5b
hash: 86ceedd043ce1327474de648f09ba993094f7835
hash: 1e1d111b87fc523c8b46b13e0300bcc0
hash: a84bef9ffa7f4ee4c682a75f1d0480c8b5cd233e355b885b61ef4a52eaf65dfb
hash: 11397967c121f36edd2e894234627d68394b2e62
hash: f4e051ee49a9559f6d71c7699226e3fb
hash: 953b808caf22274577e975b21404fcd2b69fb3e8ad266f175b100612305d5575
hash: 2217b5efd0ba9f67a74fe95ac7fff491816f0ddf
hash: 8c82f607f14980a6962993f8800cdf35
hash: e686c2dcffe94fb122df2e81debdab3e3a973c9a3bfcd06854d2a99dd5605cd0
hash: 48509b8456af7e787b098b157746489f48213095
hash: 3d305fab02241ac166687d9e3b1e1705
hash: 5a24a5a7e387ec5de6d8fc95e5bf455efae511d0f981605b0b232c6f6260f5cb
hash: 97d0345c41cd94e6c005ed7b03217bfcb351b5fe
hash: 5e1e402e90339348be7a2a68b60f55e5
hash: 863866fa9ffff1dd6e4d7bba34f127c9847e444078203fd2490a16fa08e91b92
hash: 2477cbaf09aff57e538eb9a98ded675e23ca53a0
hash: 2aad0c2944754979c4ea0b0d0461efed
hash: 210ae656df91ca6fe5cca2c03f737716637537e6b8d9e0476bafc268ceb64c32
hash: 0b3e8e11ac0aa3b88ea280af0b6625fabde3f8ad
hash: 8594a6fe0265fa1629c16411f0fd3d77
hash: 0960143403b7d6d8bbaed0f1652e83d6376c3cfe1fa6fe63b080b1fab97eb5a6
hash: 5983f394bdc9c2a191b5874a98cb736590ed5734
hash: e728c199f2f1ad356fcbee25a5475c74
domain: blwcg81617.workers.dev
domain: newpurpose.org
file: 154.91.60.106
hash: 8074
file: 154.91.56.106
hash: 8074
file: 154.91.56.108
hash: 8074
file: 154.91.56.125
hash: 8074
domain: goodlong.life
domain: nhakhoatandinh.com
domain: jl4wdm8i.bobatouch.com
domain: www.nyclimopass.com
domain: northlondonmobiletyrefitting.co.uk
domain: www.novahelixlabs.com
domain: novaairsolutions.com
domain: nucosolutions.co.uk
file: 102.134.34.85
hash: 8080
file: 154.91.63.117
hash: 8074
file: 154.91.63.119
hash: 8074
file: 154.91.63.103
hash: 8074
file: 154.91.63.123
hash: 8074
file: 154.91.63.122
hash: 8074
domain: ducave.workers.dev
domain: p8czohl7nq.workers.dev
url: http://103.226.249.227:86/info.zip
url: http://102.212.61.41:8026/sshd
domain: by1r8hqk.us-eng-zensulin.com
url: https://45.141.148.134:2002/aymxbq
domain: 73x4a00h.us-us-us-zensulin.com
url: https://login.v-panel.asia/
domain: login.v-panel.asia
domain: openmundi.com.br
domain: omumedia.co.id
domain: kidderporecollege.in
domain: kendalfortson.com
file: 154.91.63.99
hash: 8074
file: 185.193.127.10
hash: 443
file: 185.193.127.10
hash: 80
file: 185.193.127.10
hash: 8080
domain: bdidap9p.borderlinelakewood.com
url: http://117.240.155.245:30270/sshd
url: https://mysura.it/njtzac0.tar
file: 103.108.66.160
hash: 7707
file: 107.172.134.37
hash: 443
file: 124.156.108.12
hash: 443
file: 128.90.135.53
hash: 4444
file: 13.230.198.141
hash: 80
file: 138.16.178.77
hash: 7707
file: 143.246.217.103
hash: 25729
file: 144.172.65.54
hash: 4321
file: 154.13.7.196
hash: 4321
file: 172.86.74.104
hash: 7707
file: 172.86.74.104
hash: 8808
file: 18.142.104.108
hash: 8088
file: 184.176.151.16
hash: 8080
file: 185.212.128.237
hash: 9000
file: 185.242.3.250
hash: 7707
file: 194.26.192.153
hash: 7707
file: 195.2.80.76
hash: 8081
file: 206.123.132.166
hash: 3002
file: 38.54.97.169
hash: 4321
file: 62.171.148.175
hash: 7707
file: 62.171.148.175
hash: 8808
file: 69.48.229.91
hash: 65500
file: 80.190.77.86
hash: 2002
file: 80.96.108.225
hash: 65432
file: 95.31.213.79
hash: 443
file: 96.9.226.22
hash: 8808
file: 98.89.43.158
hash: 443
domain: poxizu.workers.dev
domain: jolymeza.workers.dev
domain: lazycatagency.com
domain: mariafinch.com
domain: ortodoncia-invisible-valencia.com
domain: paintmyparkinglot.com
domain: looseningcaptivesblog.com
domain: linuxbazar.com
domain: s0ls07nv.www-genesisrevival.com
file: 115.159.72.17
hash: 8084
file: 119.45.28.237
hash: 8081
file: 154.91.56.110
hash: 8074
file: 193.160.223.238
hash: 31896
url: https://nexusatlas-c74.pages.dev/apps/instalador.zip
url: http://139.95.24.51:8081/?h=139.95.24.51&p=8081&t=tcp&a=w64&stage=true
file: 64.225.107.48
hash: 8443
domain: windowsupgrade.3utilities.com
url: https://update-microsoft-data.services
url: https://cloud-flare-authenticator.click
url: http://beautynams.com/nweke/fre.php
domain: u6ytrewqgrfewdmmmjhfjpooiuyhgghfdsaokjbn.duckdns.org
file: 91.239.6.97
hash: 4449
file: 31.59.137.16
hash: 2026
file: 161.35.166.196
hash: 8443
file: 45.67.139.138
hash: 8675
file: 103.83.86.96
hash: 4001
domain: nanohaarpigmentierung.de
domain: pascalcossu.com
domain: peluqueriainesgarcia.es
domain: nakhlatee.com
domain: mihajskam.serveminecraft.net
domain: cns.grotominpgroup.pl
domain: sns.grotominpgroup.pl
file: 203.202.232.127
hash: 1515
file: 154.91.63.125
hash: 8074
file: 154.91.56.109
hash: 8074
file: 154.91.57.119
hash: 8074
file: 154.91.56.114
hash: 8074
file: 154.91.56.115
hash: 8074
url: http://zream.shop:5728/products
file: 194.116.236.9
hash: 7000
file: 103.83.86.22
hash: 7500
domain: phanxwodm.duckdns.org
file: 158.94.209.216
hash: 2404
domain: btobglobal.com
domain: llny16fk.btobglobal.com
file: 45.154.98.168
hash: 9019
file: 64.89.160.225
hash: 7001
url: http://139.162.80.182/?h=139.162.80.182&p=80&t=tcp&a=l32&stage=true
url: http://134.122.177.37:8084/?h=134.122.177.37&p=8084&t=tcp&a=l32&stage=true
domain: tifomoqa.workers.dev
domain: crimsonroundel.info
domain: bapele.workers.dev
domain: pmcimpianti.com
file: 154.91.56.99
hash: 8074
file: 154.91.56.98
hash: 8074
file: 154.91.58.101
hash: 8074
file: 154.91.58.100
hash: 8074
url: https://raw.githubusercontent.com/cowenrty/issue/refs/heads/main/left
domain: ptkevrodor.ru
domain: pormudanza.com
domain: ramonetage.ovh
domain: playfreeonline32.com
domain: qalbbyam.com
domain: princecables.com
domain: plantwatergrow.org
domain: quicksilvercleaning.ca
domain: pilotmonkeys.com
domain: ponpesinayatullah.com
url: http://132.247.103.239/video.scr
domain: drift-phantom.cc

ThreatFox IOCs for 2026-09-10

Severity: medium

Type: Malware

ThreatFox IOCs for 2026-09-10

Indicators of Compromise

file: 167.172.71.91
hash: 9035
url: https://vexxuhq.site/paths
url: https://api.vexxuhq.site/send-embed
url: https://api.vexxuhq.site/send-embed-viewer
url: https://api.vexxuhq.site/download/
domain: api.vexxuhq.site
file: 45.138.16.54
hash: 8080
file: 45.138.16.54
hash: 80
file: 45.138.16.54
hash: 443
url: https://gunbuyerclub.com
url: https://notion-brown.com/4qx0lb/tm/oppe
url: http://178.198.246.24/photo.scr
url: http://177.70.102.232:8070/tmpftp/01/recep%c3%a7%c3%a3o/2022-09-05/info.zip
file: 161.35.166.196
hash: 12345
url: https://178.16.52.221/bin/screenconnect.clientsetup.exe
url: http://95.62.202.150:10071/sshd
url: http://103.20.213.34:8080/uploads/uploads/aryacorp%20delhi/backgrounds/info.zip
url: https://netstreamplus.com/get_verify
url: https://ssospace.net
url: https://netstreamplus.com/first_allow_host
domain: logm-justia.com
url: https://csswaytech.net/js/all.min.js
domain: ssospace.net
url: https://netstreamplus.com/js/all.min.js
url: https://csswaytech.net/get_verify
url: https://ssospace.net/first_allow_host
url: https://logm-justia.com
url: https://ssospace.net/js/all.min.js
domain: netstreamplus.com
url: https://csswaytech.net/first_allow_host
url: https://ssospace.net/get_verify
domain: csswaytech.net
url: https://thankful-cliff-01dfec010.7.azurestaticapps.net/adobe_updater%20.msi
url: https://toolshare.com.tr/files/jqqvlru0vaih3z.exe
file: 103.148.58.43
hash: 9034
file: 161.35.166.196
hash: 34567
domain: okuneva.sbs
url: https://okuneva.sbs/api/v1/session
url: https://okuneva.sbs/api/v1/verify
domain: regions.globalcargonetwork.com
url: https://small-union-7018.daoahueb.workers.dev/
domain: bociljp.uk.com
file: 154.91.60.113
hash: 8074
file: 154.91.60.112
hash: 8074
file: 154.91.61.99
hash: 8074
domain: digitaltechparis.com
domain: yzegs5gy.digitaltechparis.com
url: https://tweakz-dream-launcher.lovable.app/__l5e/assets-v1/f9eec8e0-95ce-4178-b709-6136c6e6321b/v4mp-tweakz-launcher.exe
url: https://cdn.jsdelivr.net/gh/anny11-34/progress-spoiling-dividable/overstay-derail-variety
file: 222.80.159.10
hash: 8443
file: 111.228.49.20
hash: 80
file: 154.91.60.117
hash: 8074
file: 128.90.136.65
hash: 4444
file: 152.32.133.192
hash: 135
file: 152.32.133.192
hash: 5986
domain: wiro88.blog
domain: ct692p3y.wiro88.blog
domain: kujoe31070.workers.dev
domain: fykecyjo.workers.dev
file: 91.200.14.203
hash: 80
domain: mi6.operationanonrecoil.ru
file: 176.65.139.206
hash: 80
domain: www.mandysmission.net
domain: mbarkitravel.com
domain: manupinc.org
file: 176.65.139.206
hash: 11121
file: 154.91.63.98
hash: 8074
file: 154.91.62.117
hash: 8074
file: 154.91.63.118
hash: 8074
file: 154.91.63.105
hash: 8074
file: 154.91.63.120
hash: 8074
url: http://gofkaxz.click:8137/tokens
url: http://smaring.shop:9895/comments
url: http://trencts.shop:8592/payments
url: http://91.92.242.236/files-129312398/files/file_c0d2eb6a8b73120b.exe
url: http://91.92.242.236/files-129312398/files/file_b584670f7ec2f317.exe
file: 102.220.161.94
hash: 80
file: 192.162.199.179
hash: 1912
url: http://uniqion.click:6929/events
url: http://bestals.shop:8592/settings
domain: imogenarmed.workers.dev
domain: la-fenetre.com
file: 154.91.63.126
hash: 8074
file: 20.218.121.193
hash: 8080
file: 37.114.46.118
hash: 8808
file: 154.91.58.99
hash: 8074
file: 154.91.58.122
hash: 8074
domain: jykivamo.workers.dev
domain: megamidiace.com
domain: medlabglobal.com
domain: modderguys.com
domain: wiro88game.it.com
domain: brandglobalbd.com
domain: mirhattire.com
domain: www.metallerie.paris
url: http://139.162.80.182/?h=139.162.80.182&p=80&t=tcp&a=l64&stage=true
url: https://pub-5590b15da27f4f219811312b19a8df05.r2.dev/screenconnect.clientsetup.msi
domain: mike-leder.de
domain: bestduilawyerva.com
domain: saidaco.com
domain: homestaycahayasikunir.com
domain: tqr5nttr.homestaycahayasikunir.com
file: 100.87.53.0
hash: 8443
file: 38.190.198.56
hash: 23251
url: https://104.253.74.209
domain: clinicadentalbroseta.com
domain: www.morvarid-plastic.com
domain: mookes.nl
domain: www.xn--90ai3bcalp.su
domain: www.mpcfoundation.nl
file: 154.91.58.113
hash: 8074
file: 154.91.58.110
hash: 8074
file: 154.91.58.118
hash: 8074
file: 154.91.58.107
hash: 8074
file: 199.47.241.52
hash: 7890
file: 167.172.71.91
hash: 8080
file: 49.233.190.64
hash: 13428
domain: mpotofoundation.org
domain: claudiosouza.com
domain: miraco.com.vn
domain: arcona.pl
domain: mijnvirtueelassistent.be
domain: gasgas.sagamoove.com.br
domain: elegantthemesflywheel.com
domain: luminica.com.mx
url: https://app.eduac.workers.dev/updateac
domain: blein.benoit.rodezinfocom.fr
domain: asteroidesproductions.com
domain: mainge.pe
domain: biorado.pro
domain: moralesmorvel.com
domain: msvoterguide.com
domain: morkshabitat.com
domain: kaystreasures.biz
domain: bookeyz.com
domain: mechasolusindo.com
domain: mezamie.com
domain: premierurgentcarela.com
domain: magnetyourevent.com
domain: cguuniforms.org
domain: locksmith-romo.com
domain: lr-blanchisserie-champenoise.fr
domain: livingwordpublications.in
domain: lucienebata.com
domain: e-rse.fit
domain: 74br4nt0.e-rse.fit
domain: warenwerk.ch
domain: dorfpraxis-rueschlikon.ch
domain: 5nrkm0ei2e.workers.dev
domain: xer0a002po.workers.dev
domain: brycecanyonlogcabins.com
domain: iocdesignconsulting.com
domain: multiespacio.es
domain: myfacts.eu
domain: deltacolo.com
domain: ojyh0s8b.brycecanyonlogcabins.com
file: 154.91.58.112
hash: 8074
file: 154.91.58.106
hash: 8074
file: 154.91.58.103
hash: 8074
file: 144.172.65.54
hash: 80
file: 154.91.57.101
hash: 8074
domain: multilocktiles.co.za
domain: www.mysteriesmusical.com
domain: dreamsstoriesbd.com
domain: ydns.shop
domain: 8otqtzmy.ydns.shop
url: http://209.145.51.44/keepon.exe
url: http://86.109.75.162:8080/api/v1/checkin
url: http://86.109.75.162:8080/api/v1/agent/ping
url: http://86.109.75.162:8080/api/v1/agent/tasks
file: 86.109.75.162
hash: 8080
file: 185.162.75.152
hash: 8041
domain: truspanel.com
domain: friendsstack.cfd
domain: escoladeemagrecimento.com
domain: natureelitehealth.online
domain: elimargomes.com.br
domain: equiscoperes.com
domain: enlineard.net
domain: www.navarriniarchitetti.it
file: 154.91.60.105
hash: 8074
file: 154.91.59.109
hash: 8074
file: 154.91.59.114
hash: 8074
file: 154.91.56.103
hash: 8074
file: 185.29.10.23
hash: 1012
url: http://neortal.click:8321/settings
file: 94.250.202.155
hash: 443
url: http://101.53.225.68:48653/mozi.7
file: 107.149.8.250
hash: 54321
domain: dinaly.workers.dev
url: http://31.220.3.140/ri/la.bot.mips
hash: cbabe6cb9fd822bb69b271c14952397b4d2a571d9e11e08c26312fad1b158163
hash: 638bb882ff0dba784ecc078c1792706983af0f91
hash: ee12bf94330dbbb5025aae8e1ec908a7
hash: eac635e113733a48d63427369c5456b94ffe8075f447eb6e465157f08ab4c87b
hash: dddcb764f3af1265392641bbade3632b2f319ab0
hash: 41c524a1390a872f207f17a08b443a72
hash: fc8f02c2dbb35322152f330c0b872bb71ea30d4a74472734531e60de9f2454ef
hash: ce147e4941248647e59168df4e92e0331416aa0d
hash: 7ea1ac9405b7ffcb6c087e3b65d1462a
hash: cc3417c2cdd3d0a9897528f1229f8649fa7313b348f887aba05173e6542b3e14
hash: 2078271033087b2eb6582ecebf7be4e57099fdaf
hash: b7d29e94613df7d42bd2f882e77a3f85
hash: 54fced67df11a75293cb6620d57101aca7dea30fcafe9ff40df3626388328d9e
hash: 9ec707497613b9efae6a7af45a01a597e23b831e
hash: 30f23cd8c071deac110bbaa70e4260cc
hash: f0ac5a212ee1e3acb68b27dfdd8e3b9f46be4d6d49ec0e843b2c0cb832145873
hash: f03f8bf1cab0a3772864c37678ec54d411fa1ff3
hash: 90606f943f0360cda289735b31ef836f
hash: 7e6c18d1f36ea881e2029160438efad994040e41376e9b664858725523b659cd
hash: 23a8e417188fa10923dce018a278f4abdecc139e
hash: 03ff2eb2b1d54c66b7b8ee7ad84f13c6
hash: c92f2e4f8ebfa4a61f3b17663076cb8513f26bc60fbdbe6faea232f621b6e802
hash: 96add574a522e59eadea6ee8355f74a43c46f742
hash: 29d87ed8ebc9b05426800ad3c13a8fcd
hash: 67f1a3186b9c1e826ab34fb4c18a6a9c85bd5986e1214f80004c07c57cbfaa49
hash: 39f1f47a0987b08dbd423eb5642163d97d541a66
hash: 2004d8d9525445445121fb47bbbf4b00
hash: e9951dbc13b4fb5a2fe7b26783d8495131edf77b4028a8bebf25ed02beaa8b5b
hash: 86ceedd043ce1327474de648f09ba993094f7835
hash: 1e1d111b87fc523c8b46b13e0300bcc0
hash: a84bef9ffa7f4ee4c682a75f1d0480c8b5cd233e355b885b61ef4a52eaf65dfb
hash: 11397967c121f36edd2e894234627d68394b2e62
hash: f4e051ee49a9559f6d71c7699226e3fb
hash: 953b808caf22274577e975b21404fcd2b69fb3e8ad266f175b100612305d5575
hash: 2217b5efd0ba9f67a74fe95ac7fff491816f0ddf
hash: 8c82f607f14980a6962993f8800cdf35
hash: e686c2dcffe94fb122df2e81debdab3e3a973c9a3bfcd06854d2a99dd5605cd0
hash: 48509b8456af7e787b098b157746489f48213095
hash: 3d305fab02241ac166687d9e3b1e1705
hash: 5a24a5a7e387ec5de6d8fc95e5bf455efae511d0f981605b0b232c6f6260f5cb
hash: 97d0345c41cd94e6c005ed7b03217bfcb351b5fe
hash: 5e1e402e90339348be7a2a68b60f55e5
hash: 863866fa9ffff1dd6e4d7bba34f127c9847e444078203fd2490a16fa08e91b92
hash: 2477cbaf09aff57e538eb9a98ded675e23ca53a0
hash: 2aad0c2944754979c4ea0b0d0461efed
hash: 210ae656df91ca6fe5cca2c03f737716637537e6b8d9e0476bafc268ceb64c32
hash: 0b3e8e11ac0aa3b88ea280af0b6625fabde3f8ad
hash: 8594a6fe0265fa1629c16411f0fd3d77
hash: 0960143403b7d6d8bbaed0f1652e83d6376c3cfe1fa6fe63b080b1fab97eb5a6
hash: 5983f394bdc9c2a191b5874a98cb736590ed5734
hash: e728c199f2f1ad356fcbee25a5475c74
domain: blwcg81617.workers.dev
domain: newpurpose.org
file: 154.91.60.106
hash: 8074
file: 154.91.56.106
hash: 8074
file: 154.91.56.108
hash: 8074
file: 154.91.56.125
hash: 8074
domain: goodlong.life
domain: nhakhoatandinh.com
domain: jl4wdm8i.bobatouch.com
domain: www.nyclimopass.com
domain: northlondonmobiletyrefitting.co.uk
domain: www.novahelixlabs.com
domain: novaairsolutions.com
domain: nucosolutions.co.uk
file: 102.134.34.85
hash: 8080
file: 154.91.63.117
hash: 8074
file: 154.91.63.119
hash: 8074
file: 154.91.63.103
hash: 8074
file: 154.91.63.123
hash: 8074
file: 154.91.63.122
hash: 8074
domain: ducave.workers.dev
domain: p8czohl7nq.workers.dev
url: http://103.226.249.227:86/info.zip
url: http://102.212.61.41:8026/sshd
domain: by1r8hqk.us-eng-zensulin.com
url: https://45.141.148.134:2002/aymxbq
domain: 73x4a00h.us-us-us-zensulin.com
url: https://login.v-panel.asia/
domain: login.v-panel.asia
domain: openmundi.com.br
domain: omumedia.co.id
domain: kidderporecollege.in
domain: kendalfortson.com
file: 154.91.63.99
hash: 8074
file: 185.193.127.10
hash: 443
file: 185.193.127.10
hash: 80
file: 185.193.127.10
hash: 8080
domain: bdidap9p.borderlinelakewood.com
url: http://117.240.155.245:30270/sshd
url: https://mysura.it/njtzac0.tar
file: 103.108.66.160
hash: 7707
file: 107.172.134.37
hash: 443
file: 124.156.108.12
hash: 443
file: 128.90.135.53
hash: 4444
file: 13.230.198.141
hash: 80
file: 138.16.178.77
hash: 7707
file: 143.246.217.103
hash: 25729
file: 144.172.65.54
hash: 4321
file: 154.13.7.196
hash: 4321
file: 172.86.74.104
hash: 7707
file: 172.86.74.104
hash: 8808
file: 18.142.104.108
hash: 8088
file: 184.176.151.16
hash: 8080
file: 185.212.128.237
hash: 9000
file: 185.242.3.250
hash: 7707
file: 194.26.192.153
hash: 7707
file: 195.2.80.76
hash: 8081
file: 206.123.132.166
hash: 3002
file: 38.54.97.169
hash: 4321
file: 62.171.148.175
hash: 7707
file: 62.171.148.175
hash: 8808
file: 69.48.229.91
hash: 65500
file: 80.190.77.86
hash: 2002
file: 80.96.108.225
hash: 65432
file: 95.31.213.79
hash: 443
file: 96.9.226.22
hash: 8808
file: 98.89.43.158
hash: 443
domain: poxizu.workers.dev
domain: jolymeza.workers.dev
domain: lazycatagency.com
domain: mariafinch.com
domain: ortodoncia-invisible-valencia.com
domain: paintmyparkinglot.com
domain: looseningcaptivesblog.com
domain: linuxbazar.com
domain: s0ls07nv.www-genesisrevival.com
file: 115.159.72.17
hash: 8084
file: 119.45.28.237
hash: 8081
file: 154.91.56.110
hash: 8074
file: 193.160.223.238
hash: 31896
url: https://nexusatlas-c74.pages.dev/apps/instalador.zip
url: http://139.95.24.51:8081/?h=139.95.24.51&p=8081&t=tcp&a=w64&stage=true
file: 64.225.107.48
hash: 8443
domain: windowsupgrade.3utilities.com
url: https://update-microsoft-data.services
url: https://cloud-flare-authenticator.click
url: http://beautynams.com/nweke/fre.php
domain: u6ytrewqgrfewdmmmjhfjpooiuyhgghfdsaokjbn.duckdns.org
file: 91.239.6.97
hash: 4449
file: 31.59.137.16
hash: 2026
file: 161.35.166.196
hash: 8443
file: 45.67.139.138
hash: 8675
file: 103.83.86.96
hash: 4001
domain: nanohaarpigmentierung.de
domain: pascalcossu.com
domain: peluqueriainesgarcia.es
domain: nakhlatee.com
domain: mihajskam.serveminecraft.net
domain: cns.grotominpgroup.pl
domain: sns.grotominpgroup.pl
file: 203.202.232.127
hash: 1515
file: 154.91.63.125
hash: 8074
file: 154.91.56.109
hash: 8074
file: 154.91.57.119
hash: 8074
file: 154.91.56.114
hash: 8074
file: 154.91.56.115
hash: 8074
url: http://zream.shop:5728/products
file: 194.116.236.9
hash: 7000
file: 103.83.86.22
hash: 7500
domain: phanxwodm.duckdns.org
file: 158.94.209.216
hash: 2404
domain: btobglobal.com
domain: llny16fk.btobglobal.com
file: 45.154.98.168
hash: 9019
file: 64.89.160.225
hash: 7001
url: http://139.162.80.182/?h=139.162.80.182&p=80&t=tcp&a=l32&stage=true
url: http://134.122.177.37:8084/?h=134.122.177.37&p=8084&t=tcp&a=l32&stage=true
domain: tifomoqa.workers.dev
domain: crimsonroundel.info
domain: bapele.workers.dev
domain: pmcimpianti.com
file: 154.91.56.99
hash: 8074
file: 154.91.56.98
hash: 8074
file: 154.91.58.101
hash: 8074
file: 154.91.58.100
hash: 8074
url: https://raw.githubusercontent.com/cowenrty/issue/refs/heads/main/left
domain: ptkevrodor.ru
domain: pormudanza.com
domain: ramonetage.ovh
domain: playfreeonline32.com
domain: qalbbyam.com
domain: princecables.com
domain: plantwatergrow.org
domain: quicksilvercleaning.ca
domain: pilotmonkeys.com
domain: ponpesinayatullah.com
url: http://132.247.103.239/video.scr
domain: drift-phantom.cc

Source: ThreatFox MISP Feed

Published: 09/10/2026

ThreatFox IOCs for 2026-09-10

Medium

Malwaretype:osint tlp:white

Published: 09/10/2026 (09/10/2026, 00:00:00 UTC)

Source: ThreatFox MISP Feed

Description

ThreatFox IOCs for 2026-09-10

Technical Details

Threat Level: 2
Analysis: 1
Distribution: 3
Uuid: 66d77b5e-4fe9-494b-8d93-899963fccca1
Original Timestamp: 1789084989

Indicators of Compromise

File

Value	Description	Copy
file167.172.71.91	Aisuru botnet C2 server (confidence level: 100%)
file45.138.16.54	Unknown Stealer botnet C2 server (confidence level: 100%)
file45.138.16.54	Unknown Stealer botnet C2 server (confidence level: 100%)
file45.138.16.54	Unknown Stealer botnet C2 server (confidence level: 100%)
file161.35.166.196	Aisuru botnet C2 server (confidence level: 100%)
file103.148.58.43	Aisuru botnet C2 server (confidence level: 100%)
file161.35.166.196	Aisuru botnet C2 server (confidence level: 100%)
file154.91.60.113	VShell botnet C2 server (confidence level: 100%)
file154.91.60.112	VShell botnet C2 server (confidence level: 100%)
file154.91.61.99	VShell botnet C2 server (confidence level: 100%)
file222.80.159.10	Cobalt Strike botnet C2 server (confidence level: 50%)
file111.228.49.20	Cobalt Strike botnet C2 server (confidence level: 50%)
file154.91.60.117	VShell botnet C2 server (confidence level: 100%)
file128.90.136.65	AsyncRAT botnet C2 server (confidence level: 50%)
file152.32.133.192	Unknown malware botnet C2 server (confidence level: 100%)
file152.32.133.192	Unknown malware botnet C2 server (confidence level: 100%)
file91.200.14.203	Hook botnet C2 server (confidence level: 75%)
file176.65.139.206	Mirai payload delivery server (confidence level: 75%)
file176.65.139.206	Unknown malware botnet C2 server (confidence level: 50%)
file154.91.63.98	VShell botnet C2 server (confidence level: 100%)
file154.91.62.117	VShell botnet C2 server (confidence level: 100%)
file154.91.63.118	VShell botnet C2 server (confidence level: 100%)
file154.91.63.105	VShell botnet C2 server (confidence level: 100%)
file154.91.63.120	VShell botnet C2 server (confidence level: 100%)
file102.220.161.94	AsyncRAT botnet C2 server (confidence level: 100%)
file192.162.199.179	RedLine Stealer botnet C2 server (confidence level: 100%)
file154.91.63.126	VShell botnet C2 server (confidence level: 100%)
file20.218.121.193	Quasar RAT botnet C2 server (confidence level: 100%)
file37.114.46.118	Quasar RAT botnet C2 server (confidence level: 100%)
file154.91.58.99	VShell botnet C2 server (confidence level: 100%)
file154.91.58.122	VShell botnet C2 server (confidence level: 100%)
file100.87.53.0	Cobalt Strike botnet C2 server (confidence level: 75%)
file38.190.198.56	Cobalt Strike botnet C2 server (confidence level: 75%)
file154.91.58.113	VShell botnet C2 server (confidence level: 100%)
file154.91.58.110	VShell botnet C2 server (confidence level: 100%)
file154.91.58.118	VShell botnet C2 server (confidence level: 100%)
file154.91.58.107	VShell botnet C2 server (confidence level: 100%)
file199.47.241.52	Remcos botnet C2 server (confidence level: 100%)
file167.172.71.91	Aisuru botnet C2 server (confidence level: 100%)
file49.233.190.64	NjRAT botnet C2 server (confidence level: 100%)
file154.91.58.112	VShell botnet C2 server (confidence level: 100%)
file154.91.58.106	VShell botnet C2 server (confidence level: 100%)
file154.91.58.103	VShell botnet C2 server (confidence level: 100%)
file144.172.65.54	VShell botnet C2 server (confidence level: 100%)
file154.91.57.101	VShell botnet C2 server (confidence level: 100%)
file86.109.75.162	Unknown malware botnet C2 server (confidence level: 75%)
file185.162.75.152	Unknown RAT botnet C2 server (confidence level: 75%)
file154.91.60.105	VShell botnet C2 server (confidence level: 100%)
file154.91.59.109	VShell botnet C2 server (confidence level: 100%)
file154.91.59.114	VShell botnet C2 server (confidence level: 100%)
file154.91.56.103	VShell botnet C2 server (confidence level: 100%)
file185.29.10.23	XWorm botnet C2 server (confidence level: 75%)
file94.250.202.155	PureLogs Stealer botnet C2 server (confidence level: 75%)
file107.149.8.250	XWorm botnet C2 server (confidence level: 75%)
file154.91.60.106	VShell botnet C2 server (confidence level: 100%)
file154.91.56.106	VShell botnet C2 server (confidence level: 100%)
file154.91.56.108	VShell botnet C2 server (confidence level: 100%)
file154.91.56.125	VShell botnet C2 server (confidence level: 100%)
file102.134.34.85	Cobalt Strike botnet C2 server (confidence level: 100%)
file154.91.63.117	VShell botnet C2 server (confidence level: 100%)
file154.91.63.119	VShell botnet C2 server (confidence level: 100%)
file154.91.63.103	VShell botnet C2 server (confidence level: 100%)
file154.91.63.123	VShell botnet C2 server (confidence level: 100%)
file154.91.63.122	VShell botnet C2 server (confidence level: 100%)
file154.91.63.99	VShell botnet C2 server (confidence level: 100%)
file185.193.127.10	AdaptixC2 botnet C2 server (confidence level: 100%)
file185.193.127.10	AdaptixC2 botnet C2 server (confidence level: 100%)
file185.193.127.10	AdaptixC2 botnet C2 server (confidence level: 100%)
file103.108.66.160	AsyncRAT botnet C2 server (confidence level: 75%)
file107.172.134.37	PureRAT botnet C2 server (confidence level: 75%)
file124.156.108.12	PureRAT botnet C2 server (confidence level: 75%)
file128.90.135.53	AsyncRAT botnet C2 server (confidence level: 75%)
file13.230.198.141	Brute Ratel C4 botnet C2 server (confidence level: 75%)
file138.16.178.77	AsyncRAT botnet C2 server (confidence level: 75%)
file143.246.217.103	AdaptixC2 botnet C2 server (confidence level: 75%)
file144.172.65.54	AdaptixC2 botnet C2 server (confidence level: 75%)
file154.13.7.196	AdaptixC2 botnet C2 server (confidence level: 75%)
file172.86.74.104	AsyncRAT botnet C2 server (confidence level: 75%)
file172.86.74.104	AsyncRAT botnet C2 server (confidence level: 75%)
file18.142.104.108	Unknown malware botnet C2 server (confidence level: 75%)
file184.176.151.16	DeimosC2 botnet C2 server (confidence level: 75%)
file185.212.128.237	Evilginx botnet C2 server (confidence level: 75%)
file185.242.3.250	AsyncRAT botnet C2 server (confidence level: 75%)
file194.26.192.153	AsyncRAT botnet C2 server (confidence level: 75%)
file195.2.80.76	BianLian botnet C2 server (confidence level: 75%)
file206.123.132.166	DCRat botnet C2 server (confidence level: 75%)
file38.54.97.169	AdaptixC2 botnet C2 server (confidence level: 75%)
file62.171.148.175	AsyncRAT botnet C2 server (confidence level: 75%)
file62.171.148.175	AsyncRAT botnet C2 server (confidence level: 75%)
file69.48.229.91	AdaptixC2 botnet C2 server (confidence level: 75%)
file80.190.77.86	AsyncRAT botnet C2 server (confidence level: 75%)
file80.96.108.225	AdaptixC2 botnet C2 server (confidence level: 75%)
file95.31.213.79	Unknown malware botnet C2 server (confidence level: 75%)
file96.9.226.22	AsyncRAT botnet C2 server (confidence level: 75%)
file98.89.43.158	PureRAT botnet C2 server (confidence level: 75%)
file115.159.72.17	VShell botnet C2 server (confidence level: 100%)
file119.45.28.237	VShell botnet C2 server (confidence level: 100%)
file154.91.56.110	VShell botnet C2 server (confidence level: 100%)
file193.160.223.238	Remcos botnet C2 server (confidence level: 100%)
file64.225.107.48	Aisuru botnet C2 server (confidence level: 100%)
file91.239.6.97	XWorm botnet C2 server (confidence level: 75%)
file31.59.137.16	Remcos botnet C2 server (confidence level: 75%)
file161.35.166.196	Aisuru botnet C2 server (confidence level: 100%)
file45.67.139.138	Remcos botnet C2 server (confidence level: 75%)
file103.83.86.96	XWorm botnet C2 server (confidence level: 75%)
file203.202.232.127	XWorm botnet C2 server (confidence level: 75%)
file154.91.63.125	VShell botnet C2 server (confidence level: 100%)
file154.91.56.109	VShell botnet C2 server (confidence level: 100%)
file154.91.57.119	VShell botnet C2 server (confidence level: 100%)
file154.91.56.114	VShell botnet C2 server (confidence level: 100%)
file154.91.56.115	VShell botnet C2 server (confidence level: 100%)
file194.116.236.9	XWorm botnet C2 server (confidence level: 75%)
file103.83.86.22	XWorm botnet C2 server (confidence level: 75%)
file158.94.209.216	Remcos botnet C2 server (confidence level: 75%)
file45.154.98.168	XWorm botnet C2 server (confidence level: 75%)
file64.89.160.225	XWorm botnet C2 server (confidence level: 75%)
file154.91.56.99	VShell botnet C2 server (confidence level: 100%)
file154.91.56.98	VShell botnet C2 server (confidence level: 100%)
file154.91.58.101	VShell botnet C2 server (confidence level: 100%)
file154.91.58.100	VShell botnet C2 server (confidence level: 100%)

Hash

Value	Description	Copy
hash9035	Aisuru botnet C2 server (confidence level: 100%)
hash8080	Unknown Stealer botnet C2 server (confidence level: 100%)
hash80	Unknown Stealer botnet C2 server (confidence level: 100%)
hash443	Unknown Stealer botnet C2 server (confidence level: 100%)
hash12345	Aisuru botnet C2 server (confidence level: 100%)
hash9034	Aisuru botnet C2 server (confidence level: 100%)
hash34567	Aisuru botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8443	Cobalt Strike botnet C2 server (confidence level: 50%)
hash80	Cobalt Strike botnet C2 server (confidence level: 50%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash4444	AsyncRAT botnet C2 server (confidence level: 50%)
hash135	Unknown malware botnet C2 server (confidence level: 100%)
hash5986	Unknown malware botnet C2 server (confidence level: 100%)
hash80	Hook botnet C2 server (confidence level: 75%)
hash80	Mirai payload delivery server (confidence level: 75%)
hash11121	Unknown malware botnet C2 server (confidence level: 50%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash80	AsyncRAT botnet C2 server (confidence level: 100%)
hash1912	RedLine Stealer botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8080	Quasar RAT botnet C2 server (confidence level: 100%)
hash8808	Quasar RAT botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8443	Cobalt Strike botnet C2 server (confidence level: 75%)
hash23251	Cobalt Strike botnet C2 server (confidence level: 75%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash7890	Remcos botnet C2 server (confidence level: 100%)
hash8080	Aisuru botnet C2 server (confidence level: 100%)
hash13428	NjRAT botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash80	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8080	Unknown malware botnet C2 server (confidence level: 75%)
hash8041	Unknown RAT botnet C2 server (confidence level: 75%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash1012	XWorm botnet C2 server (confidence level: 75%)
hash443	PureLogs Stealer botnet C2 server (confidence level: 75%)
hash54321	XWorm botnet C2 server (confidence level: 75%)
hashcbabe6cb9fd822bb69b271c14952397b4d2a571d9e11e08c26312fad1b158163	Venus Stealer payload (confidence level: 95%)
hash638bb882ff0dba784ecc078c1792706983af0f91	Venus Stealer payload (confidence level: 95%)
hashee12bf94330dbbb5025aae8e1ec908a7	Venus Stealer payload (confidence level: 95%)
hasheac635e113733a48d63427369c5456b94ffe8075f447eb6e465157f08ab4c87b	Phantom Stealer payload (confidence level: 95%)
hashdddcb764f3af1265392641bbade3632b2f319ab0	Phantom Stealer payload (confidence level: 95%)
hash41c524a1390a872f207f17a08b443a72	Phantom Stealer payload (confidence level: 95%)
hashfc8f02c2dbb35322152f330c0b872bb71ea30d4a74472734531e60de9f2454ef	Phantom Stealer payload (confidence level: 95%)
hashce147e4941248647e59168df4e92e0331416aa0d	Phantom Stealer payload (confidence level: 95%)
hash7ea1ac9405b7ffcb6c087e3b65d1462a	Phantom Stealer payload (confidence level: 95%)
hashcc3417c2cdd3d0a9897528f1229f8649fa7313b348f887aba05173e6542b3e14	KrakenKeylogger payload (confidence level: 95%)
hash2078271033087b2eb6582ecebf7be4e57099fdaf	KrakenKeylogger payload (confidence level: 95%)
hashb7d29e94613df7d42bd2f882e77a3f85	KrakenKeylogger payload (confidence level: 95%)
hash54fced67df11a75293cb6620d57101aca7dea30fcafe9ff40df3626388328d9e	NjRAT payload (confidence level: 95%)
hash9ec707497613b9efae6a7af45a01a597e23b831e	NjRAT payload (confidence level: 95%)
hash30f23cd8c071deac110bbaa70e4260cc	NjRAT payload (confidence level: 95%)
hashf0ac5a212ee1e3acb68b27dfdd8e3b9f46be4d6d49ec0e843b2c0cb832145873	Creal Stealer payload (confidence level: 95%)
hashf03f8bf1cab0a3772864c37678ec54d411fa1ff3	Creal Stealer payload (confidence level: 95%)
hash90606f943f0360cda289735b31ef836f	Creal Stealer payload (confidence level: 95%)
hash7e6c18d1f36ea881e2029160438efad994040e41376e9b664858725523b659cd	Vidar payload (confidence level: 95%)
hash23a8e417188fa10923dce018a278f4abdecc139e	Vidar payload (confidence level: 95%)
hash03ff2eb2b1d54c66b7b8ee7ad84f13c6	Vidar payload (confidence level: 95%)
hashc92f2e4f8ebfa4a61f3b17663076cb8513f26bc60fbdbe6faea232f621b6e802	NjRAT payload (confidence level: 95%)
hash96add574a522e59eadea6ee8355f74a43c46f742	NjRAT payload (confidence level: 95%)
hash29d87ed8ebc9b05426800ad3c13a8fcd	NjRAT payload (confidence level: 95%)
hash67f1a3186b9c1e826ab34fb4c18a6a9c85bd5986e1214f80004c07c57cbfaa49	Vidar payload (confidence level: 95%)
hash39f1f47a0987b08dbd423eb5642163d97d541a66	Vidar payload (confidence level: 95%)
hash2004d8d9525445445121fb47bbbf4b00	Vidar payload (confidence level: 95%)
hashe9951dbc13b4fb5a2fe7b26783d8495131edf77b4028a8bebf25ed02beaa8b5b	Vidar payload (confidence level: 95%)
hash86ceedd043ce1327474de648f09ba993094f7835	Vidar payload (confidence level: 95%)
hash1e1d111b87fc523c8b46b13e0300bcc0	Vidar payload (confidence level: 95%)
hasha84bef9ffa7f4ee4c682a75f1d0480c8b5cd233e355b885b61ef4a52eaf65dfb	Venus Stealer payload (confidence level: 95%)
hash11397967c121f36edd2e894234627d68394b2e62	Venus Stealer payload (confidence level: 95%)
hashf4e051ee49a9559f6d71c7699226e3fb	Venus Stealer payload (confidence level: 95%)
hash953b808caf22274577e975b21404fcd2b69fb3e8ad266f175b100612305d5575	RedLine Stealer payload (confidence level: 95%)
hash2217b5efd0ba9f67a74fe95ac7fff491816f0ddf	RedLine Stealer payload (confidence level: 95%)
hash8c82f607f14980a6962993f8800cdf35	RedLine Stealer payload (confidence level: 95%)
hashe686c2dcffe94fb122df2e81debdab3e3a973c9a3bfcd06854d2a99dd5605cd0	Vidar payload (confidence level: 95%)
hash48509b8456af7e787b098b157746489f48213095	Vidar payload (confidence level: 95%)
hash3d305fab02241ac166687d9e3b1e1705	Vidar payload (confidence level: 95%)
hash5a24a5a7e387ec5de6d8fc95e5bf455efae511d0f981605b0b232c6f6260f5cb	Vidar payload (confidence level: 95%)
hash97d0345c41cd94e6c005ed7b03217bfcb351b5fe	Vidar payload (confidence level: 95%)
hash5e1e402e90339348be7a2a68b60f55e5	Vidar payload (confidence level: 95%)
hash863866fa9ffff1dd6e4d7bba34f127c9847e444078203fd2490a16fa08e91b92	Vidar payload (confidence level: 95%)
hash2477cbaf09aff57e538eb9a98ded675e23ca53a0	Vidar payload (confidence level: 95%)
hash2aad0c2944754979c4ea0b0d0461efed	Vidar payload (confidence level: 95%)
hash210ae656df91ca6fe5cca2c03f737716637537e6b8d9e0476bafc268ceb64c32	Formbook payload (confidence level: 95%)
hash0b3e8e11ac0aa3b88ea280af0b6625fabde3f8ad	Formbook payload (confidence level: 95%)
hash8594a6fe0265fa1629c16411f0fd3d77	Formbook payload (confidence level: 95%)
hash0960143403b7d6d8bbaed0f1652e83d6376c3cfe1fa6fe63b080b1fab97eb5a6	Venus Stealer payload (confidence level: 95%)
hash5983f394bdc9c2a191b5874a98cb736590ed5734	Venus Stealer payload (confidence level: 95%)
hashe728c199f2f1ad356fcbee25a5475c74	Venus Stealer payload (confidence level: 95%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8080	Cobalt Strike botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash443	AdaptixC2 botnet C2 server (confidence level: 100%)
hash80	AdaptixC2 botnet C2 server (confidence level: 100%)
hash8080	AdaptixC2 botnet C2 server (confidence level: 100%)
hash7707	AsyncRAT botnet C2 server (confidence level: 75%)
hash443	PureRAT botnet C2 server (confidence level: 75%)
hash443	PureRAT botnet C2 server (confidence level: 75%)
hash4444	AsyncRAT botnet C2 server (confidence level: 75%)
hash80	Brute Ratel C4 botnet C2 server (confidence level: 75%)
hash7707	AsyncRAT botnet C2 server (confidence level: 75%)
hash25729	AdaptixC2 botnet C2 server (confidence level: 75%)
hash4321	AdaptixC2 botnet C2 server (confidence level: 75%)
hash4321	AdaptixC2 botnet C2 server (confidence level: 75%)
hash7707	AsyncRAT botnet C2 server (confidence level: 75%)
hash8808	AsyncRAT botnet C2 server (confidence level: 75%)
hash8088	Unknown malware botnet C2 server (confidence level: 75%)
hash8080	DeimosC2 botnet C2 server (confidence level: 75%)
hash9000	Evilginx botnet C2 server (confidence level: 75%)
hash7707	AsyncRAT botnet C2 server (confidence level: 75%)
hash7707	AsyncRAT botnet C2 server (confidence level: 75%)
hash8081	BianLian botnet C2 server (confidence level: 75%)
hash3002	DCRat botnet C2 server (confidence level: 75%)
hash4321	AdaptixC2 botnet C2 server (confidence level: 75%)
hash7707	AsyncRAT botnet C2 server (confidence level: 75%)
hash8808	AsyncRAT botnet C2 server (confidence level: 75%)
hash65500	AdaptixC2 botnet C2 server (confidence level: 75%)
hash2002	AsyncRAT botnet C2 server (confidence level: 75%)
hash65432	AdaptixC2 botnet C2 server (confidence level: 75%)
hash443	Unknown malware botnet C2 server (confidence level: 75%)
hash8808	AsyncRAT botnet C2 server (confidence level: 75%)
hash443	PureRAT botnet C2 server (confidence level: 75%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8081	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash31896	Remcos botnet C2 server (confidence level: 100%)
hash8443	Aisuru botnet C2 server (confidence level: 100%)
hash4449	XWorm botnet C2 server (confidence level: 75%)
hash2026	Remcos botnet C2 server (confidence level: 75%)
hash8443	Aisuru botnet C2 server (confidence level: 100%)
hash8675	Remcos botnet C2 server (confidence level: 75%)
hash4001	XWorm botnet C2 server (confidence level: 75%)
hash1515	XWorm botnet C2 server (confidence level: 75%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash7000	XWorm botnet C2 server (confidence level: 75%)
hash7500	XWorm botnet C2 server (confidence level: 75%)
hash2404	Remcos botnet C2 server (confidence level: 75%)
hash9019	XWorm botnet C2 server (confidence level: 75%)
hash7001	XWorm botnet C2 server (confidence level: 75%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)
hash8074	VShell botnet C2 server (confidence level: 100%)

Url

Value	Description	Copy
urlhttps://vexxuhq.site/paths	Unknown Stealer botnet C2 (confidence level: 100%)
urlhttps://api.vexxuhq.site/send-embed	Unknown Stealer botnet C2 (confidence level: 100%)
urlhttps://api.vexxuhq.site/send-embed-viewer	Unknown Stealer botnet C2 (confidence level: 100%)
urlhttps://api.vexxuhq.site/download/	Unknown Stealer payload delivery URL (confidence level: 100%)
urlhttps://gunbuyerclub.com	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://notion-brown.com/4qx0lb/tm/oppe	Unknown malware payload delivery URL (confidence level: 80%)
urlhttp://178.198.246.24/photo.scr	Unknown malware payload delivery URL (confidence level: 85%)
urlhttp://177.70.102.232:8070/tmpftp/01/recep%c3%a7%c3%a3o/2022-09-05/info.zip	Unknown malware payload delivery URL (confidence level: 75%)
urlhttps://178.16.52.221/bin/screenconnect.clientsetup.exe	Unknown malware payload delivery URL (confidence level: 85%)
urlhttp://95.62.202.150:10071/sshd	Unknown malware payload delivery URL (confidence level: 85%)
urlhttp://103.20.213.34:8080/uploads/uploads/aryacorp%20delhi/backgrounds/info.zip	Unknown malware payload delivery URL (confidence level: 75%)
urlhttps://netstreamplus.com/get_verify	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://ssospace.net	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://netstreamplus.com/first_allow_host	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://csswaytech.net/js/all.min.js	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://netstreamplus.com/js/all.min.js	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://csswaytech.net/get_verify	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://ssospace.net/first_allow_host	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://logm-justia.com	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://ssospace.net/js/all.min.js	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://csswaytech.net/first_allow_host	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://ssospace.net/get_verify	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://thankful-cliff-01dfec010.7.azurestaticapps.net/adobe_updater%20.msi	Unknown malware payload delivery URL (confidence level: 85%)
urlhttps://toolshare.com.tr/files/jqqvlru0vaih3z.exe	Unknown malware payload delivery URL (confidence level: 85%)
urlhttps://okuneva.sbs/api/v1/session	KongTuke payload delivery URL (confidence level: 100%)
urlhttps://okuneva.sbs/api/v1/verify	KongTuke payload delivery URL (confidence level: 100%)
urlhttps://small-union-7018.daoahueb.workers.dev/	Unknown malware payload delivery URL (confidence level: 90%)
urlhttps://tweakz-dream-launcher.lovable.app/__l5e/assets-v1/f9eec8e0-95ce-4178-b709-6136c6e6321b/v4mp-tweakz-launcher.exe	xmrig payload delivery URL (confidence level: 95%)
urlhttps://cdn.jsdelivr.net/gh/anny11-34/progress-spoiling-dividable/overstay-derail-variety	ClearFake payload delivery URL (confidence level: 100%)
urlhttp://gofkaxz.click:8137/tokens	Remus botnet C2 (confidence level: 75%)
urlhttp://smaring.shop:9895/comments	Remus botnet C2 (confidence level: 75%)
urlhttp://trencts.shop:8592/payments	Remus botnet C2 (confidence level: 75%)
urlhttp://91.92.242.236/files-129312398/files/file_c0d2eb6a8b73120b.exe	Vidar payload delivery URL (confidence level: 100%)
urlhttp://91.92.242.236/files-129312398/files/file_b584670f7ec2f317.exe	Stealc payload delivery URL (confidence level: 95%)
urlhttp://uniqion.click:6929/events	Remus botnet C2 (confidence level: 75%)
urlhttp://bestals.shop:8592/settings	Remus botnet C2 (confidence level: 75%)
urlhttp://139.162.80.182/?h=139.162.80.182&p=80&t=tcp&a=l64&stage=true	SNOWLIGHT payload delivery URL (confidence level: 95%)
urlhttps://pub-5590b15da27f4f219811312b19a8df05.r2.dev/screenconnect.clientsetup.msi	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://104.253.74.209	Vidar botnet C2 (confidence level: 100%)
urlhttps://app.eduac.workers.dev/updateac	Unknown malware payload delivery URL (confidence level: 80%)
urlhttp://209.145.51.44/keepon.exe	XWorm payload delivery URL (confidence level: 100%)
urlhttp://86.109.75.162:8080/api/v1/checkin	Unknown malware botnet C2 (confidence level: 100%)
urlhttp://86.109.75.162:8080/api/v1/agent/ping	Unknown malware botnet C2 (confidence level: 100%)
urlhttp://86.109.75.162:8080/api/v1/agent/tasks	Unknown malware botnet C2 (confidence level: 100%)
urlhttp://neortal.click:8321/settings	Remus botnet C2 (confidence level: 75%)
urlhttp://101.53.225.68:48653/mozi.7	Mozi payload delivery URL (confidence level: 75%)
urlhttp://31.220.3.140/ri/la.bot.mips	Mirai payload delivery URL (confidence level: 100%)
urlhttp://103.226.249.227:86/info.zip	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://102.212.61.41:8026/sshd	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://45.141.148.134:2002/aymxbq	Unknown RAT botnet C2 (confidence level: 75%)
urlhttps://login.v-panel.asia/	Vidar botnet C2 (confidence level: 100%)
urlhttp://117.240.155.245:30270/sshd	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://mysura.it/njtzac0.tar	Dridex payload delivery URL (confidence level: 100%)
urlhttps://nexusatlas-c74.pages.dev/apps/instalador.zip	Unknown malware payload delivery URL (confidence level: 75%)
urlhttp://139.95.24.51:8081/?h=139.95.24.51&p=8081&t=tcp&a=w64&stage=true	Rozena payload delivery URL (confidence level: 95%)
urlhttps://update-microsoft-data.services	Stealc botnet C2 (confidence level: 75%)
urlhttps://cloud-flare-authenticator.click	Stealc botnet C2 (confidence level: 75%)
urlhttp://beautynams.com/nweke/fre.php	Loki Password Stealer (PWS) botnet C2 (confidence level: 100%)
urlhttp://zream.shop:5728/products	Remus botnet C2 (confidence level: 75%)
urlhttp://139.162.80.182/?h=139.162.80.182&p=80&t=tcp&a=l32&stage=true	SNOWLIGHT payload delivery URL (confidence level: 95%)
urlhttp://134.122.177.37:8084/?h=134.122.177.37&p=8084&t=tcp&a=l32&stage=true	SNOWLIGHT payload delivery URL (confidence level: 95%)
urlhttps://raw.githubusercontent.com/cowenrty/issue/refs/heads/main/left	ClearFake payload delivery URL (confidence level: 100%)
urlhttp://132.247.103.239/video.scr	Unknown malware payload delivery URL (confidence level: 100%)

Domain

Value	Description	Copy
domainapi.vexxuhq.site	Unknown Stealer botnet C2 domain (confidence level: 100%)
domainlogm-justia.com	Unknown malware payload delivery domain (confidence level: 80%)
domainssospace.net	Unknown malware payload delivery domain (confidence level: 80%)
domainnetstreamplus.com	Unknown malware payload delivery domain (confidence level: 80%)
domaincsswaytech.net	Unknown malware payload delivery domain (confidence level: 80%)
domainokuneva.sbs	KongTuke payload delivery domain (confidence level: 100%)
domainregions.globalcargonetwork.com	FAKEUPDATES botnet C2 domain (confidence level: 100%)
domainbociljp.uk.com	ClearFake payload delivery domain (confidence level: 100%)
domaindigitaltechparis.com	ClearFake payload delivery domain (confidence level: 100%)
domainyzegs5gy.digitaltechparis.com	ClearFake payload delivery domain (confidence level: 100%)
domainwiro88.blog	ClearFake payload delivery domain (confidence level: 100%)
domainct692p3y.wiro88.blog	ClearFake payload delivery domain (confidence level: 100%)
domainkujoe31070.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainfykecyjo.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainmi6.operationanonrecoil.ru	Unknown Stealer botnet C2 domain (confidence level: 75%)
domainwww.mandysmission.net	ClearFake payload delivery domain (confidence level: 90%)
domainmbarkitravel.com	ClearFake payload delivery domain (confidence level: 90%)
domainmanupinc.org	ClearFake payload delivery domain (confidence level: 90%)
domainimogenarmed.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainla-fenetre.com	ClearFake payload delivery domain (confidence level: 90%)
domainjykivamo.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainmegamidiace.com	ClearFake payload delivery domain (confidence level: 90%)
domainmedlabglobal.com	ClearFake payload delivery domain (confidence level: 90%)
domainmodderguys.com	ClearFake payload delivery domain (confidence level: 90%)
domainwiro88game.it.com	ClearFake payload delivery domain (confidence level: 100%)
domainbrandglobalbd.com	ClearFake payload delivery domain (confidence level: 90%)
domainmirhattire.com	ClearFake payload delivery domain (confidence level: 90%)
domainwww.metallerie.paris	ClearFake payload delivery domain (confidence level: 90%)
domainmike-leder.de	ClearFake payload delivery domain (confidence level: 90%)
domainbestduilawyerva.com	ClearFake payload delivery domain (confidence level: 90%)
domainsaidaco.com	ClearFake payload delivery domain (confidence level: 90%)
domainhomestaycahayasikunir.com	ClearFake payload delivery domain (confidence level: 100%)
domaintqr5nttr.homestaycahayasikunir.com	ClearFake payload delivery domain (confidence level: 100%)
domainclinicadentalbroseta.com	ClearFake payload delivery domain (confidence level: 90%)
domainwww.morvarid-plastic.com	ClearFake payload delivery domain (confidence level: 90%)
domainmookes.nl	ClearFake payload delivery domain (confidence level: 90%)
domainwww.xn--90ai3bcalp.su	ClearFake payload delivery domain (confidence level: 90%)
domainwww.mpcfoundation.nl	ClearFake payload delivery domain (confidence level: 90%)
domainmpotofoundation.org	ClearFake payload delivery domain (confidence level: 90%)
domainclaudiosouza.com	ClearFake payload delivery domain (confidence level: 90%)
domainmiraco.com.vn	ClearFake payload delivery domain (confidence level: 90%)
domainarcona.pl	ClearFake payload delivery domain (confidence level: 90%)
domainmijnvirtueelassistent.be	ClearFake payload delivery domain (confidence level: 90%)
domaingasgas.sagamoove.com.br	ClearFake payload delivery domain (confidence level: 90%)
domainelegantthemesflywheel.com	ClearFake payload delivery domain (confidence level: 90%)
domainluminica.com.mx	ClearFake payload delivery domain (confidence level: 90%)
domainblein.benoit.rodezinfocom.fr	ClearFake payload delivery domain (confidence level: 90%)
domainasteroidesproductions.com	ClearFake payload delivery domain (confidence level: 90%)
domainmainge.pe	ClearFake payload delivery domain (confidence level: 90%)
domainbiorado.pro	ClearFake payload delivery domain (confidence level: 90%)
domainmoralesmorvel.com	ClearFake payload delivery domain (confidence level: 90%)
domainmsvoterguide.com	ClearFake payload delivery domain (confidence level: 90%)
domainmorkshabitat.com	ClearFake payload delivery domain (confidence level: 90%)
domainkaystreasures.biz	ClearFake payload delivery domain (confidence level: 90%)
domainbookeyz.com	ClearFake payload delivery domain (confidence level: 90%)
domainmechasolusindo.com	ClearFake payload delivery domain (confidence level: 90%)
domainmezamie.com	ClearFake payload delivery domain (confidence level: 90%)
domainpremierurgentcarela.com	ClearFake payload delivery domain (confidence level: 90%)
domainmagnetyourevent.com	ClearFake payload delivery domain (confidence level: 90%)
domaincguuniforms.org	ClearFake payload delivery domain (confidence level: 90%)
domainlocksmith-romo.com	ClearFake payload delivery domain (confidence level: 90%)
domainlr-blanchisserie-champenoise.fr	ClearFake payload delivery domain (confidence level: 90%)
domainlivingwordpublications.in	ClearFake payload delivery domain (confidence level: 90%)
domainlucienebata.com	ClearFake payload delivery domain (confidence level: 90%)
domaine-rse.fit	ClearFake payload delivery domain (confidence level: 100%)
domain74br4nt0.e-rse.fit	ClearFake payload delivery domain (confidence level: 100%)
domainwarenwerk.ch	ClearFake payload delivery domain (confidence level: 90%)
domaindorfpraxis-rueschlikon.ch	ClearFake payload delivery domain (confidence level: 90%)
domain5nrkm0ei2e.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainxer0a002po.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainbrycecanyonlogcabins.com	ClearFake payload delivery domain (confidence level: 100%)
domainiocdesignconsulting.com	ClearFake payload delivery domain (confidence level: 90%)
domainmultiespacio.es	ClearFake payload delivery domain (confidence level: 90%)
domainmyfacts.eu	ClearFake payload delivery domain (confidence level: 90%)
domaindeltacolo.com	ClearFake payload delivery domain (confidence level: 90%)
domainojyh0s8b.brycecanyonlogcabins.com	ClearFake payload delivery domain (confidence level: 100%)
domainmultilocktiles.co.za	ClearFake payload delivery domain (confidence level: 90%)
domainwww.mysteriesmusical.com	ClearFake payload delivery domain (confidence level: 90%)
domaindreamsstoriesbd.com	ClearFake payload delivery domain (confidence level: 90%)
domainydns.shop	ClearFake payload delivery domain (confidence level: 100%)
domain8otqtzmy.ydns.shop	ClearFake payload delivery domain (confidence level: 100%)
domaintruspanel.com	Unknown RAT botnet C2 domain (confidence level: 100%)
domainfriendsstack.cfd	Unknown Loader botnet C2 domain (confidence level: 100%)
domainescoladeemagrecimento.com	ClearFake payload delivery domain (confidence level: 90%)
domainnatureelitehealth.online	ClearFake payload delivery domain (confidence level: 90%)
domainelimargomes.com.br	ClearFake payload delivery domain (confidence level: 90%)
domainequiscoperes.com	ClearFake payload delivery domain (confidence level: 90%)
domainenlineard.net	ClearFake payload delivery domain (confidence level: 90%)
domainwww.navarriniarchitetti.it	ClearFake payload delivery domain (confidence level: 90%)
domaindinaly.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainblwcg81617.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainnewpurpose.org	ClearFake payload delivery domain (confidence level: 90%)
domaingoodlong.life	ClearFake payload delivery domain (confidence level: 90%)
domainnhakhoatandinh.com	ClearFake payload delivery domain (confidence level: 90%)
domainjl4wdm8i.bobatouch.com	ClearFake payload delivery domain (confidence level: 100%)
domainwww.nyclimopass.com	ClearFake payload delivery domain (confidence level: 90%)
domainnorthlondonmobiletyrefitting.co.uk	ClearFake payload delivery domain (confidence level: 90%)
domainwww.novahelixlabs.com	ClearFake payload delivery domain (confidence level: 90%)
domainnovaairsolutions.com	ClearFake payload delivery domain (confidence level: 90%)
domainnucosolutions.co.uk	ClearFake payload delivery domain (confidence level: 90%)
domainducave.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainp8czohl7nq.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainby1r8hqk.us-eng-zensulin.com	ClearFake payload delivery domain (confidence level: 100%)
domain73x4a00h.us-us-us-zensulin.com	ClearFake payload delivery domain (confidence level: 100%)
domainlogin.v-panel.asia	Vidar botnet C2 domain (confidence level: 100%)
domainopenmundi.com.br	ClearFake payload delivery domain (confidence level: 90%)
domainomumedia.co.id	ClearFake payload delivery domain (confidence level: 90%)
domainkidderporecollege.in	ClearFake payload delivery domain (confidence level: 90%)
domainkendalfortson.com	ClearFake payload delivery domain (confidence level: 90%)
domainbdidap9p.borderlinelakewood.com	ClearFake payload delivery domain (confidence level: 100%)
domainpoxizu.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainjolymeza.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainlazycatagency.com	ClearFake payload delivery domain (confidence level: 90%)
domainmariafinch.com	ClearFake payload delivery domain (confidence level: 90%)
domainortodoncia-invisible-valencia.com	ClearFake payload delivery domain (confidence level: 90%)
domainpaintmyparkinglot.com	ClearFake payload delivery domain (confidence level: 90%)
domainlooseningcaptivesblog.com	ClearFake payload delivery domain (confidence level: 90%)
domainlinuxbazar.com	ClearFake payload delivery domain (confidence level: 90%)
domains0ls07nv.www-genesisrevival.com	ClearFake payload delivery domain (confidence level: 100%)
domainwindowsupgrade.3utilities.com	XWorm botnet C2 domain (confidence level: 75%)
domainu6ytrewqgrfewdmmmjhfjpooiuyhgghfdsaokjbn.duckdns.org	Remcos botnet C2 domain (confidence level: 75%)
domainnanohaarpigmentierung.de	ClearFake payload delivery domain (confidence level: 90%)
domainpascalcossu.com	ClearFake payload delivery domain (confidence level: 90%)
domainpeluqueriainesgarcia.es	ClearFake payload delivery domain (confidence level: 90%)
domainnakhlatee.com	ClearFake payload delivery domain (confidence level: 90%)
domainmihajskam.serveminecraft.net	Remcos botnet C2 domain (confidence level: 75%)
domaincns.grotominpgroup.pl	Quasar RAT botnet C2 domain (confidence level: 75%)
domainsns.grotominpgroup.pl	Quasar RAT botnet C2 domain (confidence level: 75%)
domainphanxwodm.duckdns.org	XWorm botnet C2 domain (confidence level: 75%)
domainbtobglobal.com	ClearFake payload delivery domain (confidence level: 100%)
domainllny16fk.btobglobal.com	ClearFake payload delivery domain (confidence level: 100%)
domaintifomoqa.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domaincrimsonroundel.info	SmartApeSG payload delivery domain (confidence level: 100%)
domainbapele.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainpmcimpianti.com	ClearFake payload delivery domain (confidence level: 90%)
domainptkevrodor.ru	ClearFake payload delivery domain (confidence level: 90%)
domainpormudanza.com	ClearFake payload delivery domain (confidence level: 90%)
domainramonetage.ovh	ClearFake payload delivery domain (confidence level: 90%)
domainplayfreeonline32.com	ClearFake payload delivery domain (confidence level: 90%)
domainqalbbyam.com	ClearFake payload delivery domain (confidence level: 90%)
domainprincecables.com	ClearFake payload delivery domain (confidence level: 90%)
domainplantwatergrow.org	ClearFake payload delivery domain (confidence level: 90%)
domainquicksilvercleaning.ca	ClearFake payload delivery domain (confidence level: 90%)
domainpilotmonkeys.com	ClearFake payload delivery domain (confidence level: 90%)
domainponpesinayatullah.com	ClearFake payload delivery domain (confidence level: 90%)
domaindrift-phantom.cc	Unknown Stealer botnet C2 domain (confidence level: 100%)

Threat ID: 6aa34bf091cc7f384805f97f

Added to database: 09/11/2026, 00:31:44 UTC

Last updated: 09/11/2026, 00:31:44 UTC

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by

Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

Please log in to the Console to use AI analysis features.

External Links

Search on Google

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now

OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited

View courses

ThreatFox IOCs for 2026-09-10

Indicators of Compromise

ThreatFox IOCs for 2026-09-10

Description

Technical Details

Indicators of Compromise

File

Hash

Url

Domain

Community Reviews

Related Threats

Mantax Otax: Indonesian Mobile Ransomware with Spyware Integration

Malicious Chrome and Firefox Extensions Steal Crypto Traders' Session and Wallet Data

Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence

Grand Theft Auto VI hype leads to malware

Vwork: Weaponized Open-source Software as an Addon for Gigabud

Actions

External Links

Need more coverage?

Latest Threats

Check if your credentials are on the dark web

Lead Pen Test Professional