Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-09-13

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 131

  • bosskayseri.storeClearFake payload delivery domain (confidence level: 100%)
  • miqmh80v.bosskayseri.storeClearFake payload delivery domain (confidence level: 100%)
  • ghadi.storeClearFake payload delivery domain (confidence level: 100%)
  • mard.storeClearFake payload delivery domain (confidence level: 100%)
  • omec.storeClearFake payload delivery domain (confidence level: 100%)
  • uhtu2p9o.ghadi.storeClearFake payload delivery domain (confidence level: 100%)
  • omckf2vc.omec.storeClearFake payload delivery domain (confidence level: 100%)
  • u2dqx82e.mard.storeClearFake payload delivery domain (confidence level: 100%)
  • bomyhego.workers.devphp.shin_webshell botnet C2 domain (confidence level: 50%)
  • ue4dgglt0t.workers.devphp.shin_webshell botnet C2 domain (confidence level: 50%)

URLs 56

  • http://72.255.26.37:45994/mozi.mMozi payload delivery URL (confidence level: 75%)
  • http://teculse.click:9210/notificationsRemus botnet C2 (confidence level: 75%)
  • http://arqtsop.shop:9932/webhooksRemus botnet C2 (confidence level: 75%)
  • http://115.55.144.250:57502/mozi.7Mozi payload delivery URL (confidence level: 75%)
  • http://139.135.41.164:40894/mozi.mMozi payload delivery URL (confidence level: 75%)
  • http://arqtsop.shop:9932/invoicesRemus botnet C2 (confidence level: 75%)
  • http://trwehop.shop:5627/profilesRemus botnet C2 (confidence level: 75%)
  • http://teechop.shop:8213/reviewsRemus botnet C2 (confidence level: 75%)
  • http://gofkaxz.click:8137/tagsRemus botnet C2 (confidence level: 75%)
  • http://trwehop.shop:5627/tagsRemus botnet C2 (confidence level: 75%)

IP addresses 106

  • 165.227.142.229Aisuru botnet C2 server (confidence level: 100%)
  • 64.225.107.48Aisuru botnet C2 server (confidence level: 100%)
  • 209.38.225.90Aisuru botnet C2 server (confidence level: 100%)
  • 38.76.190.209Cobalt Strike botnet C2 server (confidence level: 100%)
  • 38.76.190.209Cobalt Strike botnet C2 server (confidence level: 100%)
  • 38.76.190.209Cobalt Strike botnet C2 server (confidence level: 100%)
  • 38.76.190.209Cobalt Strike botnet C2 server (confidence level: 100%)
  • 189.24.79.40Cobalt Strike botnet C2 server (confidence level: 50%)
  • 154.46.30.12Havoc botnet C2 server (confidence level: 100%)
  • 156.254.20.46Cobalt Strike botnet C2 server (confidence level: 50%)

Hashes 101

  • f6a89afd80bcfccc8ade155c0ef92a770de44610efdcac2b6a21650dc136dca5Unknown Loader payload (confidence level: 95%)
  • 463e71c114d5db041a864d58b729b4e38e2a285fa5edd92116a028ec83255cf9Unknown Loader payload (confidence level: 95%)
  • 156e06516c508cd609f3656d2b13786b0273598500018664e13861c43e5426bdUnknown Loader payload (confidence level: 95%)
  • 4e4d0871610d78af5a83f953922d678d75f5ca1b3e2720d4603231e3ed74349fMirai payload (confidence level: 100%)
  • 4a2e34ffd5ff1f0d0cdaa2db74b8cec724c4b1a6375cb1f8eebd982d98f1fbe5Mirai payload (confidence level: 100%)
  • 3e64858dced7a1eea58505529e3cd3183cd60697e160af45b8f44acb3469657aMirai payload (confidence level: 100%)
  • fea2567c15cfa36d7a159525519358c255d73330bd0f9304f2c9557eee002c0cMirai payload (confidence level: 100%)
  • d2b5a8abdd33271500c062dae49ea54272ea64da77569d413091bf7209bb6bdeMirai payload (confidence level: 100%)
  • 0f9f3634949e0632da172e33c8a63172cfe4feba72f38020d6a1b7bffda21ae0Mirai payload (confidence level: 100%)
  • 3f5acbdfe7861fb5b193691c38de3a023c9ee7473fb0debd69e134a9a45fe421Mirai payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-09-13

Community reviews

Loading reviews…