Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-09-14

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 103

  • mesa-seen-dcjcj.liveAMOS botnet C2 domain (confidence level: 100%)
  • hashedsolver.icuIClickFix botnet C2 domain (confidence level: 100%)
  • lambertconsultinggroup.comClearFake payload delivery domain (confidence level: 100%)
  • fkoigx5czu.workers.devphp.shin_webshell botnet C2 domain (confidence level: 50%)
  • cevahine.workers.devphp.shin_webshell botnet C2 domain (confidence level: 50%)
  • www.amksport.comClearFake payload delivery domain (confidence level: 90%)
  • berare.storeClearFake payload delivery domain (confidence level: 100%)
  • verbierlanguageschool.comClearFake payload delivery domain (confidence level: 90%)
  • remoteteambuild.comClearFake payload delivery domain (confidence level: 90%)
  • kqua.storeClearFake payload delivery domain (confidence level: 100%)

URLs 72

  • https://mesa-seen-dcjcj.live/t.js?site=7093522930402530c9179116cdc07ecaIClickFix payload delivery URL (confidence level: 75%)
  • https://hashedsolver.icu/site-monitor-checkbox.jsIClickFix payload delivery URL (confidence level: 100%)
  • https://stepbysteppi9.life/t.188cfd3975db.jsIClickFix payload delivery URL (confidence level: 100%)
  • https://patzcuaro.gob.mxIClickFix payload delivery URL (confidence level: 100%)
  • https://she-explores.comIClickFix payload delivery URL (confidence level: 100%)
  • https://mathland.grIClickFix payload delivery URL (confidence level: 100%)
  • https://fotolateras.comIClickFix payload delivery URL (confidence level: 100%)
  • https://cdn.jsdelivr.net/gh/orcall7634/a0-95-49c5c-a790-2c-17-a137ec/902c17ClearFake payload delivery URL (confidence level: 100%)
  • https://cdn.jsdelivr.net/gh/19875567137/fccc8f-62-3c-61d48-4e/80-7314ClearFake payload delivery URL (confidence level: 100%)
  • https://workerstats.net/downloadables/configf.jsonUnknown malware botnet C2 (confidence level: 100%)

IP addresses 137

  • 167.172.147.77Aisuru botnet C2 server (confidence level: 100%)
  • 49.233.70.168VShell botnet C2 server (confidence level: 100%)
  • 8.163.10.60VShell botnet C2 server (confidence level: 100%)
  • 47.108.225.4VShell botnet C2 server (confidence level: 100%)
  • 120.27.228.231VShell botnet C2 server (confidence level: 100%)
  • 187.101.57.177NjRAT botnet C2 server (confidence level: 100%)
  • 47.81.57.227Cobalt Strike botnet C2 server (confidence level: 50%)
  • 198.13.158.57Havoc botnet C2 server (confidence level: 100%)
  • 23.94.53.109Unknown malware botnet C2 server (confidence level: 100%)
  • 83.229.123.249Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 52

  • 994b914dc77a84a9adbe5ba1c49cd6bab320924c4d0938134d5c47ce9cedee8bVShell payload (confidence level: 95%)
  • c66e9d85ddd7bb98a60b1823e1cc7cb27035da727744c03735317f2106da80e8VShell payload (confidence level: 95%)
  • fc04b7b1134f7c2f1d7e9fb71294d9c623e4c5455284ceb562af3b22b06fb0d0VShell payload (confidence level: 95%)
  • 9c013b9a4f2568f88e075dd3bcbee8c8fcf468b0a99d51c167d54806600fc633VShell payload (confidence level: 95%)
  • 1dc1f5d8863e2f4d6105a47e6aa11428668c9c604b3c55247e2bce376bdd5724AdaptixC2 payload (confidence level: 100%)
  • 804111c64e49ef400093f53e16f65a8607de9489e1d052c2e6bdda2cfa7fcf77VShell payload (confidence level: 95%)
  • 33808f4224a8260786123b1a662fbf6fef738031e03c6b47128c64f125e68f8bVShell payload (confidence level: 95%)
  • 2155ee0755c0daa58c70d6532db297aa06c473a3779617e56bc154da2974524eVShell payload (confidence level: 95%)
  • 27bcc30e9cb698c20bed734237dc3d929c34c70415ab79b90610ac698d768bf0VShell payload (confidence level: 95%)
  • 4c9dfdcf21998d5012eb939188ff8cd02e34d9b4ca6cc2ad477b17b333ba0553Unknown Loader payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-09-14

Community reviews

Loading reviews…