ThreatFox IOCs for 2026-09-16

Severity: mediumType: Malware

AI Analysis

Technical Summary

The data represents a collection of threat intelligence indicators (IOCs) published by ThreatFox on 2026-09-16. The information pertains to malware-related network activity and payload delivery but lacks detailed technical specifics or identified vulnerabilities. No known exploits or patches are associated with this report.

Potential Impact

The report does not specify any direct impact or affected software. It serves as an intelligence feed to aid detection and response to potential malware threats based on observed indicators.

Mitigation Recommendations

No patch or direct remediation is available or applicable. Security teams should leverage the provided IOCs within their detection tools to identify and mitigate potential threats. No urgent action is indicated by the source.

Indicators of Compromise

file: 46.101.169.198
hash: 8443
url: https://104.253.18.206
url: https://time.austriaeast.cloudapp.azure.com
url: https://timesync.westus2.cloudapp.azure.com
url: https://zigbee.eastus.cloudapp.azure.com
url: https://zigfree.eastus.cloudapp.azure.com
domain: time.austriaeast.cloudapp.azure.com
domain: timesync.westus2.cloudapp.azure.com
domain: zigbee.eastus.cloudapp.azure.com
domain: zigfree.eastus.cloudapp.azure.com
url: https://welcome.v-panel.asia/
domain: welcome.v-panel.asia
file: 204.44.69.231
hash: 14642
file: 204.44.69.231
hash: 14644
file: 204.44.69.231
hash: 14646
domain: isomnia.pl
url: https://217.60.98.234
domain: babullies.live
domain: nelson47.com
domain: jackiewhitfield.com
domain: mrsls88.com
domain: bjfox2005.com
domain: babullies.app
domain: krisannly.com
url: https://statpipeplus.com/get_verify
domain: statpipeplus.com
domain: tracewaytech.com
domain: ingestdot.net
url: https://ingestdot.net
url: https://tracewaytech.com/get_verify
url: https://ingestdot.net/first_allow_host
url: https://tracewaytech.com/first_allow_host
domain: pacer-gov.com
url: https://ingestdot.net/get_verify
url: https://ingestdot.net/js/all.min.js
url: https://tracewaytech.com/js/all.min.js
url: https://pacer-gov.com
url: https://statpipeplus.com/js/all.min.js
url: https://statpipeplus.com/first_allow_host
file: 123.60.142.164
hash: 443
file: 123.60.142.164
hash: 80
file: 123.60.142.164
hash: 8081
domain: geveby.workers.dev
url: http://36.255.33.120:57274/mozi.m
hash: ec9d65250ddb2195103381f7662ab1d370bbb84aee2b35384ffd4bb69d28177b
hash: d3bcbb06dfb6f58c7a2d895ea75a2fd72226f1ac
hash: 0d22029ef7b53677ce81e46aa38be8bd
hash: ea8e565ccaf2d39932858c6156819e2fa23eb23a7aa06f2c1d3ae33c0ad68718
hash: e8ccaf9da9ffb15c251916b8b453bb519c3d8558
hash: e37fc2c689b56a5d66076c335cce334a
hash: 6659054e7fdce5a34a040bd0c730db06ceda0a72b3c6d75dc4a17de3fdc19d2c
hash: c936f817a52a88caac0dd89c51668ff35ea8f647
hash: b99701d7d09a46bbd40fc1b778c751fe
hash: e9d7cf3afe8cf7cbf806e39ce528648ea9bb5aa64b0d1b2fc4d2ec3fe92f294b
hash: 7189c7340ef88751d5abb922a859283cb1d43126
hash: 754c6de7387dc7c44dbd765d82658d4e
hash: f9b504f0c27ae366d420f81dbcb0a7042ec52c43ac0a025da6d76aa9eb0fa2f5
hash: 69335fbf9537c737b86468dd710149e4a525e098
hash: 61d2dcf9fe9e9b0809f33c894cd91d50
hash: 7ec3efbb778bf3151bcc92213aef6f7b789569978eaf7beda4b79e47f26dc7ac
hash: 1c6fe66d5fd5a1ce55a7bea5b85b69789b527ebb
hash: 00a5a0110d71b31d9d1a5bc45ffd60e2
hash: 11706cd85085e2c69d5b5067fb20d448ed5c7ec665a16063d5e6348add2a2e70
hash: d0852d3c2b7067886bfb9d96623d6dd078eee772
hash: a43e97db7261b728db28feeb43c32421
hash: d76f7b5a55ef8f6db63f62a3e83646d57d50677267ab316909122b2ae716eb90
hash: c4ec1fdfbb4906014c279483b2478baf263134a3
hash: ea3d8bf23d059bf3e626583045dd48a0
hash: bae4f4322d4c215be01990ad77275474f829ed7b3731703ed07946ab9d041413
hash: b5abd48cdb1d3f97418047505d5a32e03e694fe5
hash: 2a85f2e5876b278a7af9393483de455b
hash: ddda27525522dba74f3b356b6a3d29b8baac2c00ed826c2b505ffa2bc16347be
hash: 154f2a6b32a5840ad0da8ca7f26a140dea5c62ca
hash: 4acdad3a642ca279d268f9bc225ac56e
hash: 744437d93633c87382f9d1a1fdf0c1a3a908c5f9e0435bb480771dbdc0282fae
hash: a51a18b3908126f1f1c11895e92c1d65230903be
hash: 895e427449556e15d357670e9e499dcb
hash: f65d4ddf2d769eb6dd9cc7021845458f7cb49be01f1859328f62407924a7d7ac
hash: 55e33706f57108668e2de1d108085d4b897c2a08
hash: 9fdb24226fb9c26e2032d51e503d9314
url: http://teculse.click:9210/files
url: http://spiohop.shop:9932/events
url: http://cruahop.shop:8213/accounts
url: https://84.200.125.134
file: 156.239.224.131
hash: 80
file: 42.193.227.214
hash: 1002
file: 123.60.142.164
hash: 8080
file: 168.245.203.109
hash: 3790
file: 123.60.142.164
hash: 8082
file: 5.104.86.108
hash: 8890
domain: me23z6yn.reneck.store
hash: 9b1d38cd728ec1a478db668e86f7445ab5f0335b388feefc15502931cdcad704
domain: 91cwlqu1.enus-theeloncode.com
domain: ggao4r0b.omars.store
url: https://id.qq1x.org
domain: e78gueny09.workers.dev
domain: id.177betwin.org
url: https://id.177betwin.org/
domain: id.qq1x.org
domain: luzygapi.workers.dev
file: 45.77.68.157
hash: 7289
file: 134.209.223.192
hash: 9034
file: 111.228.26.26
hash: 7777
file: 175.43.223.203
hash: 7443
file: 172.245.136.97
hash: 1000
file: 129.204.196.251
hash: 2222
domain: f6gn33i6.mard.store
url: http://spiohop.shop:9932/profiles
url: http://cruahop.shop:8213/images
domain: xtvaj64i.enus-zensulin.com
domain: nahoxale.workers.dev
domain: mywixely.workers.dev
file: 42.193.239.217
hash: 443
file: 45.61.170.191
hash: 443
file: 45.61.170.191
hash: 80
file: 45.76.191.22
hash: 443
file: 45.76.191.22
hash: 80
file: 45.76.191.22
hash: 8080
file: 120.53.19.157
hash: 80
file: 18.228.80.130
hash: 80
url: http://teculse.click:9210/documents
url: http://spiohop.shop:9932/orders
url: http://booohop.shop:5627/images
url: http://teculse.click:9210/webhooks
url: http://booohop.shop:5627/categories
file: 120.53.19.157
hash: 8080
file: 45.61.170.191
hash: 8080
file: 47.109.23.77
hash: 65530
domain: fafawisma.com
domain: mudefilo.workers.dev
domain: l9bwp7kn.farmf.store
hash: 1a0c3d520e16ae12ffa918032e608f573b716f009a05c35f64b53f128bf7376d
hash: 28f83470b477e89081c08772af0470c6e841cc01c6bef4472f3b8eed47f852ce
domain: fiqacigi.workers.dev
url: https://ww.qq1x.org
domain: ww.177betwin.org
url: https://ww.177betwin.org/
domain: ww.qq1x.org
url: https://cdn.jsdelivr.net/gh/19875567137/4756211933kfd/hdfe847299432
domain: fufuwisma.com
file: 202.61.85.168
hash: 7811
file: 202.61.85.168
hash: 7800
file: 207.89.17.5
hash: 3389
domain: tftp2.sh
url: http://153.117.13.0:59969/mozi.a
url: http://59.103.100.4:41691/mozi.m
url: http://153.117.55.4:52319/mozi.m
url: http://223.123.41.70:38519/mozi.m
url: http://153.117.32.196:50508/mozi.m
domain: royar.store
domain: ega6j3lp.royar.store
file: 202.61.85.153
hash: 7811
file: 202.61.85.153
hash: 7800
domain: yewanthology.co
domain: v6sjo9pv.omec.store
url: https://casagrooming.com.co/
url: https://sohoul-alkarak.com/
url: https://gesundheitsnachweis24.de/
url: https://sarialarm.com/
domain: 65ey0xwrct.workers.dev
file: 8.146.227.247
hash: 8082
file: 207.89.17.5
hash: 22
file: 207.89.17.5
hash: 5901
domain: lefahe.workers.dev
url: http://spiohop.shop:9932/settings
url: http://booohop.shop:5627/articles
hash: afd47ef7378e573c8e575b2030355a2b65a888bdaf56c00a1e6f8e5dc980e7e5
domain: occidentalconstruction.com
domain: labioforneria.ch
domain: eqngjv6s.moltem.store
domain: s6qvly4b.fews.store
domain: gesundheitsnachweis24.de
url: http://booohop.shop:5627/projects
file: 47.98.124.244
hash: 80
file: 144.225.246.14
hash: 443
file: 144.225.246.14
hash: 80
file: 47.243.191.83
hash: 88
file: 114.215.190.164
hash: 8085
file: 123.60.142.164
hash: 8084
file: 124.221.92.3
hash: 9999
file: 47.239.223.39
hash: 8123
url: https://5.9.73.173/
url: https://46.29.26.67/
url: https://2.28.34.186/
url: https://167.233.139.3/
file: 5.9.73.173
hash: 443
file: 46.29.26.67
hash: 443
file: 2.28.34.186
hash: 443
file: 167.233.139.3
hash: 443
domain: rerrioara.live
file: 178.128.253.92
hash: 80
domain: awv389zkti.workers.dev
domain: hhemb35077.workers.dev
url: http://teculse.click:9210/accounts
url: http://spiohop.shop:9932/collections
url: http://cruahop.shop:8213/profiles
hash: 5f109e7bb3df4dea81946f2f853da288
hash: 87b76a60ba7c474dbf8f689df2808e1a
hash: f9e95a1e1fa3f3aebfc802c6c8e6a2eb
hash: 106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42
hash: 170dffb37e05f525f735bc9ad84b3908a488f7ce43fcb07739a10e4331e15a2c
hash: 223be3f8648bf6998c4a58b972522e5fda8d9d0a57b4e163811930de66c3f7ca
hash: 5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552
hash: ba80216c960977fa45e317f00dcf31e96acab29904a737cbc0bf86e929c3be5f
hash: c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268
file: 164.92.207.173
hash: 8080
file: 125.75.36.126
hash: 9090
file: 125.75.36.126
hash: 8080
file: 125.75.36.126
hash: 28120
domain: kvoxeozq.ghadi.store
file: 102.220.160.198
hash: 56003
file: 102.220.163.36
hash: 7006
file: 121.200.216.74
hash: 443
file: 139.180.153.29
hash: 443
file: 144.91.78.57
hash: 443
file: 154.36.161.180
hash: 443
file: 94.154.43.217
hash: 11121
file: 172.86.112.104
hash: 7707
file: 172.86.112.104
hash: 8808
file: 172.94.18.103
hash: 74
file: 206.206.103.203
hash: 29578
file: 217.60.76.250
hash: 7707
file: 217.60.76.250
hash: 8808
file: 45.202.0.111
hash: 12159
file: 45.202.0.116
hash: 12159
file: 45.249.89.172
hash: 4321
file: 46.225.119.0
hash: 8090
file: 5.56.25.180
hash: 443
file: 66.29.134.188
hash: 8443
file: 95.158.131.149
hash: 7443
domain: nickylody124.life
domain: speedpi12321.xyz
domain: trombler312.life
domain: viorsoonlucid.life
domain: 1stchoicestaffing.co.uk
domain: allc.asia
domain: angels-of-god.com
domain: anukunj.com
domain: aprendec.cl
domain: banvenhadep.net
domain: bcvt.edu.vn
domain: brandscollectionbyrizwan.com
domain: bucaramanga.consulado.gob.ve
domain: bunnybathco.com
domain: ckquilting.com
domain: cutfromvalor.com
domain: davariyabrothers.com
domain: elipse.health
domain: evisa-e-govkg.com
domain: flyersholding.com
domain: fullynsure.com
domain: geneparks.com
domain: greendrive.bg
domain: hoshizouen.co.jp
domain: innoventservices.com
domain: iocky.com
domain: klanbaatnagger.dk
domain: latacoyota.com
domain: lms-teckpia.com
domain: lomboktourbooking.com
domain: makerman.in
domain: mordemsanat.com.tr
domain: mrpiccam.com
domain: mrusinagem.com
domain: muninn.nl
domain: ncoeorg.in
domain: pachocreate.com
domain: plasis-em.com
domain: prontohandymanllc.com
domain: skill-cert.com
domain: spairobeauty.com
domain: stepplumbing.com.au
domain: sudewi.com
domain: supwithwade.com
domain: taazaproducts.com
domain: talatatilla.com
domain: trueform.cn
domain: tvrepair.ae
domain: walterwaygood.com
domain: www.bildhochdrei.at
domain: www.eliterisk.com
domain: www.fairmounthomestaging.com
domain: www.lambayecano.com
domain: www.nanofotonica.it
domain: www.pharmafranchisemart.com
domain: www.piccadillybistrot.it
domain: www.smartlc.it
domain: www.snmechanicalhvac.com
domain: www.teczkibezkwasowe.com
domain: www.weilaizhijiao.com
domain: www.wilsondrugs.com
domain: www.wrongside.it
file: 125.75.36.126
hash: 80
file: 125.75.36.126
hash: 30272
file: 125.75.36.126
hash: 50551
file: 125.75.36.126
hash: 59214
hash: 9109d9bd117f540aed9afa6f293c1396cc18ed979056eadca97c69e3f957c14d
hash: f959a8494f2a1c4e11f346ae8e3099593f156be2a5c8010d1747e4466a11316a
hash: f6f7dbd6561e7ee6ba7e6abffdb1e5de01bf511318aade34825d888e99db645f
domain: windowsdiagnostics.st
domain: debug.windowsdiagnostics.st
url: https://windowsdiagnostics.st/api/receive/sess
url: https://windowsdiagnostics.st/api/receive/dta
url: https://windowsdiagnostics.st/api/receive/file
url: https://windowsdiagnostics.st/api/receive/walleters
url: https://windowsdiagnostics.st/api/receive/python-log
url: http://debug.windowsdiagnostics.st:8080/api/miners/submit
url: http://debug.windowsdiagnostics.st:8080/api/updates/current
url: https://windowsdiagnostics.st/api/static/loading
url: https://windowsdiagnostics.st/api/static/exodus.asar
url: https://windowsdiagnostics.st/api/static/index.js
url: https://windowsdiagnostics.st/api/static/python
url: http://debug.windowsdiagnostics.st:8080/resources/xmrig
url: http://debug.windowsdiagnostics.st:8080/resources/gminer
hash: 25506090219f37a63d69d6d0acd1688b4d639576a14e84fea71c75b0559989ed
hash: 9a8fb045a869e9d16fae8b34a0d7a1ebcb4635047f05fced42ee011f6b046a21
hash: 06a18fc06425111a95fc85c16ff679538a66c9fed00c059261856c519cb1ad73
hash: 277b73d7981302c0da84c9656c8c5e132929d433aa8485b288ba7c5397b4b469
hash: ef1c7270096b4d0dffb394d09416320d12aa24b9d9b70f89998d90e42ac63098
domain: xyhysa.workers.dev
domain: fajujyli.workers.dev
file: 125.75.36.126
hash: 443
file: 125.75.36.126
hash: 60000
file: 114.215.190.164
hash: 18084
file: 117.72.222.49
hash: 8084
file: 103.83.86.147
hash: 2404
file: 164.92.207.173
hash: 8443
file: 161.35.166.196
hash: 9034
url: https://45.91.169.55
url: https://83.229.83.197
domain: stream.echovale.cc
domain: updates.rootwave.cc
domain: segaup.store
domain: uo2vv3xp.segaup.store
url: https://cdn.jsdelivr.net/gh/19875567137/4756211933kfd/gfd65848765
domain: mcreu5e7.heroe.store
domain: 48ex7rbv.moren.store
domain: r9zhnj8a.palso.store
domain: 248labs.ch
domain: docucentercentral.live
file: 130.94.66.82
hash: 8443
file: 162.243.73.157
hash: 8084
file: 47.94.143.231
hash: 8084
url: http://103.174.243.207:53259/mozi.m
url: http://110.38.8.126:39702/mozi.a
url: http://103.162.41.140:51170/mozi.m
url: http://222.127.55.224:51117/mozi.a
domain: somageneva.ch
domain: ybkjz19142.workers.dev
url: https://fullynsure.com/
url: https://davariyabrothers.com/
domain: gagymo.workers.dev
url: https://prontohandymanllc.com/
file: 125.75.36.126
hash: 56122
file: 102.220.88.241
hash: 4444
file: 49.235.130.208
hash: 18082
file: 1.14.100.25
hash: 8084
file: 106.15.104.224
hash: 55555
url: http://drepace.click:7289/images
url: http://trwehop.shop:5627/articles
file: 143.244.141.187
hash: 8213
url: https://www.piccadillybistrot.it/
domain: xcat.store
domain: 6al7ob99.xcat.store
hash: 8152d51a72dde734c0e17832263a8884070848a88707731c5e674caae62bcce8
hash: d72f5c7468f4f8941f46972dcddfca8bae1ed9d1
hash: d8c48b948c8b4d6ca10e8cd5b210dee9
hash: 00858b3f74b5b8b22edd2dc06cf9b895bad356d1b459fd15b1e909e79e764ad9
hash: 1f11be833fed47e458e70e81b074841b9156685c
hash: 2cc7d157008e769fbd7cf44b3a36798b
hash: b1a1aa3898af536d58e251a42ad1c54f072a1f2e62db0e5b379c69e2db8fc770
hash: 627009a097dc32e1a05f8b8f6653880d66262ce2
hash: 6c305c1fa9c13b359e5e599033705782
hash: 65f984e41b45a5563cc41922e0cae530a3175bca19b33c9406ac7276adea30bd
hash: 897ca93ee57f329c8e621209dfc940bb2413d860
hash: 88ea2182c8c30ba080f1199510e28c6e
hash: b03c4d9b4c6f16f79b63e119e75447274786ef4e9ca3168af8898ed40d2bdd37
hash: fb39f2f1aae299014a8037f91bd5360fc7a4b55a
hash: 4698a8aa33d8cf85c42760ee6eba0ec0
hash: 085321a9c7fb724f1c1ca795b1e32d393c6a5a63bdebdb937b972c8b54e0ef1e
hash: 0ca30022679bbdbb1c7f5f2a1bf355db478050f4
hash: abae76526888bc27bd26b1243e971140
hash: 31e86217e63c1b64cc459a6bd2b8cf90770821a6b2c34573a3539a1381039ef8
hash: afbf107cfd4f658e80941e2de5348b872330cb4b
hash: 616e6c770234fa5a506500d1d5763de0
hash: e874f27ec4e6b0dda043a3768300dc84d7205f47e6ad1e7bbc3ef7805a7573fd
hash: df7e37a708271620b61648cfc2cf8404d6bddce3
hash: 5a74607697701830113d1ac3f61174e6
hash: 5f5a6a53fa0a869da21d3cce44be8b718f256ca7d68ca8dd8faf25e9fd9c7a44
hash: 8dc068b65b5ad95760d6f3cf58b4f7f9d8d21ed4
hash: da168c3ff95c749beec0a2f29a1e6b82
url: https://fide45felhs.com/work/
url: http://46.29.26.45/
file: 45.61.170.191
hash: 22
file: 47.243.191.83
hash: 22
file: 47.243.191.83
hash: 443
file: 47.243.191.83
hash: 80
domain: 9032terrible.workers.dev
domain: faleja.workers.dev
domain: anarchy10.duckdns.org
file: 47.243.191.83

ThreatFox IOCs for 2026-09-16

Severity: medium

Type: Malware

ThreatFox IOCs for 2026-09-16

Technical Summary

Potential Impact

The report does not specify any direct impact or affected software. It serves as an intelligence feed to aid detection and response to potential malware threats based on observed indicators.

Mitigation Recommendations

Indicators of Compromise

file: 46.101.169.198
hash: 8443
url: https://104.253.18.206
url: https://time.austriaeast.cloudapp.azure.com
url: https://timesync.westus2.cloudapp.azure.com
url: https://zigbee.eastus.cloudapp.azure.com
url: https://zigfree.eastus.cloudapp.azure.com
domain: time.austriaeast.cloudapp.azure.com
domain: timesync.westus2.cloudapp.azure.com
domain: zigbee.eastus.cloudapp.azure.com
domain: zigfree.eastus.cloudapp.azure.com
url: https://welcome.v-panel.asia/
domain: welcome.v-panel.asia
file: 204.44.69.231
hash: 14642
file: 204.44.69.231
hash: 14644
file: 204.44.69.231
hash: 14646
domain: isomnia.pl
url: https://217.60.98.234
domain: babullies.live
domain: nelson47.com
domain: jackiewhitfield.com
domain: mrsls88.com
domain: bjfox2005.com
domain: babullies.app
domain: krisannly.com
url: https://statpipeplus.com/get_verify
domain: statpipeplus.com
domain: tracewaytech.com
domain: ingestdot.net
url: https://ingestdot.net
url: https://tracewaytech.com/get_verify
url: https://ingestdot.net/first_allow_host
url: https://tracewaytech.com/first_allow_host
domain: pacer-gov.com
url: https://ingestdot.net/get_verify
url: https://ingestdot.net/js/all.min.js
url: https://tracewaytech.com/js/all.min.js
url: https://pacer-gov.com
url: https://statpipeplus.com/js/all.min.js
url: https://statpipeplus.com/first_allow_host
file: 123.60.142.164
hash: 443
file: 123.60.142.164
hash: 80
file: 123.60.142.164
hash: 8081
domain: geveby.workers.dev
url: http://36.255.33.120:57274/mozi.m
hash: ec9d65250ddb2195103381f7662ab1d370bbb84aee2b35384ffd4bb69d28177b
hash: d3bcbb06dfb6f58c7a2d895ea75a2fd72226f1ac
hash: 0d22029ef7b53677ce81e46aa38be8bd
hash: ea8e565ccaf2d39932858c6156819e2fa23eb23a7aa06f2c1d3ae33c0ad68718
hash: e8ccaf9da9ffb15c251916b8b453bb519c3d8558
hash: e37fc2c689b56a5d66076c335cce334a
hash: 6659054e7fdce5a34a040bd0c730db06ceda0a72b3c6d75dc4a17de3fdc19d2c
hash: c936f817a52a88caac0dd89c51668ff35ea8f647
hash: b99701d7d09a46bbd40fc1b778c751fe
hash: e9d7cf3afe8cf7cbf806e39ce528648ea9bb5aa64b0d1b2fc4d2ec3fe92f294b
hash: 7189c7340ef88751d5abb922a859283cb1d43126
hash: 754c6de7387dc7c44dbd765d82658d4e
hash: f9b504f0c27ae366d420f81dbcb0a7042ec52c43ac0a025da6d76aa9eb0fa2f5
hash: 69335fbf9537c737b86468dd710149e4a525e098
hash: 61d2dcf9fe9e9b0809f33c894cd91d50
hash: 7ec3efbb778bf3151bcc92213aef6f7b789569978eaf7beda4b79e47f26dc7ac
hash: 1c6fe66d5fd5a1ce55a7bea5b85b69789b527ebb
hash: 00a5a0110d71b31d9d1a5bc45ffd60e2
hash: 11706cd85085e2c69d5b5067fb20d448ed5c7ec665a16063d5e6348add2a2e70
hash: d0852d3c2b7067886bfb9d96623d6dd078eee772
hash: a43e97db7261b728db28feeb43c32421
hash: d76f7b5a55ef8f6db63f62a3e83646d57d50677267ab316909122b2ae716eb90
hash: c4ec1fdfbb4906014c279483b2478baf263134a3
hash: ea3d8bf23d059bf3e626583045dd48a0
hash: bae4f4322d4c215be01990ad77275474f829ed7b3731703ed07946ab9d041413
hash: b5abd48cdb1d3f97418047505d5a32e03e694fe5
hash: 2a85f2e5876b278a7af9393483de455b
hash: ddda27525522dba74f3b356b6a3d29b8baac2c00ed826c2b505ffa2bc16347be
hash: 154f2a6b32a5840ad0da8ca7f26a140dea5c62ca
hash: 4acdad3a642ca279d268f9bc225ac56e
hash: 744437d93633c87382f9d1a1fdf0c1a3a908c5f9e0435bb480771dbdc0282fae
hash: a51a18b3908126f1f1c11895e92c1d65230903be
hash: 895e427449556e15d357670e9e499dcb
hash: f65d4ddf2d769eb6dd9cc7021845458f7cb49be01f1859328f62407924a7d7ac
hash: 55e33706f57108668e2de1d108085d4b897c2a08
hash: 9fdb24226fb9c26e2032d51e503d9314
url: http://teculse.click:9210/files
url: http://spiohop.shop:9932/events
url: http://cruahop.shop:8213/accounts
url: https://84.200.125.134
file: 156.239.224.131
hash: 80
file: 42.193.227.214
hash: 1002
file: 123.60.142.164
hash: 8080
file: 168.245.203.109
hash: 3790
file: 123.60.142.164
hash: 8082
file: 5.104.86.108
hash: 8890
domain: me23z6yn.reneck.store
hash: 9b1d38cd728ec1a478db668e86f7445ab5f0335b388feefc15502931cdcad704
domain: 91cwlqu1.enus-theeloncode.com
domain: ggao4r0b.omars.store
url: https://id.qq1x.org
domain: e78gueny09.workers.dev
domain: id.177betwin.org
url: https://id.177betwin.org/
domain: id.qq1x.org
domain: luzygapi.workers.dev
file: 45.77.68.157
hash: 7289
file: 134.209.223.192
hash: 9034
file: 111.228.26.26
hash: 7777
file: 175.43.223.203
hash: 7443
file: 172.245.136.97
hash: 1000
file: 129.204.196.251
hash: 2222
domain: f6gn33i6.mard.store
url: http://spiohop.shop:9932/profiles
url: http://cruahop.shop:8213/images
domain: xtvaj64i.enus-zensulin.com
domain: nahoxale.workers.dev
domain: mywixely.workers.dev
file: 42.193.239.217
hash: 443
file: 45.61.170.191
hash: 443
file: 45.61.170.191
hash: 80
file: 45.76.191.22
hash: 443
file: 45.76.191.22
hash: 80
file: 45.76.191.22
hash: 8080
file: 120.53.19.157
hash: 80
file: 18.228.80.130
hash: 80
url: http://teculse.click:9210/documents
url: http://spiohop.shop:9932/orders
url: http://booohop.shop:5627/images
url: http://teculse.click:9210/webhooks
url: http://booohop.shop:5627/categories
file: 120.53.19.157
hash: 8080
file: 45.61.170.191
hash: 8080
file: 47.109.23.77
hash: 65530
domain: fafawisma.com
domain: mudefilo.workers.dev
domain: l9bwp7kn.farmf.store
hash: 1a0c3d520e16ae12ffa918032e608f573b716f009a05c35f64b53f128bf7376d
hash: 28f83470b477e89081c08772af0470c6e841cc01c6bef4472f3b8eed47f852ce
domain: fiqacigi.workers.dev
url: https://ww.qq1x.org
domain: ww.177betwin.org
url: https://ww.177betwin.org/
domain: ww.qq1x.org
url: https://cdn.jsdelivr.net/gh/19875567137/4756211933kfd/hdfe847299432
domain: fufuwisma.com
file: 202.61.85.168
hash: 7811
file: 202.61.85.168
hash: 7800
file: 207.89.17.5
hash: 3389
domain: tftp2.sh
url: http://153.117.13.0:59969/mozi.a
url: http://59.103.100.4:41691/mozi.m
url: http://153.117.55.4:52319/mozi.m
url: http://223.123.41.70:38519/mozi.m
url: http://153.117.32.196:50508/mozi.m
domain: royar.store
domain: ega6j3lp.royar.store
file: 202.61.85.153
hash: 7811
file: 202.61.85.153
hash: 7800
domain: yewanthology.co
domain: v6sjo9pv.omec.store
url: https://casagrooming.com.co/
url: https://sohoul-alkarak.com/
url: https://gesundheitsnachweis24.de/
url: https://sarialarm.com/
domain: 65ey0xwrct.workers.dev
file: 8.146.227.247
hash: 8082
file: 207.89.17.5
hash: 22
file: 207.89.17.5
hash: 5901
domain: lefahe.workers.dev
url: http://spiohop.shop:9932/settings
url: http://booohop.shop:5627/articles
hash: afd47ef7378e573c8e575b2030355a2b65a888bdaf56c00a1e6f8e5dc980e7e5
domain: occidentalconstruction.com
domain: labioforneria.ch
domain: eqngjv6s.moltem.store
domain: s6qvly4b.fews.store
domain: gesundheitsnachweis24.de
url: http://booohop.shop:5627/projects
file: 47.98.124.244
hash: 80
file: 144.225.246.14
hash: 443
file: 144.225.246.14
hash: 80
file: 47.243.191.83
hash: 88
file: 114.215.190.164
hash: 8085
file: 123.60.142.164
hash: 8084
file: 124.221.92.3
hash: 9999
file: 47.239.223.39
hash: 8123
url: https://5.9.73.173/
url: https://46.29.26.67/
url: https://2.28.34.186/
url: https://167.233.139.3/
file: 5.9.73.173
hash: 443
file: 46.29.26.67
hash: 443
file: 2.28.34.186
hash: 443
file: 167.233.139.3
hash: 443
domain: rerrioara.live
file: 178.128.253.92
hash: 80
domain: awv389zkti.workers.dev
domain: hhemb35077.workers.dev
url: http://teculse.click:9210/accounts
url: http://spiohop.shop:9932/collections
url: http://cruahop.shop:8213/profiles
hash: 5f109e7bb3df4dea81946f2f853da288
hash: 87b76a60ba7c474dbf8f689df2808e1a
hash: f9e95a1e1fa3f3aebfc802c6c8e6a2eb
hash: 106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42
hash: 170dffb37e05f525f735bc9ad84b3908a488f7ce43fcb07739a10e4331e15a2c
hash: 223be3f8648bf6998c4a58b972522e5fda8d9d0a57b4e163811930de66c3f7ca
hash: 5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552
hash: ba80216c960977fa45e317f00dcf31e96acab29904a737cbc0bf86e929c3be5f
hash: c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268
file: 164.92.207.173
hash: 8080
file: 125.75.36.126
hash: 9090
file: 125.75.36.126
hash: 8080
file: 125.75.36.126
hash: 28120
domain: kvoxeozq.ghadi.store
file: 102.220.160.198
hash: 56003
file: 102.220.163.36
hash: 7006
file: 121.200.216.74
hash: 443
file: 139.180.153.29
hash: 443
file: 144.91.78.57
hash: 443
file: 154.36.161.180
hash: 443
file: 94.154.43.217
hash: 11121
file: 172.86.112.104
hash: 7707
file: 172.86.112.104
hash: 8808
file: 172.94.18.103
hash: 74
file: 206.206.103.203
hash: 29578
file: 217.60.76.250
hash: 7707
file: 217.60.76.250
hash: 8808
file: 45.202.0.111
hash: 12159
file: 45.202.0.116
hash: 12159
file: 45.249.89.172
hash: 4321
file: 46.225.119.0
hash: 8090
file: 5.56.25.180
hash: 443
file: 66.29.134.188
hash: 8443
file: 95.158.131.149
hash: 7443
domain: nickylody124.life
domain: speedpi12321.xyz
domain: trombler312.life
domain: viorsoonlucid.life
domain: 1stchoicestaffing.co.uk
domain: allc.asia
domain: angels-of-god.com
domain: anukunj.com
domain: aprendec.cl
domain: banvenhadep.net
domain: bcvt.edu.vn
domain: brandscollectionbyrizwan.com
domain: bucaramanga.consulado.gob.ve
domain: bunnybathco.com
domain: ckquilting.com
domain: cutfromvalor.com
domain: davariyabrothers.com
domain: elipse.health
domain: evisa-e-govkg.com
domain: flyersholding.com
domain: fullynsure.com
domain: geneparks.com
domain: greendrive.bg
domain: hoshizouen.co.jp
domain: innoventservices.com
domain: iocky.com
domain: klanbaatnagger.dk
domain: latacoyota.com
domain: lms-teckpia.com
domain: lomboktourbooking.com
domain: makerman.in
domain: mordemsanat.com.tr
domain: mrpiccam.com
domain: mrusinagem.com
domain: muninn.nl
domain: ncoeorg.in
domain: pachocreate.com
domain: plasis-em.com
domain: prontohandymanllc.com
domain: skill-cert.com
domain: spairobeauty.com
domain: stepplumbing.com.au
domain: sudewi.com
domain: supwithwade.com
domain: taazaproducts.com
domain: talatatilla.com
domain: trueform.cn
domain: tvrepair.ae
domain: walterwaygood.com
domain: www.bildhochdrei.at
domain: www.eliterisk.com
domain: www.fairmounthomestaging.com
domain: www.lambayecano.com
domain: www.nanofotonica.it
domain: www.pharmafranchisemart.com
domain: www.piccadillybistrot.it
domain: www.smartlc.it
domain: www.snmechanicalhvac.com
domain: www.teczkibezkwasowe.com
domain: www.weilaizhijiao.com
domain: www.wilsondrugs.com
domain: www.wrongside.it
file: 125.75.36.126
hash: 80
file: 125.75.36.126
hash: 30272
file: 125.75.36.126
hash: 50551
file: 125.75.36.126
hash: 59214
hash: 9109d9bd117f540aed9afa6f293c1396cc18ed979056eadca97c69e3f957c14d
hash: f959a8494f2a1c4e11f346ae8e3099593f156be2a5c8010d1747e4466a11316a
hash: f6f7dbd6561e7ee6ba7e6abffdb1e5de01bf511318aade34825d888e99db645f
domain: windowsdiagnostics.st
domain: debug.windowsdiagnostics.st
url: https://windowsdiagnostics.st/api/receive/sess
url: https://windowsdiagnostics.st/api/receive/dta
url: https://windowsdiagnostics.st/api/receive/file
url: https://windowsdiagnostics.st/api/receive/walleters
url: https://windowsdiagnostics.st/api/receive/python-log
url: http://debug.windowsdiagnostics.st:8080/api/miners/submit
url: http://debug.windowsdiagnostics.st:8080/api/updates/current
url: https://windowsdiagnostics.st/api/static/loading
url: https://windowsdiagnostics.st/api/static/exodus.asar
url: https://windowsdiagnostics.st/api/static/index.js
url: https://windowsdiagnostics.st/api/static/python
url: http://debug.windowsdiagnostics.st:8080/resources/xmrig
url: http://debug.windowsdiagnostics.st:8080/resources/gminer
hash: 25506090219f37a63d69d6d0acd1688b4d639576a14e84fea71c75b0559989ed
hash: 9a8fb045a869e9d16fae8b34a0d7a1ebcb4635047f05fced42ee011f6b046a21
hash: 06a18fc06425111a95fc85c16ff679538a66c9fed00c059261856c519cb1ad73
hash: 277b73d7981302c0da84c9656c8c5e132929d433aa8485b288ba7c5397b4b469
hash: ef1c7270096b4d0dffb394d09416320d12aa24b9d9b70f89998d90e42ac63098
domain: xyhysa.workers.dev
domain: fajujyli.workers.dev
file: 125.75.36.126
hash: 443
file: 125.75.36.126
hash: 60000
file: 114.215.190.164
hash: 18084
file: 117.72.222.49
hash: 8084
file: 103.83.86.147
hash: 2404
file: 164.92.207.173
hash: 8443
file: 161.35.166.196
hash: 9034
url: https://45.91.169.55
url: https://83.229.83.197
domain: stream.echovale.cc
domain: updates.rootwave.cc
domain: segaup.store
domain: uo2vv3xp.segaup.store
url: https://cdn.jsdelivr.net/gh/19875567137/4756211933kfd/gfd65848765
domain: mcreu5e7.heroe.store
domain: 48ex7rbv.moren.store
domain: r9zhnj8a.palso.store
domain: 248labs.ch
domain: docucentercentral.live
file: 130.94.66.82
hash: 8443
file: 162.243.73.157
hash: 8084
file: 47.94.143.231
hash: 8084
url: http://103.174.243.207:53259/mozi.m
url: http://110.38.8.126:39702/mozi.a
url: http://103.162.41.140:51170/mozi.m
url: http://222.127.55.224:51117/mozi.a
domain: somageneva.ch
domain: ybkjz19142.workers.dev
url: https://fullynsure.com/
url: https://davariyabrothers.com/
domain: gagymo.workers.dev
url: https://prontohandymanllc.com/
file: 125.75.36.126
hash: 56122
file: 102.220.88.241
hash: 4444
file: 49.235.130.208
hash: 18082
file: 1.14.100.25
hash: 8084
file: 106.15.104.224
hash: 55555
url: http://drepace.click:7289/images
url: http://trwehop.shop:5627/articles
file: 143.244.141.187
hash: 8213
url: https://www.piccadillybistrot.it/
domain: xcat.store
domain: 6al7ob99.xcat.store
hash: 8152d51a72dde734c0e17832263a8884070848a88707731c5e674caae62bcce8
hash: d72f5c7468f4f8941f46972dcddfca8bae1ed9d1
hash: d8c48b948c8b4d6ca10e8cd5b210dee9
hash: 00858b3f74b5b8b22edd2dc06cf9b895bad356d1b459fd15b1e909e79e764ad9
hash: 1f11be833fed47e458e70e81b074841b9156685c
hash: 2cc7d157008e769fbd7cf44b3a36798b
hash: b1a1aa3898af536d58e251a42ad1c54f072a1f2e62db0e5b379c69e2db8fc770
hash: 627009a097dc32e1a05f8b8f6653880d66262ce2
hash: 6c305c1fa9c13b359e5e599033705782
hash: 65f984e41b45a5563cc41922e0cae530a3175bca19b33c9406ac7276adea30bd
hash: 897ca93ee57f329c8e621209dfc940bb2413d860
hash: 88ea2182c8c30ba080f1199510e28c6e
hash: b03c4d9b4c6f16f79b63e119e75447274786ef4e9ca3168af8898ed40d2bdd37
hash: fb39f2f1aae299014a8037f91bd5360fc7a4b55a
hash: 4698a8aa33d8cf85c42760ee6eba0ec0
hash: 085321a9c7fb724f1c1ca795b1e32d393c6a5a63bdebdb937b972c8b54e0ef1e
hash: 0ca30022679bbdbb1c7f5f2a1bf355db478050f4
hash: abae76526888bc27bd26b1243e971140
hash: 31e86217e63c1b64cc459a6bd2b8cf90770821a6b2c34573a3539a1381039ef8
hash: afbf107cfd4f658e80941e2de5348b872330cb4b
hash: 616e6c770234fa5a506500d1d5763de0
hash: e874f27ec4e6b0dda043a3768300dc84d7205f47e6ad1e7bbc3ef7805a7573fd
hash: df7e37a708271620b61648cfc2cf8404d6bddce3
hash: 5a74607697701830113d1ac3f61174e6
hash: 5f5a6a53fa0a869da21d3cce44be8b718f256ca7d68ca8dd8faf25e9fd9c7a44
hash: 8dc068b65b5ad95760d6f3cf58b4f7f9d8d21ed4
hash: da168c3ff95c749beec0a2f29a1e6b82
url: https://fide45felhs.com/work/
url: http://46.29.26.45/
file: 45.61.170.191
hash: 22
file: 47.243.191.83
hash: 22
file: 47.243.191.83
hash: 443
file: 47.243.191.83
hash: 80
domain: 9032terrible.workers.dev
domain: faleja.workers.dev
domain: anarchy10.duckdns.org
file: 47.243.191.83

Source: ThreatFox MISP Feed

Published: 09/16/2026

ThreatFox IOCs for 2026-09-16

Medium

Malwaretype:osint tlp:white

Published: 09/16/2026 (09/16/2026, 00:00:00 UTC)

Source: ThreatFox MISP Feed

Description

ThreatFox IOCs for 2026-09-16

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 09/17/2026, 00:48:21 UTC

Technical Analysis

Potential Impact

The report does not specify any direct impact or affected software. It serves as an intelligence feed to aid detection and response to potential malware threats based on observed indicators.

Defensive Guidance

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Threat Level: 2
Analysis: 1
Distribution: 3
Uuid: 1d8887c9-c4ad-4dc1-9c6e-88c482771ad0
Original Timestamp: 1789603389

Indicators of Compromise

File

Value	Description	Copy
file46.101.169.198	Aisuru botnet C2 server (confidence level: 100%)
file204.44.69.231	Remcos botnet C2 server (confidence level: 100%)
file204.44.69.231	Remcos botnet C2 server (confidence level: 100%)
file204.44.69.231	Remcos botnet C2 server (confidence level: 100%)
file123.60.142.164	Cobalt Strike botnet C2 server (confidence level: 100%)
file123.60.142.164	Cobalt Strike botnet C2 server (confidence level: 100%)
file123.60.142.164	Cobalt Strike botnet C2 server (confidence level: 100%)
file156.239.224.131	Cobalt Strike botnet C2 server (confidence level: 50%)
file42.193.227.214	Cobalt Strike botnet C2 server (confidence level: 50%)
file123.60.142.164	Cobalt Strike botnet C2 server (confidence level: 100%)
file168.245.203.109	Meterpreter botnet C2 server (confidence level: 50%)
file123.60.142.164	Cobalt Strike botnet C2 server (confidence level: 100%)
file5.104.86.108	Cobalt Strike botnet C2 server (confidence level: 100%)
file45.77.68.157	Remus botnet C2 server (confidence level: 100%)
file134.209.223.192	Aisuru botnet C2 server (confidence level: 100%)
file111.228.26.26	VShell botnet C2 server (confidence level: 100%)
file175.43.223.203	Unknown malware botnet C2 server (confidence level: 100%)
file172.245.136.97	DCRat botnet C2 server (confidence level: 100%)
file129.204.196.251	VShell botnet C2 server (confidence level: 100%)
file42.193.239.217	Cobalt Strike botnet C2 server (confidence level: 75%)
file45.61.170.191	Cobalt Strike botnet C2 server (confidence level: 75%)
file45.61.170.191	Cobalt Strike botnet C2 server (confidence level: 75%)
file45.76.191.22	AdaptixC2 botnet C2 server (confidence level: 100%)
file45.76.191.22	AdaptixC2 botnet C2 server (confidence level: 100%)
file45.76.191.22	AdaptixC2 botnet C2 server (confidence level: 100%)
file120.53.19.157	Cobalt Strike botnet C2 server (confidence level: 100%)
file18.228.80.130	WhiteSnake Stealer botnet C2 server (confidence level: 100%)
file120.53.19.157	Cobalt Strike botnet C2 server (confidence level: 100%)
file45.61.170.191	Cobalt Strike botnet C2 server (confidence level: 100%)
file47.109.23.77	Cobalt Strike botnet C2 server (confidence level: 100%)
file202.61.85.168	ValleyRAT botnet C2 server (confidence level: 100%)
file202.61.85.168	ValleyRAT botnet C2 server (confidence level: 100%)
file207.89.17.5	Havoc botnet C2 server (confidence level: 100%)
file202.61.85.153	ValleyRAT botnet C2 server (confidence level: 100%)
file202.61.85.153	ValleyRAT botnet C2 server (confidence level: 100%)
file8.146.227.247	Cobalt Strike botnet C2 server (confidence level: 100%)
file207.89.17.5	Havoc botnet C2 server (confidence level: 100%)
file207.89.17.5	Havoc botnet C2 server (confidence level: 100%)
file47.98.124.244	Cobalt Strike botnet C2 server (confidence level: 100%)
file144.225.246.14	Cobalt Strike botnet C2 server (confidence level: 100%)
file144.225.246.14	Cobalt Strike botnet C2 server (confidence level: 100%)
file47.243.191.83	Cobalt Strike botnet C2 server (confidence level: 100%)
file114.215.190.164	VShell botnet C2 server (confidence level: 100%)
file123.60.142.164	VShell botnet C2 server (confidence level: 100%)
file124.221.92.3	VShell botnet C2 server (confidence level: 100%)
file47.239.223.39	VShell botnet C2 server (confidence level: 100%)
file5.9.73.173	Vidar botnet C2 server (confidence level: 100%)
file46.29.26.67	Vidar botnet C2 server (confidence level: 100%)
file2.28.34.186	Vidar botnet C2 server (confidence level: 100%)
file167.233.139.3	Vidar botnet C2 server (confidence level: 100%)
file178.128.253.92	MacSync botnet C2 server (confidence level: 100%)
file164.92.207.173	Aisuru botnet C2 server (confidence level: 100%)
file125.75.36.126	Unknown malware botnet C2 server (confidence level: 100%)
file125.75.36.126	Unknown malware botnet C2 server (confidence level: 100%)
file125.75.36.126	Unknown malware botnet C2 server (confidence level: 100%)
file102.220.160.198	AsyncRAT botnet C2 server (confidence level: 75%)
file102.220.163.36	AsyncRAT botnet C2 server (confidence level: 75%)
file121.200.216.74	AsyncRAT botnet C2 server (confidence level: 75%)
file139.180.153.29	PureRAT botnet C2 server (confidence level: 75%)
file144.91.78.57	PureRAT botnet C2 server (confidence level: 75%)
file154.36.161.180	Havoc botnet C2 server (confidence level: 75%)
file94.154.43.217	Mirai botnet C2 server (confidence level: 75%)
file172.86.112.104	AsyncRAT botnet C2 server (confidence level: 75%)
file172.86.112.104	AsyncRAT botnet C2 server (confidence level: 75%)
file172.94.18.103	AsyncRAT botnet C2 server (confidence level: 75%)
file206.206.103.203	AdaptixC2 botnet C2 server (confidence level: 75%)
file217.60.76.250	AsyncRAT botnet C2 server (confidence level: 75%)
file217.60.76.250	AsyncRAT botnet C2 server (confidence level: 75%)
file45.202.0.111	DCRat botnet C2 server (confidence level: 75%)
file45.202.0.116	DCRat botnet C2 server (confidence level: 75%)
file45.249.89.172	AdaptixC2 botnet C2 server (confidence level: 75%)
file46.225.119.0	AdaptixC2 botnet C2 server (confidence level: 75%)
file5.56.25.180	PureRAT botnet C2 server (confidence level: 75%)
file66.29.134.188	Evilginx botnet C2 server (confidence level: 75%)
file95.158.131.149	Unknown malware botnet C2 server (confidence level: 75%)
file125.75.36.126	Unknown malware botnet C2 server (confidence level: 100%)
file125.75.36.126	Unknown malware botnet C2 server (confidence level: 100%)
file125.75.36.126	Unknown malware botnet C2 server (confidence level: 100%)
file125.75.36.126	Unknown malware botnet C2 server (confidence level: 100%)
file125.75.36.126	Unknown malware botnet C2 server (confidence level: 100%)
file125.75.36.126	Unknown malware botnet C2 server (confidence level: 100%)
file114.215.190.164	VShell botnet C2 server (confidence level: 100%)
file117.72.222.49	VShell botnet C2 server (confidence level: 100%)
file103.83.86.147	Remcos botnet C2 server (confidence level: 100%)
file164.92.207.173	Aisuru botnet C2 server (confidence level: 100%)
file161.35.166.196	Aisuru botnet C2 server (confidence level: 100%)
file130.94.66.82	VShell botnet C2 server (confidence level: 100%)
file162.243.73.157	VShell botnet C2 server (confidence level: 100%)
file47.94.143.231	VShell botnet C2 server (confidence level: 100%)
file125.75.36.126	Unknown malware botnet C2 server (confidence level: 100%)
file102.220.88.241	VShell botnet C2 server (confidence level: 100%)
file49.235.130.208	Unknown malware botnet C2 server (confidence level: 100%)
file1.14.100.25	VShell botnet C2 server (confidence level: 100%)
file106.15.104.224	VShell botnet C2 server (confidence level: 100%)
file143.244.141.187	Remus botnet C2 server (confidence level: 100%)
file45.61.170.191	Cobalt Strike botnet C2 server (confidence level: 100%)
file47.243.191.83	Cobalt Strike botnet C2 server (confidence level: 100%)
file47.243.191.83	Cobalt Strike botnet C2 server (confidence level: 100%)
file47.243.191.83	Cobalt Strike botnet C2 server (confidence level: 100%)
file47.243.191.83	Cobalt Strike botnet C2 server (confidence level: 100%)

Hash

Value	Description	Copy
hash8443	Aisuru botnet C2 server (confidence level: 100%)
hash14642	Remcos botnet C2 server (confidence level: 100%)
hash14644	Remcos botnet C2 server (confidence level: 100%)
hash14646	Remcos botnet C2 server (confidence level: 100%)
hash443	Cobalt Strike botnet C2 server (confidence level: 100%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)
hash8081	Cobalt Strike botnet C2 server (confidence level: 100%)
hashec9d65250ddb2195103381f7662ab1d370bbb84aee2b35384ffd4bb69d28177b	WannaCryptor payload (confidence level: 95%)
hashd3bcbb06dfb6f58c7a2d895ea75a2fd72226f1ac	WannaCryptor payload (confidence level: 95%)
hash0d22029ef7b53677ce81e46aa38be8bd	WannaCryptor payload (confidence level: 95%)
hashea8e565ccaf2d39932858c6156819e2fa23eb23a7aa06f2c1d3ae33c0ad68718	WannaCryptor payload (confidence level: 95%)
hashe8ccaf9da9ffb15c251916b8b453bb519c3d8558	WannaCryptor payload (confidence level: 95%)
hashe37fc2c689b56a5d66076c335cce334a	WannaCryptor payload (confidence level: 95%)
hash6659054e7fdce5a34a040bd0c730db06ceda0a72b3c6d75dc4a17de3fdc19d2c	Coinminer payload (confidence level: 95%)
hashc936f817a52a88caac0dd89c51668ff35ea8f647	Coinminer payload (confidence level: 95%)
hashb99701d7d09a46bbd40fc1b778c751fe	Coinminer payload (confidence level: 95%)
hashe9d7cf3afe8cf7cbf806e39ce528648ea9bb5aa64b0d1b2fc4d2ec3fe92f294b	WannaCryptor payload (confidence level: 95%)
hash7189c7340ef88751d5abb922a859283cb1d43126	WannaCryptor payload (confidence level: 95%)
hash754c6de7387dc7c44dbd765d82658d4e	WannaCryptor payload (confidence level: 95%)
hashf9b504f0c27ae366d420f81dbcb0a7042ec52c43ac0a025da6d76aa9eb0fa2f5	Vidar payload (confidence level: 95%)
hash69335fbf9537c737b86468dd710149e4a525e098	Vidar payload (confidence level: 95%)
hash61d2dcf9fe9e9b0809f33c894cd91d50	Vidar payload (confidence level: 95%)
hash7ec3efbb778bf3151bcc92213aef6f7b789569978eaf7beda4b79e47f26dc7ac	Vidar payload (confidence level: 95%)
hash1c6fe66d5fd5a1ce55a7bea5b85b69789b527ebb	Vidar payload (confidence level: 95%)
hash00a5a0110d71b31d9d1a5bc45ffd60e2	Vidar payload (confidence level: 95%)
hash11706cd85085e2c69d5b5067fb20d448ed5c7ec665a16063d5e6348add2a2e70	Vidar payload (confidence level: 95%)
hashd0852d3c2b7067886bfb9d96623d6dd078eee772	Vidar payload (confidence level: 95%)
hasha43e97db7261b728db28feeb43c32421	Vidar payload (confidence level: 95%)
hashd76f7b5a55ef8f6db63f62a3e83646d57d50677267ab316909122b2ae716eb90	WannaCryptor payload (confidence level: 95%)
hashc4ec1fdfbb4906014c279483b2478baf263134a3	WannaCryptor payload (confidence level: 95%)
hashea3d8bf23d059bf3e626583045dd48a0	WannaCryptor payload (confidence level: 95%)
hashbae4f4322d4c215be01990ad77275474f829ed7b3731703ed07946ab9d041413	NjRAT payload (confidence level: 95%)
hashb5abd48cdb1d3f97418047505d5a32e03e694fe5	NjRAT payload (confidence level: 95%)
hash2a85f2e5876b278a7af9393483de455b	NjRAT payload (confidence level: 95%)
hashddda27525522dba74f3b356b6a3d29b8baac2c00ed826c2b505ffa2bc16347be	Coinminer payload (confidence level: 95%)
hash154f2a6b32a5840ad0da8ca7f26a140dea5c62ca	Coinminer payload (confidence level: 95%)
hash4acdad3a642ca279d268f9bc225ac56e	Coinminer payload (confidence level: 95%)
hash744437d93633c87382f9d1a1fdf0c1a3a908c5f9e0435bb480771dbdc0282fae	CrossRAT payload (confidence level: 95%)
hasha51a18b3908126f1f1c11895e92c1d65230903be	CrossRAT payload (confidence level: 95%)
hash895e427449556e15d357670e9e499dcb	CrossRAT payload (confidence level: 95%)
hashf65d4ddf2d769eb6dd9cc7021845458f7cb49be01f1859328f62407924a7d7ac	Vidar payload (confidence level: 95%)
hash55e33706f57108668e2de1d108085d4b897c2a08	Vidar payload (confidence level: 95%)
hash9fdb24226fb9c26e2032d51e503d9314	Vidar payload (confidence level: 95%)
hash80	Cobalt Strike botnet C2 server (confidence level: 50%)
hash1002	Cobalt Strike botnet C2 server (confidence level: 50%)
hash8080	Cobalt Strike botnet C2 server (confidence level: 100%)
hash3790	Meterpreter botnet C2 server (confidence level: 50%)
hash8082	Cobalt Strike botnet C2 server (confidence level: 100%)
hash8890	Cobalt Strike botnet C2 server (confidence level: 100%)
hash9b1d38cd728ec1a478db668e86f7445ab5f0335b388feefc15502931cdcad704	Venom RAT payload (confidence level: 100%)
hash7289	Remus botnet C2 server (confidence level: 100%)
hash9034	Aisuru botnet C2 server (confidence level: 100%)
hash7777	VShell botnet C2 server (confidence level: 100%)
hash7443	Unknown malware botnet C2 server (confidence level: 100%)
hash1000	DCRat botnet C2 server (confidence level: 100%)
hash2222	VShell botnet C2 server (confidence level: 100%)
hash443	Cobalt Strike botnet C2 server (confidence level: 75%)
hash443	Cobalt Strike botnet C2 server (confidence level: 75%)
hash80	Cobalt Strike botnet C2 server (confidence level: 75%)
hash443	AdaptixC2 botnet C2 server (confidence level: 100%)
hash80	AdaptixC2 botnet C2 server (confidence level: 100%)
hash8080	AdaptixC2 botnet C2 server (confidence level: 100%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)
hash80	WhiteSnake Stealer botnet C2 server (confidence level: 100%)
hash8080	Cobalt Strike botnet C2 server (confidence level: 100%)
hash8080	Cobalt Strike botnet C2 server (confidence level: 100%)
hash65530	Cobalt Strike botnet C2 server (confidence level: 100%)
hash1a0c3d520e16ae12ffa918032e608f573b716f009a05c35f64b53f128bf7376d	Unknown Loader payload (confidence level: 85%)
hash28f83470b477e89081c08772af0470c6e841cc01c6bef4472f3b8eed47f852ce	Unknown Loader payload (confidence level: 85%)
hash7811	ValleyRAT botnet C2 server (confidence level: 100%)
hash7800	ValleyRAT botnet C2 server (confidence level: 100%)
hash3389	Havoc botnet C2 server (confidence level: 100%)
hash7811	ValleyRAT botnet C2 server (confidence level: 100%)
hash7800	ValleyRAT botnet C2 server (confidence level: 100%)
hash8082	Cobalt Strike botnet C2 server (confidence level: 100%)
hash22	Havoc botnet C2 server (confidence level: 100%)
hash5901	Havoc botnet C2 server (confidence level: 100%)
hashafd47ef7378e573c8e575b2030355a2b65a888bdaf56c00a1e6f8e5dc980e7e5	Unknown Loader payload (confidence level: 85%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)
hash443	Cobalt Strike botnet C2 server (confidence level: 100%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)
hash88	Cobalt Strike botnet C2 server (confidence level: 100%)
hash8085	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash9999	VShell botnet C2 server (confidence level: 100%)
hash8123	VShell botnet C2 server (confidence level: 100%)
hash443	Vidar botnet C2 server (confidence level: 100%)
hash443	Vidar botnet C2 server (confidence level: 100%)
hash443	Vidar botnet C2 server (confidence level: 100%)
hash443	Vidar botnet C2 server (confidence level: 100%)
hash80	MacSync botnet C2 server (confidence level: 100%)
hash5f109e7bb3df4dea81946f2f853da288	Pulsar RAT payload (confidence level: 50%)
hash87b76a60ba7c474dbf8f689df2808e1a	Pulsar RAT payload (confidence level: 50%)
hashf9e95a1e1fa3f3aebfc802c6c8e6a2eb	Pulsar RAT payload (confidence level: 50%)
hash106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42	Pulsar RAT payload (confidence level: 50%)
hash170dffb37e05f525f735bc9ad84b3908a488f7ce43fcb07739a10e4331e15a2c	Pulsar RAT payload (confidence level: 50%)
hash223be3f8648bf6998c4a58b972522e5fda8d9d0a57b4e163811930de66c3f7ca	Pulsar RAT payload (confidence level: 50%)
hash5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552	Pulsar RAT payload (confidence level: 50%)
hashba80216c960977fa45e317f00dcf31e96acab29904a737cbc0bf86e929c3be5f	Pulsar RAT payload (confidence level: 50%)
hashc8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268	Pulsar RAT payload (confidence level: 50%)
hash8080	Aisuru botnet C2 server (confidence level: 100%)
hash9090	Unknown malware botnet C2 server (confidence level: 100%)
hash8080	Unknown malware botnet C2 server (confidence level: 100%)
hash28120	Unknown malware botnet C2 server (confidence level: 100%)
hash56003	AsyncRAT botnet C2 server (confidence level: 75%)
hash7006	AsyncRAT botnet C2 server (confidence level: 75%)
hash443	AsyncRAT botnet C2 server (confidence level: 75%)
hash443	PureRAT botnet C2 server (confidence level: 75%)
hash443	PureRAT botnet C2 server (confidence level: 75%)
hash443	Havoc botnet C2 server (confidence level: 75%)
hash11121	Mirai botnet C2 server (confidence level: 75%)
hash7707	AsyncRAT botnet C2 server (confidence level: 75%)
hash8808	AsyncRAT botnet C2 server (confidence level: 75%)
hash74	AsyncRAT botnet C2 server (confidence level: 75%)
hash29578	AdaptixC2 botnet C2 server (confidence level: 75%)
hash7707	AsyncRAT botnet C2 server (confidence level: 75%)
hash8808	AsyncRAT botnet C2 server (confidence level: 75%)
hash12159	DCRat botnet C2 server (confidence level: 75%)
hash12159	DCRat botnet C2 server (confidence level: 75%)
hash4321	AdaptixC2 botnet C2 server (confidence level: 75%)
hash8090	AdaptixC2 botnet C2 server (confidence level: 75%)
hash443	PureRAT botnet C2 server (confidence level: 75%)
hash8443	Evilginx botnet C2 server (confidence level: 75%)
hash7443	Unknown malware botnet C2 server (confidence level: 75%)
hash80	Unknown malware botnet C2 server (confidence level: 100%)
hash30272	Unknown malware botnet C2 server (confidence level: 100%)
hash50551	Unknown malware botnet C2 server (confidence level: 100%)
hash59214	Unknown malware botnet C2 server (confidence level: 100%)
hash9109d9bd117f540aed9afa6f293c1396cc18ed979056eadca97c69e3f957c14d	AsyncRAT payload (confidence level: 100%)
hashf959a8494f2a1c4e11f346ae8e3099593f156be2a5c8010d1747e4466a11316a	Venom RAT payload (confidence level: 100%)
hashf6f7dbd6561e7ee6ba7e6abffdb1e5de01bf511318aade34825d888e99db645f	AsyncRAT payload (confidence level: 100%)
hash25506090219f37a63d69d6d0acd1688b4d639576a14e84fea71c75b0559989ed	Unknown malware payload (confidence level: 100%)
hash9a8fb045a869e9d16fae8b34a0d7a1ebcb4635047f05fced42ee011f6b046a21	Unknown malware payload (confidence level: 100%)
hash06a18fc06425111a95fc85c16ff679538a66c9fed00c059261856c519cb1ad73	Unknown malware payload (confidence level: 100%)
hash277b73d7981302c0da84c9656c8c5e132929d433aa8485b288ba7c5397b4b469	Unknown malware payload (confidence level: 100%)
hashef1c7270096b4d0dffb394d09416320d12aa24b9d9b70f89998d90e42ac63098	Unknown malware payload (confidence level: 100%)
hash443	Unknown malware botnet C2 server (confidence level: 100%)
hash60000	Unknown malware botnet C2 server (confidence level: 100%)
hash18084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash2404	Remcos botnet C2 server (confidence level: 100%)
hash8443	Aisuru botnet C2 server (confidence level: 100%)
hash9034	Aisuru botnet C2 server (confidence level: 100%)
hash8443	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash56122	Unknown malware botnet C2 server (confidence level: 100%)
hash4444	VShell botnet C2 server (confidence level: 100%)
hash18082	Unknown malware botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash55555	VShell botnet C2 server (confidence level: 100%)
hash8213	Remus botnet C2 server (confidence level: 100%)
hash8152d51a72dde734c0e17832263a8884070848a88707731c5e674caae62bcce8	Ghost RAT payload (confidence level: 95%)
hashd72f5c7468f4f8941f46972dcddfca8bae1ed9d1	Ghost RAT payload (confidence level: 95%)
hashd8c48b948c8b4d6ca10e8cd5b210dee9	Ghost RAT payload (confidence level: 95%)
hash00858b3f74b5b8b22edd2dc06cf9b895bad356d1b459fd15b1e909e79e764ad9	Coinminer payload (confidence level: 95%)
hash1f11be833fed47e458e70e81b074841b9156685c	Coinminer payload (confidence level: 95%)
hash2cc7d157008e769fbd7cf44b3a36798b	Coinminer payload (confidence level: 95%)
hashb1a1aa3898af536d58e251a42ad1c54f072a1f2e62db0e5b379c69e2db8fc770	NetWire RC payload (confidence level: 95%)
hash627009a097dc32e1a05f8b8f6653880d66262ce2	NetWire RC payload (confidence level: 95%)
hash6c305c1fa9c13b359e5e599033705782	NetWire RC payload (confidence level: 95%)
hash65f984e41b45a5563cc41922e0cae530a3175bca19b33c9406ac7276adea30bd	NetWire RC payload (confidence level: 95%)
hash897ca93ee57f329c8e621209dfc940bb2413d860	NetWire RC payload (confidence level: 95%)
hash88ea2182c8c30ba080f1199510e28c6e	NetWire RC payload (confidence level: 95%)
hashb03c4d9b4c6f16f79b63e119e75447274786ef4e9ca3168af8898ed40d2bdd37	NetWire RC payload (confidence level: 95%)
hashfb39f2f1aae299014a8037f91bd5360fc7a4b55a	NetWire RC payload (confidence level: 95%)
hash4698a8aa33d8cf85c42760ee6eba0ec0	NetWire RC payload (confidence level: 95%)
hash085321a9c7fb724f1c1ca795b1e32d393c6a5a63bdebdb937b972c8b54e0ef1e	NetWire RC payload (confidence level: 95%)
hash0ca30022679bbdbb1c7f5f2a1bf355db478050f4	NetWire RC payload (confidence level: 95%)
hashabae76526888bc27bd26b1243e971140	NetWire RC payload (confidence level: 95%)
hash31e86217e63c1b64cc459a6bd2b8cf90770821a6b2c34573a3539a1381039ef8	NetWire RC payload (confidence level: 95%)
hashafbf107cfd4f658e80941e2de5348b872330cb4b	NetWire RC payload (confidence level: 95%)
hash616e6c770234fa5a506500d1d5763de0	NetWire RC payload (confidence level: 95%)
hashe874f27ec4e6b0dda043a3768300dc84d7205f47e6ad1e7bbc3ef7805a7573fd	NetWire RC payload (confidence level: 95%)
hashdf7e37a708271620b61648cfc2cf8404d6bddce3	NetWire RC payload (confidence level: 95%)
hash5a74607697701830113d1ac3f61174e6	NetWire RC payload (confidence level: 95%)
hash5f5a6a53fa0a869da21d3cce44be8b718f256ca7d68ca8dd8faf25e9fd9c7a44	Vidar payload (confidence level: 95%)
hash8dc068b65b5ad95760d6f3cf58b4f7f9d8d21ed4	Vidar payload (confidence level: 95%)
hashda168c3ff95c749beec0a2f29a1e6b82	Vidar payload (confidence level: 95%)
hash22	Cobalt Strike botnet C2 server (confidence level: 100%)
hash22	Cobalt Strike botnet C2 server (confidence level: 100%)
hash443	Cobalt Strike botnet C2 server (confidence level: 100%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)

Url

Value	Description	Copy
urlhttps://104.253.18.206	Vidar botnet C2 (confidence level: 100%)
urlhttps://time.austriaeast.cloudapp.azure.com	EtherRAT botnet C2 (confidence level: 75%)
urlhttps://timesync.westus2.cloudapp.azure.com	EtherRAT botnet C2 (confidence level: 75%)
urlhttps://zigbee.eastus.cloudapp.azure.com	EtherRAT botnet C2 (confidence level: 75%)
urlhttps://zigfree.eastus.cloudapp.azure.com	EtherRAT botnet C2 (confidence level: 75%)
urlhttps://welcome.v-panel.asia/	Vidar botnet C2 (confidence level: 100%)
urlhttps://217.60.98.234	Vidar botnet C2 (confidence level: 100%)
urlhttps://statpipeplus.com/get_verify	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://ingestdot.net	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://tracewaytech.com/get_verify	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://ingestdot.net/first_allow_host	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://tracewaytech.com/first_allow_host	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://ingestdot.net/get_verify	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://ingestdot.net/js/all.min.js	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://tracewaytech.com/js/all.min.js	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://pacer-gov.com	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://statpipeplus.com/js/all.min.js	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://statpipeplus.com/first_allow_host	Unknown malware payload delivery URL (confidence level: 80%)
urlhttp://36.255.33.120:57274/mozi.m	Mozi payload delivery URL (confidence level: 75%)
urlhttp://teculse.click:9210/files	Remus botnet C2 (confidence level: 75%)
urlhttp://spiohop.shop:9932/events	Remus botnet C2 (confidence level: 75%)
urlhttp://cruahop.shop:8213/accounts	Remus botnet C2 (confidence level: 75%)
urlhttps://84.200.125.134	Vidar botnet C2 (confidence level: 100%)
urlhttps://id.qq1x.org	Vidar botnet C2 (confidence level: 100%)
urlhttps://id.177betwin.org/	Vidar botnet C2 (confidence level: 100%)
urlhttp://spiohop.shop:9932/profiles	Remus botnet C2 (confidence level: 75%)
urlhttp://cruahop.shop:8213/images	Remus botnet C2 (confidence level: 75%)
urlhttp://teculse.click:9210/documents	Remus botnet C2 (confidence level: 75%)
urlhttp://spiohop.shop:9932/orders	Remus botnet C2 (confidence level: 75%)
urlhttp://booohop.shop:5627/images	Remus botnet C2 (confidence level: 75%)
urlhttp://teculse.click:9210/webhooks	Remus botnet C2 (confidence level: 75%)
urlhttp://booohop.shop:5627/categories	Remus botnet C2 (confidence level: 75%)
urlhttps://ww.qq1x.org	Vidar botnet C2 (confidence level: 100%)
urlhttps://ww.177betwin.org/	Vidar botnet C2 (confidence level: 100%)
urlhttps://cdn.jsdelivr.net/gh/19875567137/4756211933kfd/hdfe847299432	ClearFake payload delivery URL (confidence level: 100%)
urlhttp://153.117.13.0:59969/mozi.a	Mozi payload delivery URL (confidence level: 75%)
urlhttp://59.103.100.4:41691/mozi.m	Mozi payload delivery URL (confidence level: 75%)
urlhttp://153.117.55.4:52319/mozi.m	Mozi payload delivery URL (confidence level: 75%)
urlhttp://223.123.41.70:38519/mozi.m	Mozi payload delivery URL (confidence level: 75%)
urlhttp://153.117.32.196:50508/mozi.m	Mozi payload delivery URL (confidence level: 75%)
urlhttps://casagrooming.com.co/	magecart payload delivery URL (confidence level: 100%)
urlhttps://sohoul-alkarak.com/	magecart payload delivery URL (confidence level: 100%)
urlhttps://gesundheitsnachweis24.de/	magecart payload delivery URL (confidence level: 100%)
urlhttps://sarialarm.com/	magecart payload delivery URL (confidence level: 100%)
urlhttp://spiohop.shop:9932/settings	Remus botnet C2 (confidence level: 75%)
urlhttp://booohop.shop:5627/articles	Remus botnet C2 (confidence level: 75%)
urlhttp://booohop.shop:5627/projects	Remus botnet C2 (confidence level: 75%)
urlhttps://5.9.73.173/	Vidar botnet C2 (confidence level: 100%)
urlhttps://46.29.26.67/	Vidar botnet C2 (confidence level: 100%)
urlhttps://2.28.34.186/	Vidar botnet C2 (confidence level: 100%)
urlhttps://167.233.139.3/	Vidar botnet C2 (confidence level: 100%)
urlhttp://teculse.click:9210/accounts	Remus botnet C2 (confidence level: 75%)
urlhttp://spiohop.shop:9932/collections	Remus botnet C2 (confidence level: 75%)
urlhttp://cruahop.shop:8213/profiles	Remus botnet C2 (confidence level: 75%)
urlhttps://windowsdiagnostics.st/api/receive/sess	Unknown malware botnet C2 (confidence level: 100%)
urlhttps://windowsdiagnostics.st/api/receive/dta	Unknown malware botnet C2 (confidence level: 100%)
urlhttps://windowsdiagnostics.st/api/receive/file	Unknown malware botnet C2 (confidence level: 100%)
urlhttps://windowsdiagnostics.st/api/receive/walleters	Unknown malware botnet C2 (confidence level: 100%)
urlhttps://windowsdiagnostics.st/api/receive/python-log	Unknown malware botnet C2 (confidence level: 100%)
urlhttp://debug.windowsdiagnostics.st:8080/api/miners/submit	Unknown malware botnet C2 (confidence level: 100%)
urlhttp://debug.windowsdiagnostics.st:8080/api/updates/current	Unknown malware botnet C2 (confidence level: 100%)
urlhttps://windowsdiagnostics.st/api/static/loading	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://windowsdiagnostics.st/api/static/exodus.asar	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://windowsdiagnostics.st/api/static/index.js	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://windowsdiagnostics.st/api/static/python	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://debug.windowsdiagnostics.st:8080/resources/xmrig	Unknown malware payload delivery URL (confidence level: 100%)
urlhttp://debug.windowsdiagnostics.st:8080/resources/gminer	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://45.91.169.55	Vidar botnet C2 (confidence level: 100%)
urlhttps://83.229.83.197	Vidar botnet C2 (confidence level: 100%)
urlhttps://cdn.jsdelivr.net/gh/19875567137/4756211933kfd/gfd65848765	ClearFake payload delivery URL (confidence level: 100%)
urlhttp://103.174.243.207:53259/mozi.m	Mozi payload delivery URL (confidence level: 75%)
urlhttp://110.38.8.126:39702/mozi.a	Mozi payload delivery URL (confidence level: 75%)
urlhttp://103.162.41.140:51170/mozi.m	Mozi payload delivery URL (confidence level: 75%)
urlhttp://222.127.55.224:51117/mozi.a	Mozi payload delivery URL (confidence level: 75%)
urlhttps://fullynsure.com/	Unknown malware payload delivery URL (confidence level: 90%)
urlhttps://davariyabrothers.com/	Unknown malware payload delivery URL (confidence level: 90%)
urlhttps://prontohandymanllc.com/	Unknown malware payload delivery URL (confidence level: 90%)
urlhttp://drepace.click:7289/images	Remus botnet C2 (confidence level: 75%)
urlhttp://trwehop.shop:5627/articles	Remus botnet C2 (confidence level: 75%)
urlhttps://www.piccadillybistrot.it/	Unknown malware payload delivery URL (confidence level: 90%)
urlhttps://fide45felhs.com/work/	Latrodectus botnet C2 (confidence level: 100%)
urlhttp://46.29.26.45/	Stealc botnet C2 (confidence level: 100%)

Domain

Value	Description	Copy
domaintime.austriaeast.cloudapp.azure.com	EtherRAT botnet C2 domain (confidence level: 75%)
domaintimesync.westus2.cloudapp.azure.com	EtherRAT botnet C2 domain (confidence level: 75%)
domainzigbee.eastus.cloudapp.azure.com	EtherRAT botnet C2 domain (confidence level: 75%)
domainzigfree.eastus.cloudapp.azure.com	EtherRAT botnet C2 domain (confidence level: 75%)
domainwelcome.v-panel.asia	Vidar botnet C2 domain (confidence level: 100%)
domainisomnia.pl	IClickFix payload delivery domain (confidence level: 100%)
domainbabullies.live	Unknown RAT botnet C2 domain (confidence level: 75%)
domainnelson47.com	Unknown RAT botnet C2 domain (confidence level: 75%)
domainjackiewhitfield.com	Unknown RAT botnet C2 domain (confidence level: 75%)
domainmrsls88.com	Unknown RAT botnet C2 domain (confidence level: 75%)
domainbjfox2005.com	Unknown RAT botnet C2 domain (confidence level: 75%)
domainbabullies.app	Unknown RAT botnet C2 domain (confidence level: 75%)
domainkrisannly.com	Unknown RAT botnet C2 domain (confidence level: 100%)
domainstatpipeplus.com	Unknown malware payload delivery domain (confidence level: 80%)
domaintracewaytech.com	Unknown malware payload delivery domain (confidence level: 80%)
domainingestdot.net	Unknown malware payload delivery domain (confidence level: 80%)
domainpacer-gov.com	Unknown malware payload delivery domain (confidence level: 80%)
domaingeveby.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainme23z6yn.reneck.store	ClearFake payload delivery domain (confidence level: 100%)
domain91cwlqu1.enus-theeloncode.com	ClearFake payload delivery domain (confidence level: 100%)
domainggao4r0b.omars.store	ClearFake payload delivery domain (confidence level: 100%)
domaine78gueny09.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainid.177betwin.org	Vidar botnet C2 domain (confidence level: 100%)
domainid.qq1x.org	Vidar botnet C2 domain (confidence level: 100%)
domainluzygapi.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainf6gn33i6.mard.store	ClearFake payload delivery domain (confidence level: 100%)
domainxtvaj64i.enus-zensulin.com	ClearFake payload delivery domain (confidence level: 100%)
domainnahoxale.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainmywixely.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainfafawisma.com	ClearFake payload delivery domain (confidence level: 100%)
domainmudefilo.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainl9bwp7kn.farmf.store	ClearFake payload delivery domain (confidence level: 100%)
domainfiqacigi.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainww.177betwin.org	Vidar botnet C2 domain (confidence level: 100%)
domainww.qq1x.org	Vidar botnet C2 domain (confidence level: 100%)
domainfufuwisma.com	ClearFake payload delivery domain (confidence level: 100%)
domaintftp2.sh	Mirai botnet C2 domain (confidence level: 75%)
domainroyar.store	ClearFake payload delivery domain (confidence level: 100%)
domainega6j3lp.royar.store	ClearFake payload delivery domain (confidence level: 100%)
domainyewanthology.co	SmartApeSG payload delivery domain (confidence level: 100%)
domainv6sjo9pv.omec.store	ClearFake payload delivery domain (confidence level: 100%)
domain65ey0xwrct.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainlefahe.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainoccidentalconstruction.com	ClearFake payload delivery domain (confidence level: 90%)
domainlabioforneria.ch	ClearFake payload delivery domain (confidence level: 90%)
domaineqngjv6s.moltem.store	ClearFake payload delivery domain (confidence level: 100%)
domains6qvly4b.fews.store	ClearFake payload delivery domain (confidence level: 100%)
domaingesundheitsnachweis24.de	ClearFake payload delivery domain (confidence level: 90%)
domainrerrioara.live	IClickFix payload delivery domain (confidence level: 100%)
domainawv389zkti.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainhhemb35077.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainkvoxeozq.ghadi.store	ClearFake payload delivery domain (confidence level: 100%)
domainnickylody124.life	IClickFix payload delivery domain (confidence level: 100%)
domainspeedpi12321.xyz	IClickFix payload delivery domain (confidence level: 100%)
domaintrombler312.life	IClickFix payload delivery domain (confidence level: 100%)
domainviorsoonlucid.life	IClickFix payload delivery domain (confidence level: 100%)
domain1stchoicestaffing.co.uk	IClickFix payload delivery domain (confidence level: 100%)
domainallc.asia	IClickFix payload delivery domain (confidence level: 100%)
domainangels-of-god.com	IClickFix payload delivery domain (confidence level: 100%)
domainanukunj.com	IClickFix payload delivery domain (confidence level: 100%)
domainaprendec.cl	IClickFix payload delivery domain (confidence level: 100%)
domainbanvenhadep.net	IClickFix payload delivery domain (confidence level: 100%)
domainbcvt.edu.vn	IClickFix payload delivery domain (confidence level: 100%)
domainbrandscollectionbyrizwan.com	IClickFix payload delivery domain (confidence level: 100%)
domainbucaramanga.consulado.gob.ve	IClickFix payload delivery domain (confidence level: 100%)
domainbunnybathco.com	IClickFix payload delivery domain (confidence level: 100%)
domainckquilting.com	IClickFix payload delivery domain (confidence level: 100%)
domaincutfromvalor.com	IClickFix payload delivery domain (confidence level: 100%)
domaindavariyabrothers.com	IClickFix payload delivery domain (confidence level: 100%)
domainelipse.health	IClickFix payload delivery domain (confidence level: 100%)
domainevisa-e-govkg.com	IClickFix payload delivery domain (confidence level: 100%)
domainflyersholding.com	IClickFix payload delivery domain (confidence level: 100%)
domainfullynsure.com	IClickFix payload delivery domain (confidence level: 100%)
domaingeneparks.com	IClickFix payload delivery domain (confidence level: 100%)
domaingreendrive.bg	IClickFix payload delivery domain (confidence level: 100%)
domainhoshizouen.co.jp	IClickFix payload delivery domain (confidence level: 100%)
domaininnoventservices.com	IClickFix payload delivery domain (confidence level: 100%)
domainiocky.com	IClickFix payload delivery domain (confidence level: 100%)
domainklanbaatnagger.dk	IClickFix payload delivery domain (confidence level: 100%)
domainlatacoyota.com	IClickFix payload delivery domain (confidence level: 100%)
domainlms-teckpia.com	IClickFix payload delivery domain (confidence level: 100%)
domainlomboktourbooking.com	IClickFix payload delivery domain (confidence level: 100%)
domainmakerman.in	IClickFix payload delivery domain (confidence level: 100%)
domainmordemsanat.com.tr	IClickFix payload delivery domain (confidence level: 100%)
domainmrpiccam.com	IClickFix payload delivery domain (confidence level: 100%)
domainmrusinagem.com	IClickFix payload delivery domain (confidence level: 100%)
domainmuninn.nl	IClickFix payload delivery domain (confidence level: 100%)
domainncoeorg.in	IClickFix payload delivery domain (confidence level: 100%)
domainpachocreate.com	IClickFix payload delivery domain (confidence level: 100%)
domainplasis-em.com	IClickFix payload delivery domain (confidence level: 100%)
domainprontohandymanllc.com	IClickFix payload delivery domain (confidence level: 100%)
domainskill-cert.com	IClickFix payload delivery domain (confidence level: 100%)
domainspairobeauty.com	IClickFix payload delivery domain (confidence level: 100%)
domainstepplumbing.com.au	IClickFix payload delivery domain (confidence level: 100%)
domainsudewi.com	IClickFix payload delivery domain (confidence level: 100%)
domainsupwithwade.com	IClickFix payload delivery domain (confidence level: 100%)
domaintaazaproducts.com	IClickFix payload delivery domain (confidence level: 100%)
domaintalatatilla.com	IClickFix payload delivery domain (confidence level: 100%)
domaintrueform.cn	IClickFix payload delivery domain (confidence level: 100%)
domaintvrepair.ae	IClickFix payload delivery domain (confidence level: 100%)
domainwalterwaygood.com	IClickFix payload delivery domain (confidence level: 100%)
domainwww.bildhochdrei.at	IClickFix payload delivery domain (confidence level: 100%)
domainwww.eliterisk.com	IClickFix payload delivery domain (confidence level: 100%)
domainwww.fairmounthomestaging.com	IClickFix payload delivery domain (confidence level: 100%)
domainwww.lambayecano.com	IClickFix payload delivery domain (confidence level: 100%)
domainwww.nanofotonica.it	IClickFix payload delivery domain (confidence level: 100%)
domainwww.pharmafranchisemart.com	IClickFix payload delivery domain (confidence level: 100%)
domainwww.piccadillybistrot.it	IClickFix payload delivery domain (confidence level: 100%)
domainwww.smartlc.it	IClickFix payload delivery domain (confidence level: 100%)
domainwww.snmechanicalhvac.com	IClickFix payload delivery domain (confidence level: 100%)
domainwww.teczkibezkwasowe.com	IClickFix payload delivery domain (confidence level: 100%)
domainwww.weilaizhijiao.com	IClickFix payload delivery domain (confidence level: 100%)
domainwww.wilsondrugs.com	IClickFix payload delivery domain (confidence level: 100%)
domainwww.wrongside.it	IClickFix payload delivery domain (confidence level: 100%)
domainwindowsdiagnostics.st	Unknown malware botnet C2 domain (confidence level: 100%)
domaindebug.windowsdiagnostics.st	Unknown malware botnet C2 domain (confidence level: 100%)
domainxyhysa.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainfajujyli.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainstream.echovale.cc	AnimateClipper botnet C2 domain (confidence level: 100%)
domainupdates.rootwave.cc	AnimateClipper botnet C2 domain (confidence level: 100%)
domainsegaup.store	ClearFake payload delivery domain (confidence level: 100%)
domainuo2vv3xp.segaup.store	ClearFake payload delivery domain (confidence level: 100%)
domainmcreu5e7.heroe.store	ClearFake payload delivery domain (confidence level: 100%)
domain48ex7rbv.moren.store	ClearFake payload delivery domain (confidence level: 100%)
domainr9zhnj8a.palso.store	ClearFake payload delivery domain (confidence level: 100%)
domain248labs.ch	Unknown malware payload delivery domain (confidence level: 90%)
domaindocucentercentral.live	Unknown malware botnet C2 domain (confidence level: 75%)
domainsomageneva.ch	ClearFake payload delivery domain (confidence level: 90%)
domainybkjz19142.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domaingagymo.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainxcat.store	ClearFake payload delivery domain (confidence level: 100%)
domain6al7ob99.xcat.store	ClearFake payload delivery domain (confidence level: 100%)
domain9032terrible.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainfaleja.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainanarchy10.duckdns.org	AsyncRAT botnet C2 domain (confidence level: 75%)

Threat ID: 6aab34dc55bf5e2cf5576fe0

Added to database: 09/17/2026, 00:31:24 UTC

Last enriched: 09/17/2026, 00:48:21 UTC

Last updated: 09/17/2026, 05:01:24 UTC

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by

Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

External Links

Search on Google

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now

OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited

View courses

ThreatFox IOCs for 2026-09-16

AI Analysis

Technical Summary

Potential Impact

Mitigation Recommendations

Indicators of Compromise

ThreatFox IOCs for 2026-09-16

Description

AI-Powered Analysis

Technical Analysis

Potential Impact

Defensive Guidance

Technical Details

Indicators of Compromise

File

Hash

Url

Domain

Community Reviews

Related Threats

How Money Laundering, Scams, and Espionage Hide in a Web Full of Casino Garbage

The banana stand: brokering and managing infections across Asia using MQTT

PIVOTPIPE: A New .NET-based Unofficial Beacon Payload

Mythic C2 Activity at Internet Scale

The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

Actions

External Links

Need more coverage?

Latest Threats

Check if your credentials are on the dark web

Lead Pen Test Professional