Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-09-18

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 185

  • xidaluze.workers.devphp.shin_webshell botnet C2 domain (confidence level: 50%)
  • test.adriance.workers.devUnknown malware payload delivery domain (confidence level: 75%)
  • help1.mcsq.workers.devUnknown malware payload delivery domain (confidence level: 75%)
  • search.csmq.workers.devUnknown malware payload delivery domain (confidence level: 75%)
  • clean.csmq.workers.devUnknown malware payload delivery domain (confidence level: 75%)
  • crs.defenders.workers.devUnknown malware payload delivery domain (confidence level: 75%)
  • connect.mcfind.workers.devUnknown malware payload delivery domain (confidence level: 75%)
  • cdn.mcsq.workers.devUnknown malware payload delivery domain (confidence level: 75%)
  • src.mcfind.workers.devUnknown malware payload delivery domain (confidence level: 75%)
  • cfd.fins.workers.devUnknown malware payload delivery domain (confidence level: 75%)

URLs 65

  • https://gamboracle.vercel.app/apiBeaverTail payload delivery URL (confidence level: 90%)
  • http://51.210.52.212:1224/api/checkstatusBeaverTail botnet C2 (confidence level: 95%)
  • https://ip-vm.vercel.app/api/settings/macBeaverTail payload delivery URL (confidence level: 95%)
  • https://ip-vm.vercel.app/api/settings/linuxBeaverTail payload delivery URL (confidence level: 95%)
  • https://ip-vm.vercel.app/api/settings/windowsBeaverTail payload delivery URL (confidence level: 95%)
  • https://ip-vm.vercel.app/api/settings/envBeaverTail payload delivery URL (confidence level: 95%)
  • https://www.jsonkeeper.com/b/7ebzpOtterCookie payload delivery URL (confidence level: 95%)
  • https://www.jsonkeeper.com/b/pab1rOtterCookie payload delivery URL (confidence level: 95%)
  • http://138.226.247.152:80/session/0f2a3fba69d29493OtterCookie payload delivery URL (confidence level: 100%)
  • https://jsonkeeper.com/b/j0vbjUnknown malware payload delivery URL (confidence level: 90%)

IP addresses 123

  • 51.210.52.212BeaverTail botnet C2 server (confidence level: 95%)
  • 172.86.126.227Unknown malware botnet C2 server (confidence level: 90%)
  • 172.86.126.227Unknown malware botnet C2 server (confidence level: 90%)
  • 172.86.126.227Unknown malware botnet C2 server (confidence level: 90%)
  • 138.226.247.152OtterCookie botnet C2 server (confidence level: 95%)
  • 43.157.63.92Aisuru botnet C2 server (confidence level: 100%)
  • 47.98.177.11VShell botnet C2 server (confidence level: 100%)
  • 49.232.21.222Cobalt Strike botnet C2 server (confidence level: 100%)
  • 49.232.21.222Cobalt Strike botnet C2 server (confidence level: 100%)
  • 49.232.21.222Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 4

  • 158e11946bf88b2de4cabca7ea6b07dde9232c903a3925a60a3fd947bf1017b2AMOS payload (confidence level: 100%)
  • 08041fe58fe8a6333f61b77e72d939b3c2c85775aa4b9d4f7639ed87e4073958Unknown malware payload (confidence level: 75%)
  • 985ead812b8b99573d2567169d73968a3754b4fbea16447bea2ac878974e6110Unknown Loader payload (confidence level: 85%)
  • 17e7f0170795c2e704077570333a1f0985b190c016d372d6b70a41e170302cdbCoinminer payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-09-18

Community reviews

Loading reviews…