ThreatFox IOCs for 2026-09-19

Severity: mediumType: Malware

AI Analysis

Technical Summary

The data represents a collection of IOCs published by ThreatFox on 2026-09-19. It serves as OSINT for tracking network activity and payload delivery but lacks detailed technical information or specific malware signatures. There are no known exploits in the wild associated with this data, and no affected software versions or vulnerabilities are identified.

Potential Impact

No direct impact is described as this is a set of IOCs without associated active exploits or confirmed malware campaigns. It serves primarily as intelligence to support detection and response efforts.

Mitigation Recommendations

No patches or fixes are applicable since this is intelligence data rather than a vulnerability. Security teams should integrate these IOCs into their detection systems as appropriate to enhance monitoring and incident response capabilities.

Indicators of Compromise

file: 193.124.131.235
hash: 2409
file: 193.124.131.235
hash: 2407
file: 193.124.131.235
hash: 2406
file: 193.124.131.235
hash: 3398
file: 193.124.131.235
hash: 2405
url: https://cik07-cos.7moor-fs2.com/im/4d2c3f00-7d4c-11e5-af15-41bf63ae4ea0/129fd90846a1e173/9221.txt
domain: lyric-8.com
url: https://lyric-8.com/api/metrics/run?event=pasted
url: https://lyric-8.com/api/metrics/run?event=stager
file: 165.232.73.74
hash: 80
url: http://165.232.73.74/api/metrics/run
domain: blueprint-71.com
url: https://blueprint-71.com/curl/amtkquxbo3/obh3bn3umykzjlth.json
url: https://blueprint-71.com/2kqyrm0dcrnyjgos4gvll_fhjrrdtuhgcbjyuywpz6c/cc2/update
hash: a3dabccd14492f4c70658ece96a3ed7b4e275ff9d70c434298bd6f863d1e24b9
hash: 6e753133e537264247a08587d87b30b8d9a96caea1d6cc92d41fc8058073b8f7
hash: 55b8fff6b61ed493f477bac718c37714075d4ff52bc302d28a331def371834b6
hash: dfe96b68cb910deb4e29f41c7525e0cd3a2d1c7234e227cbeee4a9e6d535f95f
hash: 872611186a14d610770b362e3bef2cad071cc211d30c39e2b1a186b35f0294ba
domain: qb51hxxp.burn--flow.com
file: 106.52.255.211
hash: 13321
file: 113.45.6.129
hash: 4443
file: 114.215.190.164
hash: 8086
file: 43.173.38.253
hash: 8443
url: http://202.47.44.156:53119/mozi.m
hash: 214ab25a265b929cb3a4d4efda395773a87ad0ab0e81fda15c361116921b3f69
hash: 4eb12aef549c5c5ef491ebdfe976181e1abbbb922d369f2457f099b8cfbe71e6
hash: 332d5b8d228dd3bd8fbae99f6408cdfd424f5e48d7c71b054af84d1df414c94d
hash: 4683e6a738b43dbb5d8799bb76e60920f3d684489df1863c5c9cecf7e8e8894d
hash: 1f08e8d9dd5374a4df8ae963daf20928faaeee5985eed99cb741f89fafce62fa
hash: 0377328b77a71491581e34aad9f57b6d581681c614846157c0cc0de7859ce6f7
domain: membres.encouplesimone.com
file: 80.74.30.4
hash: 8765
file: 193.181.209.137
hash: 8765
file: 208.167.233.7
hash: 80
url: http://80.74.30.4:3000/sparky/comfyui-utils.git
url: http://165.245.138.247:81/private/xmrig-win.zip
url: http://165.245.138.247:81/private/rigel-win.zip
url: http://217.76.63.67:81/private/xmrig-win.zip
url: http://217.76.63.67:81/private/rigel-win.zip
url: http://103.249.201.108:81/private/xmrig-win.zip
url: http://103.249.201.108:81/private/rigel-win.zip
hash: 6fa80698d7268f6e88aa88c06fb27ee99e1bcee747c2e76911e6206a5b1aeeb3
hash: b9df548d6214aa93b685c981fd4c39185fd9ef55933f17da1a0d7fe9321107e1
hash: 0a813de910c312b2a0206a75ccf6f0f329690ff7e706d2e0f954b540c68fe8f3
file: 66.23.197.18
hash: 8888
file: 114.55.170.136
hash: 8084
file: 111.228.27.89
hash: 5663
domain: img2.aixpirts.com
hash: d04c03df654d5cb80cd95be199b2e43337ea2f9de68addf4708fe8b73a03640f
hash: 06d41e963ea49632f199c7bd18d7d939dc9d8dc6c02cf7ce714b7c24fef4868e
hash: b98fc9f0dbc61810287e77ea978665a0b762dceea927bbffceb63fb7005149b3
hash: f656b47e2337fea418a36933f173da98901d9ba4c0e05e3457ee3c59f94ad458
domain: ngso2pi7en.workers.dev
file: 139.155.138.221
hash: 8081
file: 154.91.56.109
hash: 8084
file: 154.91.56.110
hash: 8084
file: 154.91.56.111
hash: 8084
domain: rycupadi.workers.dev
domain: 00rr59n2.en-pegasus.com
file: 193.124.131.235
hash: 9987
domain: en-us-en-smartwaterbox.com
domain: 2gp421dm.en-us-en-smartwaterbox.com
domain: uxahadmx.kaarenorge.com
url: https://ma.19hoki.org
domain: uat.edu.course.movest.co
file: 154.91.57.117
hash: 8084
file: 154.91.57.120
hash: 8084
file: 154.91.58.107
hash: 8084
file: 167.179.67.162
hash: 8443
domain: bomurily.workers.dev
url: https://192.142.37.129
file: 154.91.56.98
hash: 8084
file: 154.91.57.113
hash: 8084
file: 154.91.58.118
hash: 8084
file: 154.91.58.119
hash: 8084
file: 154.91.56.115
hash: 8084
domain: x1m07e7w.enus-metabodrops.com
url: http://homecor.click:6527/users
url: http://fuarnpp.shop:5627/sessions
hash: f48801ccbac2ccffdcc6b68db1ae21d35fad179630d5af968a0983af10a5da7b
hash: 3daf295e54b996fd0b9ed3270b03381fc8066ea32a4ead4e454058f3aab771b4
hash: 5928481fada1e9be6582b365b7effa977dc43ebf7f9e0a386f485649b30690ec
hash: 8d06ef4fd7819b75943dec120fbd50c1fd0820c760734fa13f7ffa6fac85d1d9
domain: wmicconfidance.info
domain: kodg0fih.palmdriverv.com
domain: www.sestitoedilservice.it
domain: farmtasticdoggy.com.au
file: 154.91.57.109
hash: 8084
file: 154.91.58.103
hash: 8084
file: 154.91.58.105
hash: 8084
file: 154.91.59.101
hash: 8084
domain: iwonderifulovemeaswell.vg
domain: lovefromallareas.at
domain: iloveuevenifudontlovemeback.is
domain: kanokyhy.workers.dev
domain: zunynoco.workers.dev
file: 5.226.55.130
hash: 4444
domain: mgbkbp4b.enus-tupitea.com
domain: lobby09.co.il
file: 154.91.58.102
hash: 8084
file: 154.91.59.103
hash: 8084
file: 154.91.59.105
hash: 8084
url: https://ma.1hoki.org
url: http://223.123.125.178:38438/mozi.m
url: http://203.99.56.137:36975/mozi.m
url: https://testingcf.jsdelivr.net/gh/989a-a-3ff2465495760-2b3a/4657-8765943-85742-94856/dgfyrte-98
hash: 6451fd21e11fa85cf1c076aa00825393ba3654e492675087b8bdba8f695122b0
domain: enus-flashburn.com
domain: 3nblpdw2.enus-flashburn.com
domain: awilli.co.uk
url: http://clouven.click:8527/notifications
url: http://smaring.shop:9895/attachments
file: 154.91.59.102
hash: 8084
file: 154.91.59.113
hash: 8084
file: 154.91.59.120
hash: 8084
file: 154.91.59.122
hash: 8084
file: 154.91.60.100
hash: 8084
hash: 8b60b132edfe051a17e79883e0da471f21c50804fbb7d1b2fdbc7ed5d606d9ed
hash: 8b4caad4c51a87f10977d3fecd40938d5201bb9d8762a9d728c3c0454ba5e414
domain: 8p11s24hza.workers.dev
domain: dc48r0dup9.workers.dev
domain: pjilctsx.enus-metabodrops.com
url: https://testingcf.jsdelivr.net/gh/989a-a-3ff2465495760-2b3a/4657-8765943-85742-94856/22274659-87
domain: usa-neurovera.us
file: 154.91.60.108
hash: 8084
file: 154.91.60.110
hash: 8084
file: 154.91.60.112
hash: 8084
file: 154.91.60.113
hash: 8084
file: 154.91.60.114
hash: 8084
domain: bsdsvltx.libertytokan.com
hash: 13e3e1310dd9e9210ed937a651361be16b554be2d20ce5ae06b1dcf610dda603
url: https://testingcf.jsdelivr.net/gh/boycshop/dc-0a-e1-4e-e0-05/04ec49-812b67
file: 154.91.60.116
hash: 8084
file: 154.91.60.98
hash: 8084
file: 154.91.60.99
hash: 8084
file: 154.91.61.109
hash: 8084
file: 154.91.63.113
hash: 8084
domain: scottcurdiephotography.com
domain: kiln-skioi-c29up.com
domain: trilliot6776.icu
file: 114.215.190.7
hash: 443
file: 123.57.146.34
hash: 80
file: 35.215.160.200
hash: 80
file: 139.199.18.159
hash: 81
file: 101.34.208.175
hash: 8081
file: 47.122.120.188
hash: 81
domain: 29inappropriate.workers.dev
domain: hqqpi58b.en-xenburn.com
domain: tumyveqy.workers.dev
url: http://homecor.click:6527/articles
url: http://kipthen.shop:9932/subscriptions
url: http://fuarnpp.shop:5627/transactions
file: 102.220.160.198
hash: 7707
file: 128.241.244.3
hash: 12159
file: 128.241.244.3
hash: 8848
file: 128.241.244.7
hash: 12159
file: 137.184.139.185
hash: 8080
file: 138.0.191.215
hash: 9001
file: 146.70.51.74
hash: 2512
file: 154.216.139.17
hash: 443
file: 154.86.14.17
hash: 443
file: 181.206.118.219
hash: 5118
file: 188.137.227.133
hash: 8808
file: 209.38.224.48
hash: 7443
file: 217.60.195.193
hash: 56001
file: 217.60.195.193
hash: 56002
file: 217.60.195.193
hash: 56003
file: 64.84.56.233
hash: 443
file: 91.92.241.149
hash: 7707
file: 91.92.241.149
hash: 9090
file: 42.193.169.176
hash: 80
file: 43.172.9.116
hash: 8001
url: http://tiruet.com:5632
file: 154.91.63.115
hash: 8084
file: 154.91.60.123
hash: 8084
file: 154.91.60.124
hash: 8084
file: 154.91.61.99
hash: 8084
file: 154.91.62.101
hash: 8084
domain: rd6k97w3.shop-burnflow.com
file: 43.166.252.222
hash: 443
domain: nld9qz8u.en-us-glycofree.com
domain: prguru.pk
domain: podywan.pl
file: 154.91.62.120
hash: 8084
file: 154.91.62.123
hash: 8084
file: 154.91.63.102
hash: 8084
file: 154.91.63.123
hash: 8084
file: 154.91.63.99
hash: 8084
domain: tvpmutf0em.workers.dev
domain: gyeew46396.workers.dev
hash: 0b6eb79f70d8f754bc04ebf8d4fb6e6e3d12e5d6bbdfd159168c60160dc98949
url: https://www.redsdj.ca/
file: 192.210.197.131
hash: 12313
file: 114.215.190.7
hash: 22
file: 114.215.190.7
hash: 80
file: 114.215.190.7
hash: 8080
domain: uhfao75u.usa--burnflow.com
url: http://39.34.191.107:42078/mozi.m
url: http://103.249.199.1:35620/mozi.m
url: http://100.165.12.219:42975/mozi.m
url: https://filezilla.cc/takefile/sezen/default.zip
url: https://hongyuncloud-diskmanager.hongyuncloud.workers.dev/%e7%ba%a2%e4%ba%91cloud/private/klring.dll
url: https://jfss-apakp.pages.dev/download/%e6%9c%ba%e6%88%bf%e6%9d%80%e6%89%8b1.26.7.5.zip
url: http://156.238.224.156:5522/?h=156.238.224.156&p=5522&t=ws&a=w32&stage=true
url: https://malwaredirectory.pages.dev/malware/ransomwares/birele.zip
domain: munz2.moovent.ch
domain: ohztowdn.burn--flow.com
url: http://145.79.143.4:80/nl3p
file: 138.68.168.41
hash: 8001
file: 144.126.224.25
hash: 8001
file: 144.126.234.230
hash: 8001
file: 159.65.83.2
hash: 8001
file: 167.71.45.235
hash: 8001
file: 178.128.167.82
hash: 8001
file: 178.62.118.210
hash: 8001
file: 188.166.158.18
hash: 8001
file: 209.38.218.95
hash: 8001
file: 46.101.36.181
hash: 8001
url: https://shivsagartrading.com/
file: 114.215.190.7
hash: 19999
file: 114.215.190.7
hash: 65534
file: 121.4.38.18
hash: 8888
file: 49.232.21.222
hash: 22
file: 49.232.21.222
hash: 3456
domain: slmzt25180.workers.dev
domain: qnjom46076.workers.dev
url: http://177.70.102.232:8070/tmpftp/01/cancelamento/2022-09-06/info.zip
url: http://177.70.102.232:8070/tmpftp/01/consulta/2019-08-02/info.zip
url: http://177.70.102.232:8070/tmpftp/01/inutiliza%c3%a7%c3%a3o/2019-12-19/info.zip
url: http://34.92.225.25:8084/?h=34.92.225.25&p=8084&t=tcp&a=w64&stage=true
url: http://34.92.225.25:8084/?h=34.92.225.25&p=8084&t=ws&a=w32&stage=true
hash: 95475e9c6ee155ac15f772179880ff247fa76255d70a164dc97d69d712ed5901
url: https://accountsensepro.net/js/all.min.js
domain: reportsnapbit.com
url: https://solarwinds-in.com
url: https://oauthapp.net
url: https://reportsnapbit.com/get_verify
url: https://oauthapp.net/first_allow_host
domain: solarwinds-in.com
domain: accountsensepro.net
domain: oauthapp.net
url: https://reportsnapbit.com/first_allow_host
url: https://oauthapp.net/get_verify
url: https://reportsnapbit.com/js/all.min.js
url: https://oauthapp.net/js/all.min.js
url: https://accountsensepro.net/get_verify
url: https://accountsensepro.net/first_allow_host
domain: 64nsw308x6.workers.dev
domain: api.microsoftstorapi.com
file: 106.53.168.218
hash: 443
file: 156.238.233.131
hash: 50022
file: 177.5.67.37
hash: 443
domain: xyyhb62254.workers.dev
domain: changingthesalesgame.com
file: 49.232.21.222
hash: 6379
file: 49.232.21.222
hash: 22334
file: 123.56.106.181
hash: 22
file: 123.56.106.181
hash: 443
domain: v17q5203.usa--lipogummy.com
file: 188.166.158.18
hash: 8443
file: 144.126.224.25
hash: 8443
url: http://420mafia.eu/ar-15/ar15.arc
url: http://420mafia.eu/ar-15/ar15.m68k
url: http://92.127.156.174:8880/master.exe
url: http://193.160.32.138:8085/?h=193.160.32.138&p=8085&t=tcp&a=l32&stage=true
domain: 46vm4qgb.www-glycofree.com
url: http://103.242.12.143:1234/?h=103.242.12.143&p=1234&t=tcp&a=w64&stage=true
hash: 0f07c8cb9e61897af70d073502c94fde399f5e0953e9511cfc621ee79431d12b
domain: pmeelectric.org
domain: i8tdljt4.pmeelectric.org
file: 123.56.106.181
hash: 8080
file: 35.215.160.200
hash: 22
file: 35.215.160.200
hash: 443
hash: 574fe1d0b5b67b8a4a58ad76458cfa2d5d7c9061657abc4a672cd23e96bf4aeb
hash: 491f801f4d59380016d1b8ea5ff4baa097cdf84f
hash: 0049d699536ec0a1a3242626edf840d3
hash: 5efcc11dd0c63ffd70c7e5c62ec113ccf34f560ed06e811b7abd036542b1c6d6
hash: 5e3d5e30b376d98d65a9acf7bb6681e0e967c236
hash: 604b0627a9b5462100bcd6fa5fa0dd75
hash: d3f5b2ed1b616c6302341f7a7736490e11b4b63081a22e6153d4a4c0a53d0a40
hash: 3e9cf3f84058b4600342398c4d5218c551beea7b
hash: 79d90eabf375fcae4bf76ed88d7d2c10
hash: 1ad42cab7899671275d79ff38317ae4df61d58de9d2e4f23facf297b5b33654b
hash: fc3874454b6ecbd71ca4364f26f78cc99dd872cb
hash: a5181dd5da1137c6d2e88acdc1ff32fd
hash: 1ae9433efe8a190b2dc0b842050b67255d3c54b17097314f189d608c7a40d678
hash: 3d2e9031c415884cc67ef0fedf9d802981700f6b
hash: 93e76e5b33860040d1a4235234a8e6c7
hash: 0aeba92b05174797920b9a9ec0226c7fd70f43ae
hash: 4146c7d01c0c2bb71b1f593df81ab1bd
url: http://193.160.32.138:8085/?h=193.160.32.138&p=8085&t=ws&a=l32&stage=true
url: http://420mafia.eu/ar-15/ar15.x86_64
url: http://47.254.173.184:8443/?h=47.254.173.184&p=8443&t=tcp&a=w64&stage=true
url: https://tmtworldwideltd.com/travel-and-tours-old/
url: http://222.112.70.149:8084/?h=222.112.70.149&p=8084&t=tcp&a=w32&stage=true
url: https://aaflnt.com/statement/customer/customer_statements.zip
domain: vorekabi.workers.dev
domain: chocolate65.beer
domain: www.msn00273.beer
domain: www.enter-press-code.info
domain: mail.thewellformedwoman.com
domain: s1.thewellformedwoman.com
domain: ftp.thewellformedwoman.com
domain: autodiscover.thewellformedwoman.com
domain: autoconfig.thewellformedwoman.com
domain: www.cdn-verification-cloud.boats
domain: www.framework-css-styles-js.beer
domain: www.ladydosug.love
domain: www.istounscnnd.beer
domain: www.trunnsns.beer
domain: www.mstclaudens.beer
domain: www.tescdnlast.beer
domain: www.testapi34726.sbs
domain: www.ladydosug.live
domain: www.ladydosug.top
domain: www.nfstsrcdn.beer
domain: www.nshostvps.beer
domain: risepaint.com.au
domain: shivsagartrading.com
domain: demonsbasement.com
domain: acionespastorales.com.ec
domain: sreeanugraha.com
domain: 22knightsbridge.4yourinfo.com
domain: parking.destinationauburn.com
domain: usapharmatics.com
domain: provely.io
domain: theordinaryofficial.us
domain: itsstockbro.com
domain: umwmuseumancmedcultures.org
domain: podcastblog.roger.pt
domain: pawtage.com.au
domain: navyapridedevelopers.com
domain: gamzesmith.com
domain: butygeja.workers.dev
file: 154.219.101.56
hash: 8085
file: 202.79.166.26
hash: 6666
file: 202.79.166.26
hash: 8888
file: 178.62.118.210
hash: 8443
file: 123.56.106.181
hash: 80
file: 35.215.160.200
hash: 8080
file: 8.148.187.55
hash: 8081
domain: h1zhr28q.usa-lipogummy.com
file: 167.71.45.235
hash: 8080
url: http://34.92.225.25:8084/?h=34.92.225.25&p=8084&t=ws&a=l32&stage=true
domain: frog.britishboxing.net
url: http://178.198.246.24/info.zip
url: http://178.61.160.6:5001/info.zip
hash: e0b8e9e25228ef5a4f1aa0f0ae202c8b71dc47945dcc4a9d92a57395fdf03c7b
file: 116.118.0.222
hash: 443
domain: fpymeantofagasta.cl
file: 178.128.167.82
hash: 9034
file: 123.56.106.181
hash: 8888
file: 130.94.30.47
hash: 50001
file: 149.30.232.29
hash: 22
file: 149.30.232.29
hash: 443
url: https://navyapridedevelopers.com/
file: 209.38.218.95
hash: 8443
domain: denofezu.workers.dev
url: http://178.61.160.6:5001/video.scr
url: http://180.148.33.24/av.scr
url: http://180.148.33.24/info.zip
url: http://186.235.86.129/photo.scr
url: http://103.242.12.143:1234/?h=103.242.12.143&p=1234&t=ws&a=w64&stage=true

ThreatFox IOCs for 2026-09-19

Severity: medium

Type: Malware

ThreatFox IOCs for 2026-09-19

Technical Summary

Potential Impact

Mitigation Recommendations

Indicators of Compromise

file: 193.124.131.235
hash: 2409
file: 193.124.131.235
hash: 2407
file: 193.124.131.235
hash: 2406
file: 193.124.131.235
hash: 3398
file: 193.124.131.235
hash: 2405
url: https://cik07-cos.7moor-fs2.com/im/4d2c3f00-7d4c-11e5-af15-41bf63ae4ea0/129fd90846a1e173/9221.txt
domain: lyric-8.com
url: https://lyric-8.com/api/metrics/run?event=pasted
url: https://lyric-8.com/api/metrics/run?event=stager
file: 165.232.73.74
hash: 80
url: http://165.232.73.74/api/metrics/run
domain: blueprint-71.com
url: https://blueprint-71.com/curl/amtkquxbo3/obh3bn3umykzjlth.json
url: https://blueprint-71.com/2kqyrm0dcrnyjgos4gvll_fhjrrdtuhgcbjyuywpz6c/cc2/update
hash: a3dabccd14492f4c70658ece96a3ed7b4e275ff9d70c434298bd6f863d1e24b9
hash: 6e753133e537264247a08587d87b30b8d9a96caea1d6cc92d41fc8058073b8f7
hash: 55b8fff6b61ed493f477bac718c37714075d4ff52bc302d28a331def371834b6
hash: dfe96b68cb910deb4e29f41c7525e0cd3a2d1c7234e227cbeee4a9e6d535f95f
hash: 872611186a14d610770b362e3bef2cad071cc211d30c39e2b1a186b35f0294ba
domain: qb51hxxp.burn--flow.com
file: 106.52.255.211
hash: 13321
file: 113.45.6.129
hash: 4443
file: 114.215.190.164
hash: 8086
file: 43.173.38.253
hash: 8443
url: http://202.47.44.156:53119/mozi.m
hash: 214ab25a265b929cb3a4d4efda395773a87ad0ab0e81fda15c361116921b3f69
hash: 4eb12aef549c5c5ef491ebdfe976181e1abbbb922d369f2457f099b8cfbe71e6
hash: 332d5b8d228dd3bd8fbae99f6408cdfd424f5e48d7c71b054af84d1df414c94d
hash: 4683e6a738b43dbb5d8799bb76e60920f3d684489df1863c5c9cecf7e8e8894d
hash: 1f08e8d9dd5374a4df8ae963daf20928faaeee5985eed99cb741f89fafce62fa
hash: 0377328b77a71491581e34aad9f57b6d581681c614846157c0cc0de7859ce6f7
domain: membres.encouplesimone.com
file: 80.74.30.4
hash: 8765
file: 193.181.209.137
hash: 8765
file: 208.167.233.7
hash: 80
url: http://80.74.30.4:3000/sparky/comfyui-utils.git
url: http://165.245.138.247:81/private/xmrig-win.zip
url: http://165.245.138.247:81/private/rigel-win.zip
url: http://217.76.63.67:81/private/xmrig-win.zip
url: http://217.76.63.67:81/private/rigel-win.zip
url: http://103.249.201.108:81/private/xmrig-win.zip
url: http://103.249.201.108:81/private/rigel-win.zip
hash: 6fa80698d7268f6e88aa88c06fb27ee99e1bcee747c2e76911e6206a5b1aeeb3
hash: b9df548d6214aa93b685c981fd4c39185fd9ef55933f17da1a0d7fe9321107e1
hash: 0a813de910c312b2a0206a75ccf6f0f329690ff7e706d2e0f954b540c68fe8f3
file: 66.23.197.18
hash: 8888
file: 114.55.170.136
hash: 8084
file: 111.228.27.89
hash: 5663
domain: img2.aixpirts.com
hash: d04c03df654d5cb80cd95be199b2e43337ea2f9de68addf4708fe8b73a03640f
hash: 06d41e963ea49632f199c7bd18d7d939dc9d8dc6c02cf7ce714b7c24fef4868e
hash: b98fc9f0dbc61810287e77ea978665a0b762dceea927bbffceb63fb7005149b3
hash: f656b47e2337fea418a36933f173da98901d9ba4c0e05e3457ee3c59f94ad458
domain: ngso2pi7en.workers.dev
file: 139.155.138.221
hash: 8081
file: 154.91.56.109
hash: 8084
file: 154.91.56.110
hash: 8084
file: 154.91.56.111
hash: 8084
domain: rycupadi.workers.dev
domain: 00rr59n2.en-pegasus.com
file: 193.124.131.235
hash: 9987
domain: en-us-en-smartwaterbox.com
domain: 2gp421dm.en-us-en-smartwaterbox.com
domain: uxahadmx.kaarenorge.com
url: https://ma.19hoki.org
domain: uat.edu.course.movest.co
file: 154.91.57.117
hash: 8084
file: 154.91.57.120
hash: 8084
file: 154.91.58.107
hash: 8084
file: 167.179.67.162
hash: 8443
domain: bomurily.workers.dev
url: https://192.142.37.129
file: 154.91.56.98
hash: 8084
file: 154.91.57.113
hash: 8084
file: 154.91.58.118
hash: 8084
file: 154.91.58.119
hash: 8084
file: 154.91.56.115
hash: 8084
domain: x1m07e7w.enus-metabodrops.com
url: http://homecor.click:6527/users
url: http://fuarnpp.shop:5627/sessions
hash: f48801ccbac2ccffdcc6b68db1ae21d35fad179630d5af968a0983af10a5da7b
hash: 3daf295e54b996fd0b9ed3270b03381fc8066ea32a4ead4e454058f3aab771b4
hash: 5928481fada1e9be6582b365b7effa977dc43ebf7f9e0a386f485649b30690ec
hash: 8d06ef4fd7819b75943dec120fbd50c1fd0820c760734fa13f7ffa6fac85d1d9
domain: wmicconfidance.info
domain: kodg0fih.palmdriverv.com
domain: www.sestitoedilservice.it
domain: farmtasticdoggy.com.au
file: 154.91.57.109
hash: 8084
file: 154.91.58.103
hash: 8084
file: 154.91.58.105
hash: 8084
file: 154.91.59.101
hash: 8084
domain: iwonderifulovemeaswell.vg
domain: lovefromallareas.at
domain: iloveuevenifudontlovemeback.is
domain: kanokyhy.workers.dev
domain: zunynoco.workers.dev
file: 5.226.55.130
hash: 4444
domain: mgbkbp4b.enus-tupitea.com
domain: lobby09.co.il
file: 154.91.58.102
hash: 8084
file: 154.91.59.103
hash: 8084
file: 154.91.59.105
hash: 8084
url: https://ma.1hoki.org
url: http://223.123.125.178:38438/mozi.m
url: http://203.99.56.137:36975/mozi.m
url: https://testingcf.jsdelivr.net/gh/989a-a-3ff2465495760-2b3a/4657-8765943-85742-94856/dgfyrte-98
hash: 6451fd21e11fa85cf1c076aa00825393ba3654e492675087b8bdba8f695122b0
domain: enus-flashburn.com
domain: 3nblpdw2.enus-flashburn.com
domain: awilli.co.uk
url: http://clouven.click:8527/notifications
url: http://smaring.shop:9895/attachments
file: 154.91.59.102
hash: 8084
file: 154.91.59.113
hash: 8084
file: 154.91.59.120
hash: 8084
file: 154.91.59.122
hash: 8084
file: 154.91.60.100
hash: 8084
hash: 8b60b132edfe051a17e79883e0da471f21c50804fbb7d1b2fdbc7ed5d606d9ed
hash: 8b4caad4c51a87f10977d3fecd40938d5201bb9d8762a9d728c3c0454ba5e414
domain: 8p11s24hza.workers.dev
domain: dc48r0dup9.workers.dev
domain: pjilctsx.enus-metabodrops.com
url: https://testingcf.jsdelivr.net/gh/989a-a-3ff2465495760-2b3a/4657-8765943-85742-94856/22274659-87
domain: usa-neurovera.us
file: 154.91.60.108
hash: 8084
file: 154.91.60.110
hash: 8084
file: 154.91.60.112
hash: 8084
file: 154.91.60.113
hash: 8084
file: 154.91.60.114
hash: 8084
domain: bsdsvltx.libertytokan.com
hash: 13e3e1310dd9e9210ed937a651361be16b554be2d20ce5ae06b1dcf610dda603
url: https://testingcf.jsdelivr.net/gh/boycshop/dc-0a-e1-4e-e0-05/04ec49-812b67
file: 154.91.60.116
hash: 8084
file: 154.91.60.98
hash: 8084
file: 154.91.60.99
hash: 8084
file: 154.91.61.109
hash: 8084
file: 154.91.63.113
hash: 8084
domain: scottcurdiephotography.com
domain: kiln-skioi-c29up.com
domain: trilliot6776.icu
file: 114.215.190.7
hash: 443
file: 123.57.146.34
hash: 80
file: 35.215.160.200
hash: 80
file: 139.199.18.159
hash: 81
file: 101.34.208.175
hash: 8081
file: 47.122.120.188
hash: 81
domain: 29inappropriate.workers.dev
domain: hqqpi58b.en-xenburn.com
domain: tumyveqy.workers.dev
url: http://homecor.click:6527/articles
url: http://kipthen.shop:9932/subscriptions
url: http://fuarnpp.shop:5627/transactions
file: 102.220.160.198
hash: 7707
file: 128.241.244.3
hash: 12159
file: 128.241.244.3
hash: 8848
file: 128.241.244.7
hash: 12159
file: 137.184.139.185
hash: 8080
file: 138.0.191.215
hash: 9001
file: 146.70.51.74
hash: 2512
file: 154.216.139.17
hash: 443
file: 154.86.14.17
hash: 443
file: 181.206.118.219
hash: 5118
file: 188.137.227.133
hash: 8808
file: 209.38.224.48
hash: 7443
file: 217.60.195.193
hash: 56001
file: 217.60.195.193
hash: 56002
file: 217.60.195.193
hash: 56003
file: 64.84.56.233
hash: 443
file: 91.92.241.149
hash: 7707
file: 91.92.241.149
hash: 9090
file: 42.193.169.176
hash: 80
file: 43.172.9.116
hash: 8001
url: http://tiruet.com:5632
file: 154.91.63.115
hash: 8084
file: 154.91.60.123
hash: 8084
file: 154.91.60.124
hash: 8084
file: 154.91.61.99
hash: 8084
file: 154.91.62.101
hash: 8084
domain: rd6k97w3.shop-burnflow.com
file: 43.166.252.222
hash: 443
domain: nld9qz8u.en-us-glycofree.com
domain: prguru.pk
domain: podywan.pl
file: 154.91.62.120
hash: 8084
file: 154.91.62.123
hash: 8084
file: 154.91.63.102
hash: 8084
file: 154.91.63.123
hash: 8084
file: 154.91.63.99
hash: 8084
domain: tvpmutf0em.workers.dev
domain: gyeew46396.workers.dev
hash: 0b6eb79f70d8f754bc04ebf8d4fb6e6e3d12e5d6bbdfd159168c60160dc98949
url: https://www.redsdj.ca/
file: 192.210.197.131
hash: 12313
file: 114.215.190.7
hash: 22
file: 114.215.190.7
hash: 80
file: 114.215.190.7
hash: 8080
domain: uhfao75u.usa--burnflow.com
url: http://39.34.191.107:42078/mozi.m
url: http://103.249.199.1:35620/mozi.m
url: http://100.165.12.219:42975/mozi.m
url: https://filezilla.cc/takefile/sezen/default.zip
url: https://hongyuncloud-diskmanager.hongyuncloud.workers.dev/%e7%ba%a2%e4%ba%91cloud/private/klring.dll
url: https://jfss-apakp.pages.dev/download/%e6%9c%ba%e6%88%bf%e6%9d%80%e6%89%8b1.26.7.5.zip
url: http://156.238.224.156:5522/?h=156.238.224.156&p=5522&t=ws&a=w32&stage=true
url: https://malwaredirectory.pages.dev/malware/ransomwares/birele.zip
domain: munz2.moovent.ch
domain: ohztowdn.burn--flow.com
url: http://145.79.143.4:80/nl3p
file: 138.68.168.41
hash: 8001
file: 144.126.224.25
hash: 8001
file: 144.126.234.230
hash: 8001
file: 159.65.83.2
hash: 8001
file: 167.71.45.235
hash: 8001
file: 178.128.167.82
hash: 8001
file: 178.62.118.210
hash: 8001
file: 188.166.158.18
hash: 8001
file: 209.38.218.95
hash: 8001
file: 46.101.36.181
hash: 8001
url: https://shivsagartrading.com/
file: 114.215.190.7
hash: 19999
file: 114.215.190.7
hash: 65534
file: 121.4.38.18
hash: 8888
file: 49.232.21.222
hash: 22
file: 49.232.21.222
hash: 3456
domain: slmzt25180.workers.dev
domain: qnjom46076.workers.dev
url: http://177.70.102.232:8070/tmpftp/01/cancelamento/2022-09-06/info.zip
url: http://177.70.102.232:8070/tmpftp/01/consulta/2019-08-02/info.zip
url: http://177.70.102.232:8070/tmpftp/01/inutiliza%c3%a7%c3%a3o/2019-12-19/info.zip
url: http://34.92.225.25:8084/?h=34.92.225.25&p=8084&t=tcp&a=w64&stage=true
url: http://34.92.225.25:8084/?h=34.92.225.25&p=8084&t=ws&a=w32&stage=true
hash: 95475e9c6ee155ac15f772179880ff247fa76255d70a164dc97d69d712ed5901
url: https://accountsensepro.net/js/all.min.js
domain: reportsnapbit.com
url: https://solarwinds-in.com
url: https://oauthapp.net
url: https://reportsnapbit.com/get_verify
url: https://oauthapp.net/first_allow_host
domain: solarwinds-in.com
domain: accountsensepro.net
domain: oauthapp.net
url: https://reportsnapbit.com/first_allow_host
url: https://oauthapp.net/get_verify
url: https://reportsnapbit.com/js/all.min.js
url: https://oauthapp.net/js/all.min.js
url: https://accountsensepro.net/get_verify
url: https://accountsensepro.net/first_allow_host
domain: 64nsw308x6.workers.dev
domain: api.microsoftstorapi.com
file: 106.53.168.218
hash: 443
file: 156.238.233.131
hash: 50022
file: 177.5.67.37
hash: 443
domain: xyyhb62254.workers.dev
domain: changingthesalesgame.com
file: 49.232.21.222
hash: 6379
file: 49.232.21.222
hash: 22334
file: 123.56.106.181
hash: 22
file: 123.56.106.181
hash: 443
domain: v17q5203.usa--lipogummy.com
file: 188.166.158.18
hash: 8443
file: 144.126.224.25
hash: 8443
url: http://420mafia.eu/ar-15/ar15.arc
url: http://420mafia.eu/ar-15/ar15.m68k
url: http://92.127.156.174:8880/master.exe
url: http://193.160.32.138:8085/?h=193.160.32.138&p=8085&t=tcp&a=l32&stage=true
domain: 46vm4qgb.www-glycofree.com
url: http://103.242.12.143:1234/?h=103.242.12.143&p=1234&t=tcp&a=w64&stage=true
hash: 0f07c8cb9e61897af70d073502c94fde399f5e0953e9511cfc621ee79431d12b
domain: pmeelectric.org
domain: i8tdljt4.pmeelectric.org
file: 123.56.106.181
hash: 8080
file: 35.215.160.200
hash: 22
file: 35.215.160.200
hash: 443
hash: 574fe1d0b5b67b8a4a58ad76458cfa2d5d7c9061657abc4a672cd23e96bf4aeb
hash: 491f801f4d59380016d1b8ea5ff4baa097cdf84f
hash: 0049d699536ec0a1a3242626edf840d3
hash: 5efcc11dd0c63ffd70c7e5c62ec113ccf34f560ed06e811b7abd036542b1c6d6
hash: 5e3d5e30b376d98d65a9acf7bb6681e0e967c236
hash: 604b0627a9b5462100bcd6fa5fa0dd75
hash: d3f5b2ed1b616c6302341f7a7736490e11b4b63081a22e6153d4a4c0a53d0a40
hash: 3e9cf3f84058b4600342398c4d5218c551beea7b
hash: 79d90eabf375fcae4bf76ed88d7d2c10
hash: 1ad42cab7899671275d79ff38317ae4df61d58de9d2e4f23facf297b5b33654b
hash: fc3874454b6ecbd71ca4364f26f78cc99dd872cb
hash: a5181dd5da1137c6d2e88acdc1ff32fd
hash: 1ae9433efe8a190b2dc0b842050b67255d3c54b17097314f189d608c7a40d678
hash: 3d2e9031c415884cc67ef0fedf9d802981700f6b
hash: 93e76e5b33860040d1a4235234a8e6c7
hash: 0aeba92b05174797920b9a9ec0226c7fd70f43ae
hash: 4146c7d01c0c2bb71b1f593df81ab1bd
url: http://193.160.32.138:8085/?h=193.160.32.138&p=8085&t=ws&a=l32&stage=true
url: http://420mafia.eu/ar-15/ar15.x86_64
url: http://47.254.173.184:8443/?h=47.254.173.184&p=8443&t=tcp&a=w64&stage=true
url: https://tmtworldwideltd.com/travel-and-tours-old/
url: http://222.112.70.149:8084/?h=222.112.70.149&p=8084&t=tcp&a=w32&stage=true
url: https://aaflnt.com/statement/customer/customer_statements.zip
domain: vorekabi.workers.dev
domain: chocolate65.beer
domain: www.msn00273.beer
domain: www.enter-press-code.info
domain: mail.thewellformedwoman.com
domain: s1.thewellformedwoman.com
domain: ftp.thewellformedwoman.com
domain: autodiscover.thewellformedwoman.com
domain: autoconfig.thewellformedwoman.com
domain: www.cdn-verification-cloud.boats
domain: www.framework-css-styles-js.beer
domain: www.ladydosug.love
domain: www.istounscnnd.beer
domain: www.trunnsns.beer
domain: www.mstclaudens.beer
domain: www.tescdnlast.beer
domain: www.testapi34726.sbs
domain: www.ladydosug.live
domain: www.ladydosug.top
domain: www.nfstsrcdn.beer
domain: www.nshostvps.beer
domain: risepaint.com.au
domain: shivsagartrading.com
domain: demonsbasement.com
domain: acionespastorales.com.ec
domain: sreeanugraha.com
domain: 22knightsbridge.4yourinfo.com
domain: parking.destinationauburn.com
domain: usapharmatics.com
domain: provely.io
domain: theordinaryofficial.us
domain: itsstockbro.com
domain: umwmuseumancmedcultures.org
domain: podcastblog.roger.pt
domain: pawtage.com.au
domain: navyapridedevelopers.com
domain: gamzesmith.com
domain: butygeja.workers.dev
file: 154.219.101.56
hash: 8085
file: 202.79.166.26
hash: 6666
file: 202.79.166.26
hash: 8888
file: 178.62.118.210
hash: 8443
file: 123.56.106.181
hash: 80
file: 35.215.160.200
hash: 8080
file: 8.148.187.55
hash: 8081
domain: h1zhr28q.usa-lipogummy.com
file: 167.71.45.235
hash: 8080
url: http://34.92.225.25:8084/?h=34.92.225.25&p=8084&t=ws&a=l32&stage=true
domain: frog.britishboxing.net
url: http://178.198.246.24/info.zip
url: http://178.61.160.6:5001/info.zip
hash: e0b8e9e25228ef5a4f1aa0f0ae202c8b71dc47945dcc4a9d92a57395fdf03c7b
file: 116.118.0.222
hash: 443
domain: fpymeantofagasta.cl
file: 178.128.167.82
hash: 9034
file: 123.56.106.181
hash: 8888
file: 130.94.30.47
hash: 50001
file: 149.30.232.29
hash: 22
file: 149.30.232.29
hash: 443
url: https://navyapridedevelopers.com/
file: 209.38.218.95
hash: 8443
domain: denofezu.workers.dev
url: http://178.61.160.6:5001/video.scr
url: http://180.148.33.24/av.scr
url: http://180.148.33.24/info.zip
url: http://186.235.86.129/photo.scr
url: http://103.242.12.143:1234/?h=103.242.12.143&p=1234&t=ws&a=w64&stage=true

Source: ThreatFox MISP Feed

Published: 09/19/2026

ThreatFox IOCs for 2026-09-19

Medium

Malwaretype:osint tlp:white

Published: 09/19/2026 (09/19/2026, 00:00:00 UTC)

Source: ThreatFox MISP Feed

Description

ThreatFox IOCs for 2026-09-19

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 09/20/2026, 00:46:28 UTC

Technical Analysis

Potential Impact

Defensive Guidance

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Threat Level: 2
Analysis: 1
Distribution: 3
Uuid: c7d6cd52-482e-4eb5-bcbf-e6c13c6dbbdd
Original Timestamp: 1789862588

Indicators of Compromise

File

Value	Description	Copy
file193.124.131.235	Remcos botnet C2 server (confidence level: 100%)
file193.124.131.235	Remcos botnet C2 server (confidence level: 100%)
file193.124.131.235	Remcos botnet C2 server (confidence level: 100%)
file193.124.131.235	Remcos botnet C2 server (confidence level: 100%)
file193.124.131.235	Remcos botnet C2 server (confidence level: 100%)
file165.232.73.74	AMOS botnet C2 server (confidence level: 100%)
file106.52.255.211	Unknown malware botnet C2 server (confidence level: 100%)
file113.45.6.129	VShell botnet C2 server (confidence level: 100%)
file114.215.190.164	VShell botnet C2 server (confidence level: 100%)
file43.173.38.253	Aisuru botnet C2 server (confidence level: 100%)
file80.74.30.4	xmrig botnet C2 server (confidence level: 100%)
file193.181.209.137	xmrig botnet C2 server (confidence level: 100%)
file208.167.233.7	xmrig botnet C2 server (confidence level: 100%)
file66.23.197.18	VShell botnet C2 server (confidence level: 100%)
file114.55.170.136	VShell botnet C2 server (confidence level: 100%)
file111.228.27.89	VShell botnet C2 server (confidence level: 100%)
file139.155.138.221	VShell botnet C2 server (confidence level: 100%)
file154.91.56.109	VShell botnet C2 server (confidence level: 100%)
file154.91.56.110	VShell botnet C2 server (confidence level: 100%)
file154.91.56.111	VShell botnet C2 server (confidence level: 100%)
file193.124.131.235	Remcos botnet C2 server (confidence level: 100%)
file154.91.57.117	VShell botnet C2 server (confidence level: 100%)
file154.91.57.120	VShell botnet C2 server (confidence level: 100%)
file154.91.58.107	VShell botnet C2 server (confidence level: 100%)
file167.179.67.162	Cobalt Strike botnet C2 server (confidence level: 75%)
file154.91.56.98	VShell botnet C2 server (confidence level: 100%)
file154.91.57.113	VShell botnet C2 server (confidence level: 100%)
file154.91.58.118	VShell botnet C2 server (confidence level: 100%)
file154.91.58.119	VShell botnet C2 server (confidence level: 100%)
file154.91.56.115	VShell botnet C2 server (confidence level: 100%)
file154.91.57.109	VShell botnet C2 server (confidence level: 100%)
file154.91.58.103	VShell botnet C2 server (confidence level: 100%)
file154.91.58.105	VShell botnet C2 server (confidence level: 100%)
file154.91.59.101	VShell botnet C2 server (confidence level: 100%)
file5.226.55.130	Unknown RAT botnet C2 server (confidence level: 75%)
file154.91.58.102	VShell botnet C2 server (confidence level: 100%)
file154.91.59.103	VShell botnet C2 server (confidence level: 100%)
file154.91.59.105	VShell botnet C2 server (confidence level: 100%)
file154.91.59.102	VShell botnet C2 server (confidence level: 100%)
file154.91.59.113	VShell botnet C2 server (confidence level: 100%)
file154.91.59.120	VShell botnet C2 server (confidence level: 100%)
file154.91.59.122	VShell botnet C2 server (confidence level: 100%)
file154.91.60.100	VShell botnet C2 server (confidence level: 100%)
file154.91.60.108	VShell botnet C2 server (confidence level: 100%)
file154.91.60.110	VShell botnet C2 server (confidence level: 100%)
file154.91.60.112	VShell botnet C2 server (confidence level: 100%)
file154.91.60.113	VShell botnet C2 server (confidence level: 100%)
file154.91.60.114	VShell botnet C2 server (confidence level: 100%)
file154.91.60.116	VShell botnet C2 server (confidence level: 100%)
file154.91.60.98	VShell botnet C2 server (confidence level: 100%)
file154.91.60.99	VShell botnet C2 server (confidence level: 100%)
file154.91.61.109	VShell botnet C2 server (confidence level: 100%)
file154.91.63.113	VShell botnet C2 server (confidence level: 100%)
file114.215.190.7	Cobalt Strike botnet C2 server (confidence level: 100%)
file123.57.146.34	Cobalt Strike botnet C2 server (confidence level: 100%)
file35.215.160.200	Cobalt Strike botnet C2 server (confidence level: 100%)
file139.199.18.159	Cobalt Strike botnet C2 server (confidence level: 100%)
file101.34.208.175	Cobalt Strike botnet C2 server (confidence level: 100%)
file47.122.120.188	Cobalt Strike botnet C2 server (confidence level: 100%)
file102.220.160.198	AsyncRAT botnet C2 server (confidence level: 75%)
file128.241.244.3	DCRat botnet C2 server (confidence level: 75%)
file128.241.244.3	DCRat botnet C2 server (confidence level: 75%)
file128.241.244.7	DCRat botnet C2 server (confidence level: 75%)
file137.184.139.185	PoshC2 botnet C2 server (confidence level: 75%)
file138.0.191.215	DanaBot botnet C2 server (confidence level: 75%)
file146.70.51.74	DCRat botnet C2 server (confidence level: 75%)
file154.216.139.17	DanaBot botnet C2 server (confidence level: 75%)
file154.86.14.17	DanaBot botnet C2 server (confidence level: 75%)
file181.206.118.219	DCRat botnet C2 server (confidence level: 75%)
file188.137.227.133	AsyncRAT botnet C2 server (confidence level: 75%)
file209.38.224.48	Unknown malware botnet C2 server (confidence level: 75%)
file217.60.195.193	PureRAT botnet C2 server (confidence level: 75%)
file217.60.195.193	PureRAT botnet C2 server (confidence level: 75%)
file217.60.195.193	PureRAT botnet C2 server (confidence level: 75%)
file64.84.56.233	DanaBot botnet C2 server (confidence level: 75%)
file91.92.241.149	AsyncRAT botnet C2 server (confidence level: 75%)
file91.92.241.149	AsyncRAT botnet C2 server (confidence level: 75%)
file42.193.169.176	Cobalt Strike botnet C2 server (confidence level: 75%)
file43.172.9.116	Aisuru botnet C2 server (confidence level: 100%)
file154.91.63.115	VShell botnet C2 server (confidence level: 100%)
file154.91.60.123	VShell botnet C2 server (confidence level: 100%)
file154.91.60.124	VShell botnet C2 server (confidence level: 100%)
file154.91.61.99	VShell botnet C2 server (confidence level: 100%)
file154.91.62.101	VShell botnet C2 server (confidence level: 100%)
file43.166.252.222	Jackskid botnet C2 server (confidence level: 100%)
file154.91.62.120	VShell botnet C2 server (confidence level: 100%)
file154.91.62.123	VShell botnet C2 server (confidence level: 100%)
file154.91.63.102	VShell botnet C2 server (confidence level: 100%)
file154.91.63.123	VShell botnet C2 server (confidence level: 100%)
file154.91.63.99	VShell botnet C2 server (confidence level: 100%)
file192.210.197.131	VShell botnet C2 server (confidence level: 100%)
file114.215.190.7	Cobalt Strike botnet C2 server (confidence level: 100%)
file114.215.190.7	Cobalt Strike botnet C2 server (confidence level: 100%)
file114.215.190.7	Cobalt Strike botnet C2 server (confidence level: 100%)
file138.68.168.41	Aisuru botnet C2 server (confidence level: 100%)
file144.126.224.25	Aisuru botnet C2 server (confidence level: 100%)
file144.126.234.230	Aisuru botnet C2 server (confidence level: 100%)
file159.65.83.2	Aisuru botnet C2 server (confidence level: 100%)
file167.71.45.235	Aisuru botnet C2 server (confidence level: 100%)
file178.128.167.82	Aisuru botnet C2 server (confidence level: 100%)
file178.62.118.210	Aisuru botnet C2 server (confidence level: 100%)
file188.166.158.18	Aisuru botnet C2 server (confidence level: 100%)
file209.38.218.95	Aisuru botnet C2 server (confidence level: 100%)
file46.101.36.181	Aisuru botnet C2 server (confidence level: 100%)
file114.215.190.7	Cobalt Strike botnet C2 server (confidence level: 100%)
file114.215.190.7	Cobalt Strike botnet C2 server (confidence level: 100%)
file121.4.38.18	Cobalt Strike botnet C2 server (confidence level: 100%)
file49.232.21.222	Cobalt Strike botnet C2 server (confidence level: 100%)
file49.232.21.222	Cobalt Strike botnet C2 server (confidence level: 100%)
file106.53.168.218	Cobalt Strike botnet C2 server (confidence level: 75%)
file156.238.233.131	Cobalt Strike botnet C2 server (confidence level: 75%)
file177.5.67.37	Cobalt Strike botnet C2 server (confidence level: 75%)
file49.232.21.222	Cobalt Strike botnet C2 server (confidence level: 100%)
file49.232.21.222	Cobalt Strike botnet C2 server (confidence level: 100%)
file123.56.106.181	Cobalt Strike botnet C2 server (confidence level: 100%)
file123.56.106.181	Cobalt Strike botnet C2 server (confidence level: 100%)
file188.166.158.18	Aisuru botnet C2 server (confidence level: 100%)
file144.126.224.25	Aisuru botnet C2 server (confidence level: 100%)
file123.56.106.181	Cobalt Strike botnet C2 server (confidence level: 100%)
file35.215.160.200	Cobalt Strike botnet C2 server (confidence level: 100%)
file35.215.160.200	Cobalt Strike botnet C2 server (confidence level: 100%)
file154.219.101.56	Cobalt Strike botnet C2 server (confidence level: 75%)
file202.79.166.26	ValleyRAT botnet C2 server (confidence level: 75%)
file202.79.166.26	ValleyRAT botnet C2 server (confidence level: 75%)
file178.62.118.210	Aisuru botnet C2 server (confidence level: 100%)
file123.56.106.181	Cobalt Strike botnet C2 server (confidence level: 100%)
file35.215.160.200	Cobalt Strike botnet C2 server (confidence level: 100%)
file8.148.187.55	Cobalt Strike botnet C2 server (confidence level: 100%)
file167.71.45.235	Aisuru botnet C2 server (confidence level: 100%)
file116.118.0.222	Nanocore RAT botnet C2 server (confidence level: 100%)
file178.128.167.82	Aisuru botnet C2 server (confidence level: 100%)
file123.56.106.181	Cobalt Strike botnet C2 server (confidence level: 100%)
file130.94.30.47	Cobalt Strike botnet C2 server (confidence level: 100%)
file149.30.232.29	Cobalt Strike botnet C2 server (confidence level: 100%)
file149.30.232.29	Cobalt Strike botnet C2 server (confidence level: 100%)
file209.38.218.95	Aisuru botnet C2 server (confidence level: 100%)

Hash

Value	Description	Copy
hash2409	Remcos botnet C2 server (confidence level: 100%)
hash2407	Remcos botnet C2 server (confidence level: 100%)
hash2406	Remcos botnet C2 server (confidence level: 100%)
hash3398	Remcos botnet C2 server (confidence level: 100%)
hash2405	Remcos botnet C2 server (confidence level: 100%)
hash80	AMOS botnet C2 server (confidence level: 100%)
hasha3dabccd14492f4c70658ece96a3ed7b4e275ff9d70c434298bd6f863d1e24b9	AMOS payload (confidence level: 100%)
hash6e753133e537264247a08587d87b30b8d9a96caea1d6cc92d41fc8058073b8f7	AMOS payload (confidence level: 100%)
hash55b8fff6b61ed493f477bac718c37714075d4ff52bc302d28a331def371834b6	AMOS payload (confidence level: 100%)
hashdfe96b68cb910deb4e29f41c7525e0cd3a2d1c7234e227cbeee4a9e6d535f95f	AMOS payload (confidence level: 100%)
hash872611186a14d610770b362e3bef2cad071cc211d30c39e2b1a186b35f0294ba	AMOS payload (confidence level: 100%)
hash13321	Unknown malware botnet C2 server (confidence level: 100%)
hash4443	VShell botnet C2 server (confidence level: 100%)
hash8086	VShell botnet C2 server (confidence level: 100%)
hash8443	Aisuru botnet C2 server (confidence level: 100%)
hash214ab25a265b929cb3a4d4efda395773a87ad0ab0e81fda15c361116921b3f69	VShell payload (confidence level: 95%)
hash4eb12aef549c5c5ef491ebdfe976181e1abbbb922d369f2457f099b8cfbe71e6	VShell payload (confidence level: 95%)
hash332d5b8d228dd3bd8fbae99f6408cdfd424f5e48d7c71b054af84d1df414c94d	VShell payload (confidence level: 95%)
hash4683e6a738b43dbb5d8799bb76e60920f3d684489df1863c5c9cecf7e8e8894d	Unknown Loader payload (confidence level: 85%)
hash1f08e8d9dd5374a4df8ae963daf20928faaeee5985eed99cb741f89fafce62fa	VShell payload (confidence level: 95%)
hash0377328b77a71491581e34aad9f57b6d581681c614846157c0cc0de7859ce6f7	Unknown Loader payload (confidence level: 85%)
hash8765	xmrig botnet C2 server (confidence level: 100%)
hash8765	xmrig botnet C2 server (confidence level: 100%)
hash80	xmrig botnet C2 server (confidence level: 100%)
hash6fa80698d7268f6e88aa88c06fb27ee99e1bcee747c2e76911e6206a5b1aeeb3	xmrig payload (confidence level: 100%)
hashb9df548d6214aa93b685c981fd4c39185fd9ef55933f17da1a0d7fe9321107e1	xmrig payload (confidence level: 100%)
hash0a813de910c312b2a0206a75ccf6f0f329690ff7e706d2e0f954b540c68fe8f3	xmrig payload (confidence level: 100%)
hash8888	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash5663	VShell botnet C2 server (confidence level: 100%)
hashd04c03df654d5cb80cd95be199b2e43337ea2f9de68addf4708fe8b73a03640f	Unknown Loader payload (confidence level: 85%)
hash06d41e963ea49632f199c7bd18d7d939dc9d8dc6c02cf7ce714b7c24fef4868e	Unknown Loader payload (confidence level: 85%)
hashb98fc9f0dbc61810287e77ea978665a0b762dceea927bbffceb63fb7005149b3	Unknown Loader payload (confidence level: 85%)
hashf656b47e2337fea418a36933f173da98901d9ba4c0e05e3457ee3c59f94ad458	Unknown Loader payload (confidence level: 80%)
hash8081	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash9987	Remcos botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8443	Cobalt Strike botnet C2 server (confidence level: 75%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hashf48801ccbac2ccffdcc6b68db1ae21d35fad179630d5af968a0983af10a5da7b	VShell payload (confidence level: 95%)
hash3daf295e54b996fd0b9ed3270b03381fc8066ea32a4ead4e454058f3aab771b4	VShell payload (confidence level: 95%)
hash5928481fada1e9be6582b365b7effa977dc43ebf7f9e0a386f485649b30690ec	VShell payload (confidence level: 95%)
hash8d06ef4fd7819b75943dec120fbd50c1fd0820c760734fa13f7ffa6fac85d1d9	VShell payload (confidence level: 95%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash4444	Unknown RAT botnet C2 server (confidence level: 75%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash6451fd21e11fa85cf1c076aa00825393ba3654e492675087b8bdba8f695122b0	VShell payload (confidence level: 95%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8b60b132edfe051a17e79883e0da471f21c50804fbb7d1b2fdbc7ed5d606d9ed	VShell payload (confidence level: 95%)
hash8b4caad4c51a87f10977d3fecd40938d5201bb9d8762a9d728c3c0454ba5e414	VShell payload (confidence level: 95%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash13e3e1310dd9e9210ed937a651361be16b554be2d20ce5ae06b1dcf610dda603	Unknown malware payload (confidence level: 75%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash443	Cobalt Strike botnet C2 server (confidence level: 100%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)
hash81	Cobalt Strike botnet C2 server (confidence level: 100%)
hash8081	Cobalt Strike botnet C2 server (confidence level: 100%)
hash81	Cobalt Strike botnet C2 server (confidence level: 100%)
hash7707	AsyncRAT botnet C2 server (confidence level: 75%)
hash12159	DCRat botnet C2 server (confidence level: 75%)
hash8848	DCRat botnet C2 server (confidence level: 75%)
hash12159	DCRat botnet C2 server (confidence level: 75%)
hash8080	PoshC2 botnet C2 server (confidence level: 75%)
hash9001	DanaBot botnet C2 server (confidence level: 75%)
hash2512	DCRat botnet C2 server (confidence level: 75%)
hash443	DanaBot botnet C2 server (confidence level: 75%)
hash443	DanaBot botnet C2 server (confidence level: 75%)
hash5118	DCRat botnet C2 server (confidence level: 75%)
hash8808	AsyncRAT botnet C2 server (confidence level: 75%)
hash7443	Unknown malware botnet C2 server (confidence level: 75%)
hash56001	PureRAT botnet C2 server (confidence level: 75%)
hash56002	PureRAT botnet C2 server (confidence level: 75%)
hash56003	PureRAT botnet C2 server (confidence level: 75%)
hash443	DanaBot botnet C2 server (confidence level: 75%)
hash7707	AsyncRAT botnet C2 server (confidence level: 75%)
hash9090	AsyncRAT botnet C2 server (confidence level: 75%)
hash80	Cobalt Strike botnet C2 server (confidence level: 75%)
hash8001	Aisuru botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash443	Jackskid botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash8084	VShell botnet C2 server (confidence level: 100%)
hash0b6eb79f70d8f754bc04ebf8d4fb6e6e3d12e5d6bbdfd159168c60160dc98949	VShell payload (confidence level: 95%)
hash12313	VShell botnet C2 server (confidence level: 100%)
hash22	Cobalt Strike botnet C2 server (confidence level: 100%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)
hash8080	Cobalt Strike botnet C2 server (confidence level: 100%)
hash8001	Aisuru botnet C2 server (confidence level: 100%)
hash8001	Aisuru botnet C2 server (confidence level: 100%)
hash8001	Aisuru botnet C2 server (confidence level: 100%)
hash8001	Aisuru botnet C2 server (confidence level: 100%)
hash8001	Aisuru botnet C2 server (confidence level: 100%)
hash8001	Aisuru botnet C2 server (confidence level: 100%)
hash8001	Aisuru botnet C2 server (confidence level: 100%)
hash8001	Aisuru botnet C2 server (confidence level: 100%)
hash8001	Aisuru botnet C2 server (confidence level: 100%)
hash8001	Aisuru botnet C2 server (confidence level: 100%)
hash19999	Cobalt Strike botnet C2 server (confidence level: 100%)
hash65534	Cobalt Strike botnet C2 server (confidence level: 100%)
hash8888	Cobalt Strike botnet C2 server (confidence level: 100%)
hash22	Cobalt Strike botnet C2 server (confidence level: 100%)
hash3456	Cobalt Strike botnet C2 server (confidence level: 100%)
hash95475e9c6ee155ac15f772179880ff247fa76255d70a164dc97d69d712ed5901	Unknown Loader payload (confidence level: 95%)
hash443	Cobalt Strike botnet C2 server (confidence level: 75%)
hash50022	Cobalt Strike botnet C2 server (confidence level: 75%)
hash443	Cobalt Strike botnet C2 server (confidence level: 75%)
hash6379	Cobalt Strike botnet C2 server (confidence level: 100%)
hash22334	Cobalt Strike botnet C2 server (confidence level: 100%)
hash22	Cobalt Strike botnet C2 server (confidence level: 100%)
hash443	Cobalt Strike botnet C2 server (confidence level: 100%)
hash8443	Aisuru botnet C2 server (confidence level: 100%)
hash8443	Aisuru botnet C2 server (confidence level: 100%)
hash0f07c8cb9e61897af70d073502c94fde399f5e0953e9511cfc621ee79431d12b	Unknown Loader payload (confidence level: 85%)
hash8080	Cobalt Strike botnet C2 server (confidence level: 100%)
hash22	Cobalt Strike botnet C2 server (confidence level: 100%)
hash443	Cobalt Strike botnet C2 server (confidence level: 100%)
hash574fe1d0b5b67b8a4a58ad76458cfa2d5d7c9061657abc4a672cd23e96bf4aeb	Venus Stealer payload (confidence level: 95%)
hash491f801f4d59380016d1b8ea5ff4baa097cdf84f	Venus Stealer payload (confidence level: 95%)
hash0049d699536ec0a1a3242626edf840d3	Venus Stealer payload (confidence level: 95%)
hash5efcc11dd0c63ffd70c7e5c62ec113ccf34f560ed06e811b7abd036542b1c6d6	VShell payload (confidence level: 95%)
hash5e3d5e30b376d98d65a9acf7bb6681e0e967c236	VShell payload (confidence level: 95%)
hash604b0627a9b5462100bcd6fa5fa0dd75	VShell payload (confidence level: 95%)
hashd3f5b2ed1b616c6302341f7a7736490e11b4b63081a22e6153d4a4c0a53d0a40	ValleyRAT payload (confidence level: 95%)
hash3e9cf3f84058b4600342398c4d5218c551beea7b	ValleyRAT payload (confidence level: 95%)
hash79d90eabf375fcae4bf76ed88d7d2c10	ValleyRAT payload (confidence level: 95%)
hash1ad42cab7899671275d79ff38317ae4df61d58de9d2e4f23facf297b5b33654b	stealler payload (confidence level: 95%)
hashfc3874454b6ecbd71ca4364f26f78cc99dd872cb	stealler payload (confidence level: 95%)
hasha5181dd5da1137c6d2e88acdc1ff32fd	stealler payload (confidence level: 95%)
hash1ae9433efe8a190b2dc0b842050b67255d3c54b17097314f189d608c7a40d678	Venus Stealer payload (confidence level: 95%)
hash3d2e9031c415884cc67ef0fedf9d802981700f6b	Venus Stealer payload (confidence level: 95%)
hash93e76e5b33860040d1a4235234a8e6c7	Venus Stealer payload (confidence level: 95%)
hash0aeba92b05174797920b9a9ec0226c7fd70f43ae	VShell payload (confidence level: 95%)
hash4146c7d01c0c2bb71b1f593df81ab1bd	VShell payload (confidence level: 95%)
hash8085	Cobalt Strike botnet C2 server (confidence level: 75%)
hash6666	ValleyRAT botnet C2 server (confidence level: 75%)
hash8888	ValleyRAT botnet C2 server (confidence level: 75%)
hash8443	Aisuru botnet C2 server (confidence level: 100%)
hash80	Cobalt Strike botnet C2 server (confidence level: 100%)
hash8080	Cobalt Strike botnet C2 server (confidence level: 100%)
hash8081	Cobalt Strike botnet C2 server (confidence level: 100%)
hash8080	Aisuru botnet C2 server (confidence level: 100%)
hashe0b8e9e25228ef5a4f1aa0f0ae202c8b71dc47945dcc4a9d92a57395fdf03c7b	VShell payload (confidence level: 95%)
hash443	Nanocore RAT botnet C2 server (confidence level: 100%)
hash9034	Aisuru botnet C2 server (confidence level: 100%)
hash8888	Cobalt Strike botnet C2 server (confidence level: 100%)
hash50001	Cobalt Strike botnet C2 server (confidence level: 100%)
hash22	Cobalt Strike botnet C2 server (confidence level: 100%)
hash443	Cobalt Strike botnet C2 server (confidence level: 100%)
hash8443	Aisuru botnet C2 server (confidence level: 100%)

Url

Value	Description	Copy
urlhttps://cik07-cos.7moor-fs2.com/im/4d2c3f00-7d4c-11e5-af15-41bf63ae4ea0/129fd90846a1e173/9221.txt	Unknown malware payload delivery URL (confidence level: 100%)
urlhttps://lyric-8.com/api/metrics/run?event=pasted	AMOS botnet C2 (confidence level: 100%)
urlhttps://lyric-8.com/api/metrics/run?event=stager	AMOS botnet C2 (confidence level: 100%)
urlhttp://165.232.73.74/api/metrics/run	AMOS botnet C2 (confidence level: 100%)
urlhttps://blueprint-71.com/curl/amtkquxbo3/obh3bn3umykzjlth.json	AMOS payload delivery URL (confidence level: 100%)
urlhttps://blueprint-71.com/2kqyrm0dcrnyjgos4gvll_fhjrrdtuhgcbjyuywpz6c/cc2/update	AMOS payload delivery URL (confidence level: 100%)
urlhttp://202.47.44.156:53119/mozi.m	Mozi payload delivery URL (confidence level: 75%)
urlhttp://80.74.30.4:3000/sparky/comfyui-utils.git	xmrig payload delivery URL (confidence level: 100%)
urlhttp://165.245.138.247:81/private/xmrig-win.zip	xmrig payload delivery URL (confidence level: 100%)
urlhttp://165.245.138.247:81/private/rigel-win.zip	xmrig payload delivery URL (confidence level: 100%)
urlhttp://217.76.63.67:81/private/xmrig-win.zip	xmrig payload delivery URL (confidence level: 100%)
urlhttp://217.76.63.67:81/private/rigel-win.zip	xmrig payload delivery URL (confidence level: 100%)
urlhttp://103.249.201.108:81/private/xmrig-win.zip	xmrig payload delivery URL (confidence level: 100%)
urlhttp://103.249.201.108:81/private/rigel-win.zip	xmrig payload delivery URL (confidence level: 100%)
urlhttps://ma.19hoki.org	Vidar botnet C2 (confidence level: 100%)
urlhttps://192.142.37.129	Vidar botnet C2 (confidence level: 100%)
urlhttp://homecor.click:6527/users	Remus botnet C2 (confidence level: 75%)
urlhttp://fuarnpp.shop:5627/sessions	Remus botnet C2 (confidence level: 75%)
urlhttps://ma.1hoki.org	Vidar botnet C2 (confidence level: 100%)
urlhttp://223.123.125.178:38438/mozi.m	Mozi payload delivery URL (confidence level: 75%)
urlhttp://203.99.56.137:36975/mozi.m	Mozi payload delivery URL (confidence level: 75%)
urlhttps://testingcf.jsdelivr.net/gh/989a-a-3ff2465495760-2b3a/4657-8765943-85742-94856/dgfyrte-98	ClearFake payload delivery URL (confidence level: 100%)
urlhttp://clouven.click:8527/notifications	Remus botnet C2 (confidence level: 75%)
urlhttp://smaring.shop:9895/attachments	Remus botnet C2 (confidence level: 75%)
urlhttps://testingcf.jsdelivr.net/gh/989a-a-3ff2465495760-2b3a/4657-8765943-85742-94856/22274659-87	ClearFake payload delivery URL (confidence level: 100%)
urlhttps://testingcf.jsdelivr.net/gh/boycshop/dc-0a-e1-4e-e0-05/04ec49-812b67	ClearFake payload delivery URL (confidence level: 100%)
urlhttp://homecor.click:6527/articles	Remus botnet C2 (confidence level: 75%)
urlhttp://kipthen.shop:9932/subscriptions	Remus botnet C2 (confidence level: 75%)
urlhttp://fuarnpp.shop:5627/transactions	Remus botnet C2 (confidence level: 75%)
urlhttp://tiruet.com:5632	Remus botnet C2 (confidence level: 75%)
urlhttps://www.redsdj.ca/	Unknown malware payload delivery URL (confidence level: 90%)
urlhttp://39.34.191.107:42078/mozi.m	Mozi payload delivery URL (confidence level: 75%)
urlhttp://103.249.199.1:35620/mozi.m	Mozi payload delivery URL (confidence level: 75%)
urlhttp://100.165.12.219:42975/mozi.m	Mozi payload delivery URL (confidence level: 75%)
urlhttps://filezilla.cc/takefile/sezen/default.zip	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://hongyuncloud-diskmanager.hongyuncloud.workers.dev/%e7%ba%a2%e4%ba%91cloud/private/klring.dll	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://jfss-apakp.pages.dev/download/%e6%9c%ba%e6%88%bf%e6%9d%80%e6%89%8b1.26.7.5.zip	Unknown Loader payload delivery URL (confidence level: 80%)
urlhttp://156.238.224.156:5522/?h=156.238.224.156&p=5522&t=ws&a=w32&stage=true	VShell payload delivery URL (confidence level: 95%)
urlhttps://malwaredirectory.pages.dev/malware/ransomwares/birele.zip	Unknown malware payload delivery URL (confidence level: 80%)
urlhttp://145.79.143.4:80/nl3p	Cobalt Strike botnet C2 (confidence level: 75%)
urlhttps://shivsagartrading.com/	Unknown malware payload delivery URL (confidence level: 90%)
urlhttp://177.70.102.232:8070/tmpftp/01/cancelamento/2022-09-06/info.zip	Coinminer payload delivery URL (confidence level: 90%)
urlhttp://177.70.102.232:8070/tmpftp/01/consulta/2019-08-02/info.zip	Coinminer payload delivery URL (confidence level: 90%)
urlhttp://177.70.102.232:8070/tmpftp/01/inutiliza%c3%a7%c3%a3o/2019-12-19/info.zip	Coinminer payload delivery URL (confidence level: 100%)
urlhttp://34.92.225.25:8084/?h=34.92.225.25&p=8084&t=tcp&a=w64&stage=true	VShell payload delivery URL (confidence level: 95%)
urlhttp://34.92.225.25:8084/?h=34.92.225.25&p=8084&t=ws&a=w32&stage=true	VShell payload delivery URL (confidence level: 95%)
urlhttps://accountsensepro.net/js/all.min.js	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://solarwinds-in.com	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://oauthapp.net	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://reportsnapbit.com/get_verify	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://oauthapp.net/first_allow_host	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://reportsnapbit.com/first_allow_host	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://oauthapp.net/get_verify	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://reportsnapbit.com/js/all.min.js	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://oauthapp.net/js/all.min.js	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://accountsensepro.net/get_verify	Unknown malware payload delivery URL (confidence level: 80%)
urlhttps://accountsensepro.net/first_allow_host	Unknown malware payload delivery URL (confidence level: 80%)
urlhttp://420mafia.eu/ar-15/ar15.arc	Mirai payload delivery URL (confidence level: 95%)
urlhttp://420mafia.eu/ar-15/ar15.m68k	Mirai payload delivery URL (confidence level: 95%)
urlhttp://92.127.156.174:8880/master.exe	MimiKatz payload delivery URL (confidence level: 95%)
urlhttp://193.160.32.138:8085/?h=193.160.32.138&p=8085&t=tcp&a=l32&stage=true	SNOWLIGHT payload delivery URL (confidence level: 95%)
urlhttp://103.242.12.143:1234/?h=103.242.12.143&p=1234&t=tcp&a=w64&stage=true	VShell payload delivery URL (confidence level: 95%)
urlhttp://193.160.32.138:8085/?h=193.160.32.138&p=8085&t=ws&a=l32&stage=true	Mirai payload delivery URL (confidence level: 90%)
urlhttp://420mafia.eu/ar-15/ar15.x86_64	Mirai payload delivery URL (confidence level: 95%)
urlhttp://47.254.173.184:8443/?h=47.254.173.184&p=8443&t=tcp&a=w64&stage=true	VShell payload delivery URL (confidence level: 95%)
urlhttps://tmtworldwideltd.com/travel-and-tours-old/	Unknown malware payload delivery URL (confidence level: 90%)
urlhttp://222.112.70.149:8084/?h=222.112.70.149&p=8084&t=tcp&a=w32&stage=true	VShell payload delivery URL (confidence level: 95%)
urlhttps://aaflnt.com/statement/customer/customer_statements.zip	Unknown malware payload delivery URL (confidence level: 90%)
urlhttp://34.92.225.25:8084/?h=34.92.225.25&p=8084&t=ws&a=l32&stage=true	Mirai payload delivery URL (confidence level: 95%)
urlhttp://178.198.246.24/info.zip	Coinminer payload delivery URL (confidence level: 100%)
urlhttp://178.61.160.6:5001/info.zip	Coinminer payload delivery URL (confidence level: 95%)
urlhttps://navyapridedevelopers.com/	Unknown malware payload delivery URL (confidence level: 90%)
urlhttp://178.61.160.6:5001/video.scr	Coinminer payload delivery URL (confidence level: 100%)
urlhttp://180.148.33.24/av.scr	Coinminer payload delivery URL (confidence level: 100%)
urlhttp://180.148.33.24/info.zip	Coinminer payload delivery URL (confidence level: 100%)
urlhttp://186.235.86.129/photo.scr	xmrig payload delivery URL (confidence level: 100%)
urlhttp://103.242.12.143:1234/?h=103.242.12.143&p=1234&t=ws&a=w64&stage=true	VShell payload delivery URL (confidence level: 95%)

Domain

Value	Description	Copy
domainlyric-8.com	AMOS botnet C2 domain (confidence level: 100%)
domainblueprint-71.com	AMOS payload delivery domain (confidence level: 100%)
domainqb51hxxp.burn--flow.com	ClearFake payload delivery domain (confidence level: 100%)
domainmembres.encouplesimone.com	ClearFake payload delivery domain (confidence level: 90%)
domainimg2.aixpirts.com	FAKEUPDATES botnet C2 domain (confidence level: 100%)
domainngso2pi7en.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainrycupadi.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domain00rr59n2.en-pegasus.com	ClearFake payload delivery domain (confidence level: 100%)
domainen-us-en-smartwaterbox.com	ClearFake payload delivery domain (confidence level: 100%)
domain2gp421dm.en-us-en-smartwaterbox.com	ClearFake payload delivery domain (confidence level: 100%)
domainuxahadmx.kaarenorge.com	ClearFake payload delivery domain (confidence level: 100%)
domainuat.edu.course.movest.co	ClearFake payload delivery domain (confidence level: 90%)
domainbomurily.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainx1m07e7w.enus-metabodrops.com	ClearFake payload delivery domain (confidence level: 100%)
domainwmicconfidance.info	ClearFake payload delivery domain (confidence level: 90%)
domainkodg0fih.palmdriverv.com	ClearFake payload delivery domain (confidence level: 100%)
domainwww.sestitoedilservice.it	ClearFake payload delivery domain (confidence level: 90%)
domainfarmtasticdoggy.com.au	ClearFake payload delivery domain (confidence level: 90%)
domainiwonderifulovemeaswell.vg	CECbot botnet C2 domain (confidence level: 100%)
domainlovefromallareas.at	CECbot botnet C2 domain (confidence level: 100%)
domainiloveuevenifudontlovemeback.is	CECbot botnet C2 domain (confidence level: 100%)
domainkanokyhy.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainzunynoco.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainmgbkbp4b.enus-tupitea.com	ClearFake payload delivery domain (confidence level: 100%)
domainlobby09.co.il	ClearFake payload delivery domain (confidence level: 90%)
domainenus-flashburn.com	ClearFake payload delivery domain (confidence level: 100%)
domain3nblpdw2.enus-flashburn.com	ClearFake payload delivery domain (confidence level: 100%)
domainawilli.co.uk	ClearFake payload delivery domain (confidence level: 90%)
domain8p11s24hza.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domaindc48r0dup9.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainpjilctsx.enus-metabodrops.com	ClearFake payload delivery domain (confidence level: 100%)
domainusa-neurovera.us	ClearFake payload delivery domain (confidence level: 100%)
domainbsdsvltx.libertytokan.com	ClearFake payload delivery domain (confidence level: 100%)
domainscottcurdiephotography.com	ClearFake payload delivery domain (confidence level: 90%)
domainkiln-skioi-c29up.com	IClickFix payload delivery domain (confidence level: 100%)
domaintrilliot6776.icu	IClickFix payload delivery domain (confidence level: 100%)
domain29inappropriate.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainhqqpi58b.en-xenburn.com	ClearFake payload delivery domain (confidence level: 100%)
domaintumyveqy.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainrd6k97w3.shop-burnflow.com	ClearFake payload delivery domain (confidence level: 100%)
domainnld9qz8u.en-us-glycofree.com	ClearFake payload delivery domain (confidence level: 100%)
domainprguru.pk	ClearFake payload delivery domain (confidence level: 90%)
domainpodywan.pl	ClearFake payload delivery domain (confidence level: 90%)
domaintvpmutf0em.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domaingyeew46396.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainuhfao75u.usa--burnflow.com	ClearFake payload delivery domain (confidence level: 100%)
domainmunz2.moovent.ch	ClearFake payload delivery domain (confidence level: 90%)
domainohztowdn.burn--flow.com	ClearFake payload delivery domain (confidence level: 100%)
domainslmzt25180.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainqnjom46076.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainreportsnapbit.com	Unknown malware payload delivery domain (confidence level: 80%)
domainsolarwinds-in.com	Unknown malware payload delivery domain (confidence level: 80%)
domainaccountsensepro.net	Unknown malware payload delivery domain (confidence level: 80%)
domainoauthapp.net	Unknown malware payload delivery domain (confidence level: 80%)
domain64nsw308x6.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainapi.microsoftstorapi.com	Cobalt Strike botnet C2 domain (confidence level: 75%)
domainxyyhb62254.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainchangingthesalesgame.com	ClearFake payload delivery domain (confidence level: 90%)
domainv17q5203.usa--lipogummy.com	ClearFake payload delivery domain (confidence level: 100%)
domain46vm4qgb.www-glycofree.com	ClearFake payload delivery domain (confidence level: 100%)
domainpmeelectric.org	ClearFake payload delivery domain (confidence level: 100%)
domaini8tdljt4.pmeelectric.org	ClearFake payload delivery domain (confidence level: 100%)
domainvorekabi.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainchocolate65.beer	IClickFix payload delivery domain (confidence level: 50%)
domainwww.msn00273.beer	IClickFix payload delivery domain (confidence level: 50%)
domainwww.enter-press-code.info	IClickFix payload delivery domain (confidence level: 50%)
domainmail.thewellformedwoman.com	IClickFix payload delivery domain (confidence level: 50%)
domains1.thewellformedwoman.com	IClickFix payload delivery domain (confidence level: 50%)
domainftp.thewellformedwoman.com	IClickFix payload delivery domain (confidence level: 50%)
domainautodiscover.thewellformedwoman.com	IClickFix payload delivery domain (confidence level: 50%)
domainautoconfig.thewellformedwoman.com	IClickFix payload delivery domain (confidence level: 50%)
domainwww.cdn-verification-cloud.boats	IClickFix payload delivery domain (confidence level: 50%)
domainwww.framework-css-styles-js.beer	IClickFix payload delivery domain (confidence level: 50%)
domainwww.ladydosug.love	IClickFix payload delivery domain (confidence level: 50%)
domainwww.istounscnnd.beer	IClickFix payload delivery domain (confidence level: 50%)
domainwww.trunnsns.beer	IClickFix payload delivery domain (confidence level: 50%)
domainwww.mstclaudens.beer	IClickFix payload delivery domain (confidence level: 50%)
domainwww.tescdnlast.beer	IClickFix payload delivery domain (confidence level: 50%)
domainwww.testapi34726.sbs	IClickFix payload delivery domain (confidence level: 50%)
domainwww.ladydosug.live	IClickFix payload delivery domain (confidence level: 50%)
domainwww.ladydosug.top	IClickFix payload delivery domain (confidence level: 50%)
domainwww.nfstsrcdn.beer	IClickFix payload delivery domain (confidence level: 50%)
domainwww.nshostvps.beer	IClickFix payload delivery domain (confidence level: 50%)
domainrisepaint.com.au	IClickFix payload delivery domain (confidence level: 50%)
domainshivsagartrading.com	IClickFix payload delivery domain (confidence level: 50%)
domaindemonsbasement.com	IClickFix payload delivery domain (confidence level: 50%)
domainacionespastorales.com.ec	IClickFix payload delivery domain (confidence level: 50%)
domainsreeanugraha.com	IClickFix payload delivery domain (confidence level: 50%)
domain22knightsbridge.4yourinfo.com	IClickFix payload delivery domain (confidence level: 50%)
domainparking.destinationauburn.com	IClickFix payload delivery domain (confidence level: 50%)
domainusapharmatics.com	IClickFix payload delivery domain (confidence level: 50%)
domainprovely.io	IClickFix payload delivery domain (confidence level: 50%)
domaintheordinaryofficial.us	IClickFix payload delivery domain (confidence level: 50%)
domainitsstockbro.com	IClickFix payload delivery domain (confidence level: 50%)
domainumwmuseumancmedcultures.org	IClickFix payload delivery domain (confidence level: 50%)
domainpodcastblog.roger.pt	IClickFix payload delivery domain (confidence level: 50%)
domainpawtage.com.au	IClickFix payload delivery domain (confidence level: 50%)
domainnavyapridedevelopers.com	IClickFix payload delivery domain (confidence level: 50%)
domaingamzesmith.com	IClickFix payload delivery domain (confidence level: 50%)
domainbutygeja.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)
domainh1zhr28q.usa-lipogummy.com	ClearFake payload delivery domain (confidence level: 100%)
domainfrog.britishboxing.net	ClearFake payload delivery domain (confidence level: 90%)
domainfpymeantofagasta.cl	ClearFake payload delivery domain (confidence level: 90%)
domaindenofezu.workers.dev	php.shin_webshell botnet C2 domain (confidence level: 50%)

Threat ID: 6aaf295d55bf5e2cf52a54d9

Added to database: 09/20/2026, 00:31:25 UTC

Last enriched: 09/20/2026, 00:46:28 UTC

Last updated: 09/20/2026, 04:46:25 UTC

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by

Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

External Links

Search on Google

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now

OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited

View courses

ThreatFox IOCs for 2026-09-19

AI Analysis

Technical Summary

Potential Impact

Mitigation Recommendations

Indicators of Compromise

ThreatFox IOCs for 2026-09-19

Description

AI-Powered Analysis

Technical Analysis

Potential Impact

Defensive Guidance

Technical Details

Indicators of Compromise

File

Hash

Url

Domain

Community Reviews

Related Threats

ThreatFox IOCs for 2026-09-18

WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials

PolinRider Spreads Through Compromised GitHub Accounts and Packagist

Private HTS programs that spread ransomware

LabubaRAT Threat Snapshot

Actions

External Links

Need more coverage?

Latest Threats

Check if your credentials are on the dark web

Lead Pen Test Professional