Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-09-20

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 61

  • digital.digitaldatainsights.orgUnknown malware payload delivery domain (confidence level: 75%)
  • signin.v-panel.asiaVidar botnet C2 domain (confidence level: 100%)
  • erdogan.lolUnknown RAT botnet C2 domain (confidence level: 100%)
  • selamselam.lolUnknown RAT botnet C2 domain (confidence level: 100%)
  • forgewillow.comAMOS payload delivery domain (confidence level: 90%)
  • ttoryhwh.en-bizopp.comClearFake payload delivery domain (confidence level: 100%)
  • a32uqtcs.nurvealive.comClearFake payload delivery domain (confidence level: 100%)
  • mimyfile.workers.devphp.shin_webshell botnet C2 domain (confidence level: 50%)
  • disciplinaryrhody.workers.devphp.shin_webshell botnet C2 domain (confidence level: 50%)
  • squidscript.comUnknown malware payload delivery domain (confidence level: 90%)

URLs 37

  • http://72.255.26.34:51571/mozi.aMozi payload delivery URL (confidence level: 75%)
  • http://195.24.237.240/.x/black3Unknown malware payload delivery URL (confidence level: 75%)
  • http://193.160.32.138:8085/?h=193.160.32.138&p=8085&t=ws&a=l64&stage=trueMirai payload delivery URL (confidence level: 95%)
  • https://178.105.213.40Vidar botnet C2 (confidence level: 100%)
  • http://118.145.196.225:800/Ngioweb payload delivery URL (confidence level: 100%)
  • https://signin.v-panel.asia/Vidar botnet C2 (confidence level: 100%)
  • http://107.161.168.217/?h=107.161.168.217&p=80&t=ws&a=w64&stage=trueVShell payload delivery URL (confidence level: 95%)
  • http://178.16.53.91:8443/?h=178.16.53.91&p=8443&t=ws&a=l64&stage=trueMirai payload delivery URL (confidence level: 95%)
  • https://fr.hg77.orgVidar botnet C2 (confidence level: 100%)
  • https://forgewillow.com/2kqyrm0dcrnyjgos4gvll_fhjrrdtuhgcbjyuywpz6c/kis/updateAMOS payload delivery URL (confidence level: 90%)

IP addresses 102

  • 138.68.168.41Aisuru botnet C2 server (confidence level: 100%)
  • 169.58.248.162Unknown malware botnet C2 server (confidence level: 100%)
  • 45.32.65.138xmrig botnet C2 server (confidence level: 100%)
  • 167.71.45.235Aisuru botnet C2 server (confidence level: 100%)
  • 145.249.115.184Ngioweb botnet C2 server (confidence level: 75%)
  • 161.248.179.24Remcos botnet C2 server (confidence level: 100%)
  • 43.155.214.112Aisuru botnet C2 server (confidence level: 100%)
  • 178.128.167.82Aisuru botnet C2 server (confidence level: 100%)
  • 49.232.21.222Cobalt Strike botnet C2 server (confidence level: 100%)
  • 154.12.37.146VShell botnet C2 server (confidence level: 100%)

Hashes 198

  • 28e0c4d5bc6675537ba47c6529877a3194a29585fb86477f66bf13c79252d2f0Unknown malware payload (confidence level: 100%)
  • 7d55a90710b8e79283efd756e8d3423fc23e0dcf742d6027b1a2a1b9d02a9c16Unknown malware payload (confidence level: 100%)
  • 79a47c33335fe1ed871a23cf7972652ee08a3ec0afed1c2dc6b5a8df675e153dUnknown malware payload (confidence level: 100%)
  • ffe04bc05a56f78b1273876cf17ded8df1aa3da5a15deb17dce99a3e206eb705Unknown malware payload (confidence level: 100%)
  • c1c122869f46aaf8c4e90f3132c93a801c853244c756966952d0bf19241cf084Unknown malware payload (confidence level: 100%)
  • 2bcc91fdedb8c583a9fe883be9ad453333a1bba0fdf655474982db3cbb8e7a74Unknown malware payload (confidence level: 100%)
  • a151d3f4f2422531f30a843ffb35479596c86722bb103bdf8591105687f9b125Unknown malware payload (confidence level: 100%)
  • 1631e63ee373601c1f42f2674f996fc6c14dc6aebe45ca5d2395bf347a0e3661Ngioweb payload (confidence level: 100%)
  • 1b831a9366cd53a4127f885dab247bc2f0b3f661a7d9d9510bbd0a9f150bfb27Ngioweb payload (confidence level: 100%)
  • 52bff4bf58eb6031c16763b12b696e849a38f36e69c55402a444819cb9c1bc0eNgioweb payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-09-20

Community reviews

Loading reviews…