Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-09-22

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 77

  • dome.beatdropkec.comClearFake botnet C2 domain (confidence level: 100%)
  • impact.hjdeboer.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
  • danhbalbaluatsu.netClearFake credit card skimming domain (confidence level: 100%)
  • basequill9.comAMOS payload delivery domain (confidence level: 100%)
  • questlyric8.comAMOS botnet C2 domain (confidence level: 100%)
  • yoauction.comMacSync payload delivery domain (confidence level: 100%)
  • zanderrealestate.comMacSync payload delivery domain (confidence level: 100%)
  • pixelsoftzone.netUnknown malware payload delivery domain (confidence level: 80%)
  • linkedlin-us.comUnknown malware payload delivery domain (confidence level: 80%)
  • heartbeatpipe.netUnknown malware payload delivery domain (confidence level: 80%)

URLs 95

  • http://102.33.78.165:43065/mozi.mMozi payload delivery URL (confidence level: 75%)
  • https://basequill9.com/curl/av6t87xg9gon/ahlg4goj9kfsh1itrutp47.datAMOS payload delivery URL (confidence level: 100%)
  • https://basequill9.com/zyemb6slon_3vwvlkskdijurcyhy5cfntchnavrnmgu/hiddenfix/updateAMOS payload delivery URL (confidence level: 100%)
  • https://questlyric8.com/api/metrics/run?event=pastedAMOS botnet C2 (confidence level: 100%)
  • https://yoauction.com/curl/b42a0ed9d1ecb72e42d6034502c304845d98805481d99cea4e259359f9ab206eMacSync payload delivery URL (confidence level: 100%)
  • https://zanderrealestate.com/curl/85cb26206d920216eee0c5f67e8de516b4d55bd1752025bb3c08a069a44fdbdfMacSync payload delivery URL (confidence level: 100%)
  • https://heartbeatpipe.net/get_verifyUnknown malware payload delivery URL (confidence level: 80%)
  • https://linkedlin-us.comUnknown malware payload delivery URL (confidence level: 80%)
  • https://metricsfeedware.com/js/all.min.jsUnknown malware payload delivery URL (confidence level: 80%)
  • https://heartbeatpipe.net/js/all.min.jsUnknown malware payload delivery URL (confidence level: 80%)

IP addresses 123

  • 128.90.103.184Remcos botnet C2 server (confidence level: 100%)
  • 130.78.189.71Aisuru botnet C2 server (confidence level: 100%)
  • 2.27.62.228Remcos botnet C2 server (confidence level: 100%)
  • 134.209.106.204Aisuru botnet C2 server (confidence level: 100%)
  • 43.173.38.253Aisuru botnet C2 server (confidence level: 100%)
  • 54.250.169.207Unknown malware botnet C2 server (confidence level: 100%)
  • 54.250.169.207Unknown malware botnet C2 server (confidence level: 100%)
  • 122.51.215.90Unknown malware botnet C2 server (confidence level: 100%)
  • 221.236.125.241Unknown malware botnet C2 server (confidence level: 100%)
  • 221.236.125.241Unknown malware botnet C2 server (confidence level: 100%)

Hashes 82

  • 4701f196c74af42b5ced01592bf4a74d54437b1c63b8aabfe1f92e9beabec769AMOS payload (confidence level: 100%)
  • bb2d62df63ff1726eec5e17cc9e30850c39d0a15353aa267a916bcdb75d709c6AMOS payload (confidence level: 100%)
  • d887f20ec383d7ce3a5727856bf7fa68ceb972108b6d0a5dd9924707e820dc24RemoteAdmin payload (confidence level: 100%)
  • 8f096174b0ded0a598f634567c618e12808088848cd07eb99ca4ac57a744cdd9RemoteAdmin payload (confidence level: 100%)
  • 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077RemoteAdmin payload (confidence level: 100%)
  • b7a495f517b9bf23f529552b145121f922ab4915e24b663ae68b3007daea3804RemoteAdmin payload (confidence level: 100%)
  • e34c9d3d3a50be99609cc843f91bbfcd0d79853b8c373c5146bcbf77643fb8c2RemoteAdmin payload (confidence level: 100%)
  • a39eb6928c17a779f4030bf6ac0eeec41f828a64140f2a06cb63b8658e589267AMOS payload (confidence level: 100%)
  • 6fa9d4e59f3555278ff55dd617356a51ecb43239abafa333c8fa82da2a1c7088AMOS payload (confidence level: 100%)
  • 5cc27b17795bd0cb766249d43e4082c5b900ef9d1184877cfa9c048533c945e0AMOS payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-09-22

Community reviews

Loading reviews…