Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-09-30

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 74

  • ref-api.homefulia.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
  • kwwen7ef.imzural.infoClearFake payload delivery domain (confidence level: 100%)
  • awatoz.comClearFake payload delivery domain (confidence level: 90%)
  • centralizedconsultingllc.comClearFake payload delivery domain (confidence level: 90%)
  • beanblissltd.comClearFake payload delivery domain (confidence level: 90%)
  • coderockets.academyClearFake payload delivery domain (confidence level: 90%)
  • bossforward.orgClearFake payload delivery domain (confidence level: 90%)
  • ardaas.co.ukClearFake payload delivery domain (confidence level: 90%)
  • awilddream.comClearFake payload delivery domain (confidence level: 90%)
  • bramptoncommercialkitchen.comClearFake payload delivery domain (confidence level: 90%)

URLs 23

  • https://bw.32naga.netVidar botnet C2 (confidence level: 100%)
  • http://85.137.54.178:8080/d.shUnknown malware payload delivery URL (confidence level: 75%)
  • https://recebyrn.co/tqfprveo/install-windows-update-to-play-voicemail.vbsUnknown Loader payload delivery URL (confidence level: 80%)
  • https://pz.5-rt.orgVidar botnet C2 (confidence level: 100%)
  • http://101.99.91.180/?h=101.99.91.180&p=80&t=ws&a=w64&stage=trueVShell payload delivery URL (confidence level: 95%)
  • https://91.228.153.116:6886AdaptixC2 botnet C2 (confidence level: 100%)
  • http://144.31.151.8/Stealc botnet C2 (confidence level: 100%)
  • http://148.66.17.122:60003/?h=148.66.17.122&p=60003&t=ws&a=w64&stage=trueVShell payload delivery URL (confidence level: 95%)
  • http://202.61.138.81:443/?h=202.61.138.81&p=443&t=tcp&a=w64&stage=trueUnknown Loader payload delivery URL (confidence level: 85%)
  • http://153.117.34.231:35083/mozi.aMozi payload delivery URL (confidence level: 75%)

IP addresses 176

  • 84.38.133.207Remcos botnet C2 server (confidence level: 100%)
  • 102.220.163.160CECbot botnet C2 server (confidence level: 100%)
  • 5.181.2.72Potassium botnet C2 server (confidence level: 100%)
  • 159.89.166.50Remus botnet C2 server (confidence level: 100%)
  • 124.198.131.136Remcos botnet C2 server (confidence level: 100%)
  • 172.111.139.78Remcos botnet C2 server (confidence level: 100%)
  • 154.92.252.62AdaptixC2 botnet C2 server (confidence level: 100%)
  • 154.92.252.62AdaptixC2 botnet C2 server (confidence level: 100%)
  • 154.92.252.62AdaptixC2 botnet C2 server (confidence level: 100%)
  • 188.34.196.109Unknown Stealer botnet C2 server (confidence level: 100%)

Hashes 51

  • f020e5e9674b3170ffb1b4459c4aca7b958b65ca5a572fcfbf9b507acc69a1d5Mirai payload (confidence level: 100%)
  • 9fe66e79d0915b66e8b6eb02cb7de92815220955deaeb135a677bdb4239d3ce2Mirai payload (confidence level: 100%)
  • 0eee4b37df76816992a7f7e087043489feaa391baddb8410be8d5f93c4514450Mirai payload (confidence level: 100%)
  • d54bd2dfb9071f8e94fcd38edec3a25d86319b802dd82853278f02303d863496Mirai payload (confidence level: 100%)
  • d945cf407650717fb6a880b8fda9f5daa623c33a5efb08cbed5ea01c9346131dMirai payload (confidence level: 100%)
  • 86f57b6d24c2e28c2a7a77ecd2edf5a6b3000f5a7a1dec8eb6f9bdef9a8a665bVShell payload (confidence level: 95%)
  • c3c9eeb02eba86801f64f666cd2f73c163c5e4bc65f9dc05d8d03ec5aa3e7245VShell payload (confidence level: 95%)
  • 08665fcac5fb616960399a2a0a444122403ca537d073680e632f99422c5c2a7eVShell payload (confidence level: 95%)
  • 47aa9bcda80ca9677ad31a611bf7b3d4c18ef8dded1dd94ac023277d8432188aVShell payload (confidence level: 95%)
  • 487802cb1226d9afd9eb0baa8672aca2cbab93ed612131eb4a9daf2a1fea5bafMirai payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-09-30

Community reviews

Loading reviews…